CN114362368A - Method and system for monitoring abnormal behavior of network traffic in smart substation - Google Patents

Abstract

The invention discloses a method and a system for monitoring abnormal network flow behaviors of an intelligent substation, wherein a network flow data packet is captured by using a mirror image port of an intelligent substation switch, and an application layer message of the network flow data packet is extracted; secondly, performing field-by-field analysis according to a frame format specified by a protocol to which the message belongs to obtain a specific power service represented by the message; then, single-field out-of-limit detection, multi-field coupling logic detection and integral field abnormity detection are carried out according to the characteristics of the message fields; and finally, establishing a normal behavior model according to the message service characteristics, and realizing the abnormal detection of service execution logic, service verification logic and service time scale logic based on the service model. The method overcomes the defect that the existing intelligent substation network flow abnormity detection method depends on the network layer flow characteristic index and fails to deeply consider the logic characteristic of the power service, and improves the accuracy of the intelligent substation network flow abnormity behavior detection.

Description

Method and system for monitoring abnormal behavior of network traffic in smart substation

technical field

The invention relates to the technical field of power system information security, in particular to a method and system for monitoring abnormal behavior of network traffic in an intelligent substation.

Background technique

With the wide application of advanced information and communication technology and intelligent electronic equipment in substations, the current substations have gradually developed into a new generation of intelligent substations that integrate advanced functions such as automatic control, intelligent decision-making, and collaborative interaction. The information transmission in the communication process of the smart substation takes the network traffic as the carrier, and the normal transmission of the traffic data is very important to the safe and stable operation of the smart substation and the entire power system. Network attackers can destroy the safe and stable operation of smart substations by intercepting, stealing, and tampering with traffic data. Therefore, abnormal behavior detection of network traffic is a key means of active defense of smart substation network security.

However, the existing intelligent substation network traffic anomaly detection methods focus on detection based on specific traffic characteristic indicators at the network layer, and cannot reflect specific abnormal situations. However, application layer packets of traffic data contain important power service information, and only based on network layer traffic characteristic indicators cannot fully reflect the characteristics of attack behaviors. Therefore, it is urgent to invent a new method for monitoring abnormal behavior of network traffic in smart substations, which can realize abnormal detection of traffic data application layer messages and ensure the safe and reliable operation of smart substations.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is to provide a method and system for monitoring abnormal behavior of network traffic in smart substations in view of the deficiencies of the prior art, which can effectively solve the limitation that the existing detection method cannot detect the abnormal behavior of power services at the application layer. , to improve the security and reliability of traffic information transmission in the communication process of smart substations.

In order to solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a method for monitoring abnormal behavior of network traffic in an intelligent substation, comprising the following steps:

S1. Capture the network traffic data of the smart substation in real time, and extract the application layer messages;

S2, perform field-level analysis on the message according to the frame format specified by the protocol to which the application layer message extracted in step S1 belongs;

S3. Perform single-field out-of-limit detection on the parsed application layer packet, and send an alarm signal if an abnormality occurs; otherwise, perform multi-field coupling logic detection on the parsed application layer packet, and send an alarm signal if abnormality occurs ; otherwise, perform overall field anomaly detection on the parsed application layer message, and if an anomaly occurs, send an alarm signal; otherwise, go to step S4;

S4. Perform service execution logic detection, service verification logic detection, and service time stamp logic detection on the parsed application layer message. If any detection link is abnormal, an alarm signal is issued.

The invention extracts and parses the application layer message of the network flow data of the intelligent substation, and performs abnormal detection accordingly, realizes the abnormal detection of single field, multi-field and overall field of the application layer message at the single frame level, and overcomes the problem of existing problems. Some detection methods can only perform simple malformation check for the message format. At the same time, it also realizes the abnormal detection of the service execution logic, service verification logic, and service time stamping logic of the application layer message at the multi-frame layer, overcoming the problem that the existing detection methods cannot detect the abnormal behavior of the power service at the application layer. Limitations, effectively improve the security and reliability of smart substation flow data transmission.

The specific implementation process of single-field out-of-limit detection for the parsed application layer message includes:

对解析后的应用层报文进行单字段越限检测，若该式不成立，则判定解析后的应用层报文为异常报文；否则，进入步骤2)；其中，P为解析后的应用层报文，P_WK表示电力稳控业务的可变帧报文，LEN(P_WK)表示解析后的应用层报文实际长度，LEN(P_WK)_max表示电力稳控协议所规定的最大报文长度；1) Using the formula

Perform single-field out-of-limit detection on the parsed application layer packet, if the formula does not hold, then determine that the parsed application layer packet is an abnormal packet; otherwise, go to step 2); where P is the parsed application layer message, P _WK represents the variable frame message of the power stabilization control service, LEN(P _WK ) represents the actual length of the parsed application layer message, and LEN(P _WK ) _max represents the maximum message specified by the power stabilization control protocol length;

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，进入步骤3)；其中，THE(P_WK)表示报文理论计算长度；2) Judgment formula

Whether it is established, if not, it is determined that the parsed application layer message is an abnormal message; otherwise, enter step 3); wherein, THE (P _WK ) represents the theoretical calculation length of the message;

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，进入步骤4)；其中，TYP(P_WK)表示报文的类型标识字段值；3) Judgment formula

Whether it is established, if not, it is determined that the parsed application layer message is an abnormal message; otherwise, go to step 4); wherein, TYP (P _WK ) represents the type identifier field value of the message;

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，进入步骤5)；其中，COT(P_WK)表示报文的传送原因字段值；4) Judgment formula

Whether it is established, if not, it is determined that the parsed application layer message is an abnormal message; otherwise, go to step 5); wherein, COT(P _WK ) represents the transmission reason field value of the message;

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，对解析后的应用层报文进行多字段耦合逻辑检测；其中，P_{WK_G}表示电力稳控业务固定帧报文，LEN(P_{WK_G})表示固定帧报文长度。5) Judgment formula

Whether it is true, if not, it is determined that the parsed application layer packet is an abnormal packet; otherwise, the multi-field coupling logic detection is performed on the parsed application layer packet; among them, P _{WK_G} represents the fixed frame packet of the power stabilization control service , LEN(P _{WK_G} ) represents the fixed frame message length.

The single-field over-limit detection of the present invention can perform threshold-based over-limit detection for single fields such as the length field, the type identification field, and the transmission reason field of the message. Due to the lack of electrical knowledge when constructing or tampering with the message, the attacker can tentatively modify or assign a single field of the message, which will cause the value of a single field of the message to exceed its threshold, and this anomaly can only be checked by the format of the message. It cannot be detected, but it can be accurately identified by single-field out-of-limit detection. The single-field out-of-limit detection provided by the present invention can process the field value out-of-limit message in time, and avoid the abnormal message from affecting the normal communication process. ·

In step S3, the specific implementation process of performing multi-field coupling logic detection on the parsed application layer message includes:

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，进入步骤II)；其中，P为解析后的应用层报文，P_WK表示电力稳控业务的可变帧报文，FUN(P_WK)表示报文控制域功能码数值，FCV(P_WK)表示报文帧计数有效位数值；I) Judgment formula

Whether it is true, if not, it is determined that the parsed application layer message is an abnormal message; otherwise, go to step II); wherein, P is the parsed application layer message, and P _WK represents the variable frame of the power stabilization control service message, FUN(P _WK ) represents the function code value of the message control field, and FCV(P _WK ) represents the valid bit value of the message frame count;

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，对解析后的应用层报文进行整体字段异常检测；其中，QU(P_WK)表示报文的被测量品质描述词，OV表示品质描述词的溢出标志，ER表示品质描述词的有效标志。II) Judgment formula

Whether it is true, if not, it is determined that the parsed application layer packet is an abnormal packet; otherwise, the overall field anomaly detection is performed on the parsed application layer packet; wherein, QU(P _WK ) represents the measured quality of the packet descriptor, OV represents the overflow flag of the quality descriptor, and ER represents the valid flag of the quality descriptor.

The multi-field coupling logic detection process of the present invention can realize the abnormal detection of the message control field function code coupling logic and the measured quality descriptor coupling logic. An attacker will tamper with multiple fields at the same time when constructing a malicious message. Simultaneous tampering with multiple fields will destroy the normal coupling logic between fields. This kind of coupling and logic exception can only pass through the validity of the existing message format. Inspection cannot identify, but can be accurately identified through multi-field coupled logic detection. The multi-field coupling logic detection provided by the present invention overcomes the shortcoming that the existing detection method can only perform simple malformation check for the message format, can effectively prevent the message control field information from being maliciously tampered with, and at the same time guarantees the normality and integrity of the measurement data. Reliable transmission.

是否成立，若否，则判定解析后的应用层报文为异常报文；否则，进入步骤II)；其中，P为解析后的应用层报文，P_WK表示电力稳控业务的可变帧报文，其中，THE_V(P_WK)表示报文理论校验和，为启动字符至校验和字段前的数据单字节算术累加和的低字节，REA_V(P_WK)表示报文实际校验和，为报文最后一个字节。In step S3, the specific implementation process of performing overall field anomaly detection on the parsed application layer message includes: a judgment formula

Whether it is true, if not, it is determined that the parsed application layer message is an abnormal message; otherwise, go to step II); wherein, P is the parsed application layer message, and P _WK represents the variable frame of the power stabilization control service message, where THE_V(P _WK ) represents the theoretical checksum of the message, which is the low byte of the single-byte arithmetic cumulative sum of the data before the start character to the checksum field, and REA_V(P _WK ) represents the actual checksum of the message. The checksum is the last byte of the message.

The overall field anomaly detection of the present invention can realize anomaly detection at the overall level without distinguishing the specific fields of the message. The calculation is performed according to the calculation method of the theoretical checksum of the message. If the obtained result is inconsistent with the checksum field in the message Determine the checksum error of the packet and generate an alarm. The overall field anomaly detection method provided by the invention overcomes the limitation that the existing detection methods can only check the message format, can identify malformed messages and abnormal messages, and improves the security and availability of message transmission.

The specific implementation process of step S4 includes:

Determine the specific service to which the parsed application layer packet belongs according to the type identifier, transmission reason, function type, and information sequence number fields of the parsed application layer packet;

If it is one of the services of file transmission, general call, test mode, monitoring direction blocking, remote control execution, remote adjustment execution, and disturbance data transmission, the execution logic of the service to which the parsed application layer message belongs is detected. If abnormal, an alarm signal will be sent, otherwise, the current frame traffic data will be judged as normal traffic;

If it is one of the remote control verification and fixed value modification services, the verification logic of the service to which the parsed application layer message belongs will be detected. If there is an abnormality, an alarm signal will be sent. Otherwise, the current frame traffic data will be determined as normal flow;

If it is one of the general historical data query and time synchronization services, the time stamping logic of the service to which the parsed application layer packet belongs will be detected. If an abnormality occurs, an alarm signal will be sent. Otherwise, the current frame traffic data will be determined as normal flow.

The multi-frame message business logic abnormality detection of the present invention can detect whether the execution logic, verification logic and time stamp logic of various services are correct, and overcomes the simple format of the existing intelligent substation network traffic abnormality detection method that focuses on single-frame messages Check, the limitation of not being able to detect the business logic of the specific power business in the application layer. Attackers destroy all kinds of business logic through tampering or direct injection of normal packets. This attack behavior cannot be identified only through single-frame packets, but can be accurately identified through the business logic analysis of multi-frame packets provided by the present invention. .

若否，发出告警信号，否则将当前帧流量数据判定为正常流量；其中，WJ₁为召唤目录指令，WJ₂为文件目录响应指令，WJ₃为选择文件指令，WJ₄为文件准备就绪指令，WJ₅为召唤文件指令，WJ₆为节准备就绪指令，WJ₇为召唤节指令，WJ₈为段数据上送指令，WJ₉为最后的段发送确认指令，WJ₁₀为节确认指令，WJ₁₁为文件确认指令；If the parsed application layer message belongs to the file transfer service, it is judged whether it conforms to the execution logic

If no, send an alarm signal, otherwise, the current frame traffic data is judged as normal traffic; wherein, WJ ₁ is a call directory command, WJ ₂ is a file directory response command, WJ ₃ is a file selection command, and WJ ₄ is a file ready command, WJ ₅ is the calling file command, WJ ₆ is the section ready command, WJ ₇ is the calling section command, WJ ₈ is the segment data upload command, WJ ₉ is the last segment sending confirmation command, WJ ₁₀ is the section confirmation command, WJ ₁₁ Confirmation of instructions for documents;

If the parsed application layer packet belongs to the general call service, it is judged whether it conforms to the execution logic ZZ ₁ → ZZ ₂ → ZZ ₃ , if not, an alarm signal is sent, otherwise the current frame traffic data is judged as normal traffic; among them, ZZ ₁ Start the general call command for the master station, ZZ ₂ is the slave station sending information command, and ZZ ₃ is the general call end command;

If the parsed application layer packet belongs to the test mode service, it is judged whether it conforms to the execution logic CS ₁ → CS ₂ → CS ₁ → CS ₂ , if not, an alarm signal is sent, otherwise the current frame traffic data is judged as normal traffic; , CS ₁ is the test activation command, CS ₂ is the test end command;

If the parsed application layer packet belongs to the monitoring direction blocking service, it is judged whether it conforms to the execution logic BS ₁ → BS ₂ → BS ₁ → BS ₂ , if not, an alarm signal is sent, otherwise, the current frame traffic data is judged as normal traffic;

If the parsed application layer message belongs to the remote control execution service, it is judged whether it conforms to the execution logic YK ₁ → YK ₂ → YK ₃ → YK ₄ , if not, an alarm signal is sent, otherwise the current frame traffic data is judged as normal traffic;

If the parsed application layer packet belongs to the remote adjustment execution service, it is judged whether it conforms to the execution logic YT ₁ → YT ₂ → YT ₃ → YT ₄ , if not, an alarm signal is sent, otherwise the current frame traffic data is judged as normal traffic; Among them, YT ₁ is the remote adjustment setting instruction, YT ₂ is the remote adjustment setting return-to-calibration instruction, YT ₃ is the remote adjustment execution instruction, and YT ₄ is the remote adjustment execution return-to-calibration instruction;

If the parsed application layer message belongs to the disturbed data transmission service, it is judged whether it conforms to the execution logic RD ₁ →RD ₂ →RD ₃ →RD ₄ →RD ₅ →RD ₆ , if not, send an alarm signal, otherwise the current frame traffic The data is judged to be a normal flow; wherein, RD ₁ is a preparation command for disturbed data transmission, RD ₂ is a preparation command for a transmission channel, RD ₃ is a state change transmission preparation command with a flag, and RD ₄ is a state change transmission command with a flag. RD ₅ is the command to transmit the disturbance value, and RD ₆ is the command to end the transmission.

By performing abnormal detection on the execution logic of various electric power services in the smart substation, the present invention can identify situations that do not conform to normal service execution logic, such as instruction missing, instruction duplication, and instruction error in the service execution process. For attacks on business execution logic, the format, field logic, field threshold and other characteristics of attack packets are normal, and the number of packets is small, which will not be reflected in the network layer traffic characteristics. The existing network layer traffic characteristics analysis and reporting However, the detection method of the present invention can accurately identify the attack behavior, effectively preventing attackers from tampering, injecting and intercepting service execution instructions, thereby causing great damage to the power system.

If it is one of remote control verification and fixed value modification services, the specific implementation process for detecting the verification logic of the service to which the parsed application layer message belongs includes:

是否成立，若否，发出告警信号，否则将当前帧流量数据判定为正常流量；其中，OTP₁为遥控校验命令的操作类型，OTP₂为遥控校验结果的操作类型，COT₂表示遥控校验结果的传送原因，H表示数值为16进制；If the parsed application layer packet belongs to the remote control verification service, the judgment formula

Whether it is established, if not, send an alarm signal, otherwise, the current frame traffic data will be judged as normal traffic; among them, OTP ₁ is the operation type of the remote control verification command, OTP ₂ is the operation type of the remote control verification result, and COT ₂ represents the remote control verification. The reason for the transmission of the test result, H indicates that the value is in hexadecimal;

若否，发出告警信号，否则将当前帧流量数据判定为正常流量；其中，DZ₁表示定值校验指令，COT₁表示定值校验指令的传送原因，DZ₂表示定值改写指令。该公式表示定值校验指令的传送原因为44时，即定值校验正确，则执行定值改写指令。If the parsed application layer message belongs to the fixed value modification service, it is judged whether it conforms to the execution logic

If not, send an alarm signal, otherwise, the current frame traffic data will be judged as normal traffic; among them, DZ ₁ represents the fixed value verification command, COT ₁ represents the transmission reason of the fixed value verification command, and DZ ₂ represents the fixed value rewriting command. This formula indicates that when the transmission reason of the fixed value verification command is 44, that is, the fixed value verification is correct, then the fixed value rewrite command is executed.

The present invention can identify the attack behavior against the service verification process by performing abnormal detection on the verification logic in the power service, for example, the service verification is correct but not executed or the service verification error is still executed. The business verification logic anomaly detection overcomes the deficiencies of the existing detection methods that lack consideration of the business verification process anomalies and the logical correlation between business verification and execution logic, and can accurately identify the illegal execution or non-legal execution of the business.

If it is one of general historical data query and time synchronization services, the specific implementation process for detecting the time stamp logic of the service to which the parsed application layer message belongs includes:

是否成立，若否，发出告警信号，否则将当前帧流量数据判定为正常流量；其中，P_TLS表示通用历史数据查询业务报文，T1(P_TLS)表示通用历史数据查询的开始时间，T2(P_TLS)表示通用历史数据查询的结束时间；If the parsed application layer packet belongs to the general historical data query service, the judgment formula

Whether it is true, if not, send an alarm signal, otherwise, the current frame traffic data is determined as normal traffic; among them, P _TLS represents the general historical data query service message, T1 (P _TLS ) represents the start time of general historical data query, T2 ( P _TLS ) indicates the end time of general historical data query;

是否成立，若否，发出告警信号，否则将当前帧流量数据判定为正常流量；其中，P_SJTB表示时间同步业务报文，TB1(P_SJTB)表示时间同步业务发送报文的时间，TB2(P_SJTB)表示时间同步业务确认报文的时间，Δt表示时间同步命令发送报文与确认报文的最大时间差。If the parsed application layer packet belongs to the time synchronization service, the judgment formula

Whether it is true, if not, send an alarm signal, otherwise the current frame traffic data is judged as normal traffic; among them, P _SJTB represents the time synchronization service message, TB1 (P _SJTB ) represents the time when the time synchronization service sends the message, TB2 (P SJTB ) _SJTB ) represents the time of the confirmation message of the time synchronization service, and Δt represents the maximum time difference between the message sent by the time synchronization command and the confirmation message.

The invention can judge whether the query time of the general historical data query service is normal and whether the synchronization process of the time synchronization service is normal by performing abnormal detection on the time stamp logic in the power service of the intelligent substation. The anomaly detection technology for time stamping logic overcomes the limitation of existing methods that can only identify anomalies based on the device clock, realizes active monitoring and defense against time stamping attacks at the packet level of the traffic data application layer, and improves the network of smart substations. Accuracy and reliability of data query commands and time-synchronization command transmission in traffic data.

As an inventive concept, the present invention also provides a computer device including a memory, a processor and a computer program stored in the memory; the processor executes the computer program to implement the steps of the method of the present invention.

As an inventive concept, the present invention also provides a computer program product, comprising a computer program/instruction; characterized in that, when the computer program/instruction is executed by a processor, the steps of the method of the present invention are implemented.

Compared with the prior art, the present invention has the following beneficial effects:

(1) The present invention fully considers the abnormal behavior of the network traffic data of the smart substation in the application layer, and performs abnormal detection according to the field characteristics and service characteristics of the application layer message, which overcomes the problem that the existing abnormal detection method depends on the network layer traffic characteristic index. limitation.

(2) The present invention performs single-field out-of-limit detection, multi-field coupling logic detection, and overall field abnormality detection for the application layer message of the network traffic data of the smart substation, and overcomes the problem that the existing abnormality detection method only stays in the message format check. insufficient.

(3) The present invention establishes a normal behavior model of the power stability control business, and detects business execution logic, business verification logic, and business time-scale logic according to the established business model, and realizes the abnormal discrimination of the network traffic business of the intelligent substation, Improves the accuracy of abnormal behavior detection of network traffic in smart substations.

Description of drawings

FIG. 1 is a flow chart for detecting abnormal behavior of network traffic in a smart substation according to an embodiment of the present invention.

FIG. 2 is a schematic structural diagram of a system for monitoring abnormal behavior of network traffic in a smart substation according to an embodiment of the present invention.

FIG. 3 is a system unit diagram of an anomaly detection module for field characteristics of a single frame message in an embodiment of the present invention.

FIG. 4 is a system unit diagram of an abnormality detection module of a multi-frame message service logic in an embodiment of the present invention.

Detailed ways

1 is a flowchart of a method for detecting abnormal behavior of network traffic in a smart substation provided by an embodiment of the present invention, and the specific implementation steps are as follows:

Step S1: use the mirror port of the smart substation switch to capture the network traffic data in real time, and extract the application layer message;

Step S2: perform field-level analysis on the message according to the frame format specified by the protocol to which the application layer message extracted in step S1 belongs, and obtain the type identifier, transmission reason, function type, and information sequence number field value of the message;

Step S3: For the application layer message parsed in step S2, establish an abnormal behavior detection model based on field features, and perform single-field out-of-limit detection, multi-field coupling logic detection, and overall field abnormality detection on the message according to the abnormality detection model. If an abnormality occurs, an alarm signal is sent, otherwise, go to step S4;

Step S4: For the application layer message parsed in step S2, establish a normal behavior model based on business characteristics, and perform business execution logic detection, business verification logic detection, and business time stamp logic detection on the message according to the normal behavior model. If abnormal, an alarm signal will be issued.

Further, step S3 includes:

S3-1: Establish a message single field out-of-limit exception detection model, and detect the application layer message parsed in step S2 according to the model. If an abnormality occurs, an alarm signal is sent, otherwise, step S3-2 is entered.

S3-2: Establish a message multi-field coupling logic abnormality detection model, and detect the application layer message parsed in step S2 according to the model. If abnormality occurs, send an alarm signal, otherwise, go to step S3-3.

S3-3: Establish an abnormality detection model for the overall field of the message, and detect the application layer message parsed in step S2 according to the model. If an abnormality occurs, send an alarm signal, otherwise, go to step S4.

Further, step S3-1 includes:

S3-1-1: According to the real-time captured business traffic of the power stability control system, establish a variable frame packet length violation detection model, as shown in formula (1), according to the model to detect whether the application layer packet length exceeds the limit of the protocol. If it is the specified maximum length, that is, it violates the formula (1), it is judged as an abnormal message, otherwise, it goes to step S3-1-2.

Among them, P is the network traffic data application layer message parsed in step S2, P _WK represents the variable frame message of the power stability control service, LEN(P _WK ) represents the actual length of the message, and LEN(P _WK ) _max represents the power stability control The maximum packet length specified by the control protocol.

S3-1-2: Establish a variable frame packet length consistency anomaly detection model, as shown in formula (2), according to the model to detect whether the theoretically calculated length of the packet is equal to the actual length, if not, it violates formula (2) , it is determined as an abnormal message, otherwise, go to step S3-1-3.

Among them, THE(P _WK ) represents the theoretical calculation length of the message.

S3-1-3: Establish an abnormality detection model for the out-of-limit value of the message type identifier field. As shown in formula (3), check whether the value of the message type identifier field exceeds the limit according to the model. If yes, it violates formula (3), then It is determined that it is an abnormal message, otherwise it goes to step S3-1-4.

Among them, TYP(P _WK ) represents the value of the type identification field of the message.

S3-1-4: Establish an abnormality detection model for the over-limit value of the message transmission reason field, as shown in formula (4), according to the model to detect whether the value of the message transmission reason field exceeds the limit, if yes, it violates the formula (4), then It is determined that it is an abnormal message, otherwise it goes to step S3-1-4.

Wherein, COT(P _WK ) represents the transmission reason field value of the packet.

S3-1-5: Establish a fixed frame message length violation detection model, as shown in formula (5), according to the model to detect whether the fixed frame message length is 5 bytes, if not, it violates formula (5) , it is determined as an abnormal message, otherwise, it goes to step S3-2.

Wherein, P _{WK_G} represents the fixed frame message of the power stabilization control service, and LEN(P _{WK_G} ) represents the length of the fixed frame message.

Further, step S3-2 includes:

S3-2-1: For the real-time captured business traffic of the power stability control system, establish a logical anomaly detection model for the coupling of the function code of the message control domain and the effective bit of the frame count, as shown in formula (6), and detect the application layer message according to the model. Check whether the logic of the function code of the control domain and the valid bit of the frame count is normal, if not, that is, violating the formula (6), it is judged as an abnormal message, otherwise, go to step S3-2-2.

Among them, FUN(P _WK ) represents the function code value of the message control field, and FCV(P _WK ) represents the valid bit value of the message frame count.

S3-2-2: Establish a detection model for the abnormality detection of the flag bit coupling logic of the measured quality descriptor of the packet. As shown in formula (7), check whether the coupling logic of the measured quality descriptor flag bit of the application layer packet is normal according to the model. If no, that is, it violates the formula (7), it is determined as an abnormal message, otherwise, it goes to step S3-3.

Among them, QU(P _WK ) represents the measured quality descriptor of the packet, OV represents the overflow flag of the quality descriptor, and ER represents the effective flag of the quality descriptor.

Further, step S3-3 includes:

S3-3: According to the real-time captured business traffic of the power stability control system, establish a packet checksum abnormality detection model, as shown in formula (8), according to the model to detect whether the overall checksum of the application layer packet is correct, if not , that is, if formula (8) is violated, an alarm signal is issued, otherwise, it goes to step S4.

Among them, THE_V(P _WK ) represents the theoretical checksum of the message, which is the low byte of the single-byte arithmetic cumulative sum of the data before the start character to the checksum field, REA_V(P _WK ) represents the actual checksum of the message, is the last byte of the message.

Further, step S4 includes:

S4-1: Determine the specific service to which the message belongs according to the type identifier, transmission reason, function type, and information sequence number fields of the application layer message parsed in step S2, if it is file transmission, general call, test mode, monitoring direction blocking, remote control One of execution, remote adjustment execution, and disturbance data transmission services, then enter step S4-2; if it is remote control verification, fixed value modification services, then enter step S4-3; if it is general historical data query, time synchronization services, then Go to step S4-4.

S4-2: Establish a normal behavior model of service execution logic, and detect the execution logic of the service to which the application layer message belongs according to the model. If an abnormality occurs, an alarm signal is sent, otherwise the frame traffic data is determined as normal traffic.

S4-3: Establish a normal behavior model of service verification logic, and detect the verification logic of the service to which the application layer packet belongs according to the model. If an abnormality occurs, an alarm signal is sent, otherwise the frame traffic data is determined as normal traffic.

S4-4: Establish a normal behavior model of the service time stamping logic, and detect the time stamping logic of the service to which the application layer message belongs according to the model. If an abnormality occurs, an alarm signal is sent, otherwise the frame traffic data is determined as normal traffic.

Further, step S4-2 includes:

S4-2-1: if the message belongs to the file transfer service, go to step S4-2-2; if the message belongs to the general call service, go to step S4-2-3; if the message belongs to the test mode service, go to step S4-2-3 Step S4-2-4; if the message belongs to the monitoring direction blocking service, proceed to step S4-2-5; if the message belongs to the remote control execution service, then proceed to step S4-2-6; if the message belongs to the remote adjustment execution service , then go to step S4-2-7; if the message belongs to the disturbed data transmission service, go to step S4-2-8.

S4-2-2: Establish a normal behavior model of the file transfer service execution logic, as shown in formula (9). The normal execution logic of the file transfer service is calling directory, file directory response, file selection, file ready, calling file, section ready, calling section, segment data upload, final segment sending confirmation, section confirmation, file confirmation, if If a logic abnormality occurs, that is, a violation of formula (9), an alarm signal is sent, otherwise, the frame traffic data is determined as normal traffic.

Among them, WJ ₁ is a call directory command, WJ ₂ is a file directory response command, WJ ₃ is a file selection command, WJ ₄ is a file ready command, WJ ₅ is a call file command, WJ ₆ is a section ready command, and WJ ₇ is a command Calling a section command, WJ ₈ is the segment data upload command, WJ ₉ is the last segment sending confirmation command, WJ ₁₀ is the section confirmation command, and WJ ₁₁ is the file confirmation command.

S4-2-3: Establish a normal behavior model of the general call service execution logic, as shown in formula (10). The normal execution logic of the general call service starts the general call for the main station, sends information to the sub station, and ends the general call. If there is a logic abnormality, that is, violating the formula (10), an alarm signal is sent, otherwise the frame of traffic data is judged as normal. flow.

ZZ ₁ → ZZ ₂ → ZZ ₃ (10)

Among them, ZZ ₁ starts the general call command for the master station, ZZ ₂ is the slave station sending information command, and ZZ ₃ is the general call end command.

S4-2-4: Establish a normal behavior model of the business execution logic in the test mode, as shown in formula (11). The normal execution logic of the test mode service is test activation and test end. If there is a logic abnormality, that is, formula (11) is violated, an alarm signal is sent, otherwise the frame traffic data is determined as normal traffic.

CS ₁ → CS ₂ → CS ₁ → CS ₂ (11)

Among them, CS ₁ is a test activation command, and CS ₂ is a test end command.

S4-2-5: Establish a normal behavior model of the monitoring direction blocking business execution logic, as shown in formula (12). The normal execution logic of monitoring direction blocking service is monitoring direction blocking activation and monitoring direction blocking deactivation. If a logic abnormality occurs, that is, formula (12) is violated, an alarm signal is sent, otherwise the frame traffic data is determined as normal traffic.

BS1 _→ BS2→ _{BS1 →} BS2 ( ₁₂ )

Among them, BS ₁ is the monitoring direction blocking activation command, and BS ₂ is the monitoring direction blocking stop activation command.

S4-2-6: Establish a normal behavior model of the remote control service execution logic, as shown in formula (13). The normal execution logic of the remote control service is remote control setting, remote control setting return to school, remote control execution, and remote control execution return to school. If there is a logic abnormality, that is, violating formula (13), an alarm signal will be sent, otherwise the frame of traffic data will be judged as normal traffic. .

YK ₁ → YK ₂ → YK ₃ → YK ₄ (13)

Among them, YK ₁ is the remote control setting instruction, YK ₂ is the remote control setting return-to-school instruction, YK ₃ is the remote control execution instruction, and YK ₄ is the remote control execution return-to-school instruction.

S4-2-7: Establish a normal behavior model of the remote adjustment service execution logic, as shown in formula (14). The normal execution logic of the remote adjustment service is remote adjustment setting, remote adjustment setting return to calibration, remote adjustment execution, and remote adjustment execution return to calibration. The data is judged to be normal flow.

YT ₁ →YT ₂ →YT ₃ →YT ₄ (14)

Among them, YT ₁ is the remote adjustment setting instruction, YT ₂ is the remote adjustment setting return-to-calibration instruction, YT ₃ is the remote adjustment execution instruction, and YT ₄ is the remote adjustment execution return-to-calibration instruction.

S4-2-8: Establish a normal behavior model for disturbing the execution logic of the data transmission service, as shown in formula (15). The normal execution logic of the perturbed data transmission service is preparation for perturbed data transmission, transmission channel preparation, preparation for state change transmission with flags, state change transmission with flags, transmission of disturbance value, and end of transmission. If a logic abnormality occurs, the formula is violated. (15), send an alarm signal, otherwise the frame traffic data is judged as normal traffic.

RD ₁ →RD ₂ →RD ₃ →RD ₄ →RD ₅ →RD ₆ (15)

Among them, RD ₁ is the preparation command for disturbed data transmission, RD ₂ is the preparation command for the transmission channel, RD ₃ is the command for preparing state change transmission with flag, RD ₄ is the command for state change transmission with flag, RD ₅ is the transmission disturbance value command, RD ₆ is the transfer end command.

Further, step S4-3 includes:

S4-3-1: If the message belongs to the remote control verification service, go to step S4-3-2; if the message belongs to the fixed value modification service, go to step S4-3-3.

S4-3-2: Establish a normal behavior model of the remote control service verification logic, as shown in formula (16). The remote control verification service consists of two frames of remote control verification command and remote control verification result. The operation type (01:min/02:combined) of the remote control verification result is composed of the remote control verification command and the transmission reason field of the remote control verification result. It is decided that if there is a logical abnormality, that is, the formula (16) is violated, an alarm signal is sent, otherwise the frame traffic data is judged as normal traffic.

Among them, OTP ₁ is the operation type of the remote control verification command, OTP ₂ is the operation type of the remote control verification result, COT ₂ represents the transmission reason of the remote control verification result, and H represents the value in hexadecimal.

S4-3-3: Establish a normal behavior model of the fixed value modification business verification logic, as shown in formula (17). In the fixed value modification business, the fixed value rewriting command can only be executed if the fixed value verification command is correct. If the fixed value verification command is wrong and the fixed value rewriting command is still executed, that is, it violates the formula (17), it will be judged as an abnormal message, and an alarm signal will be issued. Otherwise, the frame traffic data is determined as normal traffic.

Among them, DZ ₁ represents the fixed value verification command, COT ₁ represents the transmission reason of the fixed value verification command, and DZ ₂ represents the fixed value rewriting command. This formula indicates that when the transmission reason of the fixed value verification command is 44, that is, the fixed value verification is correct, then the fixed value rewrite command is executed.

Further, step S4-4 includes:

S4-4-1: If the message belongs to the general historical data query service, proceed to step S4-4-2; if the message belongs to the time synchronization service, proceed to step S4-4-3.

S4-4-2: Establish a normal behavior model of the general historical data query business time stamp logic, as shown in formula (18). The start time of the general historical data query must be less than the end time. If it violates the formula (18), it will be judged as an abnormal packet and an alarm signal will be sent, otherwise the frame traffic data will be judged as normal traffic.

Among them, P _TLS represents the general historical data query service message, T1 (P _TLS ) represents the start time of the general historical data query, and T2 (P _TLS ) represents the end time of the general historical data query.

S4-4-3: Establish a normal behavior model of the time-stamping logic of the time synchronization service, as shown in formula (19), detect the confirmation frame time of the time synchronization command, and if it violates formula (19), it is determined as an abnormal message , send an alarm signal, otherwise the frame traffic data is judged as normal traffic.

Among them, P _SJTB represents the time synchronization service message, TB1 (P _SJTB ) represents the time when the time synchronization service sends the message, TB2 (P _SJTB ) represents the time of the time synchronization service acknowledgment message, Δt represents the time synchronization command to send the message and the The maximum time difference for acknowledging packets.

The invention relies on the massive intelligent substation network flow data, and obtains the specific business represented by the message by performing field-level analysis on the application layer message of the flow data. Secondly, according to the field characteristics of the message, single-field out-of-limit detection, multi-field coupling logic detection, and overall field anomaly detection are performed on the message. Finally, a normal behavior model is established according to the service characteristics of the packet, and anomaly detection is carried out based on the normal behavior model, which realizes the accurate monitoring of abnormal behavior of network traffic in smart substations, and ensures the safe and reliable transmission of information in the communication process of smart substations.

2 is a schematic structural diagram of a system for monitoring abnormal behavior of network traffic in a smart substation provided by an embodiment of the present invention. The system is suitable for executing the method provided by any embodiment of the present invention, and includes: a traffic data acquisition module 100 and an application layer message parsing module 200 , a single-frame message field feature anomaly detection module 300, and a multi-frame message business logic anomaly detection module 400. All the modules of the present invention are arranged in the processor.

The traffic data acquisition module 100 is used for mirroring and collecting traffic data, and extracting application layer packets of each frame of traffic data.

The application layer message parsing module 200 is configured to perform field-by-field analysis on the extracted application layer message according to the frame format specified by the protocol, and obtain the specific service represented by the message.

The field feature anomaly detection module 300 of the single-frame message is used to perform anomaly detection on the field feature level of the single-frame message.

The multi-frame message service logic abnormality detection module 400 is used to perform frame-to-frame logic abnormality detection for messages of the same service.

The output end of the traffic data acquisition module 100 is connected to the input end of the application layer message parsing module 200 for inputting the extracted application layer message.

The output end of the application layer packet parsing module 200 is connected to the input end of the single frame packet field feature anomaly detection module 300, and is used for inputting the application layer packet parsing result of the frame traffic data.

The output end of the anomaly detection module 300 for single-frame message field characteristics is connected to the input end of the multi-frame message service logic anomaly detection module 400 for inputting the application layer message parsing result of the frame traffic data.

As shown in FIG. 3 , further, the single-frame message field feature anomaly detection module 300 includes: a data acquisition unit 301 , a first detection unit 302 , a second detection unit 303 , and a third detection unit 304 .

The output end of the data acquisition unit 301 is connected to the input end of the first detection unit 302, and is used for inputting the application layer message and its parsing result.

The output terminal of the first detection unit 302 is connected to the input terminal of the second detection unit 303 , and the output terminal of the second detection unit 303 is connected to the input terminal of the third detection unit 304 .

In one embodiment, the data acquisition unit 301 reads the application layer message of the power stabilization control service flow data and its parsing result, and transmits the read information to the first detection unit 302, the second detection unit 303, The third detection unit 304 .

The first detection unit 302 is configured to establish an abnormality detection model for exceeding the limit of a single field of a message, detect the application layer message according to the model, and send an alarm signal if an abnormality occurs.

In one embodiment, it is detected whether the length of the application layer message exceeds the maximum length specified by the protocol, whether the theoretically calculated length of the message is equal to the actual length, whether the value of the message type identifier field exceeds the limit, and the field of the message transmission reason is detected. Check whether the value exceeds the limit, and check whether the fixed frame length of the application layer message is 5 bytes. If there is an abnormality, an alarm signal is sent.

The second detection unit 303 is configured to establish a multi-field coupling logic abnormality detection model of the message, detect the application layer message according to the model, and send an alarm signal if an abnormality occurs.

In one embodiment, it is detected whether the logic of the function code of the control field of the application layer message and the valid bit of the frame count are normal, and whether the coupling logic of the flag bit of the measured quality descriptor of the application layer message is normal, and if there is an abnormality, an alarm signal is sent out, This unit takes the abnormal result as the output end of the abnormality detection module 300 of the field characteristics of the single frame message.

The third detection unit 304 is configured to establish an abnormality detection model for the overall field of the message, detect the application layer message according to the model, and issue an alarm signal if an abnormality occurs.

In one embodiment, it detects whether the overall checksum of the application layer message is correct, and if an abnormality occurs, an alarm signal is sent.

As shown in FIG. 4 , further, the multi-frame message service logic abnormality detection module 400 includes: a data acquisition unit 401 , a first detection unit 402 , a second detection unit 403 , and a third detection unit 404 .

The output end of the data acquisition unit 401 is connected to the input end of the first detection unit 402, and is used for inputting application layer packets and their specific services.

The output terminal of the first detection unit 402 is connected to the input terminal of the second detection unit 403 , and the output terminal of the second detection unit 403 is connected to the input terminal of the third detection unit 404 .

In one embodiment, the data acquisition unit 401 acquires the application layer message and the specific service to which it belongs, and transmits the read information to the first detection unit 402 , the second detection unit 403 , and the third detection unit 404 .

The first detection unit 402 is configured to detect service execution logic abnormality.

In one embodiment, a normal behavior model of service execution logic is established, and the execution logic of the service to which the application layer message belongs is detected according to the model, if an abnormality occurs, an alarm signal is sent, and the unit takes the abnormal result as the multi-frame message service logic The output of the anomaly detection module 400 .

The second detection unit 403 is configured to detect the abnormality of the service verification logic.

In one embodiment, a normal behavior model of the service verification logic is established, and the verification logic of the service to which the application layer message belongs is detected according to the model. If an abnormality occurs, an alarm signal is sent, and the unit takes the abnormal result as a multi-frame message The output end of the business logic anomaly detection module 400 .

The third detection unit 404 is configured to detect the logical abnormality of the service time stamp.

In one embodiment, a normal behavior model of service time stamping logic is established, and according to the model, the time stamping logic of the service to which the application layer message belongs is detected, if an abnormality occurs, an alarm signal is sent, and the unit treats the abnormal result as a multi-frame message The output end of the business logic anomaly detection module 400 .

Claims (10)

1. The method for monitoring the abnormal network flow behavior of the intelligent substation is characterized by comprising the following steps of:

s1, capturing network flow data of the intelligent substation in real time, and extracting application layer messages;

s2, according to the frame format specified by the protocol of the application layer message extracted in the step S1, analyzing the message in field level;

s3, carrying out single-word segment out-of-limit detection on the analyzed application layer message, and sending an alarm signal if the application layer message is abnormal; otherwise, performing multi-field coupling logic detection on the analyzed application layer message, and if the application layer message is abnormal, sending an alarm signal; otherwise, carrying out integral field abnormity detection on the analyzed application layer message, and sending an alarm signal if abnormity occurs; otherwise, go to step S4;

and S4, performing service execution logic detection, service check logic detection and service time scale logic detection on the analyzed application layer message, and sending an alarm signal if any detection link is abnormal.

2. The method for monitoring the abnormal network flow behavior of the intelligent substation according to claim 1, wherein the specific implementation process for performing single-field out-of-limit detection on the analyzed application layer message comprises the following steps:

1) using formulas

Carrying out single-field out-of-limit detection on the analyzed application layer message, and if the formula is not satisfied, judging that the analyzed application layer message is an abnormal message; otherwise, entering step 2); wherein P is the analyzed application layer message, P_WKVariable frame messages, LEN (P), representing power stability control services_WK) Indicating the actual length of the analyzed application layer message, LEN (P)_WK)_maxRepresenting the maximum message length specified by the power stability control protocol;

2) judgment formula

Whether the message is established or not is judged, if not, the analyzed application layer message is judged to be an abnormal message; otherwise, entering step 3); wherein, THE (P)_WK) Expressing the theoretical calculation length of the message;

3) judgment formula

Whether the message is established or not is judged, if not, the analyzed application layer message is judged to be an abnormal message; otherwise, entering step 4); wherein，TYP(P_WK) The type identification field value of the message is represented;

4) judgment formula

Whether the message is established or not is judged, if not, the analyzed application layer message is judged to be an abnormal message; otherwise, entering step 5); wherein, COT (P)_WK) A field value indicating a transmission cause of the message;

5) judgment formula

Whether the message is established or not is judged, if not, the analyzed application layer message is judged to be an abnormal message; otherwise, performing multi-field coupling logic detection on the analyzed application layer message; wherein, P_{WK_G}Fixed frame message, LEN (P), indicating power stability control service_{WK_G}) Indicating the fixed frame message length.

3. The method for monitoring the abnormal network flow behavior of the intelligent substation according to claim 1, wherein in step S3, the specific implementation process of performing multi-field coupling logic detection on the analyzed application layer packet includes:

I) judgment formula

FCV(P_WK) Whether the) epsilon { (0,0), (3,1), (4,0), (7,0), (10,1), (11,1) } is true or not is judged, and if not, the analyzed application layer message is judged to be an abnormal message; otherwise, entering step II); wherein P is the analyzed application layer message, P_WKVariable frame packets, FUN (P), representing power stability control traffic_WK) Indicating the value of the message control field function code, FCV (P)_WK) Representing a message frame count significand value;

II) judgment formula

Whether the message is established or not is judged, if not, the analyzed application layer message is judged to be an abnormal message; otherwise, the solution isCarrying out integral field abnormity detection on the analyzed application layer message; wherein, QU (P)_WK) The measurement quality descriptor indicates a measured quality descriptor of the message, the OV indicates an overflow flag of the quality descriptor, and the ER indicates an effective flag of the quality descriptor.

4. The method for monitoring the abnormal network flow behavior of the intelligent substation according to claim 1, wherein in step S3, the specific implementation process of performing the overall field abnormality detection on the analyzed application layer packet includes:

i) judgment formula

Whether the message is established or not is judged, if not, the analyzed application layer message is judged to be an abnormal message; otherwise, entering step II); wherein P is the analyzed application layer message, P_WKVariable frame message for representing power stable control service, wherein THEV (P)_WK) Representing the theoretical checksum of the message, REA _ V (P), a low byte of the arithmetic sum of one byte of data starting the character to the front of the checksum field_WK) And representing the actual checksum of the message, which is the last byte of the message.

5. The method for monitoring the abnormal behavior of the network flow of the intelligent substation according to claim 1, wherein the specific implementation process of the step S4 includes:

judging the specific service of the analyzed application layer message according to the type identifier, the transmission reason, the function type and the information sequence number field of the analyzed application layer message;

if the traffic is one of the services of file transmission, total calling, test mode, monitoring direction locking, remote control execution, remote regulation execution and disturbance data transmission, detecting the execution logic of the service to which the analyzed application layer message belongs, if the traffic is abnormal, sending an alarm signal, and otherwise, judging the current frame traffic data as normal traffic;

if the service is one of remote control verification and fixed value modification service, detecting the verification logic of the service to which the analyzed application layer message belongs, if the service is abnormal, sending an alarm signal, otherwise, judging the current frame flow data as normal flow;

if the service is one of general historical data query and time synchronization service, the time mark logic of the service to which the analyzed application layer message belongs is detected, if the service is abnormal, an alarm signal is sent out, and if the service is not abnormal, the current frame flow data is judged to be normal flow.

6. The method for monitoring abnormal network flow behavior of intelligent substation according to claim 5, wherein if the analyzed application layer message belongs to a file transmission service, whether the application layer message conforms to the execution logic is judged

If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein, WJ₁To call a directory instruction, WJ₂Responding to commands for file directories, WJ₃To select a file instruction, WJ₄For file ready instructions, WJ₅To call a file instruction, WJ₆For section ready instructions, WJ₇To call a node instruction, WJ₈For section data upload instructions, WJ₉Sending an acknowledgement command for the last segment, WJ₁₀To acknowledge instructions, WJ₁₁Confirming an instruction for the file;

if the analyzed application layer message belongs to the total calling service, judging whether the message conforms to the execution logic ZZ₁→ZZ₂→ZZ₃If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein ZZ₁Initiating a general call command, ZZ, for the Master station₂For transmitting information commands to substations, ZZ₃Is a total call ending instruction;

if the analyzed application layer message belongs to the test mode service, judging whether the application layer message conforms to the execution logic CS₁→CS₂→CS₁→CS₂If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein CS₁Activating instructions for testing，CS₂A test end instruction;

if the analyzed application layer message belongs to the monitoring direction blocking service, judging whether the application layer message conforms to the execution logic BS₁→BS₂→BS₁→BS₂If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow;

if the analyzed application layer message belongs to the remote control execution service, whether the application layer message conforms to the execution logic YK or not is judged₁→YK₂→YK₃→YK₄If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow;

if the analyzed application layer message belongs to the remote regulation execution service, judging whether the application layer message conforms to the execution logic YT₁→YT₂→YT₃→YT₄If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein, YT₁Setting up commands, YT, for remote regulation₂Setting a recalibration command, YT, for remote adjustment₃For remotely regulating the execution of instructions, YT₄Executing a recalibration instruction for remote adjustment;

if the analyzed application layer message belongs to a disturbance data transmission service, judging whether the application layer message conforms to the execution logic RD₁→RD₂→RD₃→RD₄→RD₅→RD₆If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein RD₁Preparing the instruction for disturbing the data transmission, RD₂Preparing instructions for transmission channels, RD₃Preparing the command for flagged state shift transmission, RD₄For flagged state-shift transmission commands, RD₅For transmitting disturbance value commands, RD₆Is a transfer end instruction.

7. The method for monitoring the abnormal network flow behavior of the intelligent substation according to claim 5, wherein if the service is one of remote control verification and fixed value modification service, a specific implementation process for detecting the verification logic of the service to which the analyzed application layer message belongs comprises the following steps:

if it is solvedIf the analyzed application layer message belongs to the remote control check service, judging the formula

If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein the OTP₁For remote control of the type of operation of the check command, OTP₂For remote control of the type of operation of the check result, COT₂The transmission reason of the remote control verification result is shown, and H represents that the numerical value is 16 systems;

if the analyzed application layer message belongs to the fixed value modification service, judging whether the application layer message conforms to the execution logic

If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein DZ₁Indicating a constant value check instruction, COT₁Indicating the reason for the transmission of the constant check instruction, DZ₂Indicating a constant value rewrite instruction. The formula shows that when the transmission reason of the constant value check instruction is 44, namely the constant value check is correct, the constant value rewrite instruction is executed.

8. The method for monitoring the abnormal network flow behavior of the intelligent substation according to claim 5, wherein if the service is one of general historical data query and time synchronization service, a specific implementation process for detecting the time scale logic of the service to which the analyzed application layer message belongs comprises:

if the analyzed application layer message belongs to the universal historical data query service, judging the formula

If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein, P_TLSIndicating a generic historical data query service message, T1 (P)_TLS) Indicates the start time of the general historical data query, T2 (P)_TLS) Representing an end time of the general historical data query;

if the analyzed application layer message belongs to the time synchronization service, judging the formula

If not, sending an alarm signal, otherwise, judging the current frame flow data as normal flow; wherein, P_SJTBIndicating a time synchronized service message, TB1 (P)_SJTB) Indicating the time when the time synchronization service sends the message, TB2 (P)_SJTB) And the time of the time synchronization service confirmation message is represented, and the delta t represents the maximum time difference between the time synchronization command sending message and the confirmation message.

9. A computer system comprising a memory, a processor, and a computer program stored on the memory; characterized in that the processor executes the computer program to carry out the steps of the method according to one of claims 1 to 8.

10. A computer program product comprising a computer program/instructions; characterized in that the computer program/instructions, when executed by a processor, performs the steps of the method according to one of claims 1 to 8.

Images