面向IEC61850智能变电站的网络安全异常流量分析方法

为了保证智能变电站的网络通信安全和整个变电站的稳定运行,提出了一种基于机器学习k-means聚类算法的异常流量分析方法。根据智能变电站中过程层网络的特性,结合对IEC61850智能变电站专有GOOSE(generic object-oriented substation event)以及SV(sample value)协议的报文结构解析,使用了一种基于信息熵的特征选取方法对智能变电站正常工作时站内网络通信流量进行特征分析选择,利用k-means聚类算法完成了对异常流量的检测分析及其相关分析。相较于以往方法,文中方法对智能变电站的过程层网络流量信息的特征进行了选取,根据信息熵理论,完成了重要特征的选择和冗余特征的剔除,提高了聚类算法的效率,提高了对异常流量检测的准确性。

Research on network security abnormal flow analysis method for IEC61850 intelligent substation

In order to ensure the network communication security of intelligent substations and their stable operation, this paper proposes an analysis method of abnormal flow based on machine learning k-means clustering algorithm. Firstly, according to the characteristics of the process level network in the intelligent substation, the message structure of IEC61850 intelligent substation''s proprietary GOOSE(generic object-oriented substation event) and SV protocol is analyzed. Then, the network communication flow in the intelligent substation during normal operation is analyzed and selected by using a feature selection method based on information entropy. Finally, k-means clustering algorithm is used to complete the detection and analysis of the abnormal flow. Compared with the previous methods, the proposed method first selects the characteristics of process layer network flow information of intelligent substation. According to the theory of information entropy, the selection of important features and the elimination of redundant features are then completed, improving the efficiency of clustering algorithm and the accuracy of abnormal flow detection.