变电站自动化系统时间同步协同攻击的检测与防护方法

为了使攻击的后果最大化,受国家支持的攻击者可以使用时间同步的协同机制发起高度隐蔽的网络攻击,而无须进行通信。这可能会使多个变电站内的所有断路器同时跳闸,从而引发大停电。提出了一种基于时间加速的方法来检测时间同步的协同攻击。在变电站自动化系统年度检修期间,通过逐步加速系统时间来触发时间逻辑,以识别是否存在潜在的恶意软件。此外,还提出了一种基于变电站自动化系统的异步化时间同步管理方法。将根据结构脆弱性指数识别的几个关键变电站的时间保持异步。因此,这些关键变电站将不会与其他变电站一起遭受时间同步的协同攻击,并且可以大大降低相关后果。基于IEEE 39节点系统的数值模拟表明,通过使2个关键变电站保持时间异步,可以显著减少2到3个变电站的协同攻击的负荷损失,并且电网可以具备应对时间同步协同攻击的韧性。

Detection and Protection Method for Time-synchronized Coordinated Cyber-attack on Substation Automation System

In order to maximize the consequences of attacks, the attackers supported by their nations can launch highly concealed cyber-attack using time-synchronized coordination mechanism without communication, which could trip all circuit breakers within multiple substations at the same time to trigger catastrophic blackout. A time acceleration based approach is proposed to detect the time-synchronized coordinated cyber-attack. During the annual maintenance of substation automation system (SAS), the system time is accelerated one by one to identify whether there are underlying malwares by triggering time logic. Moreover, an approach of time-asynchronized synchronization management based on SAS is proposed. The time of a few key substations that are identified with structural vulnerability index can be kept asynchronized. Therefore, these key substations will not suffer time-synchronized coordinated cyber-attack together with the other substations and the corresponding consequence could be greatly reduced. IEEE 39-bus system based numerical simulation indicates that by keeping 2 key substations time-asynchronized, load loss of coordinated cyber-attack of 2 to 3 substations can be reduced significantly, and the power grid can be resilient against time-synchronized coordinated cyber-attack.