基于差分序列方差与CPS融合的数字变电站数据异常检测方法

针对传统基于简单阈值的异常检测方法已无法适用于数字变电站过程层网络中可能出现的设备物理故障和恶意入侵导致的数据异常的问题,提出了一种基于差分序列方差(difference sequence variance,VDS)与信息物理系统(cyberphysical system,CPS)融合的数字变电站数据异常检测方法。首先,在分析CPS中面向通用对象的变电站事件(generic object oriented substation event,GOOSE)和制造报文规范(manufacturing message specification,MMS)数据的行为特征基础上,研究了IEC 61850协议规范的度量方法,提出了网络和系统管理方案;其次,基于VDS的异常检测方法和流程,结合数字变电站过程层报文特点,提出了变电站流量异常隶属函数以及基于CPS融合的参数确定方法;最后通过仿真验证了所提方法不仅能有效识别信息设备物理故障和恶意入侵导致的数据异常,对于拒绝服务攻击也能实现准确检测,相比于传统方法具有更高的准确性与可靠性。

An Anomaly Detection Method for Digital Substation abnormal Data Based on Fusion of Difference Sequence Variance and CPS

Given that the traditional anomaly detection method based on simple threshold is no longer applicable to the physical abnormality of the information equipment and data anomaly caused by malicious intrusion which may occur in the process layer network of the intelligent substation,this paper presents a new data abnormality detection method based on fusion of differential sequence variance(VDS)and cyberphysical system(CPS)for digital substations.First,on the basis of analyzing the behavior characteristics of the generic object oriented substation event(GOOSE)and the manufacturing message specification data in the CPS,the measurement method based on the IEC 61850 protocol specification is studied and the management scheme of the network and system is proposed.Second,based on the abnormality detection method and process of the VDS,combined with the characteristics of the digital substation process layer message,the substation process layer flow anomaly membership function and the parameter determination method based on information physical fusion are proposed.Finally,the simulation in the digital substation network has verified that the proposed method can not only effectively identify the data anomalies caused by physical failures and malicious intrusions of the information equipment,but also can accurately detect denial of service attacks,which has higher accuracy and reliability than traditional methods.