基于信息物理融合的智能变电站过程层网络异常流量检测

智能变电站过程层网络中存在的随机报文与突发报文，伴随可能的信息设备物理故障以及入侵病毒拒绝服务攻击等导致的异常流量，使得基于简单阈值的检测方法无法适用。基于信息物理融合的广义信源及基于网络演算法的通信网络流量计算模型，提出了一种基于信息物理融合和差分序列方差的新型智能变电站过程层网络异常流量检测方法。首先，基于差分序列方差的异常检测方法和流程，提出了变电站过程层流量异常隶属函数以及基于信息物理融合的参数确定方法。其次，为增加异常检测的可靠性，提出了考虑智能变电站过程层报文特点的一种攻击条件阈值以及阈值计算方法。最后，对T1-1型变电站网络进行仿真，验证了所提方法不仅能够对过程层中存在的随机和突发通用面向对象变电站事件报文进行识别，也可识别拒绝服务攻击。

Abnormal Traffic Detection on Process Layer Network of Smart Substation Based on Cyber Physical Fusion

For the process layer network of smart substation, it has the property of random and burst message in normal communication, abnormal traffic caused by possible physical failure of information equipment and denial of service(DoS)attack of invading virus, etc. , the simple threshold-based detection method cannot be suitable to use. Therefore, a novel abnormal traffic detection based on cyber physical fusion and variance of difference sequence approach is proposed based on cyber physical fusion oriented generic message source model and network calculus-oriented communication network message flow calculation model. Firstly, according to abnormal message traffic detection method and flow chart of the variance of difference sequence, a new substation traffic anomaly membership function and its parameter estimation method of cyber physical fusion are proposed. Then, thresholds of attack conditions and calculation method including message characteristic of smart substation are worked out to improve the reliability of fault detection. Finally, the simulation of the T1-1 type substation network is carried out, which proves that the random and burst messages of generic object-oriented substation event as well as DoS attacks in the process layer can be identified by proposed method.