KR101375813B1 - Active security sensing device and method for intrusion detection and audit of digital substation - Google Patents

Abstract

The present invention relates to an active security sensing device for real-time security check and abnormality detection in a digital substation. The present invention provides an active security sensing device and a method therefor for real-time security check and abnormality detection in a digital substation which include: a station level intrusion detection unit for detecting station level network abnormal activities which are used in communication between HMI system and smart electronic device, and between inside and outside of a digital substation and deriving abnormal traffic; a bay level intrusion detection unit for detecting bay level network abnormal activities which are used in communication between smart electronic devices and deriving status information and first network system management (NSM) object data of the smart electronic devices; and an abnormality determination unit for finally determining the abnormality based on the correlation analysis among the abnormal traffic, status information of the smart electronic devices and first NSM object data. [Reference numerals] (110) Station level; (111) Active type security sensor; (113) HMI system; (115) Gateway; (120) Bay level; (130) SCADA system

Description

ACTIVE SECURITY SENSING DEVICE AND METHOD FOR INTRUSION DETECTION AND AUDIT OF DIGITAL SUBSTATION}

The present invention relates to an active security sensing device for real-time security audit and anomaly detection in a digital substation, and more particularly, communication in a digital substation consisting of a terminal device (IED, HMI, etc.) and a communication network based on the IEC 61850 open protocol. An active security sensing device and method for detecting real-time security audits and abnormal signs based on health, terminal device health, and intrusion detection events.

The intelligent grid consists of a power system that is in charge of power transportation and an information system for control and monitoring (monitoring). The operation of intelligent power systems, such as digital substations, has relied on information systems, including standardized communication protocols and networks, intelligent electronic devices (IEDs), and databases. However, as the information system is changed from the existing proprietary form to the standardized open format, it becomes more vulnerable to cyber attacks, and the malicious code caused by the insider's mistakes causes the distribution of social infrastructure. There is an urgent need for security measures to secure the reliability and stability of human power facilities.

The conventional security audit system configuration for solving this is shown in FIG. Referring to FIG. 1, the conventional security audit system 10 collects an event log and a security audit unit 12 that performs security audit and abnormal symptom detection of a packet or data transmitted through a SCADA network and stores the event log in a database. It consists of a post-security audit unit 13 to determine the abnormal symptoms through the analysis of the association with the log. The security audit unit 12 is composed of an intrusion detection system 12a for detecting an intrusion or attack such as hacking, an intrusion blocking system 12b including a firewall, and a server security system 12c, and a post-security auditing unit. 13 is an event log collecting unit 13a for collecting security event logs, a database 13c for storing various collected event logs, and a real time analyzer 13b for associating and analyzing the collected event logs and event logs stored in the database. It consists of. However, there are some problems in applying the conventional security audit system 10 to IEC 61850 based digital substations.

The first problem is that since the intrusion detection system 12a collects packet information on the network and compares it with the attack pattern database to detect illegal intrusions, a new type of attack, for example, an attack pattern database is not known. Unknown attacks, such as zero day attacks, and unintended attacks by the user.

The second problem is that an intrusion prevention system 12b such as a firewall sets a packet to allow and a packet to reject according to a predefined rule, and uses this to block access to a packet to be rejected. Firewalls placed at inter-zone connection points within a secure network segment separate from the network are vulnerable to attack using allowed packets.

2 illustrates an IEC 61850 service model, which does not consider a SV / GOOSE (Sampled Values / Generic Object Oriented Substation Event) command, which is an IEC 61850 service model used for transmitting and receiving data in intelligent electronic equipment. As a result, there is a problem in that an abnormal symptom cannot be detected by an existing audit system.

An object of the present invention is to solve the above problems, communication health management information, a terminal device in a digital substation consisting of IEC 61850 open protocol (open protocol) based terminal devices (IED, HMI, etc.) and a communication network It is to provide an active security sensing device and method for detecting real-time security audits and abnormal signs based on soundness management information and intrusion detection system management information.

Another object of the present invention is to provide a service method for extracting state information and NSM object data from IEC 61850 objects of intelligent electronic equipment in constructing an active security sensor.

Active security sensing device for real-time security audit and abnormal symptoms detection of the digital substation according to the present invention for achieving the above object is a station-level network used for communication between the HMI system and intelligent electronic equipment and communication between inside and outside the digital substation A station level intrusion detection unit for detecting abnormal behavior and deriving abnormal traffic; A bay level intrusion detection unit for detecting a network abnormal behavior at a bay level used for communication between the intelligent electronic devices to derive state information of the intelligent electronic device and first network system management (NSM) object data; And an abnormal symptom determination unit configured to finally determine an abnormal symptom based on the correlation analysis between the abnormal traffic, the state information of the intelligent electronic device, and the first NSM object data.

Here, the bay level intrusion detection unit, the terminal device state information collection unit for collecting state information from the intelligent electronic equipment; And a first NSM object detector extracting first NSM object data including terminal device health management information.

Here, the station level intrusion detection unit, a network packet collection unit for collecting and monitoring network traffic characteristics and status information from the internal and external networks of the digital substation, the HMI system and the intelligent electronic equipment; A second NSM object detection unit configured to extract and monitor second NSM object data including communication health management information and intrusion detection system (IDS) management information; A traffic pattern learner which learns and detects the network traffic characteristic and the traffic pattern of the second NSM object data by itself and stores the detected traffic pattern in a learning traffic pattern database; And an abnormal traffic determination unit classifying the traffic data by suspected abnormal symptoms and deriving abnormal traffic.

Here, a pick winner algorithm for comparing the detected traffic pattern with the traffic pattern recorded in the learning traffic pattern database and determining whether the detected traffic pattern is normal is used for constructing the learning traffic pattern database. It is characterized by.

In this case, the communication health management information is applied to the maximum number of session connections allowed between terminal devices, the number of terminal connections and the maximum connection exceeded at the same time, inappropriate time synchronization detection in the network, modification / deformation protocol message detection, and multiple systems. And at least one of the enhancement support for the planned attack detection.

In this case, the terminal device health management information may include connection or data transmission detection of an unauthorized user, invalid data request, invalid data request, invalid control command detection, etc. based on an authorized user list. Stored audit logs, terminal CPU and memory resource status (Sudden increase detection), stopping and restarting of terminal devices, stopping and restarting applications, minimum and maximum idle timeouts, and actual idle time for a specific time It characterized in that it comprises at least one.

In this case, the traffic pattern learning unit and the abnormal traffic determination unit may perform suspicious observation of abnormal signs.

Here, when extracting state information and first NSM object data from the intelligent electronic device and second NSM object data from the HMI system and the intelligent electronic device, the first NSM object data to be extracted from the intelligent electronic device and The intelligent electronic equipment objects included in the intelligent electronic equipment corresponding to the second NSM object data are grouped into a data group using a DataSet function included in an Abstract Communication Service Interface (ACSI), and the abstract communication service interface. Extracting is performed by transmitting the data group to the active security sensing device using the GetDataSetValue function.

Here, when updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and intelligent electronic equipment, it uses a Report function included in the abstract communication service interface do.

Herein, when updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and the intelligent electronic device, the EEHealth data object is received from the intelligent electronic device and the corresponding data is received. It is characterized by updating.

 The active security sensing method for real-time security audit and abnormal sign detection of digital substation according to the present invention detects anomalous behavior at a station level used for communication between HMI system and intelligent electronic equipment and communication between inside and outside of digital substation. Deriving traffic; Deriving state information and first NSM object data of the intelligent electronic device by detecting a network abnormal behavior at a bay level used for communication between the intelligent electronic devices; And finally determining an abnormal symptom based on the correlation analysis between the abnormal traffic, the state information of the intelligent electronic device, and the first NSM object data.

The deriving the state information of the intelligent electronic device and the first NSM object data may include collecting state information from the intelligent electronic device; And extracting first NSM object data including terminal device health management information.

The deriving of abnormal traffic may include collecting and monitoring network traffic characteristics and status information from internal and external networks of the digital substation, the HMI system, and the intelligent electronic equipment; Extracting and monitoring second NSM object data including communication health management information and intrusion detection system (IDS) management information; Learning and detecting the traffic patterns and the traffic patterns of the second NSM object data by itself and learning and detecting the traffic patterns in a learning traffic pattern database; And classifying the traffic data by suspected abnormal symptoms and deriving abnormal traffic.

Here, a pick winner algorithm for comparing whether the detected traffic pattern is normal by comparing the traffic pattern recorded in the learning traffic pattern database with the detected traffic pattern is used to construct the learning traffic pattern database. .

In this case, the communication health management information is applied to the maximum number of session connections allowed between terminal devices, the number of terminal connections and the maximum connection exceeded at the same time, inappropriate time synchronization detection in the network, modification / deformation protocol message detection, and multiple systems. And at least one of the enhancement support for the planned attack detection.

In this case, the terminal device health management information may include connection or data transmission detection of an unauthorized user, invalid data request, invalid data request, invalid control command detection, etc. based on an authorized user list. Stored audit logs, terminal CPU and memory resource status (Sudden increase detection), stopping and restarting of terminal devices, stopping and restarting applications, minimum and maximum idle timeouts, and actual idle time for a specific time It characterized in that it comprises at least one.

Here, the final determination of the abnormal symptoms and the learning and detection of the traffic patterns may include suspicious observation of abnormal symptoms.

Here, when extracting state information and first NSM object data from the intelligent electronic device and second NSM object data from the HMI system and the intelligent electronic device, the first NSM object data to be extracted from the intelligent electronic device and Grouping the intelligent electronic equipment objects included in the intelligent electronic equipment corresponding to the second NSM object data into a data group by using a DataSet function included in the abstract communication service interface; And transmitting the data group to the active security sensing device using the GetDataSetValue function of the abstract communication service interface.

Here, when updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and intelligent electronic equipment, it characterized in that the Report function included in the abstract communication service interface.

Here, when updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and the intelligent electronic equipment, receiving the EEHealth data object from the intelligent electronic equipment and updating the corresponding data. It features.

The active security sensing apparatus and method of the present invention has the advantage that it can detect not only the abnormal symptoms of the network through the TCP / IP protocol, but also the abnormal symptoms of the network through the GOOSE command used in the IEC 61850 based digital substation. In addition, according to the abnormal symptom determination method performed in a double of the present invention, it is possible to more accurately detect the abnormal symptoms.

1 is a diagram schematically showing the configuration of a conventional security audit system.
2 is a diagram illustrating an IEC 61850 service model.
3 is a diagram illustrating an abnormal traffic process performed by an abnormal traffic determination unit of an active security sensing device according to the prior art.
4 is a diagram schematically illustrating a structure of a digital substation including an active security sensing device.
5 is a diagram illustrating a configuration of an active security sensing device according to an embodiment of the present invention, and a diagram illustrating an operation process of each component of the active security sensing device.
6 is a diagram illustrating an abnormal traffic determination process performed by an abnormal traffic determination unit of an active security sensing device according to an embodiment of the present invention.
7 is a diagram illustrating a method of extracting state information and NSM object data from a terminal device according to an embodiment of the present invention.
8 is a diagram illustrating a method of extracting state information and NSM object data from a terminal device according to another embodiment of the present invention.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

Hereinafter, an active security sensing apparatus and method for real time security audit and abnormal symptom detection of a digital substation according to an embodiment of the present invention will be described.

4 is a diagram schematically illustrating a structure of a digital substation including an active security sensing device.

Referring to FIG. 4, the digital substation 100 is largely composed of a station level 110 and a bay level 120. First, the station level 110 is used for communication between the substation inside and outside, for example, communication between the substation inside and the external SCADA system 130 and between the HMI system 113 and the intelligent electronic equipment (IED, 123). In part, it includes an active security sensor 111, an HMI system 113, and a gateway 115 used for linkage with the SCADA system 130 using an external network. Since the description of the active security sensor 111 will be made in detail with reference to FIG. 5 below, a detailed description thereof will be omitted.

In another embodiment, the gateway 115 for connecting to the HMI system or the upper SCADA system takes the form of polling with a plurality of intelligent electronic devices (IED, 123), so that a packet having a fixed IP address and a small number is provided. Rather than determining the packet by packet flow, it is possible to determine whether there is an abnormality of the network in a short time by defining all the connection packets as one set and defining one flow. Depending on the factors that specify the station level and bay level network health, and the anomaly detection method, each learning traffic pattern database can be configured or the same database can be shared, and intrusion detection method using attack pattern matching can be used in parallel. Can be.

Bay level 120 is a portion used for communication between the intelligent electronic equipment (IED, 123), and consists of an active security sensor 111, and intelligent electronic equipment (IED, 123) including NSM object data. Herein, the NSM object data is described by being divided into first NSM object data including terminal device health management information and second NSM object data including communication health and intrusion detection management information in the following description, and these management information are substations. Anomalies and security audits are used in communication between internal and external and communication between HMI system 113 and intelligent electronic equipment (IED, 123).

In addition, at the two levels, communication is performed using the TCP / IP protocol at the station level 110, and communication is performed at the bay level 120 using the GOOSE command.

5 shows an active security sensing device 111 in accordance with one embodiment of the present invention. Here, the active security sensing device 111 includes a station level intrusion detection unit 210, a bay level intrusion detection unit 220, an audit recorder 230, and an abnormal indication determination unit 240.

In FIG. 5, the active security sensing device 111 is illustrated as being configured with a station level intrusion detector 210 and a bay level intrusion detector 220, but in another embodiment, these station level intrusion detectors 210. ) And bay level intrusion detection unit 220 may be separated into active security sensing devices that perform station level intrusion detection and active security sensing devices that perform bay level intrusion detection, respectively. .

The station level intrusion detection unit 210 detects anomalous traffic at the station level, which is used for communication between the HMI system and intelligent electronic equipment (IED) and communication inside and outside the digital substation, through the TCP / IP protocol. Function to derive The station level intrusion detection unit 210 is a network packet collector 211, a second NSM object detector 213, a traffic pattern learner 215, a learning traffic pattern database 217, and an abnormal traffic determiner 219. It includes. The algorithm for operating the station level intrusion detection unit 210 is as follows.

First, the network packet collection unit 211 collects and monitors network traffic characteristics from networks inside and outside the substation, HMI systems (application servers), and intelligent electronic equipment (IED). This forwarded packet or data includes, but is not limited to, network IP, port, packet size, and the like.

Thereafter, the second NSM object detection unit 213 extracts and monitors the second NSM object data. Here, the second NSM object data includes communication health management information and intrusion detection system management information. Here, the communication health management information is an example of the implementation in the digital substation using the IEC 60870-5-104, IEC 60870-6, IEC 61850 protocol, the maximum number of session connections allowed between terminal devices, the number of terminal connections being used simultaneously and the maximum At least one of: over-connections, inadequate time synchronization detection in the network, modification / deformation protocol message detection, and enhanced support for detection of planned attacks against multiple systems.

After the collection and monitoring of the network packet described above and the collection and monitoring of the second NSM object data are performed, in the traffic pattern learning unit 215, the traffic characteristics of the network and the second NSM object based on the aforementioned communication health management information. Self-learning and detection of data traffic patterns. Thereafter, the traffic pattern that has been learned and detected is stored in the learning traffic pattern database 217 and transferred to the abnormal traffic determination unit 219.

Here, the Pick Winner algorithm may be used to build the learning traffic pattern database 217. The pick winner algorithm first scans a database and then determines whether it is normal according to a known pattern in order to specify the health of the network from NSM objects and information including network IP, port, packet size, and the like. Algorithm. Unlike other detection methods that need to learn about normal or abnormal behaviors, the pick-winner algorithm is capable of multi-pattern learning, so it is not necessary to create separate steady-state data. In addition, another advantage of the Pick Winner algorithm is that the threshold can be set as a priori expectation for false positive rate, which is suitable for fast anomaly detection.

The abnormal traffic determination unit 219 classifies the learned packets delivered from the abnormal traffic pattern learning unit 215 by the suspected abnormal symptoms. Since the description of the suspect observation state classification process performed by the traffic determination unit 219 will be made with reference to FIG. 6 below, a detailed description thereof will be omitted.

The bay level intrusion detection unit 220 detects a bay level network abnormal behavior used for communication between the intelligent electronic equipments (IEDs) through the GOOSE command of IEC 61850, and detects the status information of the intelligent electronic equipments (IEDs) and the first NSM. Derived object data. The bay level intrusion detecting unit 220 includes a terminal device state information collecting unit 221 and a first NSM object detecting unit 223. The algorithm performed by the bay level intrusion collector 220 is as follows.

First, the terminal device state information collecting unit 221 collects the state information from the intelligent electronic equipment (IED, 123). The first NSM object detector 223 extracts the first NSM object data. Here, the first NSM object data is data including terminal device health management information. In this case, the terminal device health management information includes an audit for storing an unauthorized user's connection or data transmission, invalid data request, invalid data request, and invalid control command detection based on the authorized user list. At least one of the log, the CPU and memory resource status (Sudden increase detection) of the terminal, the stop and restart of the terminal, the stop and restart of the application, the minimum / maximum idle timeout and the actual idle time for a specific time.

In addition, the network packet collection unit 211 and the second NSM object detector 213 of the station level intrusion detection unit 210 and the terminal device state information collection unit 221 and the second level of the bay level intrusion detection unit 220 are provided. 1 Events generated by the NSM object detector 223 are stored in the audit log 230 as log files.

Finally, the abnormal symptom determination unit 240 is a part which finally determines the abnormal symptom based on the correlation analysis between the abnormal traffic, the state information of the intelligent electronic equipment (IED), and the first NSM object data. Here, the abnormal symptom determination unit 240 may result in a more accurate and reliable result through performing the suspicious observation step which will be described in detail below.

FIG. 6 illustrates an abnormal traffic determination process performed by the abnormal traffic determining unit 219 of FIG. 5. Referring to FIG. 3, which illustrates a conventional abnormal traffic determination process, the related art is conventionally used to determine abnormal traffic of NSM object management information including data communication health management information, terminal device health management information, and intrusion detection system management information. Anomalies were judged by a simple comparison with the stored database. However, the abnormal traffic determination of the NSM object management information according to the present invention, as shown in the figure, by performing the abnormal observation (Abnormlities Space) step for the abnormal signs in the middle of performing the determination, by performing the abnormal traffic determination by double It is characterized in that it can result in more accurate and reliable results than the prior art. For example, categorizing abnormal data into suspicious symptom observation state may be compared with a separate database, such as denial of service detection due to Denial of Service (DoS) attack and buffer overflow DoS. Analyze the network abnormality suspect state observed through the suspicion of abnormal symptoms, the correlation between the state collected from the terminal equipment, and the NSM data in time series, and finally determine the abnormal symptoms to generate a security event. .

7 and 8 illustrate embodiments of a method of extracting state information and NSM object data from an intelligent electronic device (IED) 123 by an active security sensor, which is another object of the present invention. This extraction method is characterized by utilizing an IEC 61850 object and an Abstract Communication Service Interface (ACSI). Here, the Abstract Communication Service Interface (ACSI) is defined in IEC 61850 that deals with data objects, the ability to define a set of abstract services for accessing these objects, and the basic set of data types for describing the objects. Functions and functions that limit the behavior of objects. The results of mapping IEC 61850 objects and NSM object data are shown below in Tables 1-3. In Tables 1 to 3, the first column represents NSM object data, the second column represents a source object of intelligent electronic equipment indicating which object of the intelligent electronic equipment is extracted from, and finally the third The columns show the function and description of each NSM object data.

In Figures 7 and 8 illustrating embodiments for this, the left part shown with dashed blocks represents active security sensors 71, 81, and the right part shown with dashed blocks shows intelligent electronic equipment 73, 83. These figures show the data flow when one NSM object consists of two or more IEC 61850 data combinations.

NSM Object Extraction from Description EndLst LPHD.PhyHealth, NumPwrUp,
PwrUp, PwrDn (DO) List of end systems connected in network ACLLst GSAL (LN) Monitoring security violation regarding authorization, access control, inactive association EndDct LPHD.PwrUp, PwrDn (DO) Detection of connect or disconnect of an end device Nodset GenDataObjectClass service (SVC) Writing values of data object in a LN NodRs LLN0.LEDRs (DO) Reset all LED, true causes reset to occur PthLog Log service (SVC) Log of all path configuration changes Nodlog Log service (SVC) Log of all equipment status changes TimSyncAlm LTMS (LN) Supervision of the time synchronization BufOvrfAlm  LPHD.OutOv, InOv (DO) Output and input communications buffer overflow

First, referring to FIG. 7, as described in Table 1 above, an End device list (EndLst) of NSM object data is an LPHD (Physical Device Information) logical node included in object data of the intelligent electronic device 73. It consists of a combination of four data objects (PhyHealth, NumPwrUp, PwrUp, PwrDn). For effective processing, the DataSet class included in ACSI is used to make four data objects (PhyHealth, NumPwrUp, PwrUp, PwrDn) into one data group, and upon request of an active security agent, the DataSet Send the data to the GetDataSetValue service supported by the class. Here, GetDataSetValue is one of the protocols supported by ACSI and is used for data transmission. By the way, NSM EndLst needs to manage the status of the terminal devices in the digital substation in real time, so the active security sensor can update EndLst at regular intervals, but most terminal device lists remain unchanged to send and receive unnecessary packets. I can make it. To improve this inefficient part, the Report function included in ACSI can be introduced. As shown by the dotted arrows in FIG. 7, the Event Monitor in the BRCB monitors the data composed of the DataSet and updates EndLst by transmitting the designated data to the active security sensor only when there is a data change for the intelligent electronic device. The term BRCB described here is a method included in IEC 61850 that functions to monitor and report on data.

NSM Object Extraction from Description EndOI LNReference (SVC) Object Reference (identifier) of the LN Netoilst ITPC.EEHealth (DO) The state of the communication channel EndOILst LCCH.ChLiv (DO) Physical channel status; true if channel receives telegrams within a specified time interval AppDatSt, DataInvAlm Q (quality) (CDC) Attribute Quality has validity information CntInvAlm opRcvd, (t) opOk (CDC) Attribute opRcvd, (t) opOk has the information of control command validity. NetSt, NetAlm ITPC.LosSyn (DO) Loss of Synchronism (No communication is possible) Appst Common LN.Beh, Mod (DO) Application behavior and mode controls Endst EEHealth (DO) Reflecting the state of external equipment EndStrCnt GSAL.NumCntRs (DO) Number of counter resets EndLog Log service (SVC) Log of all significant events in end system (implementation-dependent)

In addition, referring to Table 2 above, it can be seen that PwrOnAlm, which is NSM object data, is composed of a data object PwrUp of an LPHD logical node. Therefore, it can be seen that PwrUp of intelligent electronic equipment is used to extract PwrOnAlm, which is NSM object data.

 One embodiment according to another data extraction method is shown in FIG. 8. NSM NetOILst (Network Object Identifier List) can receive the EEHealth data object of the teleprotection communication interface (ITPC), it is possible to update the corresponding data (see Table 3 below).

NSM Object Extraction from Description BufOvCnt, BufOvAlm LPHD.OutOv & InOv (DO) Output and input communications buffer overflow PwrLosCnt, PwrLosAlm LPHD.PwrSupAlm (DO) External power supply alarm PwrOnAlm LPHD.PwrUp (DO) Power-up detection ComLosCnt ITPC.LosSig (DO) No signal alarm, indicate a channel problem Syntmms, SynAlm LTMS (LN) Supervision of the time synchronization

FIG. 8 shows that ITPC EEHealth is data in the form of CDC called Enumerated Status (ENS), and shows how the active security sensor collects data through the GetDataValue service of ACSI. Of course, as in the case of Figure 7 composed of a DataSet, it is also possible to collect real-time data by using the Report function of the ACSI.

As described above, an optimal embodiment has been disclosed in the drawings and specification. Although specific terms have been employed herein, they are used for purposes of illustration only and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

100: digital substation 110: station level
111: active security sensing device 120: bay level
210: station level intrusion detection unit
220: bay level intrusion detection unit
230: audit log 240: abnormal signs determination unit

Claims (20)

A station level intrusion detection unit for detecting a network abnormal behavior of a station level used for communication between the HMI system and intelligent electronic equipment and communication between inside and outside the digital substation, to derive abnormal traffic;
A bay level intrusion detection unit for detecting a network abnormal behavior at a bay level used for communication between the intelligent electronic devices to derive state information of the intelligent electronic device and first network system management (NSM) object data; And
And an abnormal symptom determination unit configured to finally determine an abnormal symptom based on the correlation analysis between the abnormal traffic, the state information of the intelligent electronic equipment, and the first NSM object data.
The station level intrusion detection unit,
A network packet collecting unit for collecting and monitoring network traffic characteristics and status information from the internal and external networks of the digital substation, the HMI system, and the intelligent electronic equipment;
A second NSM object detection unit configured to extract and monitor second NSM object data including communication health management information and intrusion detection system (IDS) management information;
A traffic pattern learner which learns and detects the network traffic characteristic and the traffic pattern of the second NSM object data by itself and stores the detected traffic pattern in a learning traffic pattern database; And
And an abnormal traffic determination unit for classifying the traffic data by suspected abnormal symptoms and deriving abnormal traffic, and real-time security auditing and abnormal symptom detection of a digital substation. The method of claim 1,
The bay level intrusion detection unit,
A terminal device state information collecting unit collecting state information from the intelligent electronic device; And
Terminal device comprising a first NSM object detection unit for extracting the first NSM object data including health management information, active security sensing device for real-time security audit and abnormal symptoms detection of the digital substation. delete The method of claim 1,
A pick winner algorithm for comparing the detected traffic pattern with the traffic pattern recorded in the learning traffic pattern database and determining whether the detected traffic pattern is normal is used to construct the learning traffic pattern database. Active security sensing device for real-time security audit and abnormal symptoms detection of the digital substation. The method of claim 1,
The communication soundness management information,
Improvements for the maximum number of session connections allowed between terminal devices, the number of concurrently used terminal connections and the maximum number of connections exceeded, the detection of inappropriate time synchronization in the network, the detection of malformed / deformed protocol messages, and the detection of planned attacks against multiple systems. Active security sensing device for real-time security audit and abnormal symptoms detection of the digital substation, characterized in that it comprises at least one. 3. The method of claim 2,
The terminal device health management information,
Audit log that stores connection or data transmission of unauthorized user based on authorized user list, invalid data, invalid data request, invalid control command detection, etc. in terminal device application, CPU and memory of terminal At least one of resource status (Sudden increase detection), stopping and restarting of the terminal device, stopping and restarting an application, minimum and maximum idle timeouts, and actual idle time for a specific time period. Active Sensing Device for Real-time Security Audit and Anomaly Detection of Digital Substation. The method of claim 1,
Active traffic sensing device for real-time security audit and abnormal symptoms detection of the digital substation, characterized in that the suspicious observation of abnormal signs using a database is performed in the traffic pattern learning unit and the abnormal traffic determination unit. The method of claim 1,
When extracting state information and first NSM object data from the intelligent electronic equipment and second NSM object data from the HMI system and the intelligent electronic equipment,
DataSet included in an Abstract Communication Service Interface (ACSI) for intelligent electronic device objects included in the intelligent electronic device corresponding to the first NSM object data and the second NSM object data to be extracted from the intelligent electronic device. By using a function grouping the data group, and using the GetDataSetValue function of the abstract communication service interface to extract the data group to the active security sensing device, real-time security audit and abnormal symptoms detection of the digital substation Active Security Sensing Device. 9. The method of claim 8,
When updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and intelligent electronic equipment, characterized in that using the Report function included in the abstract communication service interface, Active security sensing device for real time security audit and anomaly detection of digital substation. 9. The method of claim 8,
When updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and intelligent electronic equipment, receiving the EEHealth data object from the intelligent electronic equipment to update the corresponding data Active security sensing device for real-time security audit and abnormal symptoms detection of the digital substation. Detecting abnormal traffic at a station level used for communication between the HMI system and the intelligent electronic equipment and between the inside and the outside of the digital substation to derive abnormal traffic;
Deriving state information and first NSM object data of the intelligent electronic device by detecting a network abnormal behavior at a bay level used for communication between the intelligent electronic devices; And
And finally determining an abnormal symptom based on the correlation analysis between the abnormal traffic, the state information of the intelligent electronic equipment, and the first NSM object data.
Deriving the abnormal traffic,
Collecting and monitoring network traffic characteristics and status information from the internal and external networks of the digital substation, the HMI system, and the intelligent electronic equipment;
Extracting and monitoring second NSM object data including communication health management information and intrusion detection system (IDS) management information;
Learning and detecting the traffic patterns and the traffic patterns of the second NSM object data by itself and learning and detecting the traffic patterns in a learning traffic pattern database; And
And classifying the traffic data by suspected abnormal symptoms and deriving abnormal traffic. The active security sensing method for real-time security audit and abnormal symptom detection of a digital substation. 12. The method of claim 11,
Deriving the state information and the first NSM object data of the intelligent electronic device,
Collecting state information from the intelligent electronic device; And
And extracting first NSM object data including terminal device soundness management information. The active security sensing method for real-time security auditing and abnormal symptom detection of a digital substation. delete 12. The method of claim 11,
Characterized in that a pick winner algorithm for comparing the detected traffic pattern with the traffic pattern recorded in the learning traffic pattern database and determining whether the detected traffic pattern is normal is used to construct the learning traffic pattern database. Active security sensing method for real-time security audit and abnormal symptom detection of substation. 12. The method of claim 11,
The communication soundness management information,
Improvements for the maximum number of session connections allowed between terminal devices, the number of concurrently used terminal connections and the maximum number of connections exceeded, the detection of inappropriate time synchronization in the network, the detection of malformed / deformed protocol messages, and the detection of planned attacks against multiple systems. Active security sensing method for real-time security audit and abnormal symptoms detection of the digital substation, characterized in that it comprises at least one. The method of claim 12,
The terminal device health management information,
Audit log that stores connection or data transmission of unauthorized user based on authorized user list, invalid data, invalid data request, invalid control command detection, etc. in terminal device application, CPU and memory of terminal At least one of resource status (Sudden increase detection), stopping and restarting of the terminal device, stopping and restarting an application, minimum and maximum idle timeouts, and actual idle time for a specific time period. Active Security Sensing Method for Real-time Security Audit and Anomaly Detection of Digital Substation. 12. The method of claim 11,
The final determination of the abnormal symptoms and the learning and detection of the traffic patterns include suspicious observation of abnormal symptoms using a database. Active security for real-time security audit and abnormal symptom detection of a digital substation. Sensing method. 12. The method of claim 11,
When extracting state information and first NSM object data from the intelligent electronic equipment and second NSM object data from the HMI system and the intelligent electronic equipment,
The intelligent electronic device objects included in the intelligent electronic device corresponding to the first NSM object data and the second NSM object data to be extracted from the intelligent electronic device are grouped into a data group using a DataSet function included in an abstract communication service interface. step; And
Extraction is performed by transmitting the data group to the active security sensing device by using the GetDataSetValue function of the abstract communication service interface. The active security sensing method for real-time security auditing and abnormal symptom detection of a digital substation. . 19. The method of claim 18,
When updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and intelligent electronic equipment, the Report function included in the abstract communication service interface, characterized in that Active security sensing method for real-time security audit and anomaly detection. 19. The method of claim 18,
When updating the state information, the first NSM object data and the second NSM object data extracted from at least one of the HMI system and intelligent electronic equipment, receiving the EEHealth data object from the intelligent electronic equipment to update the corresponding data Active security sensing method for real-time security audit and abnormal symptom detection of digital substation.

Images