CN104125084A

CN104125084A - Intelligent network security incident visualization system for substation

Info

Publication number: CN104125084A
Application number: CN201310147469.3A
Authority: CN
Inventors: 郭余维
Original assignee: JIANGSU HUAWEI ELECTRIC POWER TECHNOLOGY Co Ltd
Current assignee: JIANGSU HUAWEI ELECTRIC POWER TECHNOLOGY Co Ltd
Priority date: 2013-04-25
Filing date: 2013-04-25
Publication date: 2014-10-29

Abstract

The invention relates to an intelligent network security incident visualization system for a substation. The system is composed of a data acquisition module, a clustering module of topological data, a stress layout control module, an optimization module of network topology, a visualization module and a coordinate mapping module of abnormal data. By the technology, security of an intelligent network of a substation can be greatly enhanced.

Description

Intelligent substation network security incident visualization system

Technical field

The present invention relates to network security incident visualization technical field, refer in particular to a kind of intelligent substation network security incident visualization system.

Background technology

At present, intelligent error preventing block sytem is very extensive in the station application of the dispensing power plant such as power plant or power station, develop also rapider, although the product of each producer respectively has its characteristic, but the technological means of general principle and employing is roughly the same, device is mainly made up of Intelligent simulation screen, industrial computer, computer key and various number.By simulation examination operation on Intelligent simulation screen, by logic rules pre-stored in industrial computer and state, every step is operated and judged, and by serial line interface communication, operating procedure is inputted in computer key, then open by computer key the puzzle lock being loaded on on-the-spot relevant device, carry out grid switching operation.That the superiority of this kind of error proof locking system of microcomputer is is easy to operate, it is simple to safeguard, dependable performance, cost are relatively low, but due to its critical piece computer key can not with other part real-time exchange data in field apparatus and system, and its anti-error function and scope are extremely restricted, cannot meet anti-error needs when prerun of accident conditions and maintenance and have no alternative but use the emergency release without any anti-error function, move and bring very big hidden danger to electric power safety.

There is a kind of technical scheme, on computer key, be provided with wireless communication module, be connected by INTERNET with server, carry out in real time swap data, although can solve the problems of the technologies described above, but also have to see, because Internet is an open system, its potential safety problem produces and has a strong impact on the applications of computer network.Existing intruding detection system is just submitted warning message with the form of record to keeper simply, and keeper is difficult to draw the current abnormal distribution situation of network from uninteresting record.Especially for the distributed attack of current large scale network, grasp the spatial distribution state of security incident from macroscopic view, formulate effective emergency response strategy for network manager and will provide strong macroscopic view foundation.

For this reason, a kind of system of defense based on active measurement and abnormality detection technology is proposed, this system utilization initiatively measures the physical connection situation of network, according to this information, abnormality detection is visited to the warning message that point submits to and carries out secondary analysis, finally with the form of scheming be presented in intuitively extremely distributing keeper in face of.

In said system, in order to show whole topological diagram, the subgraph after it must being cut apart is effectively organized, and the contact having between subgraph less, the contact that has is relatively tight, only has rational tissue and put them, just can better show whole topological diagram.And the analysis of network data is inseparable with the visual of network data, the visual of security incident is the important component part of large-scale network security macroscopic view early warning.

Summary of the invention

Object of the present invention, for overcoming above-mentioned defect, provides a kind of intelligent substation network security incident visualization system, has greatly strengthened network security.

For achieving the above object, adopt following structure:

A kind of intelligent substation network security incident visualization system, coordinate mapping module by optimization module, visualization model and the abnormal data of the sub-clustering module of data acquisition module, topological data, stressed layout control module, network topological diagram forms, wherein:

Data acquisition module, for initiatively measuring the physical connection situation that obtains live network, thereby obtains network bottom layer router topological connection relation data, simultaneously, obtains abnormal data and whois location library information, forms network topological diagram;

The sub-clustering module of topological data for the topological data of acquisition is carried out to sub-clustering processing, and is the unique mark of central dispense of each bunch;

The coordinate mapping module of abnormal data, carry out sub-clustering network topological diagram afterwards for the coordinate of the abnormal data of acquisition being mapped to the sub-clustering module of topological data, and point corresponding anomalous event is indicated, obtain the network topological diagram that is labeled with anomalous event;

The optimization module of network topological diagram, for the network topological diagram that is labeled with anomalous event being divided to the topological diagram obtaining after optimizing, making can be even between each bunch;

Stressed layout control module, puts according to the principle of stress balance for the network topological diagram that the optimization resume module through network topological diagram is obtained, and obtains the topological diagram after layout;

Visualization model, for being undertaken visual by the topological diagram after layout.

Beneficial effect: greatly increase the fail safe of intelligent substation network.

Brief description of the drawings

Fig. 1, intelligent substation network security incident visualization system each several part module map of the present invention.

Embodiment

In conjunction with Fig. 1, a kind of intelligent substation network security incident visualization system, it is characterized in that, it is made up of the coordinate mapping module 3 of optimization module 4, visualization model 6 and the abnormal data of the sub-clustering module 2 of data acquisition module 1, topological data, stressed layout control module 5, network topological diagram, wherein:

Data acquisition module 1, for initiatively measuring the physical connection situation that obtains live network, thereby obtains network bottom layer router topological connection relation data, simultaneously, obtains abnormal data and whois location library information, forms network topological diagram;

The sub-clustering module 2 of topological data for the topological data of acquisition is carried out to sub-clustering processing, and is the unique mark of central dispense of each bunch;

The coordinate mapping module 3 of abnormal data, carry out sub-clustering network topological diagram afterwards for the coordinate of the abnormal data of acquisition being mapped to the sub-clustering module 2 of topological data, and point corresponding anomalous event is indicated, obtain the network topological diagram that is labeled with anomalous event;

The optimization module 4 of network topological diagram, for the network topological diagram that is labeled with anomalous event being divided to the topological diagram obtaining after optimizing, making can be even between each bunch;

Stressed layout control module 5, for the network topological diagram of processing acquisition through the optimization module 4 of network topological diagram is put according to the principle of stress balance, obtains the topological diagram after layout;

Visualization model 6, for being undertaken visual by the topological diagram after layout.

Claims

1. an intelligent substation network security incident visualization system, it is characterized in that, it is made up of the coordinate mapping module (3) of optimization module (4), visualization model (6) and the abnormal data of the sub-clustering module (2) of data acquisition module (1), topological data, stressed layout control module (5), network topological diagram, wherein:

Data acquisition module (1), for initiatively measuring the physical connection situation that obtains live network, thereby obtains network bottom layer router topological connection relation data, simultaneously, obtains abnormal data and whois location library information, forms network topological diagram;

The sub-clustering module (2) of topological data for the topological data of acquisition is carried out to sub-clustering processing, and is the unique mark of central dispense of each bunch;

The coordinate mapping module (3) of abnormal data, carry out sub-clustering network topological diagram afterwards for the coordinate of the abnormal data of acquisition being mapped to the sub-clustering module (2) of topological data, and point corresponding anomalous event is indicated, obtain the network topological diagram that is labeled with anomalous event;

The optimization module (4) of network topological diagram, for the network topological diagram that is labeled with anomalous event being divided to the topological diagram obtaining after optimizing, making can be even between each bunch;

Stressed layout control module (5), puts according to the principle of stress balance for the optimization module (4) through network topological diagram is processed to the network topological diagram obtaining, and obtains the topological diagram after layout;

Visualization model (6), for being undertaken visual by the topological diagram after layout.