CN109066981B - Information security monitoring method for medium voltage distribution network - Google Patents
Information security monitoring method for medium voltage distribution network Download PDFInfo
- Publication number
- CN109066981B CN109066981B CN201810962229.1A CN201810962229A CN109066981B CN 109066981 B CN109066981 B CN 109066981B CN 201810962229 A CN201810962229 A CN 201810962229A CN 109066981 B CN109066981 B CN 109066981B
- Authority
- CN
- China
- Prior art keywords
- distribution network
- medium
- voltage distribution
- information
- probability
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 71
- 238000000034 method Methods 0.000 title claims abstract description 19
- 238000004891 communication Methods 0.000 claims abstract description 17
- 238000004458 analytical method Methods 0.000 claims abstract description 15
- 230000008447 perception Effects 0.000 claims description 9
- 230000002159 abnormal effect Effects 0.000 claims description 8
- 238000010586 diagram Methods 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000002955 isolation Methods 0.000 description 1
Images
Classifications
-
- H02J13/0006—
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J2203/00—Indexing scheme relating to details of circuit arrangements for AC mains or AC distribution networks
- H02J2203/20—Simulating, e g planning, reliability check, modelling or computer assisted design [CAD]
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Remote Monitoring And Control Of Power-Distribution Networks (AREA)
Abstract
本发明公开了一种用于中压配电网的信息安全监测方法，包括采集中压配电网终端的通信数据信息；构建中压配电网终端的态势感知分析概率模型并对中压配电网的信息安全状态进行监测；监测信息上报主站并完成中压配电网的信息安全监测。本发明提供的这种用于中压配电网的信息安全监测方法，通过主动获取和充分考虑配网主站监测到的配网终端通信流量的数据统计和接入频次特性，通过采集获取配网主站的监测配电终端的数据信息，构建配网终端的流量和接入频次态势感知分析模型，提高了中压配电网终端信息安全监测的有效性。
The invention discloses an information security monitoring method for a medium-voltage distribution network, which includes collecting communication data information of a medium-voltage distribution network terminal; The information security status of the power grid is monitored; the monitoring information is reported to the main station and the information security monitoring of the medium voltage distribution network is completed. The information security monitoring method for the medium-voltage distribution network provided by the present invention obtains and fully considers the data statistics and access frequency characteristics of the communication flow of the distribution network terminals monitored by the distribution network master station, and obtains the distribution network by collecting and obtaining the distribution network. The main station of the network monitors the data information of the distribution terminals, and builds a situational awareness analysis model for the flow and access frequency of the distribution network terminals, which improves the effectiveness of the information security monitoring of the medium-voltage distribution network terminals.
Description
Technical Field
The invention particularly relates to an information safety monitoring method for a medium-voltage distribution network.
Background
With the development of economic technology and the improvement of living standard of people, electric energy becomes essential secondary energy in production and life of people, and brings endless convenience to production and life of people.
The communication information safety of the medium-voltage distribution network is one of the preconditions for the normal operation of the distribution network. The information security attack incident to medium voltage distribution network is increasingly frequent, and the safety protection equipment is relatively isolated, and the phenomenon of safe isolated island is outstanding. The harm of malicious network attack to the power distribution network is serious, which may cause the data leakage of the power distribution network terminal, and even may cause social harm such as large-area power failure.
In the existing communication information security strategy of the medium-voltage distribution network, most of the strategies are focused on setting physical isolation or adopting an encryption authentication system and the like. However, at present, the communication information security strategy for the medium voltage distribution network is passive, that is, the external attack event to the medium voltage distribution network communication is invalidated through enhancing the confidentiality and the tolerance of the strategy. However, it is obvious that the current security policy is very passive, and the protection capability against unknown attack events is obviously insufficient, so that the communication information security of the medium-voltage distribution network still bears huge risks.
Disclosure of Invention
The invention aims to provide an information safety monitoring method for a medium-voltage distribution network, which realizes the active monitoring of the communication information safety of the medium-voltage distribution network by actively sensing the communication information data volume of the medium-voltage distribution network.
The invention provides an information safety monitoring method for a medium-voltage distribution network, which comprises the following steps:
s1, collecting communication data information of a medium-voltage distribution network terminal;
s2, constructing a situation awareness analysis probability model of the medium-voltage power distribution network terminal according to the communication data information collected in the step S1;
s3, monitoring the information safety state of the medium-voltage distribution network by adopting the situation perception analysis probability model obtained in the step S2;
and S4, reporting the monitoring information obtained in the step S3 to the main station, thereby completing the information safety monitoring of the medium voltage distribution network.
Step S1 is to collect communication data information of the medium voltage distribution network terminal, specifically to collect traffic and frequency data information of the medium voltage distribution network terminal.
The method comprises the steps of collecting flow and frequency data information of a medium-voltage distribution network terminal, specifically, collecting flow data and access frequency of each monitoring period in a counting period by taking the first N monitoring periods of the current monitoring period as the counting period, so as to obtain a flow sequence { x (i) } and a frequency sequence { y (i) } in the counting period; wherein x (i) is the flow data of the ith monitoring period in the counting period, and y (i) is the frequency data of the ith monitoring period in each stage in the counting period.
Step S2, constructing a situation awareness analysis probability model of the medium voltage distribution network terminal, specifically constructing the model by adopting the following steps:
a. the mathematical expectation λ of the flow rate sequence { x (i) } obtained in step S1 is calculatedxAnd constructing a Poisson parameter of λxA poisson probability distribution model of (a);
b. calculating the mathematical expectation λ of the flow rate sequence { y (i) } obtained in step S1yAnd constructing a Poisson parameter of λyA poisson probability distribution model of (a);
c. constructing a situation perception analysis probability model p (x, y) ═ p (x) × p (y) of the medium-voltage distribution network terminal, wherein p (x) is flow probability density, and the value of p (x) is Poisson parameter lambdaxThe probability density of the poisson probability distribution model of (1); p (y) is the frequency probability density with a Poisson parameter of λyThe poisson probability distribution model probability density.
Step S3, monitoring the information security state of the medium voltage distribution network, specifically, monitoring by using the following steps:
(1) setting a flow safety coefficient alpha, a frequency safety coefficient beta and a safety threshold gamma;
(2) in the space of a situation perception analysis probability model of a medium-voltage distribution network terminal, a two-dimensional area S is defined by taking a flow variable as an x axis and a frequency variable as a y axis, wherein the range of the area S is defined by a straight line x ═ 1-alpha lambdax、x＝(1+α)λx、y＝(1-β)λyAnd y ═ 1+ β) λyThe enclosed area;
(3) acquiring flow data x of medium-voltage distribution network terminal in current monitoring period0Sum frequency data y0；
(4) And (3) judging the information safety state of the current monitoring period by adopting the following rules:
r1. if point (x)0,y0) If the current monitoring period is not in the region S, judging that the information safety state of the current monitoring period is abnormal;
r2. if point (x)0,y0) In the region S, the information security probability of the current monitoring period is calculated according to the following formula:
and if P (x)0,y0) If the current monitoring period is more than or equal to gamma, judging the information safety of the current monitoring period to be normal; if P (x)0,y0) If the current monitoring period is less than gamma, the information safety state of the current monitoring period is judged to be abnormal.
According to the information safety monitoring method for the medium-voltage distribution network, provided by the invention, the data statistics and the access frequency characteristic of the communication flow of the distribution network terminal monitored by the distribution network main station are actively obtained and fully considered, and the data information of the monitoring distribution terminal of the distribution network main station is acquired and obtained, so that a sensing analysis model of the flow and the access frequency situation of the distribution network terminal is constructed, and the effectiveness of information safety monitoring of the medium-voltage distribution network terminal is improved.
Drawings
FIG. 1 is a process flow diagram of the process of the present invention.
Fig. 2 is a schematic diagram of a two-dimensional region S constructed by the method of the present invention.
Detailed Description
FIG. 1 shows a flow chart of the method of the present invention: the invention provides an information safety monitoring method for a medium-voltage distribution network, which comprises the following steps:
s1, collecting communication data information of a medium-voltage power distribution network terminal, specifically collecting flow and frequency data information of the medium-voltage power distribution network terminal; in the acquisition process, the first N (10-15 suggested values) monitoring periods of the current monitoring period are taken as statistical periods, and the flow data and the access frequency of each monitoring period in the statistical periods are acquired, so that a flow sequence { x (i) } and a frequency sequence { y (i) } in the statistical periods are obtained; wherein x (i) is the flow data of the ith monitoring period in the statistical period, and y (i) is the frequency data of the ith monitoring period in each stage in the statistical period;
s2, constructing a situation awareness analysis probability model of the medium-voltage power distribution network terminal according to the communication data information collected in the step S1; specifically, the model is constructed by adopting the following steps:
a. the mathematical expectation λ of the flow rate sequence { x (i) } obtained in step S1 is calculatedxAnd constructing a Poisson parameter of λxA poisson probability distribution model of (a);
b. calculating the mathematical expectation λ of the flow rate sequence { y (i) } obtained in step S1yAnd constructing a Poisson parameter of λyA poisson probability distribution model of (a);
c. constructing a situation perception analysis probability model p (x, y) ═ p (x) × p (y) of the medium-voltage distribution network terminal, wherein p (x) is flow probability density, and the value of p (x) is Poisson parameter lambdaxThe probability density of the poisson probability distribution model of (1); p (y) is the frequency probability density with a Poisson parameter of λyThe probability density of the poisson probability distribution model;
s3, monitoring the information safety state of the medium-voltage distribution network by adopting the situation perception analysis probability model obtained in the step S2; the method specifically comprises the following steps of:
(1) setting a flow safety coefficient alpha, a frequency safety coefficient beta and a safety threshold gamma, wherein the value range of the safety coefficient alpha is 0-1, the value range of the frequency safety coefficient beta is 0-1, and the value range of the proposed safety threshold gamma is 4% -8%;
(2) in the space of a situation perception analysis probability model of a medium-voltage distribution network terminal, a two-dimensional area S is defined by taking a flow variable as an x axis and a frequency variable as a y axis, wherein the range of the area S is defined by a straight line x ═ 1-alpha lambdax、x＝(1+α)λx、y＝(1-β)λyAnd y ═ 1+ β) λyThe enclosed area; the schematic diagram of the region S is shown in fig. 2;
(3) acquiring flow data x of medium-voltage distribution network terminal in current monitoring period0Sum frequency data y0；
(4) And (3) judging the information safety state of the current monitoring period by adopting the following rules:
r1. if point (x)0,y0) If the current monitoring period is not in the region S, judging that the information safety state of the current monitoring period is abnormal;
r2. if point (x)0,y0) In the region S, the information security probability of the current monitoring period is calculated according to the following formula:
and if P (x)0,y0) If the current monitoring period is more than or equal to gamma, judging the information safety of the current monitoring period to be normal; if P (x)0,y0) If the current monitoring period is less than gamma, judging the information safety state of the current monitoring period to be abnormal;
the above calculation step is a calculation point (x)0,y0) The information safety probability corresponding to the shadow part in the region where the shadow part falls;
in the examples, α is 0.2, β is 0.2, γ is 8%, and λ is takenx＝λyIf 100, the safety range S is S { (x, y) | x ∈ [80,120 { (x, y) | x ∈ { (x, y) |],y∈[80,120]When the judgment is carried out, two specific situations are adopted: in the monitoring period, if the monitored information security parameter flow time sequence x (i) of the distribution network terminal at the current time is 60, the monitored frequency time sequence y (i) is 80 times/S, and the terminal is not in the security region S, the terminal is identifiedThe information security is in an abnormal state; in the monitoring period, the monitored information security parameter flow time sequence x (i) of the distribution network terminal at the current time is 90bps, and the frequency time sequence y (i) is 90 times/S, and in the security region S, the information security reconfirmation state is entered, and the joint probability value P (x, y) of the joint probability density function P (x, y) of the flow and the frequency is calculated through a formula. If P (x, y) is not less than 0.08, the terminal information safety is identified to be in a normal state, otherwise, the terminal information safety is identified to be in an abnormal state;
and S4, reporting the monitoring information obtained in the step S3 to the main station, thereby completing the information safety monitoring of the medium voltage distribution network.
Claims (2)
1. An information safety monitoring method for a medium-voltage distribution network comprises the following steps:
s1, collecting communication data information of a medium-voltage distribution network terminal; specifically, the method comprises the steps of collecting flow and frequency data information of a medium-voltage distribution network terminal; collecting flow data and access frequency of each monitoring period in the counting period by taking the first N monitoring periods of the current monitoring period as the counting period, thereby obtaining a flow sequence { x (i) } and a frequency sequence { y (i) } in the counting period; wherein x (i) is the flow data of the ith monitoring period in the statistical period, and y (i) is the frequency data of the ith monitoring period in each stage in the statistical period;
s2, constructing a situation awareness analysis probability model of the medium-voltage power distribution network terminal according to the communication data information collected in the step S1; specifically, the model is constructed by adopting the following steps:
a. the mathematical expectation λ of the flow rate sequence { x (i) } obtained in step S1 is calculatedxAnd constructing a Poisson parameter of λxA poisson probability distribution model of (a);
b. calculating the mathematical expectation λ of the frequency sequence { y (i) } obtained in step S1yAnd constructing a Poisson parameter of λyA poisson probability distribution model of (a);
c. constructing a situation perception analysis probability model p (x, y) ═ p (x) × p (y) of the medium-voltage distribution network terminal, wherein p (x) is flow probability density, and the value of p (x) is Poisson parameter lambdaxThe probability density of the poisson probability distribution model of (1); p (y) is the frequency probability density,having a Poisson parameter of λyThe probability density of the poisson probability distribution model;
s3, monitoring the information safety state of the medium-voltage distribution network by adopting the situation perception analysis probability model obtained in the step S2;
and S4, reporting the monitoring information obtained in the step S3 to the main station, thereby completing the information safety monitoring of the medium voltage distribution network.
2. The information safety monitoring method for the medium voltage distribution network according to claim 1, wherein the step S3 of monitoring the information safety state of the medium voltage distribution network specifically comprises the following steps:
(1) setting a flow safety coefficient alpha, a frequency safety coefficient beta and a safety threshold gamma;
(2) in the space of a situation perception analysis probability model of a medium-voltage distribution network terminal, a two-dimensional area S is defined by taking a flow variable as an x axis and a frequency variable as a y axis, wherein the range of the area S is defined by a straight line x ═ 1-alpha lambdax、x＝(1+α)λx、y＝(1-β)λyAnd y ═ 1+ β) λyThe enclosed area;
(3) acquiring flow data x of medium-voltage distribution network terminal in current monitoring period0Sum frequency data y0；
(4) And (3) judging the information safety state of the current monitoring period by adopting the following rules:
r1. if point (x)0,y0) If the current monitoring period is not in the region S, judging that the information safety state of the current monitoring period is abnormal;
r2. if point (x)0,y0) In the region S, the information security probability of the current monitoring period is calculated according to the following formula:
and if P (x)0,y0) If the current monitoring period is more than or equal to gamma, judging the information safety of the current monitoring period to be normal; if P (x)0,y0) If < gamma, the current monitor is determinedAnd measuring the information safety state of the cycle as abnormal.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810962229.1A CN109066981B (en) | 2018-08-22 | 2018-08-22 | Information security monitoring method for medium voltage distribution network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810962229.1A CN109066981B (en) | 2018-08-22 | 2018-08-22 | Information security monitoring method for medium voltage distribution network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109066981A CN109066981A (en) | 2018-12-21 |
| CN109066981B true CN109066981B (en) | 2021-08-17 |
Family
ID=64687950
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810962229.1A Active CN109066981B (en) | 2018-08-22 | 2018-08-22 | Information security monitoring method for medium voltage distribution network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109066981B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110765421B (en) * | 2019-10-22 | 2023-05-23 | 南方电网科学研究院有限责任公司 | Verification method, device, equipment and storage medium for operation parameters of power distribution network |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103501293A (en) * | 2013-09-25 | 2014-01-08 | 国网重庆市电力公司 | Authentication method of terminal credible access in smart power grid |
| CN106027288A (en) * | 2016-05-10 | 2016-10-12 | 华北电力大学 | Communication traffic prediction method for distribution line information monitoring service |
| CN107834703A (en) * | 2017-11-21 | 2018-03-23 | 武汉精伦电气有限公司 | A kind of intelligent grid power distribution room monitoring management system and method |
-
2018
- 2018-08-22 CN CN201810962229.1A patent/CN109066981B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103501293A (en) * | 2013-09-25 | 2014-01-08 | 国网重庆市电力公司 | Authentication method of terminal credible access in smart power grid |
| CN106027288A (en) * | 2016-05-10 | 2016-10-12 | 华北电力大学 | Communication traffic prediction method for distribution line information monitoring service |
| CN107834703A (en) * | 2017-11-21 | 2018-03-23 | 武汉精伦电气有限公司 | A kind of intelligent grid power distribution room monitoring management system and method |
Non-Patent Citations (1)
| Title |
|---|
| 基于主动配电系统供电能力的安全态势感知方法;黄伟等;《电力自动化设备》;20170831;第37卷(第8期);74-79 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109066981A (en) | 2018-12-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107204876B (en) | Network security risk assessment method | |
| CN105868629B (en) | Security threat situation assessment method suitable for electric power information physical system | |
| CN103634296B (en) | Intelligent electricity network attack detection method based on physical system and information network abnormal data merging | |
| CN109767352B (en) | A Security Situation Assessment Method for Power Cyber-Physical Fusion System | |
| Efstathopoulos et al. | Operational data based intrusion detection system for smart grid | |
| CN109861825B (en) | Internal attack detection method based on weighted rules and consistency in CPS system | |
| Deng et al. | A quantitative risk assessment model for distribution cyber-physical system under cyberattack | |
| CN110942137A (en) | Power grid information operation and maintenance monitoring method based on deep learning | |
| CN107708173A (en) | The choosing method and device of aggregators | |
| CN113902300B (en) | Smart grid control system risk assessment method considering topological structure | |
| CN110458463A (en) | A security assessment method for power Internet of things based on interval intuitionistic fuzzy decision-making | |
| CN105515888A (en) | Intelligent substation communication network anomaly detection method based on multi-dimensional entropy sequence classification | |
| CN109066981B (en) | Information security monitoring method for medium voltage distribution network | |
| CN107767014A (en) | A kind of power information physical system security risk assessment and defence resource allocation methods | |
| CN112398693A (en) | Assessment method for safety protection capability of power Internet of things sensing layer | |
| CN117579388B (en) | Risk assessment methods, systems, equipment and media for intelligent networked industrial control systems | |
| Presekal et al. | Cyber forensic analysis for operational technology using graph-based deep learning | |
| CN116736781B (en) | A safety status monitoring method and device for industrial automation control equipment | |
| CN202798762U (en) | Alarm device for power communication failure information analysis | |
| CN118095823A (en) | A factor-correlated security risk assessment method for power Internet of Things | |
| CN117521084A (en) | Active safety early warning method for complex system | |
| Liang et al. | Anomaly detection based on edge computing framework for AMI | |
| CN111447168B (en) | Multidimensional network security prediction method | |
| Bhattacharjee et al. | Vulnerability characterization and privacy quantification for cyber-physical systems | |
| CN112672301B (en) | Network data aggregation method for wireless sensor |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |