CN114513342B - Intelligent substation communication data safety monitoring method and system - Google Patents

Abstract

The invention discloses a communication data security monitoring method and system of an intelligent substation. The method includes: generating a data security monitoring rule configuration file, a security monitoring policy configuration file, and a switch forwarding configuration file based on the substation-wide SCD configuration file and safety requirements; Send the data security monitoring rule configuration file and the security monitoring policy configuration file to the security monitoring device, and send the security monitoring policy configuration file and the switch forwarding configuration file to the substation network switch; in response to receiving from the security monitoring device and the substation network switch The security event information sent by it is used for alarm display, information recording, processing and control. The invention generates safety monitoring basis through the SCD configuration information of the whole station, performs safety monitoring and inspection on communication data in real time, and performs safety event control and alarm, improves the communication network security of the smart substation, and ensures the reliable and stable operation of the protection control and automatic monitoring system of the smart substation .

Description

A method and system for monitoring communication data security of smart substation

Technical Field

The present invention relates to the technical field of power system automation control and network communication, and in particular to a method and system for securely monitoring communication data of an intelligent substation.

Background Art

With the gradual promotion of smart substation technology, the monitoring system based on networked data information transmission is gradually replacing the traditional mode based on hard connection of secondary cables. At present, the smart substation network is logically composed of the station control layer network, the bay layer network and the process layer network, and is physically configured with two layers, namely the station control layer and the process layer. The automation equipment in the station is uniformly modeled according to the IEC61850 standard, and the unified data interface model defined by IEC61850 is applied to realize information sharing and interaction through the station control layer MMS (Manufacturing Message Specification) network switching equipment and the process layer GOOSE (Generic Object Oriented Substation Event) and SV (Sampled Value) network switching equipment. However, the business messages in the current smart substation are in plain text transmission, and there is no deployment of network attacks and attack protection in the station communication.

With the emergence of a severe network security situation, substations play an important role in power grid security, and it is necessary to conduct security monitoring and security protection of data communications within substations.

Summary of the invention

Purpose of the invention: In view of the deficiencies in the prior art, the present invention provides a smart substation communication data security monitoring system and method to achieve security monitoring and security protection of data communications within the substation.

Technical solution: In order to achieve the above-mentioned invention object, the present invention adopts the following technical solution:

A method for monitoring communication data security of a smart substation comprises the following steps:

Generate data security monitoring rule configuration file, security monitoring policy configuration file and switch forwarding configuration file based on the substation-wide SCD configuration file and security requirements;

Send the data security monitoring rule configuration file and the security monitoring policy configuration file to the security monitoring device, and send the security monitoring policy configuration file and the switch forwarding configuration file to the substation network switch;

In response to receiving security event information sent from the security monitoring device and the substation network switch, the security event information is displayed as an alarm and recorded, wherein the security event information sent by the security monitoring device is the security event that the security monitoring device monitors the business data packets on the network in real time according to the data security monitoring rule configuration information, and performs data packet monitoring, processing and reporting according to the configured security monitoring strategy; the security event information sent by the substation network switch is the security event that the substation network switch monitors the network access device status, physical link status, data flow information in real time according to the security monitoring policy configuration information and the switch forwarding configuration information, and processes and reports according to the security monitoring policy configuration information.

Preferably, the method for generating a data security monitoring rule configuration file includes:

Read the content of the SCD configuration file and read the security check parameters entered in the configuration interface, wherein the security check parameters include the service message check field, check depth, service message type range, and terminal device network parameters;

Based on the SCD configuration file, the terminal equipment network parameters are extracted, and based on the terminal equipment network parameters extracted by the SCD configuration file and the terminal equipment network parameters input in the configuration interface, the network parameters of all substation terminal equipment are extracted; based on the SCD configuration file, the IED device goose/sv service subscription relationship, the definition information of the service data item, and the service data sending cycle are extracted; based on the security check parameters input in the configuration interface, the security rule information is parsed, and the security rule information includes one or more of the following: service traffic bandwidth range, message check rules, terminal equipment access rules, network parameter range rules, layer 2 service application check rules, and layer 3 service application check rules;

A data security monitoring rule configuration file is generated based on the security rule information, network parameters of all substation terminal devices, goose/sv service subscription relationship of IED devices, definition information of business data items, and business data sending cycle. The content of the data security monitoring rule configuration file includes at least one of the following: substation business message description and message inspection strategy configuration.

Preferably, the method for generating a security monitoring policy configuration file includes:

Read the contents of the SCD configuration file and the security policy parameters entered in the configuration interface, including security events, merging parameters, security event reporting policies, and corresponding processing actions for abnormal and illegal events;

Based on the SCD configuration file, the goose/sv service subscription relationship of the IED device, the definition information of the service data item, the network connection relationship, and the terminal network parameters are extracted. Based on the security policy parameters input in the configuration interface, the security policy information is parsed. The security policy information includes one or more of the following: over-limit flow processing, abnormal message processing, illegal access device processing, illegal message processing, and illegal and abnormal message tracing;

A security monitoring policy configuration file is generated based on the security policy information and the IED device goose/sv service subscription relationship, the definition information of the service data items, the network connection relationship, and the terminal network parameters. The content of the security monitoring policy configuration file includes at least one of the following: alarm definition, event definition, alarm and event merging configuration, abnormal message processing policy configuration, traffic alarm threshold, over-limit traffic processing policy configuration, illegal access device processing policy configuration, illegal message processing policy configuration, and illegal and abnormal message tracing policy configuration.

Abnormal message processing strategies and over-limit traffic processing strategies include: alarm, discard, speed limit, forwarding, and recording; illegal access device processing strategies include: alarm, device information recording, and access port blocking; illegal message processing strategies include: alarm, discard, speed limit, redirection, and recording.

Preferably, the method for generating a switch forwarding configuration file includes:

Read the contents of the SCD configuration file and read the forwarding security parameters entered in the configuration interface, wherein the forwarding security parameters include forwarding security events and actions, and forwarding security event reporting conditions;

Based on the SCD configuration file, the goose/sv service subscription relationship, network connection relationship, and terminal network parameters of the IED device are extracted. Based on the forwarding security parameters entered in the configuration interface, the forwarding security policy information is parsed. The forwarding security policy information includes: traffic alarm policy, over-limit traffic processing policy, message exception processing policy, illegal access device processing policy, illegal message processing policy, and network topology change policy; among them, the over-limit traffic processing policy and message exception processing policy include: alarm, discard, speed limit, forwarding, and recording; the illegal access device processing policy includes: alarm, device information recording, and access port blocking; the illegal message processing policy includes: alarm, discard, speed limit, redirection, and recording;

A switch forwarding configuration file is generated according to the forwarding security policy information and the IED device goose/sv service subscription relationship, network connection relationship, and terminal network parameters. The switch forwarding configuration file includes at least one of the following: forwarding table configuration, forwarding table search exception policy configuration, business flow policy configuration, terminal information of interface connection, unknown traffic policy configuration, abnormal message policy configuration, and network topology change policy.

Preferably, the method for the security monitoring device to report security incidents includes: the security monitoring device detects the substation business message according to the rules of the data security monitoring rule configuration file, and when the substation's Layer 2 business message MAC address, business application serial number, and business message data item do not meet the Layer 2 business inspection configuration rules, it is an illegal message; when the substation's Layer 3 business message MAC address, IP address, port number, and business message data item do not meet the Layer 3 business inspection configuration rules, it is an illegal message, and alarm display and information recording are performed according to the security monitoring policy configuration file, wherein the Layer 2 business inspection configuration rules include a legal MAC address, a multicast MAC address configured by SCD, a legal business application serial number, the correspondence between multicast MAC and business application serial number, a legal range of data items, and a legal message type; the Layer 3 business inspection configuration rules include message address anomalies, legal message addresses, legal port numbers, business message data item ranges, and legal message types.

Preferably, the method for reporting security incidents by a substation network switch includes: the substation network switch collects messages entering the interface in real time, forwards and filters the messages according to the switch forwarding configuration file; performs hardware statistics on the message traffic, and determines that a security incident has occurred when the message traffic exceeds the configured traffic threshold; when a terminal device is connected, it is determined as a security incident when the terminal information is not in the legal device list; when the network topology changes, it is determined as a security incident when the changed topology is not in the legal topology list; when an illegal message occurs, it is determined as a security incident; and the security incident that occurs is displayed as an alarm and information is recorded and processed according to the security monitoring policy configuration file.

Preferably, the method further includes: in response to receiving security event information sent from the security monitoring device and the substation network switch, issuing security policy instructions to the substation network switch, and the substation network switch executes security policy actions on the specified message data flow based on the issued security policy instructions, and the security policy actions include one or more of traffic suppression, discarding, record storage, and redirection.

The present invention also provides a smart substation communication data security monitoring system, comprising:

The safety monitoring main control system module is used to generate a data safety monitoring rule configuration file, a safety monitoring policy configuration file and a switch forwarding configuration file based on the substation-wide SCD configuration file and safety requirements, and to send the data safety monitoring rule configuration file and the safety monitoring policy configuration file to the safety monitoring device, and to send the safety monitoring policy configuration file and the switch forwarding configuration file to the substation network switch, and to respond to the safety event information sent from the safety monitoring device and the substation network switch, and to perform alarm display and information recording processing on the safety event information;

Security monitoring equipment, used to monitor business data packets on the network in real time according to the data security monitoring rule configuration information, and to monitor and process data packets and report security events according to the configured security monitoring strategy;

The substation network switch is used to monitor the network access device status, physical link status, and data flow information in real time according to the security monitoring policy configuration information and the switch forwarding configuration information, and to process and report security incidents according to the security monitoring policy configuration information.

The present invention also provides a computer device, comprising:

one or more processors;

Memory; and

One or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the smart substation communication data security monitoring method as described above are implemented.

The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the smart substation communication data security monitoring method as described above are implemented.

Beneficial effects: The present invention generates a security monitoring basis based on the whole station SCD configuration file and security requirements and extracted information, monitors the data legitimacy of the smart substation communication network in real time according to the security policy, and captures, records, traces and alarms illegal messages on the communication network in real time. Through network security monitoring equipment and substation network switches, it is possible to monitor substation communication service data messages, network terminal equipment access conditions, and network link operation conditions in real time, identify abnormal attack messages and abnormal network conditions, and handle exceptions according to security policies. The present invention has a promoting effect on improving the security of smart substation communication networks and ensuring the reliable and stable operation of smart substation protection control and automation monitoring systems.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a block diagram of a smart substation communication data security monitoring system according to an embodiment of the present invention;

FIG2 is a flow chart of configuration file generation in a method for secure monitoring of communication data in a smart substation according to an embodiment of the present invention.

DETAILED DESCRIPTION

The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

As shown in FIG1 , a smart substation communication data security monitoring system includes: a security monitoring main control system module, a security monitoring device, and a substation network switch. The security monitoring main control system module is deployed on the server host, and the security monitoring device and the substation network switch are connected through the MMS interface or the snmp management interface. The security monitoring device is a dedicated network message analysis device that receives and identifies data security monitoring rule configuration files and security monitoring policy configuration file information, and monitors all substation service messages in real time. All functions of the security monitoring device can also be deployed on the switch as a functional module. The security monitoring device is also called a security monitoring device, a network security monitoring device, or a network security monitoring device, which can be used interchangeably in the description of the present invention. The security monitoring device can be distributed according to different networking principles. For example, the security monitoring device can be deployed on the interface of the central switch, and all data streams of the process layer service message are directed to the security monitoring device through the multicast address, and the station control layer service message is copied and redirected to the security monitoring device through the switch. The security monitoring device can also be used as a network security monitoring function module of the substation switch, integrated on the substation switch device, and the switch realizes the network security monitoring device function of the smart substation communication data security monitoring system.

An independent security monitoring module runs on the substation network switch, which receives security policy instructions, security policy configuration and forwarding configuration information issued by the main control module; the substation network switch collects network monitoring information defined by the security policy in real time, including terminal access events, terminal equipment information, link status, link statistics and other information, and records and reports alarms for identified security events; it responds to security policy instructions and suppresses specified abnormal message data flows.

Substation service messages include MMS messages, GOOSE messages, and SV messages defined in IEC61850, but are not limited to IEC61850 messages.

The communication data security monitoring method based on the intelligent substation communication data security monitoring system comprises the following steps:

1) On the security monitoring main control system module, by loading the substation-wide SCD configuration file and setting security rule requirements, a data security monitoring rule configuration file, a security monitoring policy configuration file, and a switch forwarding configuration file are generated.

2) The security monitoring main control system module sends the security data monitoring rule configuration file, security monitoring policy configuration file, and switch forwarding configuration file to the substation switch. In this embodiment, the security monitoring device function is deployed on the switch as a functional module, and the switch implements the security monitoring device function;

3) The substation switch monitors the business data packets on the network in real time according to the data security monitoring rule configuration information, and monitors and processes the data packets and reports security events according to the configured security monitoring strategy; the substation network switch monitors the network access equipment status, physical link status, data flow information and other information in real time according to the security monitoring policy configuration information and switch forwarding configuration information, and processes and reports security events according to the security monitoring policy configuration information.

4) The substation security monitoring main control system module receives security event information sent by network security monitoring equipment and substation network switches, and performs alarm display, information recording and other processing on the security event information. The substation security monitoring main control system module sends protection strategies to the substation network switches, and the substation network switches execute security strategy actions on the designated illegal message data flows according to the security strategy instructions sent. The strategy actions include flow suppression, discarding, record storage, redirection, etc.

In an embodiment of the present invention, on the security monitoring main control system module, a data security monitoring rule configuration file, a security monitoring policy configuration file and a switch forwarding configuration file are generated through a configuration management tool based on the SCD configuration file of the entire site, the security regulations of user applications and the enterprise security specifications.

The content of the data security monitoring rule configuration file includes the description information of all business message data fields of the substation, the inspection range of message data fields, the depth of data message analysis inspection, the business message range and other rule configurations. As shown in Figure 2, on the security monitoring main control system module, load the whole station SCD configuration file, and set the business message inspection field, inspection depth, business message type range, terminal network parameters and other security inspection parameters in the configuration generation interface of the security monitoring main control system module. The configuration file generation function of the security monitoring main control system module extracts the terminal device network parameters from the SCD file and the terminal network parameters input by the configuration according to the content and configuration parameters of the SCD configuration file. The terminal network parameters include the device name, IP address, and MAC address; the SCD file is parsed to extract the IED device goose/sv business subscription relationship, the definition information of the business data item, and the business data sending cycle. The security policy information is parsed by the security inspection parameters input by the configuration. According to the intermediate data information extracted by the above analysis, the data security monitoring rule configuration file is generated after analysis and calculation. The content includes: substation business message description and message inspection policy configuration. The content and format of the data security monitoring rule configuration file are as follows, where! --The text at the beginning indicates a comment, which explains the meaning of this code segment:

The content of the security monitoring policy configuration file includes policy information such as security event merging configuration, security event sending configuration, abnormal message rules and action configuration, and security event recording configuration. As shown in Figure 2, on the security monitoring control system module, the same data security monitoring rule configuration file generation step is used. First, the entire station SCD configuration file is loaded, and security policy parameters such as security events, merging parameters, security event reporting strategies, and abnormal illegal event corresponding action processing are set in the security monitoring control system module configuration generation interface. The security monitoring main control system module configuration file generation function is based on the SCD configuration file content and configuration parameters. The SCD configuration file is parsed to extract the IED device goose/sv service subscription relationship, the definition information of the service data item, the network connection relationship, and the terminal network parameters. The security policy information is parsed according to the security policy parameters input by the configuration. According to the intermediate data information extracted by the above parsing, the security monitoring policy configuration file is generated after analysis and calculation. The main contents include: alarm definition, event definition, alarm and event merging configuration, abnormal handling strategy configuration, etc. The content and format of the security monitoring policy configuration file are as follows, where! The text at the beginning of -- indicates a comment, which is an explanation of the meaning of this code:

The switch forwarding configuration file includes configuration information such as the device MAC address information, the port information to which the device is connected, the multicast forwarding information, and the alarm setting information. Here, the device refers to the IED device connected to the switch. As shown in Figure 2, on the security monitoring main control system module, the same data security monitoring rule configuration file generation step is used. First, the entire station SCD configuration file is loaded, and the security policy parameters such as forwarding security event actions and forwarding security event reporting are set in the security monitoring main control system module configuration generation interface. The security monitoring main control system module configuration file generation function is based on the SCD configuration file content and configuration parameters. The SCD configuration file is parsed to extract the IED device goose/sv service subscription relationship, network connection relationship, and terminal network parameters. The security policy information is parsed according to the security policy parameters input by the configuration. According to the intermediate data information extracted by the above parsing, the switch forwarding configuration file is generated after analysis and calculation. The content includes: forwarding table and corresponding flow policy configuration, terminal information connected to the interface, unknown flow policy configuration, etc. The content and format of the switch forwarding configuration file are as follows, where! The text at the beginning of -- indicates a comment, which is an explanation of the meaning of this code:

The security monitoring main control system module sends the generated configuration file to the network security monitoring device and the substation network switch; the network security monitoring device monitors the substation network service message in real time according to the data security monitoring rule configuration and the security monitoring policy configuration, and reports the security incident. As mentioned above, the network security monitoring device is a dedicated network message analysis device or integrated into the substation switch as a functional module, receives and identifies the data security monitoring rule configuration file and the security monitoring policy configuration file information, monitors all substation service messages in real time, and after identifying the illegal message, records the message, discards it, issues an alarm, etc. according to the policy.

For example, when a network security monitoring device or a switch with integrated network security monitoring device function identifies that the source MAC address is not in the security configuration file, or the source/destination MAC is within the illegal address range specified in the security configuration file, it is an illegal message; when the appid in the goose/sv message is not in the configuration file, it is an illegal message; when the destination MAC and appid do not correspond, it is an illegal message, etc., after identifying the illegal message, it is handled according to the policy, such as recording, alarming, discarding, redirecting and forwarding the illegal message, blocking the physical link of the illegal message sending device, etc., which are corresponding policy actions. Illegal messages are identified according to the security monitoring rule configuration file, and the corresponding illegal message events are executed according to the security monitoring policy configuration file. Messages that trigger the rules in the security monitoring rule configuration file are illegal messages.

In an embodiment of the present invention, the security policy instructions, security policy configuration and forwarding configuration information are executed by the security monitoring module of the substation network switch. The independent security monitoring module running on the switch collects network monitoring information defined by the security policy in real time, including terminal access events, terminal equipment information, link status, link statistics and other information; records and reports alarms for identified security events; responds to security policy instructions, and performs policy actions on specified abnormal message data flows, and the policy actions include bandwidth limitation, message discarding, and message collection and recording.

The switch collects the messages entering the interface in real time, and the multi-core CPU on the switch parses and detects the collected messages according to the rules of the security monitoring rule configuration file. Any corresponding field in any rule that does not meet the configuration requirements is an illegal abnormal message; the switch hardware chip performs hardware statistics on the message traffic, and any message flow that exceeds the configured traffic threshold is one of the security events, including: abnormal traffic, service flow timeout interruption, terminal device access to the network, physical link abnormality, etc.; security events are known and can be classified and merged, and the corresponding processing strategy is set according to the event level. For example, terminal device access to the network is a high-level security event, which requires immediate alarm reporting and blocking of the device access port; physical link interruption is a high-level security event and requires immediate alarm reporting; service traffic bursts are based on the user-defined level, and the bursts exceeding the threshold are discarded and reported with an alarm, or only the exceeding threshold traffic is discarded without an alarm. The determination of policy actions is determined according to the network security requirements of users, enterprises, and industries.

In the implementation mode of the present invention, the security monitoring main control system module is integrated in the background monitoring system or the network security monitoring system; when the system is debugged and the SCD configuration is changed, the data security monitoring rules, security monitoring strategies and switch forwarding configurations are generated based on the SCD according to the safety regulations and safety technical specifications, and sent to the network security monitoring equipment and the switch, and the security configuration takes effect immediately and the monitoring operation is carried out. When the system is running, the security monitoring main control system module receives the security event information of the network security monitoring equipment and the substation network switch in real time, analyzes and processes the security event information, displays alarms in real time, and sends abnormal message suppression strategy instructions to the switch according to the processing results.

The process layer network required by the power grid company specification only allows goose/sv message transmission, but there are users who require that only whitelist (messages with forwarding tables) data be forwarded in the communication network, and other messages be discarded. In addition, DOS attack defense and illegal messages should also be filtered. However, there are currently no security specifications specifically for network transmission, and they are all interspersed in various specifications, such as power industry standards, enterprise standards, provincial companies or municipal company requirements. The present invention automatically parses and generates security monitoring basis through configuration management tools based on the SCD configuration file of the entire station, the security regulations of user applications and the enterprise security specifications, performs security monitoring and inspection on communication data in real time, and controls and warns the system master according to the security policy. The security of the communication network of the smart substation is improved, and the reliable and stable operation of the protection control and automatic monitoring system of the smart substation is guaranteed.

The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present invention is described with reference to the flowchart and/or block diagram of the method, device (system), and computer program product according to the embodiment of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims (10)

1. The intelligent substation communication data safety monitoring method is characterized by comprising the following steps of:

generating a data security monitoring rule configuration file, a security monitoring strategy configuration file and a switch forwarding configuration file based on the substation total station SCD configuration file and the security requirement;

the data security monitoring rule configuration file and the security monitoring strategy configuration file are issued to the security monitoring equipment, and the security monitoring strategy configuration file and the switch forwarding configuration file are issued to the transformer substation network switch;

responding to the received security event information sent from the security monitoring equipment and the substation network switch, carrying out alarm display and information recording processing on the security event information, wherein the security event information sent by the security monitoring equipment is a security event which is obtained by the security monitoring equipment and is obtained by carrying out real-time monitoring on service data messages on a network according to configuration information of data security monitoring rules and carrying out monitoring processing and reporting on the data messages according to the configured security monitoring strategies; the security event information sent by the substation network switch is security events which are processed and reported by the substation network switch according to the security monitoring policy configuration information and the switch forwarding configuration information, and the network access equipment condition, the physical link state and the data flow information are monitored in real time;

the method for generating the security monitoring policy configuration file comprises the following steps:

reading SCD configuration file content, and reading security policy parameters input by a configuration interface, wherein the security policy parameters comprise security events, merging parameters, security event reporting policies and processing actions corresponding to abnormal illegal events;

analyzing and extracting a goose/sv service subscription relation of IED equipment, definition information of service data items, a network connection relation and terminal network parameters based on an SCD configuration file, analyzing and extracting security policy information based on security policy parameters input by a configuration interface, wherein the security policy information comprises one or more of the following items: the method comprises the steps of ultra-limit flow processing, abnormal message processing, illegal access equipment processing, illegal message processing, illegal and abnormal message tracing;

generating a security monitoring policy configuration file according to the security policy information and the IED equipment goose/sv service subscription relationship, the definition information of service data items, the network connection relationship and the terminal network parameters, wherein the content of the security monitoring policy configuration file comprises at least one of the following: alarm definition, event definition, alarm and event merging configuration, abnormal message processing strategy configuration, flow alarm threshold value, overrun flow processing strategy configuration, illegal access equipment processing strategy configuration, illegal message tracing strategy configuration.

2. The intelligent substation communication data security monitoring method according to claim 1, wherein the method for generating the data security monitoring rule configuration file comprises the following steps:

reading SCD configuration file content, and reading security inspection parameters input by a configuration interface, wherein the security inspection parameters comprise a service message inspection field, inspection depth, a service message type range and terminal equipment network parameters;

extracting network parameters of terminal equipment based on the SCD configuration file analysis, and extracting network parameters of all substation terminal equipment based on the terminal equipment network parameters extracted by the SCD configuration file analysis and the terminal equipment network parameters input by the configuration interface; analyzing and extracting a goose/sv service subscription relation of IED equipment, definition information of service data items and a service data sending period based on the SCD configuration file; resolving security rule information based on security check parameters input by a configuration interface, wherein the security rule information comprises one or more of the following: service flow bandwidth range, message inspection rule, terminal equipment access rule, network parameter range rule, two-layer service application inspection rule and three-layer service application inspection rule;

generating a data security monitoring rule configuration file according to the security rule information, network parameters of all substation terminal equipment, a goose/sv service subscription relation of the IED equipment, definition information of service data items and a service data sending period, wherein the content of the data security monitoring rule configuration file comprises at least one of the following: and describing a substation service message and configuring a message checking strategy.

3. The intelligent substation communication data security monitoring method according to claim 1, wherein the abnormal message processing strategy and the overrun flow processing strategy comprise: alarming, discarding, limiting speed, forwarding and recording; the illegal access device processing strategy comprises the following steps: alarming, recording equipment information and blocking an access port; the illegal message processing strategy comprises the following steps: alert, discard, speed limit, redirect, record.

4. The intelligent substation communication data security monitoring method according to claim 1, wherein the method for generating the switch forwarding configuration file comprises the following steps:

reading SCD configuration file content, and reading forwarding security parameters input by a configuration interface, wherein the forwarding security parameters comprise forwarding security events, actions and forwarding security event reporting conditions;

analyzing and extracting a goose/sv service subscription relation, a network connection relation and terminal network parameters of IED equipment based on an SCD configuration file, analyzing and extracting forwarding security policy information based on forwarding security parameters input by a configuration interface, wherein the forwarding security policy information comprises: a flow alarm strategy, an overrun flow processing strategy, a message exception processing strategy, an illegal access equipment processing strategy, an illegal message processing strategy and a network topology change strategy; the over-limit flow processing strategy and the message exception processing strategy comprise the following steps: alarming, discarding, limiting speed, forwarding and recording; the illegal access device processing strategy comprises the following steps: alarming, recording equipment information and blocking an access port; the illegal message processing strategy comprises the following steps: alarming, discarding, limiting speed, redirecting and recording;

generating a switch forwarding configuration file according to the forwarding security policy information, the IED equipment goose/sv service subscription relationship, the network connection relationship and the terminal network parameter, wherein the switch forwarding configuration file comprises at least one of the following contents: forwarding table configuration, forwarding table searching abnormal strategy configuration, service flow strategy configuration, terminal information of interface connection, unknown flow strategy configuration, abnormal message strategy configuration and network topology changing strategy.

5. The intelligent substation communication data security monitoring method according to claim 1, wherein the method for reporting the security event by the security monitoring device comprises the following steps: the security monitoring equipment detects the service message of the transformer substation according to the rule of the data security monitoring rule configuration file, and the security monitoring equipment is an illegal message when the MAC address, the service application serial number and the service message data item of the second-layer service message of the transformer substation do not meet the second-layer service inspection configuration rule; when the MAC address, IP address, port number and service message data item of the three-layer service message of the transformer substation do not meet the three-layer service checking configuration rule, the three-layer service checking configuration rule is an illegal message, alarm display and information recording processing are carried out according to the security monitoring policy configuration file, wherein the two-layer service checking configuration rule comprises a legal MAC address, a multicast MAC address configured by SCD, a legal service application serial number, a corresponding relation of multicast MAC and service application serial number, a legal range of the data item and a legal message type; the three-layer service checking configuration rule comprises abnormal message address, legal port number, service message data item range and legal message type.

6. The intelligent substation communication data security monitoring method according to claim 1, wherein the method for reporting the security event by the substation network switch comprises the following steps: the network switch of the transformer substation collects the message entering the interface in real time, and forwards and filters the message according to the forwarding configuration file of the switch; carrying out hardware statistics on the message flow, and recognizing that a safety event occurs when the message flow exceeds a configured flow threshold; when the terminal equipment is accessed, the terminal information is not in the legal equipment list and is identified as a security event; when the network topology is changed, the changed topology is not identified as a security event when the legal topology list is changed; when illegal messages appear, the illegal messages are identified as security events; and the security event is displayed and recorded according to the security monitoring policy configuration file.

7. The intelligent substation communication data security monitoring method according to claim 1, further comprising: in response to receiving security event information uploaded from the security monitoring device and the substation network switch, issuing a security policy instruction to the substation network switch, the substation network switch performing security policy actions on the specified message data stream based on the issued security policy instruction, the security policy actions including one or more of traffic suppression, discarding, record storage, redirection.

8. An intelligent substation communication data security monitoring system, characterized by comprising:

the security monitoring master control system module is used for generating a data security monitoring rule configuration file, a security monitoring strategy configuration file and an exchanger forwarding configuration file based on the substation total station SCD configuration file and security requirements, issuing the data security monitoring rule configuration file and the security monitoring strategy configuration file to the security monitoring equipment, issuing the security monitoring strategy configuration file and the exchanger forwarding configuration file to the substation network exchanger, and carrying out alarm display and information recording processing on the security event information in response to receiving the security event information sent from the security monitoring equipment and the substation network exchanger;

the safety monitoring equipment is used for configuring information according to data safety monitoring rules to monitor service data messages on a network in real time, and carrying out data message monitoring processing and reporting safety events according to configured safety monitoring strategies;

the substation network switch is used for monitoring the condition of network access equipment, the physical link state and the data flow information in real time according to the security monitoring policy configuration information and the switch forwarding configuration information, processing security events according to the security monitoring policy configuration information and reporting the security events;

the method for generating the security monitoring policy configuration file comprises the following steps:

reading SCD configuration file content, and reading security policy parameters input by a configuration interface, wherein the security policy parameters comprise security events, merging parameters, security event reporting policies and processing actions corresponding to abnormal illegal events;

analyzing and extracting a goose/sv service subscription relation of IED equipment, definition information of service data items, a network connection relation and terminal network parameters based on an SCD configuration file, analyzing and extracting security policy information based on security policy parameters input by a configuration interface, wherein the security policy information comprises one or more of the following items: the method comprises the steps of ultra-limit flow processing, abnormal message processing, illegal access equipment processing, illegal message processing, illegal and abnormal message tracing;

generating a security monitoring policy configuration file according to the security policy information and the IED equipment goose/sv service subscription relationship, the definition information of service data items, the network connection relationship and the terminal network parameters, wherein the content of the security monitoring policy configuration file comprises at least one of the following: alarm definition, event definition, alarm and event merging configuration, abnormal message processing strategy configuration, flow alarm threshold value, overrun flow processing strategy configuration, illegal access equipment processing strategy configuration, illegal message tracing strategy configuration.

9. A computer device, comprising:

one or more processors;

a memory; and

one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, which when executed by the processor implement the steps of the intelligent substation communication data security monitoring method of any of claims 1-7.

10. A computer readable storage medium having stored thereon a computer program, wherein the computer program when executed by a processor implements the steps of the intelligent substation communication data security monitoring method according to any of claims 1-7.