CN114825607A - Attack behavior monitoring method and device for relay protection information processing system - Google Patents

Abstract

The invention discloses a method and device for monitoring the attack behavior of a relay protection information processing system. The flow data of the relay protection information processing system captured in real time is extracted from the application layer, and analyzed according to the IEC 60870-5-103 protocol. Secondly, the clock tampering attack detection is performed on the packets. Then perform malformed packet attack detection according to the requirements of the protocol. Finally, the normal behavior model of various system services is established, and the attack behavior detection at the application layer is performed on the system traffic data according to the normal behavior model. The invention overcomes the deficiencies that the existing attack behavior detection method of the relay protection information processing system focuses on the data analysis of the measurement point of the relay protection device and lacks the attack behavior detection for the flow data application layer message, and improves the relay protection information processing. The accuracy of system attack behavior detection.

Description

Method and device for monitoring attack behavior of relay protection information processing system

technical field

The invention relates to the technical field of power system information security, in particular to a method and device for monitoring attack behavior of a relay protection information processing system.

Background technique

With the continuous improvement of the level of substation automation and dispatching automation, the informatization and intelligence of the power system are gradually enhanced. The relay protection information processing system composed of relay protection device, safety automatic device and fault recorder has become an important part of the power system. The relay protection information processing system can collect the action information and operating status information of the relay protection device in real time, and conduct automatic and in-depth analysis of the action information of the protection device, so as to assist the power dispatcher to quickly judge the protection action behavior, perform fault location, and make make decisions and deal with accidents. Therefore, the reliable transmission and correct processing of relay protection information is of great significance to the safe and stable operation of the power system.

The relay protection information processing system adopts the IEC 60870-5-103 protocol for information transmission. Due to the lack of authentication mechanism, authorization mechanism, and lack of encryption mechanism in the design of the protocol itself, it is faced with theft, interception, and tampering of messages. and other network attacks. However, the existing network attack detection methods of the relay protection system focus on the data analysis of the measurement points of the relay protection device, which are prone to problems such as false positives and false negatives. detection. Therefore, it is urgent to invent a new method for monitoring attack behavior of relay protection information processing system, which can improve the accuracy of detecting attack behavior and enhance the network security defense capability of power system.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is to provide a method and device for monitoring the attack behavior of a relay protection information processing system in view of the deficiencies of the prior art, which effectively solves the problem that the existing detection method cannot perform the attack behavior at the application layer for the business of the relay protection system. The limitation of detection is improved, and the safety and reliability of the relay protection information processing system are improved.

In order to solve the above-mentioned technical problems, the technical solution adopted in the present invention is: a method for monitoring the attack behavior of a relay protection information processing system, comprising the following steps:

S1. Capture the flow data packets of the relay protection information processing system in real time, and extract the application layer message of the current frame flow data;

S2. Perform field-level parsing on the application layer packet;

S3. Perform clock tampering attack detection on the parsed packet. If the clock range, clock logic, clock synchronization, and clock delay of the packet do not conform to normal clock characteristics, it is determined that there is a clock tampering attack, otherwise, go to step S4;

S4. Perform malformed packet attack detection on the parsed packet. If the length field, type identifier, transmission reason, and information sequence number value of the packet do not meet the requirements of the protocol, it is determined that there is a malformed packet attack, otherwise, go to step S5;

S5. Perform attack detection on the parsed packet according to the service system to which the parsed packet belongs. If the parsed packet does not conform to the normal service model, it is determined that there is a business logic attack; otherwise, the current frame traffic data is determined to be normal flow.

The invention parses the application layer message of the flow data of the relay protection information processing system (the message is parsed according to the IEC60870-5-103 protocol), and performs clock tampering attack detection, malformed message attack detection, and detection on the parsed message. The business logic attack detection effectively solves the limitation that the existing detection methods cannot detect the attack behavior at the application layer for the business of the relay protection system, and improves the security and reliability of the relay protection information processing system.

In step S3, the specific implementation process of performing clock tampering attack detection on the parsed message includes:

Y_t表示时标年份，y_t表示时标的年份标识字节数值；1) Determine whether the formula Y _t ∈ [1970, 2069] holds, if not, it is determined as a clock tampering attack, otherwise, go to step 2); where,

Y _t represents the year of the time stamp, and y _t represents the byte value of the year of the time stamp;

是否成立，若否，则判定为时钟篡改攻击，否则，进入步骤3)；其中，

表示全称量词“任意”，P为步骤S2解析后的应用层报文，P_DS表示IEC60870-5-103对时报文，A_g(P)表示报文ASDU地址高8位的值，F表示16进制的15，H表示数值为16进制；2) Judgment formula

Whether it is established, if not, it is determined as a clock tampering attack, otherwise, go to step 3); wherein,

Indicates the universal quantifier "any", P is the application-layer packet parsed in step S2, P _DS refers to the IEC60870-5-103 synchronization packet, A _g (P) refers to the value of the upper 8 bits of the ASDU address of the packet, and F refers to 16 Base 15, H means the value is hexadecimal;

是否成立，若否，则判定为时钟篡改攻击，否则，进入步骤4)；其中，P_DZ表示IEC 60870-5-103告警、遥信变位、动作事件数据上送报文中的一种，T_js(P)表示事件子站接收时间，T_sj(P)表示事件实际发生时间；3) Judgment formula

Whether it is established, if not, it is determined to be a clock tampering attack, otherwise, go to step 4); wherein, P _DZ represents one of the IEC 60870-5-103 alarm, remote signaling, and action event data upload message, T _js (P) represents the receiving time of the event substation, and T _sj (P) represents the actual occurrence time of the event;

4) Detect whether the time period of the historical fault information sent by the sub-station is consistent with the time period of the main station's calling fault historical information, if the time of the two is inconsistent, it is determined to be a clock tampering attack, otherwise, go to step 5);

是否成立，若否，则判定为时钟篡改攻击，否则，进入步骤S4；其中，

P_XC表示IEC 60870-5-103主-子站信息传送报文，T_cs(P)表示信息传送时间，T_max表示最大延迟时间，P₁表示继电保护装置动作信息传送报文，P₂表示继电保护装置模拟量测量值传送报文，P₃表示继电保护装置运行状态传送报文，P₄表示继电保护装置定值传送报文。5) Judgment formula

Whether it is established, if not, it is determined as a clock tampering attack, otherwise, go to step S4; wherein,

P _XC represents the IEC 60870-5-103 master-substation information transmission message, T _cs (P) represents the information transmission time, T _max represents the maximum delay time, P ₁ represents the relay protection device action information transmission message, P ₂ Represents the relay protection device analog measurement value transmission message, P ₃ represents the relay protection device operating state transmission message, and P ₄ represents the relay protection device fixed value transmission message.

By performing clock tampering attack detection on the traffic data of the relay protection information processing system, the invention can identify the attack behaviors targeting clock features such as clock range, clock logic, clock synchronization, clock delay, etc., and overcomes the existing detection methods that focus on time The numerical analysis of the target can not be used for abnormal detection of features such as time-scale logic. Clock tampering attack detection can effectively avoid the occurrence of various relay protection devices that cannot work normally due to abnormal clocks, and can also prevent attackers from maliciously expanding the time range of information transmission to illegally obtain system information, improving relay protection information. The ability of the processing system to respond to non-numerical timescale tampering attacks.

The specific implementation process of detecting malformed packet attacks on the parsed packets includes:

是否成立，若否，则判定为畸形报文攻击，否则进入步骤II)；其中，P_IEC103表示IEC 60870-5-103报文，F_l(P)表示报文理论长度，L_s(P)表示报文实际长度；I) Judgment formula

Whether it is established, if not, it is determined as a malformed packet attack, otherwise, go to step II); wherein, P _IEC103 represents the IEC 60870-5-103 message, F _l (P) represents the theoretical length of the message, L _s (P) Indicates the actual length of the message;

是否成立，若否，则判定为畸形报文攻击，否则进入步骤III)；II) Judgment formula

Whether it is established, if not, it is determined to be a malformed packet attack, otherwise, go to step III);

是否成立，若否，判定为畸形报文攻击，否则进入步骤IV)；其中，F_t(P)表示报文类型标识字段值；III) Judgment formula

Whether it is established, if not, it is determined to be a malformed packet attack, otherwise, enter step IV); wherein, F _t (P) represents the value of the packet type identification field;

是否成立，若否，判定为畸形报文攻击，否则进入步骤V)；其中，F_c(P)表示报文传送原因字段值；IV) Judgment formula

Whether it is established, if not, it is determined to be a malformed packet attack, otherwise, go to step V); wherein, F _c (P) represents the value of the message transmission reason field;

是否成立，若否，判定为畸形报文攻击，否则进入步骤S5；F_i(P)表示报文信息序号字段值。V) Judgment formula

Whether it is established, if not, it is determined as a malformed packet attack, otherwise, go to step S5; F _i (P) represents the value of the packet information sequence number field.

The malformed packet attack detection process of the present invention can identify malformed packets when the packet format is correct, including packet length malformation, packet field threshold malformation, etc., and overcomes the fact that the existing method can only check the validity of the packet format. Limitations of verification. At the same time, the malformed packet attack detection detects the malformation before the specific service to which the packet belongs is executed, so as to quickly respond to the dispatch center, re-establish the communication process of the service in the relay protection information processing system, and send a normal service report. To avoid abnormality of malformed packets after execution, which affects the execution of normal services.

In step S5, when the message is to read the sub-station configuration service, the specific implementation process of attack detection on the parsed message includes:

是否成立，若否，则判定存在配置数据恶意拦截攻击，否则，判断公式

是否成立，若否，则判定存在数据篡改攻击，否则将当前帧流量数据判定为正常流量；其中，P_BT表示继电保护信息处理系统中读取子站配置业务报文，B_n(P)表示子站上送标题数目，B_s表示子站配置的所有标题数目，B_zh(P)表示同一组标题信息的各个条目的组号，C_zh表示当前组标题信息的组号。Judgment formula

Whether it is established, if not, it is judged that there is a malicious interception attack of configuration data, otherwise, the judgment formula

Whether it is true, if not, it is determined that there is a data tampering attack, otherwise the current frame traffic data is determined to be normal traffic; among them, P _BT represents the read sub-station configuration service message in the relay protection information processing system, B _n (P) Indicates the number of titles sent by the sub-station, B _s represents the number of all titles configured by the sub-station, B _zh (P) represents the group number of each entry of the same group of header information, and C _zh represents the group number of the current group header information.

The detection of the attack behavior of the read sub-station configuration business logic of the present invention can realize the detection of whether the configuration information is completely uploaded, and whether the entries of the configuration information and the group number are consistent. The complete upload of configuration information and the consistency of entries and group numbers are the prerequisites to ensure the normal operation of relay protection devices. This detection method overcomes the existing attack behavior detection methods of relay protection information processing systems, which focus on the measurement of relay protection devices. Point-to-point data analysis, lack of attack behavior detection for the business logic of traffic data application layer packets, effectively avoids the risk of configuration information being intercepted and tampered with.

In step S5, when the message is a protection event sending service, the specific implementation process of performing attack detection on the parsed message includes:

是否成立，若否，则判定存在双点信息恶意篡改攻击，否则，进入步骤B)；其中，P_BH表示继电保护信息处理系统中保护事件上送报文，D_pi(P)表示双点信息数值；A) Judgment formula

Whether it is established, if not, it is judged that there is a double-point information malicious tampering attack, otherwise, go to step B); wherein, P _BH represents the protection event in the relay protection information processing system to send the message, D _pi (P) represents the double point information value;

B) Detect whether the logic of the frame message before and after the switch variable displacement, action signal, and platen state is correct. If the previous frame of the switch variable displacement is open/close, the next frame is still open/close; the previous frame of the action signal is reset/action , the next frame is still reset/action; the previous frame of the platen state is not put in/in, and the next frame is still not put in/in, then it is judged that there is a malicious opening and closing attack, otherwise go to step C);

是否成立，若否，则判定存在动作事件非法上送攻击，否则将当前帧流量数据判定为正常流量；其中，L_bh(P)表示保护事件报文类型标识，P₅表示告警或开关量变位事件报文，P₆表示动作事件报文。C) Judgment formula

Whether it is true, if not, it is determined that there is an illegal uploading attack of action events, otherwise, the current frame traffic data is determined to be normal traffic; wherein, L _bh (P) represents the type identifier of the protection event message, and P ₅ represents the alarm or switch value change. Event message, P ₆ represents the action event message.

The protection event uploading business logic attack behavior detection of the present invention can realize malicious tampering attack detection and illegal uploading attack detection of various protection events in the relay protection information processing system. The business logic attack behavior of the protection event can be highly hidden in the normal traffic data. The existing method only analyzes the data of the measurement point of the relay protection device, and it is difficult to detect this kind of high-energy stealth attack behavior. The invention deeply integrates the sending business logic of the protection event in the traffic data application layer message, thereby improving the accuracy of the attack behavior of the relay protection information processing system.

In step S5, the specific implementation process of performing attack detection on the parsed message when the message is a wave recording brief report sending service includes:

是否成立，若否，则判定存在跳闸相别恶意篡改攻击，否则进入步骤ii)；其中，P_LB表示继电保护信息处理系统中录波简报业务报文，G_xb(P)表示故障相别，Z_xb(P)表示跳闸相别；i) Judgment formula

Whether it is established, if not, it is determined that there is a trip phase-specific malicious tampering attack, otherwise, go to step ii); wherein, P _LB represents the wave recording briefing service message in the relay protection information processing system, and G _xb (P) represents the fault phase , Z _xb (P) means tripping phase difference;

是否成立，若否，则判定存在接地故障标志位数据篡改攻击，否则进入步骤iii)；其中，D₃表示报文短路接地故障标志位数值，D₀表示报文A相短路故障标志位数值，D₁表示报文B相故短路障标志位数值，D₂表示报文C相短路故障标志位数值；ii) Judgment formula

Whether it is true, if not, it is determined that there is a ground fault flag bit data tampering attack, otherwise, go to step iii); wherein, D ₃ represents the value of the message short circuit ground fault flag bit, D ₀ represents the message A phase short circuit fault flag bit value, D ₁ represents the value of the short-circuit fault flag bit of the phase B of the message, and D ₂ represents the value of the short-circuit fault flag bit of the phase C of the message;

iii) Detect whether the reclosing in the wave recording briefing is abnormal. If there is a reclosing after the fault occurs, but the reclosing time is 0, or there is no reclosing, but the reclosing time is not 0, it is determined that there is a reclosing time tampering attack, Otherwise, the current frame traffic data is determined as normal traffic.

The business logic attack behavior detection of the wave recording brief report of the present invention can discriminate the malicious tampering attack of trip phase, ground fault flag bit data tampering attack and reclosing time tampering attack. The information of the wave recording briefing report, such as trip phase, fault flag, reclosing time, etc., must be extracted through the field-level in-depth analysis of the flow data application layer message of the relay protection information system, which cannot be identified only by the format check of the message. such aggression. The attack behavior detection method provided by the present invention overcomes the limitation that the existing detection methods cannot detect the time sequence and context logic of the wave recording briefing, and improves the ability to protect the integrity and accuracy of the wave recording briefing data.

In step S5, when the message is a fixed-value operation service, the specific implementation process of performing attack detection on the parsed message includes:

Determine whether the logic X _g1 → X _g2 → X _g3 → X _g4 → X _g5 → X _g6 → X _g7 → X _g8 is established, if not, it is determined that there is a malicious tampering attack on the setting value of the relay protection device, otherwise the current frame traffic data It is judged to be normal flow; wherein, X _g1 represents the current running fixed value area code message of the calling device, X _g2 represents the sub station uploading device current running fixed value area code message, X _g3 represents the master station calling device fixed value message, X _g4 represents The slave station uploads the device setting value message, X _g5 means downloading the setting value message to the slave station, X _g6 means responding to the setting value message downloaded by the slave station, X _g7 means executing the setting value modification message, X _g8 The slave station responds Fixed value modification message.

The fixed value operation business logic attack behavior detection of the present invention can discriminate the malicious tampering attack of the setting value of the relay protection device in the process of constant value modification according to the normal fixed value modification logic, and actively block the attack behavior of maliciously tampering with the fixed value. . However, the existing data analysis method of the measuring point of the relay protection device can only detect after the fixed value is tampered with, and cannot monitor and block the modification of the fixed value in time. The business logic attack behavior detection method of fixed value operation provided by the present invention penetrates into the application layer of traffic data, can effectively prevent the setting value of the relay protection device from being maliciously tampered with, and is of great significance to the correct action of the relay protection device.

In step S5, when the packet is a general call service, the specific implementation process of performing attack detection on the parsed packet includes:

是否成立，若否，则判定存在非法总召攻击，否则将当前帧流量数据判定为正常流量；其中，Z_h1表示主站启动总召唤报文，Z_h2表示子站上送信息报文，Z_h3表示总召唤结束报文，P_ZH表示继电保护信息处理系统总召唤业务，Z_hn表示子站上送信息数目，Z_hs表示子站装置数量，A_s表示报文ASDU地址，H表示数值为16进制。Judging whether the logic Z _h1 →Z _h2 →Z _h3 is established, if not, it is determined that there is an illegal general call attack, otherwise the judgment formula

Whether it is true, if not, it is determined that there is an illegal general call attack, otherwise, the current frame traffic data is determined to be normal traffic; among them, Z _h1 indicates that the master station starts a general calling message, Z _h2 indicates that the slave station sends an information message, Z h2 indicates that the slave station sends an information message. _h3 represents the general call end message, P _ZH represents the general call service of the relay protection information processing system, Z _hn represents the number of messages sent by the sub-station, Z _hs represents the number of sub-station devices, A _s represents the message ASDU address, and H represents the value It is hexadecimal.

The general call business logic attack behavior detection of the present invention can determine the illegal general call attack according to the normal business logic of the general call. The illegal general call attack can combine the constructed general call service message with the normal general call service message by means of tampering or injection, so as to obtain data illegally. This type of attack cannot be identified only by checking the validity of packet fields and analyzing the consistency of telemetry data. The attack must be identified at the service logic level of packets. The general call service logic attack behavior detection provided by the present invention can effectively identify the attack behaviors against the general call service by detecting the logic and scope of the general call service, and prevent redundant and incomplete information from being uploaded.

是否成立，若否，则判定存在文件时钟篡改攻击，否则将当前帧流量数据判定为正常流量；其中，P_WJ表示继电保护信息处理系统文件列表上传报文，T_lb(P)表示文件列表上传时间，C_q表示文件列表时查询起始时间，C_z表示文件列表时查询终止时间。In step S5, when the message is a general file transfer service, the specific implementation process of attack detection on the parsed message includes: detecting whether the file name only contains the directory name and wildcard characters, and if it contains other illegal characters, it is determined that there is an illegal file. Upload the attack, otherwise the judgment formula

Whether it is true, if not, it is determined that there is a file clock tampering attack, otherwise the current frame traffic data is determined to be normal traffic; wherein, P _WJ represents the relay protection information processing system file list upload message, T _lb (P) represents the file list Upload time, C _q represents the start time of the query in the file list, and C _z represents the end time of the query in the file list.

The general file transmission business logic attack behavior detection of the present invention can identify illegal file uploading attacks and file clock tampering attacks. Once an illegal file containing attack code is uploaded to the master station, the master station will lose its control authority; file clock tampering attacks tamper with the time of the file upload list, thereby illegally stealing information. The general file transmission business logic attack behavior detection provided by the present invention overcomes the limitation of the prior methods that focus on the statistical analysis of network layer traffic, and can effectively prevent attackers from uploading malicious file data or tampering with the file time, causing the main station to crash and the file to be destroyed. Theft occurs.

A computer device includes a memory, a processor and a computer program stored on the memory; the processor executes the computer program to implement the steps of the method of the present invention.

Compared with the prior art, the present invention has the following beneficial effects:

(1) The present invention proposes an attack behavior detection method for traffic data application layer packets, which overcomes the existing attack detection methods that focus on the following Limitations of data analysis at measuring points of electrical protection devices.

(2) The present invention proposes the detection of clock tampering attack and malformed message attack for the flow data application layer message of the relay protection information processing system, which overcomes the lack of authentication mechanism, authorization mechanism, and lack of encryption in IEC 60870-5-103 statute. insufficiency of the mechanism.

(3) The present invention establishes a normal behavior model of power business according to the business characteristics of the relay protection information processing system, and performs attack behavior detection on the application layer message of the flow data, so as to realize the flow data of the relay protection information processing system in the application layer. Active defense against attacks improves the security of information transmission in business systems.

Description of drawings

FIG. 1 is a flowchart of a method for monitoring an attack behavior of a relay protection information processing system in an embodiment of the present invention.

FIG. 2 is a schematic structural diagram of an attack behavior monitoring system of a relay protection information processing system according to an embodiment of the present invention.

FIG. 3 is a system unit diagram of a clock tampering attack detection module in an embodiment of the present invention.

FIG. 4 is a system unit diagram of a malformed packet attack detection module in an embodiment of the present invention.

FIG. 5 is a system unit diagram of a business logic attack detection module in an embodiment of the present invention.

Detailed ways

1 is a flowchart of a method for monitoring an attack behavior of a relay protection information processing system provided by an embodiment of the present invention, and the specific implementation steps are as follows:

Step S1: capturing the relay protection information processing system traffic data packets in real time, and extracting the application layer message of the current frame traffic data;

Step S2: perform field-level analysis on the message according to the IEC 60870-5-103 protocol, obtain the specific value of the message length field, type identifier, transmission reason, information serial number, and clock characteristics, and determine the system service to which the message belongs;

Step S3: Perform clock tampering attack detection on the packet parsed in step S2, if the clock range, clock logic, clock synchronization, and clock delay of the packet do not conform to normal clock characteristics, it is determined that there is a clock tampering attack, otherwise, go to step S4 ;

Step S4: Perform malformed packet attack detection on the packet parsed in step S2. If the length field, type identifier, transmission reason, and information sequence number value of the packet do not meet the requirements of the protocol, it is determined that there is a malformed packet attack, otherwise, go to step S4. S5;

Step S5: establish a normal behavior model according to the system service to which the message belongs, and perform attack detection on the message according to the normal behavior model. If the message does not conform to the normal service model, it is determined that there is a business logic attack, otherwise, the current frame traffic data is determined to be normal flow.

Further, step S3 includes:

S3-1: Detect whether the time stamp year of the message is within the normal range, if the time stamp year exceeds the limit, that is, violating formula (1), it is determined as a clock tampering attack, otherwise, go to step S3-2.

Y _t ∈ [1970,2069] (1)

Among them, Y _t represents the year of the time stamp, and y _t represents the byte value of the year of the time stamp.

S3-2: Detect whether the time synchronization message is broadcast time synchronization. The master station issues a broadcast time synchronization command, which is aimed at all devices. The high 8 bits of the public address of the application service data unit (referred to as ASDU address) in the message at this time are FFH, which means broadcasting to all devices in the slave station. (3), it is determined as a clock tampering attack, otherwise, go to step S3-3.

表示全称量词“任意”，P为步骤S2解析后的应用层报文，P_DS表示IEC60870-5-103对时报文，A_g(P)表示报文ASDU地址高8位的值，F表示16进制的15，H表示数值为16进制。in,

Represents the universal quantifier "any", P represents the application layer packet parsed in step S2, P _DS represents the IEC60870-5-103 time-synchronized message, A _g (P) represents the high 8-bit value of the ASDU address of the message, and F represents 16 Base 15, H means the value is hexadecimal.

S3-3: Check whether the actual occurrence time of alarm, remote signal displacement, action event and slave station receiving time logic are correct. After the alarm, remote signal displacement, and action events occur, the relay protection device will record the actual occurrence time of the event, and there will be a certain delay in the substation receiving the fault information, so the substation receiving time must be greater than the actual occurrence time. If the violation of formula (4) ), then it is determined as a clock tampering attack, otherwise, go to step S3-4.

Among them, P _DZ represents one of IEC 60870-5-103 alarm, remote signal displacement, and action event data upload message, T _js (P) represents the receiving time of the event substation, and T _sj (P) represents the actual event Time of occurrence.

S3-4: Detect whether the time period of the historical fault information sent by the slave station is consistent with the time period of the historical fault information of the master station's call. If the two times are inconsistent, it is determined as a clock tampering attack, otherwise, go to step S3-5.

S3-5: Detect whether the master-slave information transmission times out. If the information transmission time exceeds the maximum delay time required by the protocol, that is, the formula (5) is violated, it is determined as a clock tampering attack, otherwise, it goes to step S4.

Among them, P _XC represents the IEC 60870-5-103 master-substation information transmission message, T _cs (P) represents the information transmission time, T _max represents the maximum delay time, P ₁ represents the relay protection device action information transmission message, P ₂ represents the relay protection device analog measurement value transmission message, P ₃ represents the relay protection device operating state transmission message, and P ₄ represents the relay protection device fixed value transmission message.

Further, step S4 includes:

S4-1: For the packet parsed in step S2, check whether the theoretical length of the packet calculated by the length field is equal to the actual length. If it is not equal, that is, it violates the formula (7), it is determined as a malformed packet attack, otherwise Go to step S4-2.

Among them, P _IEC103 represents the IEC 60870-5-103 message, F _l (P) represents the theoretical length of the message, and L _s (P) represents the actual length of the message.

S4-2: Check whether the actual length of the message is greater than 2048 bytes, and if it is greater than the formula (8), it is determined as a malformed message attack, otherwise, go to step S4-3.

S4-3: Detecting whether the value of the type identification field of the message is valid, if invalid, that is, violating formula (9), it is determined as a malformed message attack, otherwise, go to step S4-4.

Among them, F _t (P) represents the value of the message type identification field.

S4-4: Detect whether the value of the transmission reason field of the message is valid, if invalid, that is, violating formula (10), it is determined as a malformed message attack, otherwise, go to step S4-5.

Among them, F _c (P) represents the value of the message transmission reason field.

S4-5: Check whether the value of the information sequence number field of the message is valid, if invalid, that is, violating formula (11), it is determined as a malformed message attack, otherwise, go to step S5.

Among them, F _i (P) represents the value of the serial number field of the message information.

Further, step S5 includes:

S5-1: Classify and detect the attack behavior according to the service to which the packet obtained in step S2 belongs. If the packet is a read substation configuration service, go to step S5-2; if the packet is a protection event upload service, go to step S5-1 S5-3; if the message is the wave recording briefing service, go to step S5-4; if the message is the fixed value operation business, go to step S5-5; if the message is the general call service, go to step S5-6; If the message is a general file transfer service, go to step S5-7;

S5-2: Analyze the normal logic of the read sub-station configuration service according to the technical specifications of the relay protection information processing system, establish a normal behavior model of the read sub-station configuration service based on the normal business logic, and perform the relay protection according to the normal behavior model. The traffic data of the service in the information processing system is subjected to attack behavior detection. If the packet does not conform to the normal behavior model, it is determined that there is a logical attack on the read substation configuration service. Otherwise, the current frame traffic data is determined to be normal traffic.

S5-3: Analyze the normal logic of the protection event sending service according to the technical specifications of the relay protection information processing system, establish a normal behavior model of the protection event sending service based on the normal service logic, and process the relay protection information according to the normal behavior model. The traffic data of the service in the system is used for attack behavior detection. If the packet does not conform to the normal behavior model, it is determined that there is a protection event to send the service logic attack, otherwise the current frame traffic data is determined to be normal traffic.

S5-4: Analyze the normal logic of the recording and briefing service according to the technical specifications of the relay protection information processing system, establish a normal behavior model of the recording and briefing service based on the normal business logic, and conduct the relay protection based on the normal behavior model. The traffic data of the service in the information processing system is subjected to attack behavior detection. If the packet does not conform to the normal behavior model, it is determined that there is a logic attack on the recording and briefing report submission service. Otherwise, the current frame traffic data is determined to be normal traffic.

S5-5: Analyze the normal logic of the fixed-value operation business according to the technical specifications of the relay protection information processing system, establish a normal behavior model of the fixed-value operation business based on the normal business logic, and analyze the information in the relay protection information processing system according to the normal behavior model. Attack behavior detection is performed on the traffic data of this service. If the packet does not conform to the normal behavior model, it is determined that there is a fixed-value operation service logic attack, otherwise, the current frame traffic data is determined to be normal traffic.

S5-6: Analyze the normal logic of the general call service according to the technical specifications of the relay protection information processing system, establish a normal behavior model of the general call service based on the normal business logic, and analyze the service in the relay protection information processing system according to the normal behavior model. If the packet does not conform to the normal behavior model, it is determined that there is a general call service logic attack; otherwise, the current frame traffic data is determined to be normal traffic.

S5-7: Analyze the normal logic of the general file transmission business according to the technical specifications of the relay protection information processing system, establish the normal behavior model of the general file transmission business based on the normal business logic, and analyze the information in the relay protection information processing system according to the normal behavior model. Attack behavior detection is performed on the traffic data of the service. If the packet does not conform to the normal behavior model, it is determined that there is a general file transfer service logic attack; otherwise, the current frame traffic data is determined to be normal traffic.

Further, step S5-2 includes:

S5-2-1: Detect whether the number of headers sent by the substation is complete when the relay protection information processing system reads each group of headers configured by the substation. If it is incomplete, that is, it violates the formula (12), it is determined that there is malicious interception of configuration data. Attack, otherwise go to step S5-2-2.

Among them, P _BT represents the read sub-station configuration service message in the relay protection information processing system, B _n (P) represents the number of headers sent by the sub-station, and B _s represents the number of all headers configured by the sub-station.

S5-2-2: Detect whether the group numbers of all items of the same group of header information are consistent. If they are inconsistent, that is, violating formula (13), it is determined that there is a data tampering attack. Otherwise, the current frame traffic data is determined to be normal traffic.

Among them, B _zh (P) represents the group number of each item of the same group title information, and C _zh represents the group number of the current group title information.

Further, step S5-3 includes:

S5-3-1: Check whether the double-point information transmission of the protection event is abnormal. If the double-point information state is not within the specified range, that is, it violates the formula (14), it is determined that there is a double-point information malicious tampering attack, otherwise, go to step S5-3 -2.

Among them, P _BH represents the protection event sending message in the relay protection information processing system, and D _pi (P) represents the double-point information value.

S5-3-2: Check whether the logic of the frame message before and after the switch variable displacement, action signal, and platen state is correct. It is a reset/action, and the next frame is still a reset/action; the previous frame of the platen state is not put in/in, and the next frame is still not put in/in, it is determined that there is a malicious opening and closing attack, otherwise, go to step S5-3- 3.

S5-3-3: Check whether the type identifier used for sending protection events is correct. Alarms and switch variable displacement events can only be sent using type identifier 1, and action events can only be sent using type identifier 2. If it violates formula (15) , it is determined that there is an illegal uploading attack of action events, otherwise, the current frame traffic data is determined to be normal traffic.

Wherein, L _bh (P) represents the type identifier of the protection event message, P ₅ represents the alarm or switch variable displacement event message, and P ₆ represents the action event message.

Further, step S5-4 includes:

S5-4-1: Check whether the fault phase and trip phase in the oscillographic briefing report are consistent. If they are inconsistent, that is, in violation of formula (16), it is determined that there is a malicious tampering attack on the trip phase, otherwise, go to step S5-4-2 .

Among them, P _LB represents the wave recording briefing service message in the relay protection information processing system, G _xb (P) represents the fault phase, and Z _xb (P) represents the trip phase.

S5-4-2: Detect whether the short-circuit grounding fault flag in the wave recording briefing is correct, if it is incorrect, that is, violating formula (17), determine the grounding fault flag data tampering attack, otherwise go to step S5-4-3.

Among them, D ₃ represents the value of the short-circuit ground fault flag of the message, D ₀ represents the value of the short-circuit fault flag of the phase A of the message, D ₁ represents the value of the short-circuit fault flag of the phase B of the message, and D ₂ represents the short-circuit fault of the phase C of the message. Flag bit value.

S5-4-3: Check whether the reclosing in the oscillographic briefing is abnormal. If there is a reclosing after the fault occurs, but the reclosing time is 0 or there is no reclosing, but the reclosing time is not 0, it is determined that there is a reclosing time tampering attack, otherwise the current frame traffic data is determined to be normal traffic.

Further, step S5-5 includes:

S5-5-1: Check whether the setting value modification logic of the relay protection device is correct. If the logic is wrong, that is, it violates the formula (18), it is determined that there is a malicious tampering attack on the setting value of the relay protection device. Otherwise, the current frame traffic data is determined as normal flow.

X _g1 →X _g2 →X _g3 →X _g4 →X _g5 →X _g6 →X _g7 →X _g8 (18)

Among them, X _g1 represents the current running fixed value area code message of the calling device, X _g2 represents the sub station uploading device current running fixed value area code message, X _g3 represents the master station calling device fixed value message, X _g4 represents the slave station uploading device fixed value message value message, X _g5 means downloading the setting value message to the substation, X _g6 means responding to the substation downloading the setting value message, X _g7 means executing the setting value modifying message, X _g8 substation responding to the setting value modifying message .

Further, step S5-6 includes:

S5-6-1: Detect whether the general calling business process is abnormal. If the actual general calling business process is inconsistent with the normal process, that is, violating formula (19), it is determined that there is an illegal general calling attack, otherwise, go to step S5-6-2.

Z _h1 →Z _h2 →Z _h3 (19)

Among them, Z _h1 indicates that the master station starts the general call message, Z _h2 indicates that the slave station sends an information message, and Z _h3 indicates the general call end message.

S5-6-2: Check whether the number of messages sent by the slave station is correct. After receiving the general call command from the master station, the slave station will reply the specified information according to the ASDU address in the message. When the ASDU address is not equal to zero, it will answer the switch information of the specific device; when the ASDU address is equal to zero, it will answer the communication status of each device in the slave station and The operating status of the device. If the formula (20) is violated, it is determined that there is an illegal general call attack; otherwise, the current frame traffic data is determined to be normal traffic.

Among them, P _ZH represents the general call service of the relay protection information processing system, Z _hn represents the number of information sent by the sub-station, Z _hs represents the number of sub-station devices, A _s represents the message ASDU address, and H represents the value in hexadecimal.

Further, step S5-7 includes:

S5-7-1: Check whether the file name only contains the directory name and wildcard characters (* and ?). If it contains other illegal characters, it is determined that there is an illegal file upload attack, otherwise, go to step S5-7-2.

S5-7-2: Detect whether the file list upload is within the query time range. When the master station calls the file list, the query start time and end time will be given. The file list uploaded by the slave station needs to be within this time range. If it exceeds, that is, it violates the formula (21), it is determined that there is a file clock tampering attack, otherwise it will be tampered with. The current frame traffic data is determined as normal traffic.

Among them, P _WJ represents the file list upload message of the relay protection information processing system, T _lb (P) represents the file list upload time, C _q represents the file list query start time, and C _z represents the file list query end time.

The present invention relies on massive relay protection information processing system traffic data, extracts the application layer message of the traffic data and parses the message according to the IEC 60870-5-103 protocol, and obtains the specific value of the message feature field and the system service to which the message belongs. . Secondly, the clock tampering attack detection and the malformed packet attack detection are performed according to the specific value of the packet characteristic field. Finally, a normal business model is established according to the specific system business to which the message belongs, and business logic attack detection is carried out according to the normal business model, which realizes the comprehensive monitoring of the attack behavior of the relay protection information processing system and ensures the safe and reliable operation of the power system.

FIG. 2 is a schematic structural diagram of an attack behavior monitoring system of a relay protection information processing system provided by an embodiment of the present invention. The system is suitable for executing the method provided by any embodiment of the present invention, and includes: a flow data acquisition module 100, an application layer packet parsing Module 200 , a clock tampering attack detection module 300 , a malformed packet attack detection module 400 , and a business logic attack detection module 500 .

The flow data acquisition module 100 is used for collecting the flow data of the relay protection information processing system, and extracting the application layer message.

The application layer message parsing module 200 is configured to perform field-level parsing on the application layer message according to the IEC 60870-5-103 protocol, and obtain the specific relay protection service represented by the message.

The clock tampering attack detection module 300 is used to detect the clock range, clock logic, clock synchronization, and clock delay of the message, and determine whether there is a clock tampering attack.

The malformed packet attack detection module 400 is configured to verify the packet format according to the requirements of the protocol, and determine whether there is a malformed packet attack.

The business logic attack detection module 500 is used to establish a normal behavior model for the system business to which the message belongs, and to perform detection according to the normal behavior model to determine whether there is a business logic attack.

The output end of the traffic data acquisition module 100 is connected to the input end of the application layer message parsing module 200 for inputting the extracted application layer message.

The output end of the application layer message parsing module 200 is connected to the input end of the clock tampering attack detection module 300 for inputting the application layer message and its analysis result.

The output end of the clock tampering attack detection module 300 is connected to the input end of the malformed packet attack detection module 400, and is used for inputting application layer packets and their parsing results.

The output end of the malformed packet attack detection module 400 is connected to the input end of the business logic attack detection module 500, and is used for inputting application layer packets and their parsing results.

3 , further, the clock tampering attack detection module 300 includes: a data acquisition unit 301 , a first detection unit 302 , a second detection unit 303 , a third detection unit 304 , a fourth detection unit 305 , and a fifth detection unit 306 .

The output end of the data acquisition unit 301 is connected to the input end of the first detection unit 302, and is used for inputting the application layer message and its parsing result.

The output terminal of the first detection unit 302 is connected to the input terminal of the second detection unit 303, the output terminal of the second detection unit 303 is connected to the input terminal of the third detection unit 304, and the output terminal of the third detection unit 304 is connected. The output terminal is connected to the input terminal of the fourth detection unit 305 , and the output terminal of the fourth detection unit 305 is connected to the input terminal of the fifth detection unit 306 .

In one embodiment, the data acquisition unit 301 reads the application layer message of the traffic data and its parsing result, and transmits the read information to the first detection unit 302, the second detection unit 303, and the third detection unit 304 , a fourth detection unit 305 , and a fifth detection unit 306 .

The first detection unit 302 is configured to detect whether the time stamp year of the message is within a normal range, and if the time stamp year exceeds the limit, it is determined as a clock tampering attack.

The second detection unit 303 is configured to detect whether the time synchronization message is broadcast time synchronization, and if not, it is determined as a clock tampering attack.

The third detection unit 304 is used to detect whether the logic of alarm, remote signal displacement, action event data uploading and substation receiving time is correct, if not, it is determined as a clock tampering attack.

The fourth detection unit 305 is configured to detect whether the time period of the historical fault information sent by the slave station is consistent with the time period of the historical fault information of the master station calling, and if not, it is determined as a clock tampering attack.

The fifth detection unit 306 is used for whether the master-slave information transmission times out, and if so, it is determined as a clock tampering attack.

4, further, the malformed packet attack detection module 400 includes: a data acquisition unit 401, a packet length field detection unit 402, a packet length threshold detection unit 403, a type identification field detection unit 404, and a transmission reason field detection unit 404. Unit 405, information serial number field detection unit 406.

The output end of the data acquisition unit 401 is connected to the input end of the message length field detection unit 402 for inputting the application layer message and its parsing result.

The output end of the message length field detection unit 402 is connected with the input end of the message length threshold detection unit 403, and the output end of the message length threshold detection unit 403 is connected with the input end of the type identification field detection unit 404, so The output terminal of the type identification field detection unit 404 is connected to the input terminal of the transmission reason field detection unit 405 , and the output terminal of the transmission reason field detection unit 405 is connected to the input terminal of the information serial number field detection unit 406 .

In one embodiment, the data acquisition unit 401 reads the traffic data application layer packet and its parsing result, and transmits the read information to the packet length field detection unit 402, the packet length threshold detection unit 403, the type The identification field detection unit 404 , the transmission reason field detection unit 405 , and the information sequence number field detection unit 406 .

The message length field detection unit 402 is configured to detect whether the theoretical length of the message calculated by the length field is equal to the actual length, and if not, it is determined as a malformed message attack.

The packet length threshold detection unit 403 is configured to detect whether the actual length of the packet is greater than 2048 bytes, and if it is greater than 2048 bytes, it is determined as a malformed packet attack.

The type identification field detection unit 404 is configured to detect whether the value of the type identification field of the message is valid, and if it is invalid, it is determined as a malformed message attack.

The transmission reason field detection unit 405 is configured to detect whether the transmission reason field value of the message is valid, and if it is invalid, it is determined as a malformed message attack.

The information sequence number field detection unit 406 is configured to detect whether the value of the information sequence number field of the message is valid, and if it is invalid, it is determined as a malformed message attack.

5, further, the business logic attack detection module 500 includes: a data acquisition unit 501, a read sub-station configuration service detection unit 502, a protection event upload service detection unit 503, and a wave recording briefing report upload service detection unit 504 , a custom operation service detection unit 505 , a general call service detection unit 506 , and a general file transfer service detection unit 507 .

The output end of the data acquisition unit 501 is connected to the input end of the reading substation configuration service detection unit 502, and is used for inputting the relay protection service to which the message belongs.

The output end of the read sub-station configuration service detection unit 502 is connected to the input end of the protection event upload service detection unit 503, and the output end of the protection event upload service detection unit 503 is connected to the wave recording brief report upload service detection unit. The input end of 504 is connected, the output end of the recording and briefing service detection unit 504 is connected with the input end of the customized operation service detection unit 505, and the output end of the customized operation service detection unit 505 is connected with the general call service detection unit 506. The input end of the general call service detection unit 506 is connected to the input end of the general file transfer service detection unit 507 .

In one embodiment, the data acquisition unit 501 acquires the specific relay protection service to which the message belongs, and the unit transmits the read information to the read sub-station configuration service detection unit 502, the protection event upload service detection unit 503, and the wave recorder. A briefing service detection unit 504 , a customized operation service detection unit 505 , a general call service detection unit 506 , and a general file transfer service detection unit 507 .

The reading sub-station configuration service detection unit 502 is configured to detect whether there is an attack in the reading sub-station configuration service in the relay protection information processing system.

In one embodiment, a normal behavior model for reading the configuration service of the substation is established, and attack behavior detection is performed on the traffic data of the service in the relay protection information processing system according to the normal behavior model. If the message does not conform to the normal behavior model, then It is determined that there is a business logic attack in the configuration of the reading substation, and the unit takes the detection result as an output of the business logic attack detection module 500 .

The protection event sending service detection unit 503 is configured to detect whether there is an attack in the protection event sending service.

In one embodiment, a normal behavior model of the protection event uploading service is established, and the traffic data of the service in the relay protection information processing system is subjected to attack behavior detection according to the normal behavior model, and if the message does not conform to the normal behavior model, it is determined that If there is a protection event to send a business logic attack, the unit takes the detection result as an output of the business logic attack detection module 500 .

The recording and briefing report sending service detection unit 504 is configured to detect whether there is an attack in the recording and briefing report sending service.

In one embodiment, a normal behavior model of the recording and briefing service is established, and attack behavior is detected on the traffic data of the service in the relay protection information processing system according to the normal behavior model. If the message does not conform to the normal behavior model, then It is determined that there is a business logic attack on the recording brief report, and the unit takes the detection result as the output end of the business logic attack detection module 500 .

The customized operation service detection unit 505 is configured to detect whether there is an attack behavior in the fixed-value operation service.

In one embodiment, a normal behavior model of the fixed-value operation service is established, and the traffic data of the service in the relay protection information processing system is subjected to attack behavior detection according to the normal behavior model. If the packet does not conform to the normal behavior model, it is determined that there is To customize the operation of business logic attack, the unit takes the detection result as the output of the business logic attack detection module 500 .

The general call service detection unit 506 is configured to detect whether there is an attack behavior in the general call service.

In one embodiment, a normal behavior model of the general calling service is established, and the traffic data of the service in the relay protection information processing system is subjected to attack behavior detection according to the normal behavior model. If the message does not conform to the normal behavior model, it is determined that there is a general Summons a business logic attack, the unit takes the detection result as an output of the business logic attack detection module 500 .

The general file transfer service detection unit 507 is configured to detect whether there is an attack behavior in the general file transfer service.

In one embodiment, a normal behavior model of a general file transmission service is established, and according to the normal behavior model, the traffic data of the service in the relay protection information processing system is subjected to attack behavior detection, and if the message does not conform to the normal behavior model, it is determined that there is For general file transfer business logic attack, the unit takes the detection result as the output of the business logic attack detection module 500 .

Claims (10)

1. A method for monitoring attack behaviors of a relay protection information processing system is characterized by comprising the following steps:

s1, capturing a relay protection information processing system flow data packet in real time, and extracting an application layer message of current frame flow data;

s2, performing field level analysis on the application layer message;

s3, performing clock tampering attack detection on the analyzed message, if the clock range, clock logic, clock synchronization and clock delay of the message do not accord with normal clock characteristics, judging that clock tampering attack exists, otherwise, entering S4;

s4, carrying out abnormal message attack detection on the analyzed message, if the length field, the type identification, the transmission reason, the information sequence number value and the protocol requirement of the message are not in accordance, judging that abnormal message attack exists, otherwise, entering the step S5;

and S5, according to the service system to which the analyzed message belongs, carrying out attack detection on the analyzed message, if the analyzed message does not conform to the normal service model, judging that service logic attack exists, otherwise, judging that the current frame flow data is normal flow.

2. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S3, the specific implementation process of performing the clock tamper attack detection on the analyzed message includes:

1) judgment formula Y _t ∈[1970,2069]Whether the clock is true or not is judged, if not, the clock is judged to be attacked by tampering, otherwise, the step 2) is carried out; wherein,

Y _t year, y, of the time scale _t A year identification byte value representing a time stamp;

2) judgment formula

If true, it is determined as clock tamperingChanging attack, otherwise, entering step 3); wherein,

indicating a full-scale word "optional", P being the application layer message parsed in step S2, P _DS Representing IEC60870-5-103 time tick messages, A _g (P) represents the high 8-bit value of the ASDU address of the message, F represents the 15 of the 16-system, and H represents the value of the 16-system;

3) judgment formula

Whether the clock is true or not is judged, if not, the clock is judged to be attacked by tampering, otherwise, the step 4) is carried out; wherein, P _DZ Represents one of IEC60870-5-103 alarm, remote signaling deflection and action event data uploading message, T _js (P) represents the event substation reception time, T _sj (P) represents an actual occurrence time of the event;

4) detecting whether the time period for sending the historical fault information by the substation is consistent with the time period for calling the fault historical information by the main station, if the time periods are not consistent, determining that the clock is tampered and attacked, and if not, entering the step 5);

5) judgment formula

Whether the clock is true or not is judged, if not, the clock is judged to be clock tampering attack, and if not, the step S4 is carried out; wherein,

P _XC indicating IEC60870-5-103 main-substation information transfer message, T _cs (P) denotes an information transfer time, T _max Denotes the maximum delay time, P ₁ Message, P, indicating relay protection device action information transfer ₂ Message, P, representing the transmission of analog measurement values of a relay protection device ₃ Transmitting messages, P, indicating the operating state of the protective relaying device ₄ And indicating the relay protection device to transmit a message according to the fixed value.

3. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein the specific implementation process for performing the malformed message attack detection on the analyzed message comprises:

I) judgment formula

Whether the abnormal message attack is established or not is judged, if not, the abnormal message attack is judged, and if not, the step II) is carried out; wherein, P _IEC103 Representing IEC60870-5-103 message, F _l (P) represents the theoretical length of the message, L _s (P) representing the actual length of the message;

II) judgment formula

Whether the abnormal message attack is established or not is judged, if not, the abnormal message attack is judged, and if not, the step III) is carried out;

III) judgment formula

Whether the abnormal message attack is established or not is judged, if not, the abnormal message attack is judged, and if not, the step IV is carried out); wherein, F _t (P) indicating a message type identification field value;

IV) judgment formula

Whether the abnormal message attack is established or not is judged, if not, the abnormal message attack is judged, and if not, the step V) is carried out; wherein, F _c (P) a value representing a message transmission reason field;

v) judgment formula

If not, determining that the malformed message is attacked, otherwise, entering step S5; f _i (P) represents a message information sequence number field value.

4. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S5, when the message configures a service for the reading substation, the specific implementation process of performing attack detection on the analyzed message includes:

judgment formula

Whether the configuration data are established or not is judged, if not, the configuration data malicious interception attack exists, otherwise, a formula is judged

If not, judging that data tampering attack exists, otherwise, judging that the current frame traffic data is normal traffic; wherein, P _BT Indicating a reading substation configuration service message in a relay protection information processing system, B _n (P) number of titles sent on substation, B _s Number of all titles, B, representing the configuration of the substation _zh (P) group number, C, of each entry representing the same group of header information _zh A group number indicating the current group header information.

5. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S5, when the packet is a protection event upload service, the specific implementation process of performing attack detection on the analyzed packet includes:

A) judgment formula

If the two-point information is true, if not, judging that the two-point information malicious tampering attack exists, otherwise, entering the step B); wherein, P _BH Presentation of protection events in a relay protection information processing system, D _pi (P) represents a two-point information value;

B) detecting whether the switching value displacement, the action signal and the message logic of the front frame and the rear frame of the pressing plate state are correct or not, and if the front frame of the switching value displacement is opened/closed, the rear frame is still opened/closed; the former frame of the action signal is reset/action, and the latter frame is still reset/action; if the former frame of the pressing plate state is not input/input and the latter frame is still not input/input, judging that malicious opening and closing attack exists, otherwise, entering the step C);

C) judgment formula

If not, judging that the illegal uploading attack of the action event exists, otherwise, judging the current frame flow data as normal flow; wherein L is _bh (P) indicates protection event message type identification, P ₅ Message indicating an alarm or a switching value change event, P ₆ Representing an action event message.

6. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S5, the specific implementation process of performing attack detection on the analyzed message when the message is a wave recording presentation reporting service includes:

i) judgment formula

If not, judging that the tripping phase malicious tampering attack exists, otherwise, entering a step ii); wherein, P _LB Presentation of a message of a wave recording presentation service in a relay protection information processing system, G _xb (P) represents the phase of failure, Z _xb (P) indicates the phase of trip;

ii) judgment formula

Whether the ground fault flag bit data are true or not is judged, if not, the ground fault flag bit data tampering attack is judged, and if not, the step iii) is carried out; wherein D is ₃ Indicating the value of the flag bit of the message short-circuit earth fault, D ₀ Indicating the value of the flag bit of the short-circuit fault of the A phase of the message, D ₁ Indicating the value of the short-circuit fault flag bit of the B-phase of the message, D ₂ Representing the value of the flag bit of the short circuit fault of the C phase of the message;

and iii) detecting whether the reclosure in the recording brief report is abnormal, if the reclosure exists after the fault occurs and the reclosure time is 0 or the reclosure does not exist and is not 0, judging that tampering attack of the reclosure time exists, and otherwise, judging the current frame flow data to be normal flow.

7. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S5, when the packet is a fixed value operation service, the specific implementation process of performing attack detection on the analyzed packet includes:

judgment logic X _g1 →X _g2 →X _g3 →X _g4 →X _g5 →X _g6 →X _g7 →X _g8 Whether the current frame flow data are normal flow is judged, if not, whether malicious tampering attack of the relay protection device setting value exists is judged, and otherwise, the current frame flow data are judged to be normal flow; wherein, X _g1 Message, X, indicating the current running fixed-value area code of the calling device _g2 Message, X, indicating the current running fixed-value area code of the substation uploading device _g3 Message, X, indicating the fixed value of the calling device of the Master station _g4 Message, X, indicating the fixed value of the uploading device of the substation _g5 Presentation substation downloading of definite value message, X _g6 Message, X, indicating the value of the response substation _g7 Indicating execution of a constant value modification message, X _g8 The substation responds to the fixed value modification message.

8. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S5, when the packet is a total call service, the specific implementation process of performing attack detection on the analyzed packet includes:

logic of judgement Z _h1 →Z _h2 →Z _h3 If not, judging that the illegal general calling attack exists, otherwise, judging a formula

If not, judging that the illegal general calling attack exists, otherwise, judging that the current frame traffic data is normal traffic; wherein Z is _h1 Indicating the master station initiating a total call message, Z _h2 Presentation substation uploadingInformation message, Z _h3 Indicating a total call completion message, P _ZH Z representing the total call service of the relay protection information processing system _hn Indicating the number of messages sent on the substation, Z _hs Indicating the number of devices in the substation, A _s Indicating the address of the message ASDU and H indicating the value is 16.

9. The method for monitoring the attack behavior of the relay protection information processing system according to claim 1, wherein in step S5, when the packet is a general file transfer service, the specific implementation process of performing attack detection on the analyzed packet includes:

detecting whether the file name only contains a directory name and a wildcard character, if so, judging that the illegal file uploading attack exists, otherwise, judging a formula

If not, judging that the file clock tampering attack exists, otherwise, judging that the current frame traffic data is normal traffic;

wherein, P _WJ Representing relay protection information processing system file list upload message, T _lb (P) represents a file list upload time, C _q Query start time, C, when representing a list of files _z The query termination time when representing the list of files.

10. A computer apparatus comprising a memory, a processor and a computer program stored on the memory; characterized in that the processor executes the computer program to carry out the steps of the method according to one of claims 1 to 9.

Images