WO2024045095A1

WO2024045095A1 - Data processing method, electronic device, and storage medium

Info

Publication number: WO2024045095A1
Application number: PCT/CN2022/116365
Authority: WO
Inventors: 林涛; 易恺; 金一泓
Original assignee: 西门子股份公司; 西门子（中国）有限公司
Priority date: 2022-08-31
Filing date: 2022-08-31
Publication date: 2024-03-07

Abstract

Embodiments of the present application provide a data processing method, an electronic device, and a storage medium. The data processing method comprises: obtaining, by means of a network traffic analysis tool, a first GOOSE data packet received by a data receiver in the current data receiving period and a second GOOSE data packet received by the data receiver in the previous data receiving period of the current data receiving period; parsing the first GOOSE data packet and the second GOOSE data packet by using the network traffic analysis tool, to determine first verification information in the first GOOSE data packet and second verification information in the second GOOSE data packet, wherein the first verification information comprises a first state number value of the first GOOSE data packet, and the second verification information comprises a second state number value of the second GOOSE data packet; and determining the security of the current communication of the data receiver on the basis of the comparison of the first verification information and the second verification information.

Description

Data processing methods, electronic equipment and storage media

Technical field

The present application relates to the field of communication technology, and in particular, to a data processing method, electronic device and storage medium.

Background technique

IEC 61850 GOOSE (Generic Object Oriented Substation Events, GOOSE for short) is a communication protocol that defines a controlled model mechanism in which data (status, value) in any format are grouped into A data set and transmitted within a predetermined time, which is widely used in substation event communication in the energy field. Today, the energy sector is vital to the country's economy and is constantly looking for ways to modernize the system and increase productivity and efficiency. The energy field that applies the GOOSE protocol for network communication has become the target of more extensive and complex network security attacks. These network security attacks may interrupt normal GOOSE communication or equipment control processes and cause damage to equipment and/or staff. These network security attacks Incidents can significantly impact productivity and increase operating costs. Therefore, a technical solution is needed to determine the potential security risks of GOOSE communication to improve the security of GOOSE communication and reduce the adverse effects of network security attacks.

Contents of the invention

In order to at least partially solve the above technical problems, embodiments of the present application provide a data processing method, electronic device, and storage medium.

According to the first aspect of the embodiments of the present application, the embodiments of the present application provide a data processing method, which includes:

Use the network traffic analysis tool to obtain the first GOOSE data packet received by the data receiver in the current data reception cycle and the second GOOSE data packet received by the data receiver in the previous data reception cycle of the current data reception cycle. ;

Use the network traffic analysis tool to analyze the first GOOSE data packet and the second GOOSE data packet to determine the first verification information in the first GOOSE data packet and the second GOOSE data packet. Second verification information, wherein the first verification information includes the first status number value of the first GOOSE data packet, and the second verification information includes the second status number value of the second GOOSE data packet;

Based on the comparison of the first verification information and the second verification information, the security of the current communication of the data recipient is determined.

According to the second aspect of the embodiments of the present application, the embodiments of the present application provide an electronic device, including: a processor, a communication interface, a memory, and a communication bus. The processor, the communication interface, and the memory complete communication with each other through the communication bus. ; The memory is used to store at least one executable instruction. The executable instruction causes the processor to perform operations corresponding to any of the data processing methods provided in the first aspect.

According to the third aspect of the embodiments of the present application, the embodiments of the present application provide a computer-readable storage medium. Computer instructions are stored on the computer-readable storage medium. When the computer instructions are executed by a processor, they cause the processor to execute the foregoing. Any data processing method provided by the first aspect.

According to the fourth aspect of the embodiments of the present application, the embodiments of the present application provide a computer program product. The computer program product is tangibly stored on a computer-readable medium and includes computer-executable instructions. The computer-executable instructions are executed when executed. At least one processor is caused to execute any of the data processing methods provided in the first aspect.

The data processing method of the embodiment of the present application can obtain the first GOOSE data packet received by the data receiver in the current data receiving cycle and the data received by the data receiver in the previous data receiving cycle of the current data receiving cycle through the network traffic analysis tool. The second GOOSE data packet is received, and the network traffic analysis tool can be used to analyze the first GOOSE data packet and the second GOOSE data packet, and determine the first verification information in the first GOOSE data packet and the second GOOSE data packet. Second verification information, the first verification information includes the first status number value of the first GOOSE data packet, the second verification information includes the second status number value of the second GOOSE data packet, and then it can be based on the first verification information and the second verification Comparison of information determines the security of the data recipient's current communication. Therefore, the data processing method in this application can quickly determine the security of the data recipient's current GOOSE communication in real time, and can more reliably determine whether there is potential in the current GOOSE communication. Security risks, so as to facilitate subsequent staff to deal with security risks in a timely manner, or automatically take measures to deal with security risks in a timely manner, thereby reducing the adverse effects of network security attacks during the GOOSE communication process.

Description of drawings

The following drawings are only intended to schematically illustrate and explain the present application and do not limit the scope of the present application.

Figure 1 shows an optional flow chart of the data processing method according to the embodiment of the present application.

Figure 2 shows a schematic diagram of the retransmission mechanism of the GOOSE protocol.

Figure 3 shows an optional structural schematic diagram of an electronic device according to an embodiment of the present application.

Reference signs:

300. Electronic equipment; 302. Processor; 304. Communication interface; 306. Memory; 308. Communication bus; 310. Program.

Detailed ways

In order to enable those in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the description The embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the examples in the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art should fall within the scope of protection of the embodiments of this application.

Figure 1 is an optional flow chart of the data processing method according to the embodiment of the present application. According to the first aspect of the embodiment of the present application, with reference to the flow chart in Figure 1, the data processing method provided in the embodiment of the present application includes the following steps S101, step S102 and step S103:

Step S101: Obtain the first GOOSE data packet received by the data receiver in the current data reception cycle and the second GOOSE data packet received by the data receiver in the previous data reception cycle of the current data reception cycle through the network traffic analysis tool.

It should be noted that the data processing method in the embodiment of the present application can be executed by a computer device capable of data processing. The computer device can include one or more processing units, such as CPU, MCU, PLC, etc., or the data The processing method can also be executed and data processed based on cloud systems, edge computing systems, etc. It should be understood that there is no limitation on this in the embodiments of the present application.

In this application, the data receiver can be a device that receives the GOOSE data packet during the GOOSE communication process. After receiving the GOOSE data packet, it can perform actions in response to the data in the GOOSE data packet. For example, taking the data receiver as a relay as an example , after receiving the GOOSE data packet, it can respond to the data in it to maintain the status of the relay coil being energized or the relay coil being de-energized, etc.

Corresponding to the data receiver, the data sender is the other party that performs GOOSE communication with the data receiver, which can also be a device. In a normal GOOSE communication process, the data sender sends the GOOSE data packet to the data receiver. For example, the GOOSE data packet may be sent to the data receiver through a switch (such as an Ethernet switch). In this process, network attackers can tamper with or perform other operations on the GOOSE data packets received by the data receiver, causing abnormalities in the GOOSE data packets received by the data receiver, making it difficult for the data receiver to correctly respond to the data in the GOOSE data packet and perform normal actions. This in turn affects the communication process and subsequent device control process to complete the purpose of network security attacks.

The network traffic analysis tool in this application can be used as an IDS (Intrusion Detection Systems, intrusion detection system), which can monitor and capture network traffic data (such as GOOSE data packets received by the data receiver, etc.). This application uses a network traffic analysis tool as an IDS. Compared with the conventional means of using firewalls to intercept data packets, it does not cross borders on any links and can work without the need for network traffic to flow through it. It only needs to be hooked up to The network traffic of concern (that is, the network traffic that needs to be captured) must be on the link that must pass through, so it will not affect the connectivity and stability of the network, nor will it affect the speed of the original link at all.

The network traffic analysis tool in this application can be implemented with any existing network traffic analyzer. For example, in some optional embodiments, the network traffic analysis tool can be implemented with Zeek network traffic analyzer. Zeek is a passive, open source network traffic analyzer commonly used as a network security monitoring tool that can easily capture network data. It provides a flexible framework that allows developers to analyze the network traffic in different protocols (such as GOOSE, HTTP, FTP, SSH, DNP3, etc.) to create different plug-ins to achieve different functions.

In this application, the data receiver receives one GOOSE data packet within one data reception cycle. For GOOSE communication, therefore the first GOOSE data packet received by the data receiver in the current data reception cycle and the second GOOSE data packet received by the data receiver in the previous data reception cycle of the current data reception cycle are data receptions. Two consecutive GOOSE data packets received by the party.

It should be understood that due to the characteristics of the GOOSE protocol, the length of time of two consecutive data reception cycles may not be the same. In GOOSE communication, in order to ensure the reliability of high-speed communication, GOOSE communication uses a retransmission mechanism. Referring to the schematic diagram of the retransmission mechanism of the GOOSE protocol shown in Figure 2, GOOSE messages (including GOOSE data packets) appear in a new event 200 (for example, the data sender is a device, and the new event can be its switch state change, motor blockage, etc. A physical event is converted into an abstract software event) and is immediately published to the data receiver, which then retransmits the same state as long as it persists. In these transmissions, the time interval between each adjacent GOOSE message transmission (i.e., the interval from the time when one GOOSE message starts to be sent to the time when another GOOSE message starts to be sent) increases exponentially (as shown in Figure 2 , the time intervals T1, T2, T3, T0, etc. increase successively), and stop changing when the time interval reaches the steady-state value T0. The values of T1, T0, and exponential increment can be set during the initial configuration of the data sender before GOOSE communication starts. In Figure 2, T1 is the minimum retransmission time after a new event occurs, T2 and T3 are the retransmission times before reaching the stable value T0, and T0 is the retransmission time in the stable state (no new events occur). During T0 If a new event occurs, T0 can be shortened (refer to (T0) in Figure 2, after the new event 200 occurs, T1 starts directly). It should be understood that the retransmission mechanism of the GOOSE protocol in Figure 2 should belong to the existing technology, and its details will not be described again here. For the data receiver, the different time intervals T1, T2, T3, T0, etc. can be regarded as data reception cycles.

Step S102: Use a network traffic analysis tool to analyze the first GOOSE data packet and the second GOOSE data packet, and determine the first verification information in the first GOOSE data packet and the second verification information in the second GOOSE data packet, where, The first verification information includes the first status number value of the first GOOSE data packet, and the second verification information includes the second status number value of the second GOOSE data packet.

Using a network traffic analysis tool to analyze the first GOOSE data packet and the second GOOSE data packet can be implemented using any data packet parsing algorithm, and is not particularly limited here.

In some optional embodiments, "Using a network traffic analysis tool to analyze the first GOOSE data packet and the second GOOSE data packet" in step S102 includes: integrating a pre-established data packet analysis plug-in into the network traffic analysis tool , the first GOOSE data packet and the second GOOSE data packet are analyzed through the data packet analysis plug-in.

Optionally, the pre-built packet analysis plug-in can be a DPA (Deep Packet Analyse) plug-in, which is integrated in a network traffic analysis tool (such as Zeek network traffic analyzer) and can implement deep packet analysis algorithms , when parsing the first GOOSE data packet, the first verification information in the first GOOSE data packet and the second verification information guaranteed by the second GOOSE data can be parsed out. In this way, it is easy to assist in determining the security of the current communication of the data recipient.

In this application, the first verification information at least includes the first status number value in the first GOOSE data packet, the second verification information at least includes the second status number value in the second GOOSE data packet, the first verification information and the second verification The information can be used in subsequent step S103 to determine the security of the current communication of the data recipient.

In the GOOSE protocol, GOOSE's APDU (Application Protocol Data Unit) includes two 32-bit counters, namely the status number counter (StNum) and the sequence number counter (SqNum). These two counters are used to support The retransmission mechanism of the GOOSE protocol. When communicating with GOOSE, each new event (such as the aforementioned new event, for example, the data sender is a device, and physical events such as switch state changes and motor blockage are converted into abstract software events) will result in a corresponding data packet. Or multiple values change. During GOOSE communication, the data sender responds to the change by publishing a GOOSE message with incrementing StNum, that is, each time a value changes, StNum+1. Without any status change, the data sender transmits the same GOOSE message and only increases SqNum while StNum remains unchanged. Although the values of StNum, SqNum and the aforementioned T0 are all set on the data sender, the data receiver in GOOSE communication only responds to GOOSE messages whose StNum or SqNum (when StNum remains unchanged) is higher than the previous GOOSE message. It should be understood that the relevant content of StNum or SqNum of the GOOSE protocol should belong to the existing technology, and the details will not be described again here.

In this application, the first status number value is the value of the status number counter (StNum) in the first GOOSE data packet, and the second status number value is the value of the status number counter (StNum) in the second GOOSE data packet. For ease of description, the first status number value is denoted as StNum1 and the second status number value is denoted as StNum2 in the following.

Step S103: Based on the comparison of the first verification information and the second verification information, determine the security of the current communication of the data recipient.

Through the data processing method in this application, it is possible to obtain the first GOOSE data packet received by the data receiver in the current data receiving cycle and the data received by the data receiver in the previous data receiving cycle of the current data receiving cycle through the network traffic analysis tool. The second GOOSE data packet is received, and the network traffic analysis tool can be used to analyze the first GOOSE data packet and the second GOOSE data packet, and determine the first verification information in the first GOOSE data packet and the second GOOSE data packet. Second verification information, the first verification information includes the first status number value of the first GOOSE data packet, the second verification information includes the second status number value of the second GOOSE data packet, and then it can be based on the first verification information and the second verification Comparison of information determines the security of the data recipient's current communication. Therefore, the data processing method in this application can quickly determine the security of the data recipient's current GOOSE communication in real time, and can more reliably determine whether there is potential in the current GOOSE communication. Security risks, so as to facilitate subsequent staff to deal with security risks in a timely manner, or automatically take measures to deal with security risks in a timely manner, thereby reducing the adverse effects of network security attacks during the GOOSE communication process.

In this application, based on the comparison between the first verification information and the second verification information, while determining the security of the current communication of the data recipient, the type of potential security risks can also be determined at the same time, which is not limited here.

In some optional implementations, step S103 is "determine the security of the current communication of the data recipient based on the comparison of the first verification information and the second verification information", including: if the first status number in the first verification information If the difference between the value and the second status number value in the second verification information is greater than the first predetermined threshold, it is determined that there is a security risk in the current communication of the data receiver, and the type of security risk is determined as the status number value of the GOOSE data packet been tampered with.

Because when the data sender is conducting GOOSE communication with the data receiver normally, when the status number value changes, the status number value should increase sequentially according to the time sequence, that is, the first status number value of the first GOOSE data packet StNum1 The second status number value StNum2 of the second GOOSE data packet should satisfy: StNum1=StNum2+1. When the difference between the first status number value StNum1 and the second status number value StNum2 is too large, that is, the difference between the first status number value in the first verification information and the second status number value in the second verification information is When the difference is greater than the first predetermined threshold, it means that the status number value in the GOOSE data packet received by the data receiver has an abnormal mutation, and this abnormal mutation is often caused by an external network attacker inputting a GOOSE with a high StNum value to the data receiver. data packets, which caused the originally normal communication GOOSE data packets to be tampered with. Under the GOOSE protocol, the data receiver will receive and respond to GOOSE data packets with high StNum values (that is, GOOSE data packets input by external network attackers) during the current data reception cycle, and discard low StNum value packets sent by the data sender. GOOSE data packets (that is, GOOSE data packets during normal communication), thus causing the GOOSE data packets originally used for normal communication to be tampered with. In this case, it will have serious adverse effects on the communication between the data sender and the data receiver. External network attackers can directly attack the data receiver's subsequent data through tampered GOOSE data packets with high StNum values. GOOSE communications and equipment control processes are interfered with, seriously affecting the normal operation of equipment and/or the personal safety of staff.

In this application, the first predetermined threshold can be set according to the actual situation, for example, it can be 2, 10, 100, 500, 1000, 2000, etc., and is not specifically limited here.

Based on this, this application can effectively determine whether the status number value of the GOOSE data packet has been tampered with in this way, so as to facilitate subsequent staff to deal with the security risk in a timely manner, or automatically take measures to deal with the security risk in a timely manner. , thereby reducing the adverse effects of this security risk in the GOOSE communication process.

The following is an example of an actual network security attack. In this example, the data sender is a protective relay at a factory site. When equipment in a certain area of the factory site (for example, marked as the first area) fails, the relay coil loses power and the circuit breaker connected to it is de-energized. Trip to power off the equipment in the first area to ensure the safety of the equipment in the field area; the data receiver is the main relay at the factory site, which can trip the main circuit breaker connected to it through the loss of power in the relay coil to control The equipment in a larger area in the factory site (for example, recorded as the second area, and the second area may include the aforementioned first site area) is powered off to ensure the safety of the equipment in the second area. The protective relay (i.e. the data sender) can communicate with the main relay (i.e. the data receiver) through a switch (which can be an Ethernet switch). For example, if the equipment in the first area fails and the circuit breaker connected to the protection relay needs to trip, the protection relay sends a GOOSE data packet to the main relay through the switch to inform the main relay, so that the main relay will no longer cause the main relay to detect the fault after subsequent detection. Circuit breakers tripped to avoid widespread power outages. During a network attack, the network attacker intercepts the GOOSE data packet transmitted from the switch to the main relay, analyzes the GOOSE data packet, tamperes with the status number value StNum of the GOOSE data packet to a higher value, and then sends it to the main relay through the switch. The main relay will respond to the GOOSE data packet with a high StNum value tampered by the network attacker in accordance with the GOOSE protocol, and discard the GOOSE data packet with a low StNum value sent by the protection relay. Therefore, when the main relay subsequently detects the presence of a fault, it will make the connection The main circuit breaker tripped, causing equipment in the second area to lose power, causing a wider power outage. Obviously, in this application, the status of the GOOSE data packet is determined by determining whether the difference between the first status number value in the first verification information and the second status number value in the second verification information is greater than the first predetermined threshold. Whether the number value has been tampered with can facilitate subsequent staff to deal with the security risk in a timely manner, or automatically take measures to deal with the security risk in a timely manner, thereby reducing the adverse effects of this security risk in the GOOSE communication process (corresponding to This example, i.e. avoid tripping the main circuit breaker to prevent a wider outage). Of course, this example is only used to facilitate understanding and does not serve as any limitation on this application.

In some optional implementations, the first verification information also includes the first sequence value number of the first GOOSE data packet, and the second verification information also includes the second sequence value number of the second GOOSE data packet; step S103 is "based on Comparison of the first verification information and the second verification information to determine the security of the current communication of the data recipient", including: if the first serial number value in the first verification information is equal to the second serial number value in the second verification information The difference between them is greater than the second predetermined threshold, and the first status number value in the first verification information is equal to the second status number value in the second verification information, then it is determined that there is a security risk in the current communication of the data receiver, and the security The type of risk is determined to be that the sequence number value of the GOOSE packet is tampered with.

In this application, for the convenience of description, the first sequence number value of the first GOOSE data packet is referred to as SqNum1, and the second sequence number value of the second GOOSE data packet is referred to as SqNum2. From the above, the first sequence number value of the first GOOSE data packet and the second sequence number value of the second GOOSE data packet can both be obtained by parsing the aforementioned data packet analysis plug-in integrated in the network traffic analysis tool.

Because when the data sender is conducting GOOSE communication with the data receiver normally, when the status number value remains unchanged and the sequence number changes, the sequence number value should increase sequentially in chronological order, that is, the first number of the first GOOSE data packet The sequence number value SqNum1 and the second sequence number value SqNum2 of the second GOOSE data packet should satisfy: SqNum1=SqNum2+1. When the difference between the first serial number value SqNum1 and the second serial number value SqNum2 is too large, that is, the difference between the first serial number value SqNum1 in the first verification information and the second serial number value SqNum2 in the second verification information is When the difference between is greater than the first predetermined threshold, it means that the sequence number value in the GOOSE data packet received by the data receiver undergoes an abnormal mutation, and this abnormal mutation is often caused by an external network attacker inputting a high SqNum value to the data receiver. Caused by GOOSE packets. Under the GOOSE protocol, when the status number value StNum remains unchanged, the data receiver will receive and respond to the GOOSE data packet with a high SqNum value (that is, the GOOSE data packet input by the external network attacker) in the current data reception cycle, and discard the data. The GOOSE data packet with a low SqNum value sent by the sender (that is, the GOOSE data packet during normal communication), thus causing the original normal GOOSE data packet to be tampered with. In this case, it will have serious adverse effects on the communication between the data sender and the data receiver. External network attackers can directly attack the data receiver's subsequent data through tampered GOOSE data packets with high SqNum values. GOOSE communications and equipment control processes are interfered with, seriously affecting the normal operation of equipment and/or the personal safety of staff.

In this application, the second predetermined threshold can be set according to the actual situation, for example, it can be 2, 10, 50, 100, 200, 500, 1000, etc., which is not specifically limited here.

Based on this, this application can effectively determine whether the sequence number value of the GOOSE data packet has been tampered with in this way, so as to facilitate subsequent staff to deal with the security risk in a timely manner, or automatically take measures to deal with the security risk in a timely manner. , thereby reducing the adverse effects of this security risk in the GOOSE communication process.

In some optional implementations, the data processing method also includes: obtaining the first device operating parameters in the current data receiving cycle and the second device operating parameters in the previous data receiving cycle of the current data receiving cycle; step S103 is "Based on the comparison of the first verification information and the second verification information, determine the security of the current communication of the data recipient", including: if the first status number value in the first verification information and the second status number in the second verification information If the difference between the values is greater than the third predetermined threshold, and the first device operating parameter is not equal to the second device operating parameter, it is determined that there is a security risk in the current communication of the data recipient, and the type of security risk is determined to be that the data recipient is injected Equipment failure data.

As mentioned before, both the data receiver and the data sender in this application can be equipment, such as relays, motors, etc., and the equipment operating parameters can refer to the operating parameters of relays, motors, switching equipment, etc. Taking relays as an example, it can It is a parameter that indicates whether the relay coil of the relay is energized. Taking a motor as an example, it can be a parameter that indicates whether the motor is rotating. Taking a switching device as an example, it can be a switching status parameter of the switching device.

Optionally, the first device operating parameters can be parsed from the first GOOSE data packet, and the second device operating parameters can be parsed from the second GOOSE data packet, and both can be obtained by the aforementioned network traffic analysis tool integrated into the network traffic analysis tool. It can be obtained by parsing the data packet analysis plug-in, or it can be obtained through other methods, which is not limited by this application. Optionally, the third predetermined threshold can be set according to the actual situation. For example, the third predetermined threshold can be set to 1, or it can be 2, 5, 10, etc., which is not specifically limited here.

Specifically, when the data sender is in normal GOOSE communication with the data receiver, when the status number value changes, the status number value should increase sequentially in chronological order, that is, the first status number of the first GOOSE data packet The value StNum1 and the second status number value StNum2 of the second GOOSE data packet should satisfy: StNum1=StNum2+1. When the difference between the first status number value in the first verification information and the second status number value in the second verification information is greater than the third predetermined threshold, and the difference between the first equipment operating parameter and the second equipment operating parameter is When the values are not equal, it can be considered that the data receiver has been injected with device fault data by an external network attacker. This device fault data will interfere with the normal operation of the data receiver. Based on this, in this application, by combining the first device operating parameters and the second device operating parameters at the application level, and combining the comparison of the first status number value and the second status number value, the data reception can be more conveniently and accurately determined. Whether the equipment failure data is injected into the party, so as to facilitate subsequent staff to deal with the security risk in a timely manner, or automatically take measures to deal with the security risk in a timely manner, thereby reducing the adverse effects of this security risk in the GOOSE communication process.

In some optional implementations, the data processing method also includes: obtaining the first timestamp parameter in the current data reception cycle and the second timestamp parameter in the previous data reception cycle of the current data reception cycle; step S103 is "Determining the security of the current communication of the data recipient based on the comparison of the first verification information and the second verification information" includes: if the first status number value in the first verification information and the second status number value in the second verification information If the difference between them is greater than the fourth predetermined threshold, and the first timestamp parameter is less than or equal to the second timestamp parameter, it is determined that there is a security risk in the current communication of the data receiver, and the type of security risk is determined to be the current communication of the data receiver. The communication timing of the communication process is disrupted.

In this application, the first timestamp parameter can be obtained by parsing the first GOOSE data packet, and the second timestamp parameter can be obtained by parsing the second GOOSE data packet, and both of them can be obtained by the aforementioned network traffic analysis tool. It can be obtained by parsing the data packet analysis plug-in, or it can be obtained through other methods, which is not limited by this application.

Specifically, under normal circumstances, the timestamp parameter can indicate the sending time of the GOOSE data packet. According to chronological order, the sending time of the first GOOSE data packet is later than the second GOOSE data packet. The timestamp parameter of the first GOOSE data packet Should be greater than the first timestamp parameter. Therefore, if the timestamp parameter of the first GOOSE data packet is less than or equal to the second timestamp parameter, and the difference between the first status number value in the first verification information and the second status number value in the second verification information is greater than The fourth predetermined threshold indicates that the communication timing of the current communication process between the data sender and the data receiver is confused, and the data sender resends the GOOSE message that has been sent to the data receiver, which will affect the data receiver. The communication and data receiver's actions based on the first GOOSE data packet will have adverse effects.

In this application, the fourth predetermined threshold can be set according to actual conditions, and is not limited here. Generally, the fourth predetermined threshold may be set to 1.

Based on this, this application can effectively determine whether the communication timing of the current communication process of the data recipient is chaotic in this way, so as to facilitate the subsequent staff to deal with the security risk in a timely manner, or automatically take measures to deal with the security risk in a timely manner. Risks are dealt with to reduce the negative impact of this security risk in the GOOSE communication process.

In some optional implementations, the data processing method also includes: if it is determined that the number of times the data recipient has received the same GOOSE data packet within a predetermined time period is greater than the predetermined number threshold, determining that there is a security risk in the current communication of the data recipient. , and the type of security risk is determined to be that the data recipient is subject to a DoS flood attack.

In some implementations, it can be determined whether multiple GOOSE data packets are the same data packet by obtaining and detecting whether each status number value (StNum) in each GOOSE data packet is the same and whether each sequence number value (SqNum) is the same. . Alternatively, in other embodiments, it can be determined whether multiple GOOSE data packets are the same data packet by individually detecting whether each sequence number value (SqNum) in each GOOSE data packet is the same.

When the data receiver is subject to a DoS flood attack, an external network security attacker can maliciously send a large number of the same GOOSE data packets to the data receiver in a short period of time, which will prevent the data receiver from properly processing communications with the data sender. , thus causing security risks in current communications. In this application, the predetermined time period can be set according to the actual situation, for example, it can be 10 seconds, 30 seconds, 1 minute, 2 minutes, etc., and is not specifically limited here. The predetermined times threshold can also be set according to the actual situation, for example, it can be 50,000 times, 80,000 times, 100,000 times, etc., and is not specifically limited here. For example, assuming that the predetermined time period is 1 minute and the predetermined frequency threshold is 100,000 times, it is determined that the number of times the data receiver has received the same GOOSE data packet is greater than 100,000 times within 1 minute, then it is determined that the data receiver's current communication exists Security risk, and determine the type of security risk as the data recipient being subject to a DoS flood attack.

Based on this, this application can effectively determine whether the data receiver is subject to a DoS flood attack in this way, so as to facilitate subsequent staff to deal with the security risk in a timely manner, or automatically take measures to deal with the security risk in a timely manner, thereby Reduce the adverse effects of this security risk during GOOSE communication.

In some optional embodiments, the data processing method further includes: generating a log file indicating the determination result according to the determination result of the type of security risk, and sending the log file to an external monitoring unit.

Based on this, in this application, by generating a log file indicating the type of security risk and sending the log file to an external monitoring unit, it is possible for staff to better understand the security risk and take appropriate measures. This will facilitate subsequent staff to deal with security risks in a timely manner, thereby reducing the adverse effects of network security attacks during GOOSE communication.

In this application, the external monitoring unit can be a computer device (such as a host computer at the substation site, a worker's computer, etc.), a portable device (such as a worker's mobile phone, PAD, etc.), a cloud platform, or a software Monitoring platform is not restricted here. Optionally, in addition to indicating the determination result of the type of security risk, the log file can also record in detail the determination process and relevant details of the security risk, the source of network security attacks, etc., so that staff can conduct better analysis. deal with.

Or in some other embodiments, a notification message indicating the determination result of the type of security risk may be sent directly to the external monitoring unit without generating a log file, which is not limited here.

It can be understood that the above content is only some exemplary explanations of the data processing methods in the embodiments of the present application, and does not serve as any limitation on the embodiments of the present application.

Figure 3 shows a schematic structural diagram of an optional electronic device according to an embodiment of the present application. The embodiment of the present application does not limit the specific implementation of the electronic device 300. As an example, with reference to Figure 3, the electronic device 300 provided in the second aspect of the embodiment of the present application includes: a processor (processor) 302, a communication interface ( Communications Interface) 304, memory (memory) 306, and communication bus 308. in:

The processor 302, the communication interface 304, and the memory 306 complete communication with each other through the communication bus 308.

Communication interface 304 is used to communicate with other electronic devices or servers.

The processor 302 is used to execute the program 310. Specifically, it can execute the relevant steps in any of the foregoing data processing method embodiments.

Specifically, program 310 may include program code including computer operating instructions.

The processor 302 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present application. The one or more processors included in the smart device can be the same type of processor, such as one or more CPUs; or they can be different types of processors, such as one or more CPUs and one or more ASICs.

Memory 306 is used to store program 310. The memory 306 may include high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.

The program 310 can be specifically used to cause the processor 302 to execute the data processing method in any of the foregoing embodiments.

For the specific implementation of each step in the program 310, please refer to the corresponding description of the corresponding steps and units in any of the foregoing data processing method embodiments, and will not be described again here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described devices and modules can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be described again here.

According to a third aspect of the embodiments of the present application, embodiments of the present application provide a computer storage medium that stores instructions for causing a machine to execute the data processing method as described herein. Specifically, a system or device equipped with a storage medium may be provided, on which the software program code that implements the functions of any of the above embodiments is stored, and the computer (or CPU or MPU) of the system or device ) reads and executes the program code stored in the storage medium.

In this case, the program code itself read from the storage medium can implement the functions of any one of the above embodiments, and therefore the program code and the storage medium storing the program code form part of this application.

Examples of storage media for providing program codes include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), Tapes, non-volatile memory cards and ROM. Alternatively, the program code can be downloaded from the server computer via the communications network.

In addition, it should be clear that the above embodiments can be implemented not only by executing the program code read by the computer, but also by causing the operating system etc. operating on the computer to complete some or all of the actual operations through instructions based on the program code. function of any embodiment.

In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or written into the memory provided in the expansion module connected to the computer, and then based on the program code The instructions cause the CPU installed on the expansion board or expansion module to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

According to the fourth aspect of the embodiments of the present application, the embodiments of the present application further provide a computer program product, the computer program product is tangibly stored on a computer-readable medium and includes computer-executable instructions, and the computer can When executed, the execution instructions cause at least one processor to execute the data processing method provided by the above embodiments. It should be understood that each solution in this embodiment has the corresponding technical effects in the above method embodiment, and will not be described again here.

The electronic device 400/computer storage medium embodiment of the present application is basically similar to the relevant content and beneficial effects in the data processing method embodiment provided in the first aspect, so the description here is relatively brief. This can be understood by referring to the embodiments of the aforementioned data processing method.

It should be understood that the various steps described in the method embodiments of the present application can be executed in different orders and/or in parallel. Furthermore, method embodiments may include additional steps and/or omit performance of illustrated steps. The scope of the present application is not limited in this respect.

As used herein, the term "include" and its variations are open-ended, ie, "including but not limited to." The term "based on" means "based at least in part on." The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; and the term "some embodiments" means "at least some embodiments". It should be noted that the modifications of "one" and "multiple" mentioned in this application are illustrative and not restrictive. Those skilled in the art will understand that unless the context clearly indicates otherwise, it should be understood as "one or Multiple”.

It should be understood that expressions similar to “first” and “second” used in the embodiments of the present application may modify various components regardless of order and/or importance, but these expressions do not limit the corresponding components. The above expressions are only provided for the purpose of distinguishing one component from another component.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, and are not intended to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or to make equivalent substitutions for some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and spirit of the technical solutions of the embodiments of the present application. scope.

Claims

A data processing method, characterized by including:

Use the network traffic analysis tool to obtain the first GOOSE data packet received by the data receiver in the current data reception cycle and the second GOOSE data packet received by the data receiver in the previous data reception cycle of the current data reception cycle. ;

Use the network traffic analysis tool to analyze the first GOOSE data packet and the second GOOSE data packet to determine the first verification information in the first GOOSE data packet and the second GOOSE data packet. Second verification information, wherein the first verification information includes the first status number value of the first GOOSE data packet, and the second verification information includes the second status number value of the second GOOSE data packet;

Based on the comparison of the first verification information and the second verification information, the security of the current communication of the data recipient is determined.
The data processing method according to claim 1, using the network traffic analysis tool to analyze the first GOOSE data packet and the second GOOSE data packet includes:

Integrate a pre-established data packet analysis plug-in into the network traffic analysis tool, and use the data packet analysis plug-in to analyze the first GOOSE data packet and the second GOOSE data packet.
The data processing method according to claim 1, wherein determining the security of the current communication of the data recipient based on the comparison of the first verification information and the second verification information includes:

If the difference between the first status number value in the first verification information and the second status number value in the second verification information is greater than the first predetermined threshold, it is determined that the current communication of the data recipient is safe. Risk, and determine the type of security risk as the status number value of the GOOSE data packet being tampered with.
The method of claim 1, wherein the first verification information further includes a first sequence number of the first GOOSE data packet, and the second verification information further includes a second sequence of the second GOOSE data packet. value number;

Determining the security of the current communication of the data recipient based on the comparison of the first verification information and the second verification information includes:

If the difference between the first serial number value in the first verification information and the second serial number value in the second verification information is greater than a second predetermined threshold, and the first serial number value in the first verification information If the status number value is equal to the second status number value in the second verification information, it is determined that there is a security risk in the current communication of the data receiver, and the type of security risk is determined to be that the sequence number value of the GOOSE data packet has been tampered with.
The method according to claim 1, characterized in that the method further includes: obtaining the first device operating parameter in the current data receiving cycle and the second device operating parameter in the previous data receiving cycle of the current data receiving cycle. Equipment operating parameters;

Determining the security of the current communication of the data recipient based on the comparison of the first verification information and the second verification information includes:

If the difference between the first status number value in the first verification information and the second status number value in the second verification information is greater than the third predetermined threshold, and the first equipment operating parameter is not equal to the If the second device operating parameter is determined, it is determined that there is a security risk in the current communication of the data recipient, and the type of the security risk is determined to be equipment failure data injected into the data recipient.
The method according to claim 1, characterized in that the method further includes: obtaining the first timestamp parameter in the current data reception cycle and the second time stamp parameter in the previous data reception cycle of the current data reception cycle. timestamp parameter;

Determining the security of the current communication of the data recipient based on the comparison of the first verification information and the second verification information includes:

If the difference between the first status number value in the first verification information and the second status number value in the second verification information is greater than the fourth predetermined threshold, and the first timestamp parameter is less than or equal to If the second timestamp parameter is used, it is determined that there is a security risk in the current communication of the data recipient, and the type of the security risk is determined to be confusion in the communication timing of the current communication process of the data recipient.
The method of claim 1, further comprising:

If it is determined that the number of times the data recipient has received the same GOOSE data packet within a predetermined time period is greater than the predetermined number threshold, it is determined that there is a security risk in the current communication of the data recipient, and the type of security risk is determined as the data The receiver is subject to a DoS flood attack.
The method according to any one of claims 3-7, characterized in that the method further includes:

According to the determination result of the type of security risk, a log file indicating the determination result is generated, and the log file is sent to the external monitoring unit.
An electronic device (300), characterized by including: a processor (302), a communication interface (304), a memory (306) and a communication bus (308), the processor (302), the communication interface (308) 304) and the memory (306) complete communication with each other through the communication bus (308);

The memory (306) is used to store at least one executable instruction, and the executable instruction causes the processor (302) to perform operations corresponding to the method described in any one of claims 1-8.
A computer-readable storage medium, characterized in that computer instructions are stored on the computer-readable storage medium. When executed by a processor, the computer instructions cause the processor to execute any one of claims 1-8. method described in the item.
A computer program product, characterized in that the computer program product is tangibly stored on a computer-readable medium and includes computer-executable instructions that, when executed, cause at least one processor to perform according to the rights The method described in any one of claims 1-8.