基于FARIMA模型的智能变电站通信流量异常分析

FARIMA Model Based Analysis of Communication Traffic Anomaly in Smart Substation

随着输变电设备自动化、变电站智能化建设的快速发展,电网信息安全隐患日益凸显。精确可靠的变电站通信网络流量模型建模和异常检测方法已成为预防网络安全问题和识别网络攻击的重要手段。文中在对变电站站控层网络流量行为特性进行分析的基础上,采用分形自回归积分滑动平均(FARIMA)模型对网络流量构建了阈值模型。针对变电站典型的网络攻击模式和流量异常特征,基于运行状态评估算法对某实际变电站站控层流量数据进行分析,并计算典型网络异常概率,从而实现了变电站在网络攻击情形下的安全态势评价。

With the rapid development of power transmission and transformation equipment automation and smart substation construction,the hidden danger of grid information security is increasingly prominent.Accurate and reliable traffic modeling and anomaly detection method of substation communication network(SCN)have become very important to prevent network security problems and identify cyber attacks.Based on the analysis of behavior characteristics of network traffic on the control layer of substation station,this paper proposes the fractional autoregressive integrated moving average(FARIMA)model to construct the threshold model for network traffic.Aiming at the typical cyber-attack mode and traffic anomaly characteristics of substation,the traffic data on the control layer of an actual substation station is analyzed based on the operation state assessment algorithm.And the probability of typical network anomaly is calculated.Finally,the safety situation evaluation of the substation is realized under the cyber attacks.