一种基于BF-DT-CUSUM算法的电网工控系统DDoS攻击检测方法

Efficient detection technology of DDoS attacks based on BF-DT-CUSUM algorithm in smart grid industrial control system

信息通信技术的高速发展使得国家电网已经迈进了智能化、信息化、自动化发展时代,然而同时智能电网中信息通信技术的广泛应用也为攻击者提供了更多的途径入侵和攻击电网工控系统。提出一种基于BloomFilter地址统计的动态阈值更新的改进型CUSUM(BF-DT-CUSUM)DDo S(distributed denial of service)入侵攻击检测方法,针对电网工控系统存在的DDoS攻击采用基于BloomFilter正常流量统计的动态阈值技术,同时改进了传统的EWMA算法使其可用于计算识别DDoS攻击用阈值,并对CUSUM(cumulative sum)算法作出一定变动,以此来更高效地检测电网工控系统DDoS攻击事件。仿真实验验证了该方法对电网工控系统中DDoS攻击具有较高的检测速度和精度,且系统开销小。

Rapid development of information and communication technology has led China National Grid Corp into the era of intelligent, informational and automated, simultaneously with wide application of information and communication technology in smart grid also providing more ways for attackers to invade and attack power system. A DDoS attacks detection method based on modified CUSUM with dynamic threshold was proposed according to Bloom Filter address statistics in smart grid. The proposed method used dynamic threshold technology based on Bloom Filter normal traffic statistics, and optimized traditional EWMA algorithm to identify threshold of DDoS attacks, finally modified CUSUM algorithm in order to efficiently detect DDoS attacks in smart grid. Simulation experiments demonstrate that proposed method has high detection speed and precision for DDoS attacks in smart grid, and the system overhead is small.