基于Spark的电网工控系统流量异常检测平台

Flow Anomaly Detection Platform for Power Grid Industrial Control System Based on Spark

针对传统的电力网络流量检测安全预警系统在面对海量高维度数据时,其在精度、实时性、扩展性以及效率上都无法满足需求的问题,建立出一种基于Spark的电网工控系统流量异常检测平台.该平台以Spark为计算框架,主要由数据采集与网络流量深度包检测协议解析模块,实时计算数据分析处理模块,安全预警预测模块和数据存储模块组成,为流量异常检测提出了一套完整的流程.实验结果表明,该平台能够有效地检测出异常流量,做出安全预警,方便工作人员及时做出决策,这充分说明该平台非常适用于电力控制系统,能够应对海量高维复杂数据做出实时分析以及安全预警,极大地提高了电网工控系统的安全性能.

Aiming at the problem that the traditional power network traffic detection and security warning system cannot meet the demand in terms of accuracy, timeliness, expansibility, and efficiency in facing of massive high-dimensional data, a Spark based traffic anomaly detection platform for power grid industrial control system is established. The platform takes Spark as its computing framework, which is mainly composed of data acquisition and network traffic deep packet detection protocol parsing module, real-time computing data analysis and processing module, security warning and prediction module, and data storage module, to complete process for traffic anomaly detection. Experimental results show that the platform can effectively detect the abnormal flow, make the safety warning, convenient for staff to make decisions in time. This fully shows that the platform is very suitable for electric control system, can deal with massive amounts of high-dimensional complex data real time analysis and early warning, greatly improve the safety performance of the power grid control system.