工控运维中基于语义分析的智能电网控制攻击防御

Smart Grid Control Attack Defense Based on Semantic Analysis in Industrial Control Operation and Maintenance

为了降低控制相关攻击对智能电网的威胁,在数据采集与监视控制(supervisory control and data acquisition,SCADA)系统中,提出一种语义分析框架,利用智能电网的信息和物理工控设备,检测控制相关攻击。首先,对控制网络进行监控,识别控制命令,并从网络提取出与控制命令相关的语义和更新的测量值,并评估命令的物理后果;然后,采用自适应通用潮流分析算法,从控制命令提取出语义信息,并调整参数。在IEEE24节点、28节点和38节点系统以及一个2730节点系统上进行实验,结果表明:与交流潮流相比,所提算法将24节点和38节点系统的检测延迟均降低了约50%,将2730节点系统检测延迟降低了66%,平均漏警率为0.01%,最差情况下误警率为0.78%。

To reduce the threat of control-related attacks on the smart grid, a semantic analysis framework is proposed in supervisory control and data acquisition(SCADA) system, in which the smart grid information and physical industrial control equipment are used to detect and defend against such attacks. Firstly, the control network is monitored to identify the control commands. Also the semantics and updated measurements related to the control commands are extracted from the network so as to evaluate the physical consequences of the commands. Then through the application of the general self-adaptive power flow analysis algorithm, the semantics information is extracted from the control commands to adjust the parameters. Case studies are carried out on the IEEE 24-node, 28-node and 38-node system and a 2 730-node system respectively. The results show that, compared with AC algorithm, the proposed algorithm reduces the detection delay of 24-node and 38-node systems by about 50% and that of 2 730-node systems by66%. The average fault alarm rate is 0.01%, and the fault dismissal rate is 0.78% at the worst case.