基于纵深防御的电力信息安全监测系统设计

Design of power information security monitoring system based on defense in depth

以往使用的入侵检测系统、电力专用安全隔离装置、加密认证装置对未知攻击无法精准捕获攻击点,导致监测效果较差,文中提出了基于纵深防御的电力信息安全监测系统。使用事件生成器可将预过滤事件传递给事件收集格式化器,格式化器经过协议收集,对已知事件进行不同等级告警定义。在关联分析引擎的支持下,通过特征匹配找出已知事件发生的真正原因。利用TMS320LF2812DSP监控器,连接电脑端进行远程办公和管理。依据信息安全威胁类型设定纵深防御模式。利用白名单与规则匹配方式添加边界隔离条件,触发边界隔离机制。扫描漏洞,并结合遗传算法生成的测试用例发现漏洞。由实验结果可知,该系统攻击点捕捉精度始终高于80%,具有良好监控效果。

The use of intrusion detection system,power special security isolation device,encryption authentication device to unknown attacks can not accurately capture the attack point,resulting in poor monitoring effect.A power information security monitoring system based on defense in depth is proposed.The pre filtered events can be passed to the event collection formatter by using the event generator,and the formatter defines different levels of alarms for known events through protocol collection.With the support of association analysis engine,the real cause of known events can be found by feature matching.TMS320LF2812DSP monitor is used to connect the computer terminal for remote office and management.According to the types of information security threats,the defense in depth mode is set.By using white list and rule matching method,boundary isolation condition is added to trigger boundary isolation mechanism.Scanning vulnerabilities,combined with the test cases generated by genetic algorithm,to find vulnerabilities.The experimental results show that the system attack point capture accuracy is always higher than 80%,with good monitoring effect.