Research On Abnormal Detection Of Substation Network Based On DPI

With the continuous development of electric power construction,intelligent substation has become a key part of smart grid,and it is an important development direction of power grids in the future.Interconnection between substation industrial control systems has become inevitable,and dedicated platforms and protocols are gradually being opened.As a result of the replacement with the agreement,the security risks have increased.IEC61850 is a unified standard for substation automation systems,which coinects almost all intelligent electronic devices within the substation.Therefore,it is necessary to deeply analyze the communication protocol used by the substation network,and clarify its operational behavior on the equipment,which may endanger the substation.The operational behavior of safe operation is blocked in time to improve the reliability of the safe operation of the substation control system.This article takes this as a starting point.The main research work is as follows:Firstly,this paper analyzes the security risks in the substation industrial control system,deeply studies the IEC61850 conmunication protocol,including the content and characteristics of the protocol,and understands the substation network communication architecture based on the IEC61850 standard.Secondly,since IEC61850 includes multiple communication protocols,this paper only uses the GOOSE protocol in the IEC61850 communication protocol as an example to carry out key analysis.The communication architecture of GOOSE protocol is described.The frame structure of GOOSE is analyzed in detail,the key content of the message is fully understood,and the GOOSE control block and its corresponding services are discussed.Finally,based on the theory of GOOSE message,the method of detecting the abnormality of GOOSE protocol by using deep packet inspection technology is studied.The working principle and process of capturing GOOSE message based on Libpcap are studied.The GOOSE message is packaged and unpacked according to IEC61850.The configuration file in the statute gives the judgment method of common abnormal events in the transmission process of GOOSE messages,and the effectiveness of this method is verified by experiments.