Research And Implementation Of Intelligent Substation Network Anomaly Detection Method

Under the vigorous promotion and promotion of "Made in China 2025" and "Industry 4.0",China’s industry has developed rapidly.With the application of information technology and network technology to the power network of power systems,it has gradually broken the traditional power industrial control network.The relatively closed state,because most industrial control network protocols did not consider security issues at the beginning of design,making the security of industrial control networks face a severe test.among the industrial control systems,the power industry is the most widely used,among which substation automation accounts for about 40% of the entire industrial control system.As an important part of the smart grid construction,the application of smart substations provides the guarantee for smart grids.However,more research and applications focus on the realization of new functions after the introduction of informatization.The global nature of smart substations in a globalized context lacks sufficient consideration.This paper takes the power system network as the research object,mainly focusing on the network security issues of substation automation and remote dispatch automation,combining the periodicity of industrial control networks and the time-sequence characteristics of traffic packets,and proposes an abnormal detection method for industrial control network traffic based on LSTM networks Used to detect network abnormalities in smart substations.First collect power network traffic data through the mirror port,then perform in-depth analysis on the collected data packets,use the parsed original fields to construct the features required for the timing prediction model,and finally train the prediction model,that is,the model learns the Normal traffic characteristic value,and then predict the traffic characteristic value at the next moment.On the premise that the model has a high accuracy on the training set,the predicted value of the model can be considered as the normal value.By comparing the predicted value and the actual value of the model,whether there is abnormal traffic on the network.The experiments show that the time series prediction model proposed in this paper can be used to detect network anomalies in the power system network.At the same time,because the method calculates the predicted value in advance,the detection efficiency is greatly improved on the premise of ensuring the recognition rate.The intelligent substation network online detection is implemented using a distributed cluster built with big data technology.The platform is designed as a threetier structure.The distributed file system HDFS provided by Hadoop and unified resource scheduling Yarn serve as the bottom layer of the platform system.The realtime calculation engine Flink and depth The learning framework TensorFlow is the middle engine layer,which connects the bottom layer and the middle layer through the Kafka message queue,and the uppermost platform layer provides real-time network anomaly detection.The experimental results show that through the use of distributed architecture and timing prediction model,the detection efficiency of network anomalies is greatly improved.