| The electric power industrial control system is one of the important components of the industrial Internet,which is of critical significance to the security and stable operation of power grid.The main consideration in the early construction of electric power industrial control system were the system performance and practical utility,which were more closed in the physical sense.With the advancement of industrial control system standardization and network construction,the electric power industrial control system is gradually interconnected with the outside world,and with this comes the increasing network security threat,and it is urgent to strengthen the network security protection of the electric power industrial control system.As a widely used security protection strategy,traffic anomaly detection technology can analyze network traffic and diagnose anomalies in the system in real time.However,for electric power industrial control systems,the communication protocols used are mostly specialized and private.Due to the lack of systematic format and rules,it is difficult to detect abnormalities directly,and anomaly detection using Support Vector Machines(SVM)is easily affected by parameter selection.There is an urgent need to propose a more effective flow anomaly detection method for electric power industrial control systems.Therefore,this paper constructs a rule base for anomaly detection of common electric power industrial control protocols,and combines the Immune Algorithm(IA)with the SVM,and proposes the IA-SVM algorithm to improve anomaly detection recognition rate.The main work and innovations of this paper are as follows.A rule base for traffic anomaly detection in electric power industrial control system based on electric power communication protocol is constructed.In response to the problem of the privacy of electric power industrial control system protocols,the in-depth analysis of 7 commonly used electric power industrial control protocols,such as IEC102,IEC104,PMU,State Grid 103,NARI Jibao 103,NARI Stable 103,CDT,is carried out.Based on the format of the communication protocol and the requirements of communication rules,a traffic anomaly detection rule base is established,and experiments are carried out by manually constructing abnormal packets.The results show that the detection accuracy of known anomalies using the rule base can reach100%.In the actual operation of the electric power industrial control system,due to the existence of some unknown anomalies,the anomaly detection rule base alone cannot detect the anomalies other than the rules,and the abnormal traffic will be falsely reported as normal.Machine learning algorithms can effectively solve such problems.Therefore,a flow anomaly detection method based on IA-SVM in electric power industrial control system is proposed.Aiming at the problem that the direct rules cannot identify unknown anomalies and the effect of the SVM is greatly affected by the parameters,an Immune Algorithm is proposed to optimize the parameters of the Support Vector Machine,and a traffic anomaly detection method based on IA-SVM is proposed.Experiments are carried out with the real flow data collected on the substation site.First,the global optimization ability of the Immune Algorithm is verified,and then a complete set of power grid data flow preprocessing process is designed.Finally,the experimental results show that the average traffic recognition rate of the anomaly detection model can reach 93.17%,and it has good generalization ability. |
