With the rapid development of power transmission and transformation equipment automation and smart substation construction

the hidden danger of grid information security is increasingly prominent. Accurate and reliable traffic modeling and anomaly detection method of substation communication network(SCN)have become very important to prevent network security problems and identify cyber attacks. Based on the analysis of behavior characteristics of network traffic on the control layer of substation station

this paper proposes the fractional autoregressive integrated moving average(FARIMA)model to construct the threshold model for network traffic. Aiming at the typical cyber-attack mode and traffic anomaly characteristics of substation

the traffic data on the control layer of an actual substation station is analyzed based on the operation state assessment algorithm. And the probability of typical network anomaly is calculated. Finally

the safety situation evaluation of the substation is realized under the cyber attacks.