Risk Estimation of Cyber Threat to Substation Based on Cyber-net and Learning Algorithm

Zhiyuan YANG; Shipeng ZHANG; Hao SUN; Xiaohong GUAN

doi:10.7500/AEPS20191230009

您当前的位置：

首页 >

文章列表页 >

Risk Estimation of Cyber Threat to Substation Based on Cyber-net and Learning Algorithm

Cyber Energy Systems | 更新时间：2025-06-16

- Risk Estimation of Cyber Threat to Substation Based on Cyber-net and Learning Algorithm
- Automation of Electric Power Systems Vol. 44, Issue 24, Pages: 19-27(2020)
- 作者机构：
  
  1.中国能源建设集团广东省电力设计研究院有限公司，广东省广州市 510663
  2.智能网络与网络安全教育部重点实验室（西安交通大学），陕西省西安市 710049
- 作者简介：
- 基金信息：
- DOI：10.7500/AEPS20191230009
  CLC：
- Received：30 December 2019，
  
  Revised：2020-08-31，
  
  Published Online：28 September 2020，
  
  Published：25 December 2020
- 稿件说明：
移动端阅览
杨至元,张仕鹏,孙浩等.基于Cyber-net与学习算法的变电站网络威胁风险评估[J].电力系统自动化,2020,44(24):19-27.

YANG Zhiyuan,ZHANG Shipeng,SUN Hao,et al.Risk Estimation of Cyber Threat to Substation Based on Cyber-net and Learning Algorithm[J].Automation of Electric Power Systems,2020,44(24):19-27.
杨至元,张仕鹏,孙浩等.基于Cyber-net与学习算法的变电站网络威胁风险评估[J].电力系统自动化,2020,44(24):19-27. DOI： 10.7500/AEPS20191230009.

YANG Zhiyuan,ZHANG Shipeng,SUN Hao,et al.Risk Estimation of Cyber Threat to Substation Based on Cyber-net and Learning Algorithm[J].Automation of Electric Power Systems,2020,44(24):19-27. DOI： 10.7500/AEPS20191230009.

摘要

现有网络安全风险研究仍然存在基础概率不准确和严重性模型缺失等问题。文中首先基于变电站电力监控系统框架提出“边界-本体防护”模型来描述系统入侵威胁，根据历史数据的机器学习结果完善基础入侵概率模型，基于广义随机佩式网和电力监控系统的网络安全拓扑得到特定状态转移图Cyber-net。然后，根据系统的运行结果和马尔可夫链稳态概率量化电力系统信息安全和工程安全的相关关系，提出网络安全综合风险评估模型，并通过暂态故障计算提高了风险模型的准确性。最后，通过算例仿真和灵敏性分析验证了模型的有效性和适用性，总结出了可行防御策略和潜在应用场景。

Abstract

There still exist problems in the current risk analysis on cyber security such as the inaccuracy of fundamental probability and the lack of severity models. First

based on the framework of the power monitoring system in the substation

this paper proposes a “perimeter-device protection” model to describe the cyber threat of intrusion and improve the preliminary invasion probability model with the machine learning results based on historical data. Cyber-net as a specific state transition diagram is achieved based on the network security topology of general stochastic Petri net (GSPN) and power monitoring system. Then

a comprehensive risk estimation model for cyber security is proposed based on system operation results and the Markov chain steady-state probability to quantify the correlation between information and physical security of the power system. The accuracy of the risk model is improved by transient fault calculation. Finally

the feasibility and effectiveness of the model are verified by simulation and sensitivity analysis

and the feasible defense strategies and potential application scenarios are summarized.

关键词

Keywords

references

U .S. Government Accountability Office . Critical infrastructure protection： actions needed to address significant cybersecurity risks facing the electric grid ［EB/OL］. ［ 2019-08-26 ］. https：//www.gao.gov/products/GAO-19-332 https://www.gao.gov/products/GAO-19-332 .

刘烃，田决，王稼舟，等 . 信息物理融合系统综合安全威胁与防御研究［J］. 自动化学报， 2019 ， 45 （ 1 ）： 5 - 24 .

LIU Ting ， TIAN Jue ， WANG Jiazhou ， et al . Integrated security threats and defense of cyber-physical systems ［J］. Acta Automatica Sinica ， 2019 ， 45 （ 1 ）： 5 - 24 .

ALSHAMRANI A ， MYNENI S ， CHOWDHARY A ， et al . A survey on advanced persistent threats： techniques， solutions， challenges， and research opportunities ［J］. IEEE Communications Surveys & Tutorials ， 2019 ， 21 （ 2 ）： 1851 - 1877 .

SUN C C ， HAHNA A ， LIU C C . Cyber security of a power grid： state-of-the-art ［J］. Electrical Power and Energy Systems ， 2018 ， 99 （ 1 ）： 45 - 56 .

SOMMESTAD T ， EKSTEDT M ， NORDSTRÖM L . Modeling security of power communication systems using defense graphs and influence diagrams ［J］. IEEE Transactions on Power Delivery ， 2009 ， 24 （ 4 ）： 1801 - 1808 .

MCQUEEN M A ， BOYER W F ， FLYNN M A ， et al . Time-to-compromise model for cyber risk reduction estimation ［C］// Quality of Protection Workshop ， September 1 ， 2005 ， Milan ， Italy： 49 - 64 .

ZHANG Y ， WANG L ， XIANG Y ， et al . Inclusion of SCADA cyber vulnerability in power system reliability assessment considering optimal resources allocation ［J］. IEEE Transactions on Power Systems ， 2106 ， 31 （ 6 ）： 4379 - 4394 .

ZHANG Y ， WANG L ， XIANG Y ， et al . Power system reliability evaluation with SCADA cybersecurity considerations ［J］. IEEE Transactions on Smart Grid ， 2015 ， 6 （ 4 ）： 1707 - 1721 .

郭创新，陆海波，俞斌，等 . 电力二次系统安全风险评估研究综述［J］. 电网技术， 2013 ， 37 （ 1 ）： 112 - 118 .

GUO Chuangxin ， LU Haibo ， YU Bin ， et al . A survey of research on security risk assessment of secondary system ［J］. Power System Technology ， 2013 ， 37 （ 1 ）： 112 - 118 .

HONG J ， LIU C C ， MANIMARAN G . Integrated anomaly detection for cyber security of the substations ［J］. IEEE Transactions on Smart Grid ， 2014 ， 5 （ 4 ）： 1643 - 1653 .

TIAN J ， TAN R ， GUAN X ， et al . Enhanced hidden moving target defense in smart grids ［J］. IEEE Transactions on Smart Grid ， 2019 ， 10 （ 2 ）： 2208 - 2223 .

DENG R ， ZHUANG P ， LIANG H . CCPA： coordinated cyber-physical attacks and countermeasures in smart grid ［J］. IEEE Transactions on Smart Grid ， 2017 ， 8 （ 5 ）： 2420 - 2430 .

TEN C W ， HONG J ， LIU C C . Anomaly detection for cybersecurity of the substations ［J］ IEEE Transactions on Smart Grid ， 2011 ， 2 （ 4 ）： 865 - 873 .

LIU R ， VELLAITHURAI C ， BISWAS S S . Analyzing the cyber-physical impact of cyber events on the power grid ［J］. IEEE Transactions on Smart Grid ， 2015 ， 6 （ 5 ）： 2444 - 2453 .

ASHOK A ， MANIMARAN G ， WANG J ， et al . Cyber-physical attack-resilient wide-area monitoring， protection， and control for the power grid ［J］. Proceedings of the IEEE ， 2017 ， 105 （ 7 ）： 1389 - 1407 .

TEN C W ， LIU C C ， MANIMARAN G . Vulnerability assessment of cybersecurity for SCADA systems ［J］. IEEE Transactions on Power Systems ， 2008 ， 23 （ 4 ）： 1836 - 1846 .

YANG Z ， TEN C W ， GINTER A . Extended enumeration of hypothesized substations outages incorporating overload implication ［J］. IEEE Transactions on Smart Grid ， 2018 ， 9 （ 6 ）： 6929 - 6938 .

YANG Z . Cyber-based contingency analysis and insurance implications of power grid ［D］. Houghton ， USA： Michigan Technological University ， 2018 .

YANG Z ， LIU Y ， CAMPBELL M ， et al . Premium calculation for insurance businesses based on cyber risks in IP-based power substations ［J］. IEEE Access ， 2020 ， 8 （ 1 ）： 78890 - 78900 .

高昆仑，辛耀中，李钊，等 . 智能电网调度控制系统安全防护技术及发展［J］. 电力系统自动化， 2015 ， 39 （ 1 ）： 48 - 52 .

GAO Kunlun ， XIN Yaozhong ， LI Zhao ， et al . Development and process of cybersecurity protection architecture for smart grid dispatching and control systems ［J］. Automation of Electric Power Systems ， 2015 ， 39 （ 1 ）： 48 - 52 .

国家发展改革委员会 . 电力监控系统安全防护规定［R］.2014.

National Development and Reform Commission . Provisions on the security protection of the electric power monitoring systems ［R］. 2014.

国家能源局 . 电力监控系统安全防护总体方案［R］.2015.

National Energy Administration . General planning on the security protection of power monitoring system ［R］. 2015.

中国南方电网有限责任公司 . 中国南方电网电力监控系统安全防护技术规范［R］.2015.

China Southern Power Grid Company Limited . Technical specifications for security protection of power monitoring system of China Southern Power Grid ［R］. 2015.

全国人民代表大会常务委员会 . 中华人民共和国网络安全法［R］.2017.

Standing Committee of the National People’s Congress . Cybersecurity law of the People’s Republic of China ［R］. 2017.

中国国家标准化管理委员会 . 信息安全技术网络安全等级保护基本要求［R］.2019.

Standardization Administration of the People’s Republic of China （SAC） . Information security technology evaluation requirement for classified protection of cybersecurity ［R］. 2019.

谢丽霞，王亚超，于巾博 . 基于神经网络的网络安全态势感知［J］. 清华大学学报（自然科学版）， 2013 ， 53 （ 12 ）： 1750 - 1760 .

XIE Lixia ， WANG Yachao . YU Jinbo. Network security situation awareness based on neural networks ［J］. Journal of Tsinghua University （Science and Technology）， 2013 ， 53 （ 12 ）： 1750 - 1760 .

中国信息物理系统发展论坛 . 信息物理系统白皮书［EB/OL］.［ 2017-03-01 ］. http：//www.cesi.ac.cn/201703/2251.html http://www.cesi.ac.cn/201703/2251.html .

China Cyber-Physical System Development Forum . Cyber-physical system white paper ［EB/OL］. ［ 2017-03-01 ］. http：//www.cesi.ac.cn/201703/2251.html http://www.cesi.ac.cn/201703/2251.html .

汤奕，陈倩，李梦雅，等 . 电力信息物理融合系统环境中的网络攻击研究综述［J］. 电力系统自动化， 2016 ， 40 （ 17 ）： 59 - 69 .

TANG Yi ， CHEN Qian ， LI Mengya ， et al . Overview on cyber-attacks against cyber physical power system ［J］. Automation of Electric Power Systems ， 2016 ， 40 （ 17 ）： 59 - 69 .

Industrial Control Systems Cyber Emergency Response Team （ICS-CERT） . Cyber-attack against Ukrainian critical infrastructure ［EB/OL］. ［ 2016-02-25 ］. https：//www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01 https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01 .

STAGGS J ， FERLEMANN D ， SHENOI S . Wind farm security： attack surface， targets， scenarios and mitigation ［J］. International Journal of Critical Infrastructure Protection ， 2017 ， 17 （ 1 ）： 3 - 14 .

The UCI KDD Archive . University of California， Irvine KDD cup［DB/OL］ . http：//kdd.ics.uci.edu/databases/kddcup99/kddcup99.html http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html .

PLATT J . Probabilistic outputs for support vector machines and comparison to regularized likelihood methods ［J］. Advances in Large Margin Classifiers ， 1999 ， 10 （ 1 ）： 61 - 74 .

University of New Brunswick . CIC-IDS-2017［DB/OL］ . https：//iscxdownloads.cs.unb.ca/iscxdownloads/CIC-IDS-2017/ https://iscxdownloads.cs.unb.ca/iscxdownloads/CIC-IDS-2017/ .

Security Repo . SecRepo/Data/System/auth.log［DB/OL］ . http：//www.secrepo.com/ http://www.secrepo.com/ .

BONNEAU J . Yahoo password frequency corpus［DB/OL］ . https：//figshare.com/articles/yahoo_password_frequency_corpus/2057937 https://figshare.com/articles/yahoo_password_frequency_corpus/2057937 .

ALI S ， SHAH R ， ISSAC B . Performance comparison of intrusion detection systems and application of machine learning to Snort system ［J］. Future Generation Computer Systems ， 2018 ， 80 （ 1 ）： 157 - 170 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Optimization Method for Maintenance Decisions on 220 kV Side of Substation Considering Collaboration of Transmission and Distribution

Reasoning Method for Multi-station Cooperative Operation Tickets on Master-station Side Based on Substation State Matrix

Modeling of Doubly-fed Wind Turbine with Rotor-side Converter Control and Mechanism Analysis of Subsynchronous Oscillation

Reserve Optimization and Real-time Scheduling of Frequency Regulation Ancillary Service with Participation of Flexible Resource on Demand Side

Related Author

LI Xinran

TANG Aihong

ZHANG Kanjun

TENG Jie

WANG Wenhao

YANG Huiyuan

ZHOU Kai

HU Hao

Related Institution

Electric Power Research Institute, State Grid Hubei Electric Power Co., Ltd.

School of Automation, Wuhan University of Technology

Maintenance Company of State Grid Hubei Electric Power Co., Ltd.

School of Electrical Engineering and Automation, Wuhan University

School of Electric Power, South China University of Technology

⁰