Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features

Ting YANG; Yucheng HOU; Liyuan ZHAO; Haibo PEN; Kai YUAN; Yi SONY

doi:10.7500/AEPS20200304005

您当前的位置：

首页 >

文章列表页 >

Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features

Basic Research | 更新时间：2025-06-16

- Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features
- Automation of Electric Power Systems Vol. 44, Issue 16, Pages: 79-86(2020)
- 作者机构：
  
  1.智能电网教育部重点实验室（天津大学），天津市 300072
  2.国网经济技术研究院有限公司，北京市 102209
- 作者简介：
- 基金信息：
  
  National Natural Science Foundation of China;National Key R&D Program of China;State Grid Corporation of China
- DOI：10.7500/AEPS20200304005
  CLC：
- Received：04 March 2020，
  
  Revised：2020-04-07，
  
  Published Online：17 June 2020，
  
  Published：25 August 2020
- 稿件说明：
移动端阅览
杨挺,侯昱丞,赵黎媛等.基于时-频域混合特征的变电站通信网异常流量检测方法[J].电力系统自动化,2020,44(16):79-86.

YANG Ting,HOU Yucheng,ZHAO Liyuan,et al.Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features[J].Automation of Electric Power Systems,2020,44(16):79-86.
杨挺,侯昱丞,赵黎媛等.基于时-频域混合特征的变电站通信网异常流量检测方法[J].电力系统自动化,2020,44(16):79-86. DOI： 10.7500/AEPS20200304005.

YANG Ting,HOU Yucheng,ZHAO Liyuan,et al.Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features[J].Automation of Electric Power Systems,2020,44(16):79-86. DOI： 10.7500/AEPS20200304005.

摘要

准确快速检测智能变电站通信网络异常流量是发现系统异常、实现安全态势感知和主动防御的关键技术，对保证智能电网安全稳定运行有着重要意义。文中提出了基于时-频域混合特征的智能变电站通信网络异常流量检测新方法。首先，设计了基于分形自回归积分滑动平均（FARIMA）流量模型和小波包分析方法的流量频域特征提取方法，并结合电力信息流时域特征构建时-频域混合特征集。进而，采用人工蜂群优化的支持向量机算法进行异常流量辨识。最后，基于某110 kV变电站的站内实际网络流量和CIC DDoS2019数据集、KDD99数据集进行仿真，结果表明所提算法对网络异常流量识别有更低的误判率和漏检率。

Abstract

Accurate and rapid identification of abnormal traffic in smart substation communication network is the primary key technology for rapid detection of system anomalies

and realization of safety situational awareness and active defense

which is of great significance to ensure safe and stable operation of smart grid. This paper proposes a new abnormal traffic detection method of smart substation communication network based on time-frequency domain mixed features. Firstly

a method of extracting the features of traffic in frequency domain is designed based on the fractional autoregressive integrated moving average (FARIMA) traffic model and the wavelet packet analysis method. In addition

combined with the time-domain features of power information flow

a mixed time-frequency domain feature set is constructed. Then the support vector machine (SVM) algorithm optimized by artificial bee colony (ABC) is used to identify the abnormal traffic. Finally

the simulation is conducted based on the network traffic in a 110 kV substation

the CIC DDoS2019 data set and the KDD99 data set. The results show that the proposed algorithm has low misjudging and missing rates in abnormal traffic detection.

关键词

Keywords

references

郝唯杰 , 杨强 , 李炜 . 基于FARIMA模型的智能变电站通信流量异常分析 [J]. 电力系统自动化 , 2019 , 43 ( 1 ): 158 - 167 .

HAO Weijie , YANG Qiang , LI Wei . FARIMA model based analysis of communication traffic anomaly in smart substation [J]. Automation of Electric Power Systems , 2019 , 43 ( 1 ): 158 - 167 .

王梓博 , 穆云飞 , 王宇飞 , 等 . 考虑多代理供电恢复系统通信失效的配电网CPS风险评估 [J]. 电力系统自动化 , 2016 , 40 ( 17 ): 51 - 58 .

WANG Zibo , MU Yunfei , WANG Yufei , et al . Cyber physical system risk assessment of distribution network considering communication failure of multi-agent system for power restoration [J]. Automation of Electric Power Systems , 2016 , 40 ( 17 ): 51 - 58 .

杨挺 , 翟峰 , 赵英杰 , 等 . 泛在电力物联网释义与研究展望 [J]. 电力系统自动化 , 2019 , 43 ( 13 ): 9 - 20 .

YANG Ting , ZHAI Feng , ZHAO Yingjie , et al . Explanation and prospect of ubiquitous electric power Internet of Things [J]. Automation of Electric Power Systems , 2019 , 43 ( 13 ): 9 - 20 .

汤奕 , 陈倩 , 李梦雅 , 等 . 电力信息物理融合系统环境中的网络攻击研究综述 [J]. 电力系统自动化 , 2016 , 40 ( 17 ): 59 - 69 .

TANG Yi , CHEN Qian , LI Mengya , et al . Overview on cyber-attacks against cyber physical power system [J]. Automation of Electric Power Systems , 2016 , 40 ( 17 ): 59 - 69 .

LI Yuancheng , QIU Rixuan , JING Sitong . Intrusion detection system using online sequence extreme learning machine (OS-ELM) in advanced metering infrastructure of smart grid [J]. PLoS One , 2018 , 13 ( 2 ): e0192216 .

WANG Wenye , LU Zhuo . Cyber security in the smart grid: survey and challenges [J]. Computer Networks , 2013 , 57 ( 5 ): 1344 - 1371 .

ABUROMMAN A A , REAZ M B I . A novel SVM-KNN-PSO ensemble method for intrusion detection system [J]. Applied Soft Computing , 2016 , 38 : 360 - 372 .

EREZ N , WOOL A . Control variable classification, modeling and anomaly detection in Modbus/TCP SCADA systems [J]. International Journal of Critical Infrastructure Protection , 2015 , 10 : 59 - 70 .

LIU Lanchao , ESMALIFALAK M , DING Qifeng , et al . Detecting false data injection attacks on power grid by sparse optimization [J]. IEEE Transactions on Smart Grid , 2014 , 5 ( 2 ): 612 - 621 .

ESMALIFALAK M , LIU Lanchao , NGUYEN N , et al . Detecting stealthy false data injection using machine learning in smart grid [J]. IEEE Systems Journal , 2017 , 11 ( 3 ): 1644 - 1652 .

QIANG Yang , HAO Weijie , GE Leijiao , et al . FARIMA model-based communication traffic anomaly detection in intelligent electric power substations [J]. IET Cyber-Physical Systems: Theory & Applications , 2019 , 4 ( 1 ): 22 - 29 .

YOO H , SHON T . Novel approach for detecting network anomalies for substation automation based on IEC 61850 [J]. Multimedia Tools and Applications , 2015 , 74 ( 1 ): 303 - 318 .

ROBERT M , ING-RAY C . Behavior-rule based intrusion detection systems for safety critical smart grid applications [J]. IEEE Transactions on Smart Grid , 2013 , 4 ( 3 ): 1254 - 1263 .

NASEER S , SALEEM Y , KHALID S , et al . Enhanced network anomaly detection based on deep neural networks [J]. IEEE Access , 2018 , 6 : 48231 - 48246 .

ZHANG Y , CHEN X , GUO D , et al . PCCN: parallel cross convolutional neural network for abnormal network traffic flows detection in multi-class imbalanced network traffic flows [J]. IEEE Access , 2019 , 7 : 119904-119916 .

HONG J , LIU C C , GOVINDARASU M . Integrated anomaly detection for cyber security of the substations [J]. IEEE Transactions on Smart Grid , 2014 , 5 ( 4 ): 1643 - 1653 .

YANG Y , XU H Q , GAO L , et al . Multidimensional intrusion detection system for IEC 61850-based SCADA networks [J]. IEEE Transactions on Power Delivery , 2017 , 32 ( 2 ): 1068 - 1078 .

YANG Ting , RUI Zhao , ZHANG Weixin , et al . On the modeling and analysis of communication traffic in intelligent electric power substations [J]. IEEE Transactions on Power Delivery , 2017 , 32 ( 3 ): 1329 - 1338 .

TAN J , CHEN X , DU M , et al . A novel internet traffic identification approach using wavelet packet decomposition and neural network [J]. Journal of Central South University , 2012 , 19 ( 8 ): 2218 - 2230 .

KUMAWAT P N , VERMA D K , ZAVERI N , et al . Comparison between wavelet packet transform and m-band wavelet packet transform for identification of power quality disturbances [J]. Power Research , 2019 , 14 ( 1 ): 37 - 45 .

LOZANO M , GARCÍA-MARTÍNEZ C , RODRÍGUEZ F J , et al . Optimizing network attacks by artificial bee colony [J]. Information Sciences , 2017 , 377 : 30 - 50 .

ASLAHI-SHAHRI B M , RAHMANI R , CHIZARI M , et al . A hybrid method consisting of GA and SVM for intrusion detection system [J]. Neural Computing and Applications , 2016 , 27 ( 6 ): 1669 - 1676 .

JIANG Dingde , XU Zheng , PENG Zhang , et al . A transform domain-based anomaly detection approach to network-wide traffic [J]. Journal of Network and Computer Applications , 2014 , 40 : 292 - 306 .

VINAYAKUMAR R , MAMOUN A , SOMAN K P , et al . Deep learning approach for intelligent intrusion detection system [J]. IEEE Access , 2019 , 7 : 41525 - 41550 .

张嘉誉 , 章坚民 , 杨才明 , 等 . 基于信息物理融合的智能变电站过程层网络异常流量检测 [J]. 电力系统自动化 , 2019 , 43 ( 14 ): 173 - 181 .

ZHANG Jiayu , ZHANG Jianmin , YANG Caiming , et al . Abnormal traffic detection on process layer network of smart substation based on cyber physical fusion [J]. Automation of Electric Power Systems , 2019 , 43 ( 14 ): 173 - 181 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Calculation Method for Maximum Time Delay of Substation Communication Network Based on Time-sensitive Networking

Analysis Method for Difference of Similar SCD Files from the Perspective of Big Data

Reliability Evaluation Method for Smart Substation Based on Cyber-Physical Fusion

Related Author

ZHANG Jiayu

JIA Huibin

HU Zihan

WU Kun

WU Wenrui

Yuangang ZHOU

Xuan LIU

Bo ZHANG

Related Institution

School of Automation, Hangzhou Dianzi University

Department of Electronic & Communication Engineering, North China Electric Power University

College of Electrical and Information Engineering, Hunan University

Global Energy Interconnection Research Institute Co., Ltd.

Beijing Key Laboratory of Research and System Evaluation of Power Dispatching Automation Technology (China Electric Power Research Institute)

⁰