基于时-频域混合特征的变电站通信网异常流量检测方法

杨挺; 侯昱丞; 赵黎媛; 盆海波; 原凯; 宋毅

doi:10.7500/AEPS20200304005

您当前的位置：

首页 >

文章列表页 >

基于时-频域混合特征的变电站通信网异常流量检测方法

学术研究 | 更新时间：2025-06-16

- 基于时-频域混合特征的变电站通信网异常流量检测方法
- Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features
- 电力系统自动化-方正平台 2020年44卷第16期页码：79-86
- 作者机构：
  
  1.智能电网教育部重点实验室（天津大学），天津市 300072
  2.国网经济技术研究院有限公司，北京市 102209
- 作者简介：
  
  杨挺(1979—)，男，通信作者，博士，教授，博士生导师，主要研究方向：人工智能与大数据、电力信息物理系统。E-mail：yangting@tju.edu.cn
  侯昱丞(1993—)，男，博士研究生，主要研究方向：能源互联网、电力信息物理系统。E-mail：houyucheng@tju.edu.cn
  赵黎媛(1992—)，女，博士研究生，主要研究方向：人工智能、综合能源系统。
- 基金信息：
  
  国家自然科学基金资助项目(61971305);国家重点研发计划资助项目(2017YFE0132100);国家电网公司科技项目(SGTJDK00DWJS1800232)
- DOI：10.7500/AEPS20200304005
  中图分类号：
- 收稿日期：2020-03-04，
  
  修回日期：2020-04-07，
  
  网络出版日期：2020-06-17，
  
  纸质出版日期：2020-08-25
- 稿件说明：
移动端阅览
杨挺,侯昱丞,赵黎媛等.基于时-频域混合特征的变电站通信网异常流量检测方法[J].电力系统自动化,2020,44(16):79-86.

YANG Ting,HOU Yucheng,ZHAO Liyuan,et al.Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features[J].Automation of Electric Power Systems,2020,44(16):79-86.
杨挺,侯昱丞,赵黎媛等.基于时-频域混合特征的变电站通信网异常流量检测方法[J].电力系统自动化,2020,44(16):79-86. DOI： 10.7500/AEPS20200304005.

YANG Ting,HOU Yucheng,ZHAO Liyuan,et al.Abnormal Traffic Detection Method of Substation Communication Network Based on Time-Frequency Domain Mixed Features[J].Automation of Electric Power Systems,2020,44(16):79-86. DOI： 10.7500/AEPS20200304005.

摘要

准确快速检测智能变电站通信网络异常流量是发现系统异常、实现安全态势感知和主动防御的关键技术，对保证智能电网安全稳定运行有着重要意义。文中提出了基于时-频域混合特征的智能变电站通信网络异常流量检测新方法。首先，设计了基于分形自回归积分滑动平均（FARIMA）流量模型和小波包分析方法的流量频域特征提取方法，并结合电力信息流时域特征构建时-频域混合特征集。进而，采用人工蜂群优化的支持向量机算法进行异常流量辨识。最后，基于某110 kV变电站的站内实际网络流量和CIC DDoS2019数据集、KDD99数据集进行仿真，结果表明所提算法对网络异常流量识别有更低的误判率和漏检率。

Abstract

Accurate and rapid identification of abnormal traffic in smart substation communication network is the primary key technology for rapid detection of system anomalies

and realization of safety situational awareness and active defense

which is of great significance to ensure safe and stable operation of smart grid. This paper proposes a new abnormal traffic detection method of smart substation communication network based on time-frequency domain mixed features. Firstly

a method of extracting the features of traffic in frequency domain is designed based on the fractional autoregressive integrated moving average (FARIMA) traffic model and the wavelet packet analysis method. In addition

combined with the time-domain features of power information flow

a mixed time-frequency domain feature set is constructed. Then the support vector machine (SVM) algorithm optimized by artificial bee colony (ABC) is used to identify the abnormal traffic. Finally

the simulation is conducted based on the network traffic in a 110 kV substation

the CIC DDoS2019 data set and the KDD99 data set. The results show that the proposed algorithm has low misjudging and missing rates in abnormal traffic detection.

关键词

Keywords

references

郝唯杰 , 杨强 , 李炜 . 基于FARIMA模型的智能变电站通信流量异常分析 [J]. 电力系统自动化 , 2019 , 43 ( 1 ): 158 - 167 .

HAO Weijie , YANG Qiang , LI Wei . FARIMA model based analysis of communication traffic anomaly in smart substation [J]. Automation of Electric Power Systems , 2019 , 43 ( 1 ): 158 - 167 .

王梓博 , 穆云飞 , 王宇飞 , 等 . 考虑多代理供电恢复系统通信失效的配电网CPS风险评估 [J]. 电力系统自动化 , 2016 , 40 ( 17 ): 51 - 58 .

WANG Zibo , MU Yunfei , WANG Yufei , et al . Cyber physical system risk assessment of distribution network considering communication failure of multi-agent system for power restoration [J]. Automation of Electric Power Systems , 2016 , 40 ( 17 ): 51 - 58 .

杨挺 , 翟峰 , 赵英杰 , 等 . 泛在电力物联网释义与研究展望 [J]. 电力系统自动化 , 2019 , 43 ( 13 ): 9 - 20 .

YANG Ting , ZHAI Feng , ZHAO Yingjie , et al . Explanation and prospect of ubiquitous electric power Internet of Things [J]. Automation of Electric Power Systems , 2019 , 43 ( 13 ): 9 - 20 .

汤奕 , 陈倩 , 李梦雅 , 等 . 电力信息物理融合系统环境中的网络攻击研究综述 [J]. 电力系统自动化 , 2016 , 40 ( 17 ): 59 - 69 .

TANG Yi , CHEN Qian , LI Mengya , et al . Overview on cyber-attacks against cyber physical power system [J]. Automation of Electric Power Systems , 2016 , 40 ( 17 ): 59 - 69 .

LI Yuancheng , QIU Rixuan , JING Sitong . Intrusion detection system using online sequence extreme learning machine (OS-ELM) in advanced metering infrastructure of smart grid [J]. PLoS One , 2018 , 13 ( 2 ): e0192216 .

WANG Wenye , LU Zhuo . Cyber security in the smart grid: survey and challenges [J]. Computer Networks , 2013 , 57 ( 5 ): 1344 - 1371 .

ABUROMMAN A A , REAZ M B I . A novel SVM-KNN-PSO ensemble method for intrusion detection system [J]. Applied Soft Computing , 2016 , 38 : 360 - 372 .

EREZ N , WOOL A . Control variable classification, modeling and anomaly detection in Modbus/TCP SCADA systems [J]. International Journal of Critical Infrastructure Protection , 2015 , 10 : 59 - 70 .

LIU Lanchao , ESMALIFALAK M , DING Qifeng , et al . Detecting false data injection attacks on power grid by sparse optimization [J]. IEEE Transactions on Smart Grid , 2014 , 5 ( 2 ): 612 - 621 .

ESMALIFALAK M , LIU Lanchao , NGUYEN N , et al . Detecting stealthy false data injection using machine learning in smart grid [J]. IEEE Systems Journal , 2017 , 11 ( 3 ): 1644 - 1652 .

QIANG Yang , HAO Weijie , GE Leijiao , et al . FARIMA model-based communication traffic anomaly detection in intelligent electric power substations [J]. IET Cyber-Physical Systems: Theory & Applications , 2019 , 4 ( 1 ): 22 - 29 .

YOO H , SHON T . Novel approach for detecting network anomalies for substation automation based on IEC 61850 [J]. Multimedia Tools and Applications , 2015 , 74 ( 1 ): 303 - 318 .

ROBERT M , ING-RAY C . Behavior-rule based intrusion detection systems for safety critical smart grid applications [J]. IEEE Transactions on Smart Grid , 2013 , 4 ( 3 ): 1254 - 1263 .

NASEER S , SALEEM Y , KHALID S , et al . Enhanced network anomaly detection based on deep neural networks [J]. IEEE Access , 2018 , 6 : 48231 - 48246 .

ZHANG Y , CHEN X , GUO D , et al . PCCN: parallel cross convolutional neural network for abnormal network traffic flows detection in multi-class imbalanced network traffic flows [J]. IEEE Access , 2019 , 7 : 119904-119916 .

HONG J , LIU C C , GOVINDARASU M . Integrated anomaly detection for cyber security of the substations [J]. IEEE Transactions on Smart Grid , 2014 , 5 ( 4 ): 1643 - 1653 .

YANG Y , XU H Q , GAO L , et al . Multidimensional intrusion detection system for IEC 61850-based SCADA networks [J]. IEEE Transactions on Power Delivery , 2017 , 32 ( 2 ): 1068 - 1078 .

YANG Ting , RUI Zhao , ZHANG Weixin , et al . On the modeling and analysis of communication traffic in intelligent electric power substations [J]. IEEE Transactions on Power Delivery , 2017 , 32 ( 3 ): 1329 - 1338 .

TAN J , CHEN X , DU M , et al . A novel internet traffic identification approach using wavelet packet decomposition and neural network [J]. Journal of Central South University , 2012 , 19 ( 8 ): 2218 - 2230 .

KUMAWAT P N , VERMA D K , ZAVERI N , et al . Comparison between wavelet packet transform and m-band wavelet packet transform for identification of power quality disturbances [J]. Power Research , 2019 , 14 ( 1 ): 37 - 45 .

LOZANO M , GARCÍA-MARTÍNEZ C , RODRÍGUEZ F J , et al . Optimizing network attacks by artificial bee colony [J]. Information Sciences , 2017 , 377 : 30 - 50 .

ASLAHI-SHAHRI B M , RAHMANI R , CHIZARI M , et al . A hybrid method consisting of GA and SVM for intrusion detection system [J]. Neural Computing and Applications , 2016 , 27 ( 6 ): 1669 - 1676 .

JIANG Dingde , XU Zheng , PENG Zhang , et al . A transform domain-based anomaly detection approach to network-wide traffic [J]. Journal of Network and Computer Applications , 2014 , 40 : 292 - 306 .

VINAYAKUMAR R , MAMOUN A , SOMAN K P , et al . Deep learning approach for intelligent intrusion detection system [J]. IEEE Access , 2019 , 7 : 41525 - 41550 .

张嘉誉 , 章坚民 , 杨才明 , 等 . 基于信息物理融合的智能变电站过程层网络异常流量检测 [J]. 电力系统自动化 , 2019 , 43 ( 14 ): 173 - 181 .

ZHANG Jiayu , ZHANG Jianmin , YANG Caiming , et al . Abnormal traffic detection on process layer network of smart substation based on cyber physical fusion [J]. Automation of Electric Power Systems , 2019 , 43 ( 14 ): 173 - 181 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于时间敏感网络的变电站通信网络最大时延计算方法

大数据视角下相近SCD文件的差异分析方法

智能变电站信息物理融合可靠性评估方法