Research On Real-time Monitoring System And Simulation Of Network Traffic In Smart Substation

Intelligent substation uses an open,standard network technology and peer-to-peer communication mode to improve the automation level of substations.At the same time,it brings the information security problem of network communication,which makes the intelligent substation face a new network intrusion threat.In view of the above problems,this paper constructs the network traffic flow monitoring system and simulation platform of intelligent substation,and carries on the research of network intrusion warning and communication flow analysis for intelligent substation.Based on the analysis of fingerprint characteristics of network communication traffic and the intrusion detection based on traffic feature fingerprint,a new idea is put forward for intelligent intrusion network intrusion detection for smart grid.The main contents of this paper are as follows:Firstly,according to the communication protocol and the basic link structure of smart substation,it proposes a network traffic collection framework of the intelligent substation.The data preprocessing of the collected traffic data sets is carried out by means of flow calculation and cluster analysis.Secondly,based on the communication structure of intelligent substation and the characteristics of each functional part of the intelligent substation,the communication model of the intelligent substation is simplified by the idea of "three layers and two nets".Using the simulation tool of network communication equipment and sending,CID model and IEC 61850 server and client communication tools,this paper respectively sets up the simulation platforms of process layer,spacer layer and control layer of intelligent substation.Taking the simulation platform as the object,the design and simulation of the network communication flow monitoring system for the intelligent substation are carried out.Through the simulation platform of the equipment communication simulation,it achieves the traffic classification monitoring.The abnormal traffic scene is simulated and the monitoring process of traffic flow in abnormal traffic scene is analyzed.Furthermore,on the basis of the above simulation platform and design of intelligent substation network traffic monitoring system,the characteristics of network intrusion and attack against intelligent substation are analyzed.Based on the quantitative analysis of the data of the communication network in the smart substation,the abnormal traffic matrix of the typical intrusion behavior in the intelligent substation communication link is obtained.In addition,aiming at the defects of the traditional K-means clustering algorithm applied to the intelligent substation communication network intrusion detection,some improved mean clustering algorithms are proposed,which is proposed from three aspects:initial center selection,intrusion data sample weighting and dynamic clustering threshold Improve,improve the detection accuracy of the algorithm to make it more meet the needs of intelligent substation.Then,the research of intelligent substation network communication flow fingerprint feature extraction technology is studied.Based on the analysis technology of network communication protocol,the automatic fingerprint extraction method of intelligent substation is proposed.By using the idea of hierarchical model,based on the analysis of the link and structure of intelligent substation communication network,the hierarchical flow characteristic fingerprint database is established,which contains the communication protocol type,traffic size,device protocol configuration,and protocol attribute.Based on the intelligent substation flow monitoring system and simulation platform,the extraction simulation of the traffic characteristics of the intelligent substation network and the flow characteristics of the process layer network are carried out.Finally,based on the construction of the network traffic characteristic fingerprints for the substation interval and the process layer network traffic,the intrusion detection research of the fingerprint characteristic of the intelligent substation network is carried out.An intrusion detection model based on traffic feature fingerprint is designed.Taking intelligent substation intelligent substation network as an example,the simulation is carried out,which simulates three different intrusion behaviors that cause the traffic size,protocol type,and protocol data content to change.