Research On Abnormal Flow Detection In Substation Based On IEC61850 Protocol Analysis

With the continuous development of smart grids,substation systems increasingly rely on computer-based remote control and automated operations,and the dedicated and private protocols used in the past are gradually being replaced by open and unified protocols,so the network security risks and intrusion threats faced by them are also increasing.As an important part of the smart grid,the security of the substation system urgently needs to be strengthened.In order to enhance the ability of substation system to respond to malicious network attacks,this paper studies the substation traffic anomaly detection technology based on IEC61850 protocol analysis,which provides technical support for the construction of substation security defense system.The main work done in the thesis is as follows:Firstly,the system structure and security requirements of intelligent substation are analyzed,the possible security risks in the substation system are analyzed,the content of intelligent substation control protocol IEC61850 and so on is deeply studied,and the network architecture of substation is analyzed,and the protocol analysis principle and flow anomaly detection method are studied.Secondly,the key protocols GOOSE and SV in IEC61850 standard are taken as the research objects,and the transmission mechanism,service model and message frame format are thoroughly analyzed to fully grasp the message format and key content.Finally,on the basis of the above research,the message capture technology based on Libpcap is adopted to realize the collection and capture of GOOSE and SV traffic,and the deep analysis of GOOSE and SV protocol is carried out,layer by layer from the data link layer to the application layer,and the analysis content is matched and analyzed with the provisions of IEC61850 standard and the content of substation configuration file to realize the abnormal flow detection of the substation network,and the effectiveness and accuracy of this method are verified through experiments.