基于时序神经网络的智能变电站采样值报文虚假数据检测和丢包预测研究
|
摘要
随着我国智能变电站的推广,采样值报文的研究也越来越重要。我国智能变电站系统结构与IEC61850标准相同,IEC61850使得变电站自动化系统(Substation Automation Systems,SAS)使用电子式互感器,并通过以太网将电压和电流量测值作为采样值(Sampled Measured Values,SMV)报文进行传送。然而SMV过高的传输率将会引起丢包等现象;同时SMV严格的4ms约束使得加密几乎不可实现。为此,本文首先分析了IEC61850可能面临的安全威胁,给出了可能的攻击类型。然后提出了一种虚假SMV报文的在线检测方案,同时也满足IEC61850规定的4ms约束。为了确保SAS的可靠运行,本文也提出了一种利用时序神经网络来对丢包进行检测的方法。为了验证本文所提方法的有效性,在合并单元和智能电子设备中进行验证。实验结果表明,通过对SMV报文丢包的准确预测,可以实现虚假数据的辨识并提高继电保护的鲁棒性。
The sampled measured values of smart substation become more and more critical to the stability and resilience of the power system. With the advent of IEC 61850, contemporary Substation Automation Systems(SAS) are utilizing electronic instrument transformers and merging units to transmit current and voltage measurements over Ethernet as Sampled Measured Values(SMV). However, if a substation's network resources are not properly managed, the high transmission rate of SMV would make them prone to packet loss. Also, the strict 4 ms time constraint imposed on SMVs makes encrypting these messages nearly impossible. Therefore, this paper first analyses the possible attacks to the IEC61850 protocol and then presents an online device level fake data detection system for detecting fake SMV messages without violating the4 ms time constraint set forth by IEC 61850. In order to ensure a reliable SAS operation, a coupled neural network-time series method for forecasting lost SMV packets is proposed. The proposed algorithm is implemented in a system composed of merging units and intelligent electronic devices developed for this purpose. Real-time experimental results of the proposed algorithms over a real IEC 61850 network showe excellent results in terms of detecting fake messages and increasing the robustness of protection schemes by accurately forecasting dropped SMV packets.
The sampled measured values of smart substation become more and more critical to the stability and resilience of the power system. With the advent of IEC 61850, contemporary Substation Automation Systems(SAS) are utilizing electronic instrument transformers and merging units to transmit current and voltage measurements over Ethernet as Sampled Measured Values(SMV). However, if a substation's network resources are not properly managed, the high transmission rate of SMV would make them prone to packet loss. Also, the strict 4 ms time constraint imposed on SMVs makes encrypting these messages nearly impossible. Therefore, this paper first analyses the possible attacks to the IEC61850 protocol and then presents an online device level fake data detection system for detecting fake SMV messages without violating the4 ms time constraint set forth by IEC 61850. In order to ensure a reliable SAS operation, a coupled neural network-time series method for forecasting lost SMV packets is proposed. The proposed algorithm is implemented in a system composed of merging units and intelligent electronic devices developed for this purpose. Real-time experimental results of the proposed algorithms over a real IEC 61850 network showe excellent results in terms of detecting fake messages and increasing the robustness of protection schemes by accurately forecasting dropped SMV packets.
引文
[1]FRIES S,HOF H J,SEEWALD M.Enhancing IEC62351 to Improve Security for Energy Automation in Smart Grid Environments[C]//Fifth International Conference on Internet and Web Applications and Services.IEEE,2010:135-142.
[2]KANABAR M G,SIDHU T S.Performance of IEC 61850-9-2 Process Bus and Corrective Measure for Digital Relaying[J].IEEE Transactions on Power Delivery,2011,26(2):725-735.
[3]CIMADEVILL R,FERRERO I,Yarza J M.IEC61850-9-2 Process Bus implementation on IEDs[C]//T&D Conference and Exposition,2014 IEEE PES.IEEE,2014:1-5.
[4]胡国,梅德冬.智能变电站采样值报文安全分析与实现[J].中国电机工程学报,2017,37(8):2215-2221.
[5]YOUSSEF T A,HARIRI M E,BUGAY N,et al.IEC 61850:Technology standards and cyber-threats[C]//IEEE,International Conference on Environment and Electrical Engineering.IEEE,2016:1-6.
[6]TOURNIER J C,GOERLITZ O.Strategies to secure the IEEE 1588 protocol in digital substation automation[C]//International Conference on Critical Infrastructures.IEEE,2009:1-8.
[7]ABDOLKHALIG A,ZIVANOVIC R.Evaluation of IEC 61850-9-2 samples loss on total vector error of an estimated phasor[C]//Research and Development.IEEE,2013:269-274.
[8]BO C,LIU Y,YAO Z.FS-LSSVM based fake measurement detection in substation automation system using IEC 61850[C].2010:1-5.
[9]HONG J,LIU C C,GOVINDARASU M.Integrated Anomaly Detection for cyber security of the substations[C]//Pes General Meeting|Conference&Exposition.IEEE,2011:1-1.
[10]MAELLE KABIR-QUERREC.Cyber security of the smart grid control systems:intrusion detection in IEC 61850 communication networks[C].2018.
[11]YANG Y,X U H Q,GAO L,et al.Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks[J].IEEE Transactions on Power Delivery,2017,32(2):1068-1078.
[12]Wang H,Lu T,Dong X,et al.Hierarchical Online Intrusion Detection for SCADA Networks[C].2016.
[13]SHITHARTH S,WINSTON D P.An enhanced optimization based algorithm for intrusion detection in SCADA network[J].Computers&Security,2017,70.
[14]李金,武芳瑛,张喜铭.基于IEC61850Ed2.0的变电站与调度端保护信息通信方法[J].电力系统自动化,2018(3).
[15]佟为明,高吉星,卢雷,等.基于报文信息标签的智能变电站通信服务策略[J].电力系统自动化,2018(3).
[16]孙海波,徐志强,张亮,等.智能变电站网管系统通信业务的自动发现的研究[J].电力系统保护与控制,2018(2):144-149.
[17]HOYOS J,DEHUS M,BROWN T X.Exploiting the GOOSE protocol:A practical attack on cyber-infrastructure[C]//GLOBECOM Workshops.IEEE,2013:1508-1513.
[18]姜鸿羽,马宏忠,梁欢,等.改进粒子BP神经网络在变电站噪声控制中的应用[J].中国电力,2014,47(9):71-76.
[19]王在乾,向敏,高盼.基于时间序列分析的电力负荷数据预处理方法[J].科技创新与应用,2018(7):94-95.
[20][Online]Available:http://libiec61850.com/libiec61850/.
[2]KANABAR M G,SIDHU T S.Performance of IEC 61850-9-2 Process Bus and Corrective Measure for Digital Relaying[J].IEEE Transactions on Power Delivery,2011,26(2):725-735.
[3]CIMADEVILL R,FERRERO I,Yarza J M.IEC61850-9-2 Process Bus implementation on IEDs[C]//T&D Conference and Exposition,2014 IEEE PES.IEEE,2014:1-5.
[4]胡国,梅德冬.智能变电站采样值报文安全分析与实现[J].中国电机工程学报,2017,37(8):2215-2221.
[5]YOUSSEF T A,HARIRI M E,BUGAY N,et al.IEC 61850:Technology standards and cyber-threats[C]//IEEE,International Conference on Environment and Electrical Engineering.IEEE,2016:1-6.
[6]TOURNIER J C,GOERLITZ O.Strategies to secure the IEEE 1588 protocol in digital substation automation[C]//International Conference on Critical Infrastructures.IEEE,2009:1-8.
[7]ABDOLKHALIG A,ZIVANOVIC R.Evaluation of IEC 61850-9-2 samples loss on total vector error of an estimated phasor[C]//Research and Development.IEEE,2013:269-274.
[8]BO C,LIU Y,YAO Z.FS-LSSVM based fake measurement detection in substation automation system using IEC 61850[C].2010:1-5.
[9]HONG J,LIU C C,GOVINDARASU M.Integrated Anomaly Detection for cyber security of the substations[C]//Pes General Meeting|Conference&Exposition.IEEE,2011:1-1.
[10]MAELLE KABIR-QUERREC.Cyber security of the smart grid control systems:intrusion detection in IEC 61850 communication networks[C].2018.
[11]YANG Y,X U H Q,GAO L,et al.Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks[J].IEEE Transactions on Power Delivery,2017,32(2):1068-1078.
[12]Wang H,Lu T,Dong X,et al.Hierarchical Online Intrusion Detection for SCADA Networks[C].2016.
[13]SHITHARTH S,WINSTON D P.An enhanced optimization based algorithm for intrusion detection in SCADA network[J].Computers&Security,2017,70.
[14]李金,武芳瑛,张喜铭.基于IEC61850Ed2.0的变电站与调度端保护信息通信方法[J].电力系统自动化,2018(3).
[15]佟为明,高吉星,卢雷,等.基于报文信息标签的智能变电站通信服务策略[J].电力系统自动化,2018(3).
[16]孙海波,徐志强,张亮,等.智能变电站网管系统通信业务的自动发现的研究[J].电力系统保护与控制,2018(2):144-149.
[17]HOYOS J,DEHUS M,BROWN T X.Exploiting the GOOSE protocol:A practical attack on cyber-infrastructure[C]//GLOBECOM Workshops.IEEE,2013:1508-1513.
[18]姜鸿羽,马宏忠,梁欢,等.改进粒子BP神经网络在变电站噪声控制中的应用[J].中国电力,2014,47(9):71-76.
[19]王在乾,向敏,高盼.基于时间序列分析的电力负荷数据预处理方法[J].科技创新与应用,2018(7):94-95.
[20][Online]Available:http://libiec61850.com/libiec61850/.