基于马尔可夫链的电力工控边界流量遥控行为异常检测模型OA

With the evolution of smart grids,the cybersecurity of power industrial control systems has gained paramount importance.As the core of power industrial control systems,power dispatching automation system is now confronted with severe challenges such as customized false data injection attacks.Furthermore,the massive scale and diversity of smart device models,coupled with the access of heterogeneous communication links in the smart grid,significantly complicates threat detection at the network edge.This paper proposes a Markov chain-based anomaly detection model for IEC 60870-5-104 protocol used remote control behaviors that is deployed at the boundary of the power communication network.Firstly,the IEC 60870-5-104 protocol is analyzed in detail to extract key features of its remote-control behaviors.Secondly,Markov chain theory is employed to build a state-transition probability model that characterizes these behaviors.By monitoring the network traffic in real time and training this model online,a historical behavior baseline is established for each business.If the currently observed state sequence is different from the baseline,it is judged as an abnormal activity.Finally,it is verified through the simulation that the model can effectively detect various behaviors anomaly such as interaction behavior anomaly and operation frequency anomaly during the power dispatching process.