面向智慧园区系统的网络攻击关联分析与防护策略研究  

Network attack association analysis and attack protection strategy for smart park systems

作　　者：李惠军 陆建强 周霞 解相朋[2] 万磊[2] LI Huijun;LU Jianqiang;ZHOU Xia;XIE Xiangpeng;WAN Lei(NARI Technology Development Company Limited,Nanjing 211106,China;Institute of Advanced Technology for Carbon Neutrality,Nanjing University of Post and Telecommunication,Nanjing 210023,China)

机构地区：[1]国电南瑞科技股份有限公司,南京211106 [2]南京邮电大学碳中和先进技术研究院,南京210023

出　　处：《综合智慧能源》2022年第7期1-9,共9页Integrated Intelligent Energy

基　　金：国家自然科学基金项目(61933005)。

摘　　要：智慧园区系统内各层次时刻遭受网络攻击的威胁,为提高智慧园区系统面向网络攻击威胁的应对能力与恶意攻击事件识别的精度和效率,提出面向智慧园区系统的网络攻击关联分析方法,其是采用频繁模式增长(FP-Growth)算法的网络攻击异常事件关联规则分析技术。首先利用FP-Growth算法快速挖掘异常事件频繁项集,训练关联规则;其次利用灰色关联分析算法生成实时异常事件对于网络攻击异常表现形式的元素集合;接着结合关联规则实现网络攻击场景的在线识别;同时针对匹配的攻击场景所对应的环节提出网络攻击防护策略,进行网络攻击防御,消除攻击影响;最后在不同数据量下验证所提方法在关联规则训练方面效率的优越性,并以智慧园区系统负荷频率控制(LFC)业务为场景验证所提网络攻击防护策略的可行性和有效性。Control system of smart parks at all levels are vulnerable to network attacks.In order to improve the system's coping capacities to network attacks and the identification accuracy and efficiency of malicious attack events,a network attack association analysis method for smart park systems is proposed.The method takes Frequent Pattern-Growth(FP-Growth)algorithm to detect the association rules of abnormal network attack events.FP-Growth algorithm can quickly mine the frequent item sets of abnormal events and train the association rules.Grey correlation analysis algorithm generates the abnormal manifestation set of real-time abnormal network attack events.Then,following the association rules,the network attack scenarios can be recognized on-line.Network attack protection strategy is made according to the links corresponding to the different attack scenarios to eliminate the impact of the attack.Finally,the efficiency of the proposed method in training association rules is verified by data of different volumes,and the feasibility of the network attack protection strategy is verified by the Load Frequency Control module of the smart park system.

关 键 词：智慧园区 综合能源系统 微电网 网络攻击 关联规则分析与匹配 灰色关联分析 攻击防护策略 负荷频率控制 

分 类 号：TK01[动力工程及工程热物理] TM73[电气工程—电力系统及自动化] TP393.08[自动化与计算机技术—计算机应用技术]