面向智能电网AMI的异常入侵检测方法  

Anomaly Intrusion Detection Method for Smart Grid AMI

作　　者：雷轩 刘华飞 颜辰凡 李爱元 李军文 王潇淇 LEI Xuan;LIU Huafei;YAN Chenfan;LI Aiyuan;LI Junwen;WANG Xiaoqi(Zhuzhou Power Supply Company,State Grid Hunan Electric Power Co.,Ltd.,Zhuzhou Hunan 412000,China;Xianning Power Supply Company,State Grid Hubei Electric Power Co.,Ltd.,Xianning Hubei 437100,China)

机构地区：[1]国网湖南省电力有限公司株洲供电公司,湖南株洲412000 [2]国网湖北省电力有限公司咸宁供电公司,湖北咸宁437100

出　　处：《湖北电力》2024年第3期43-52,共10页Hubei Electric Power

基　　金：中国博士后面上基金项目(项目编号:2022M70677)。

摘　　要：高级量测体系(Advanced Metering Infrastructure,AMI)是智能电网的重要组成部分,可以实时收集消费侧电力数据信息,有效支撑电力企业用电行为分析和管理。AMI在接入大量信息通信网络的同时,不可避免地带来了严峻的网络安全问题。传统的入侵检测方法主要依赖于规则和模式的匹配,无法有效检测到未知的网络攻击行为;已有的异常入侵检测方法也存在准确率低、误报率高的问题。针对上述问题,提出一种面向智能电网AMI的异常入侵检测方法。该方法首先在分析AMI业务行为基础上,提取网络通信流量多维度特征;接着,采用随机森林算法对特征按照重要度排序,进行特征选择;最后,训练搭建的机器学习模型,来对AMI网络流量进行异常行为检测。通过在某电力公司服务器上采集的真实流量数据进行实验,结果表明所提方法准确率能够达到99.88%,可以实现AMI场景下的异常行为检测,有效提高了电网的安全与稳定。Advanced metering infrastructure(AMI)is an important component of smart grid,which can collect real-time power consumption data information,and effectively support the analysis and management of electricity consumption behavior of power enterprises.When AMI is connected to a large number of information and communication networks,it inevitably brings severe network security problems.Traditional intrusion detection methods mainly rely on the matching of rules and patterns,unable to effectively detect unknown network attack behaviors.The existing anomaly intrusion detection methods also have such problems as low accuracy and high false alarm rate.In order to address the above problems,this paper proposes an anomaly intrusion detection method for smart grid AMI.Firstly,this method is used to extract multi-dimensional features of network communication traffic based on the analysis of AMI business behavior.And then,the random forest algorithm is used to sort the features according to their importance and perform feature selection.Finally,the machine learning model is trained to detect abnormal behavior of AMI network traffic.The experiments conducted on real traffic data collected from a power company server show that the proposed method can achieve 99.88%accuracy,and can help realize abnormal behavior detection in AMI scenario,effectively improving the security and stability of power grid.

关 键 词：智能电网 AMI 网络流量 入侵检测 机器学习 特征工程 

分 类 号：TM76[电气工程—电力系统及自动化] TP393.08[自动化与计算机技术—计算机应用技术]