刘见 赵震宇 裴茂林 杨爱超 单鹏 刘明

摘 要：为了避免智能变电站过程层网络通信出现异常变动的现象，需要准确检测智能变电站过程层网络异常流量，为此提出新型的检测方法。设计了基于网络演算的变电站通信网络流量计算模型，将根节点全部设成信源，通过流量路由实现周围输入与输出端口的联系，获取智能变电站过程层网络中全部设备端口输入与输出流量。还应用优化支持向量模型进行异常流量检测，将网络异常流量与正常流量分类，实现智能变电站过程层网络异常流量检测。实验结表明：在检测，网络流量特征提取、异常流量检测效果均符合应用需求。

关键词：智能变电站;过程层网络;异常流量检测;网络演算;支持向量模型

Abstract：In order to avoid abnormal changes in the network communication at the process level of the smart substation， it is necessary to accurately detect the abnormal traffic at the process level network of the smart substation. To this end， a new detection method is proposed. In this study， a substation communication network flow calculation model based on network calculus is designed， all root nodes are set as sources， and the surrounding input and output ports are connected through flow routing to obtain the input and output flow of all equipment ports in the process layer network of the intelligent substation . This study also uses the optimized support vector model to detect abnormal traffic， classify network abnormal traffic from normal traffic， and implement network abnormal traffic detection at the process level of intelligent substations. The experimental results show that： in this study， the network traffic feature extraction and abnormal traffic detection effects all meet the application requirements.

Key words： intelligent substation; process layer network; abnormal flow detection; network calculus; support vector model

智能变电站过程层网络性能入侵（简称性能攻击）、智能变电站数据入侵（简称数据攻击）是智能变电站过程层出现网络异常流量的两大源头[1]。性能攻击与数据攻击联合后变成协同攻击，协同攻击对智能变电站存在“致命威胁”。智能变电站过程层中存在变压设备与智能组件合成的智能设备、合并模块以及智能終端[2]。过程层网络流量异常与否对变电站稳定运行存在绝对性作用，优化过程层网络稳定性与安全性的核心方法就是高精度检测智能变电站过程层网络异常流量，以此能够及时规避风险[3]。

智能变电站过程层网络流量存在周期性，周期性流量数据多，变动性低，运行较为稳定[4]。……