Research on Power Information Network Security Situation Awareness Based on LDA-RBF

doi:10.16628/j.cnki.2095-8188.2021.08.004

Abstract

Abstract:

To accurately predict the security situation of power information network,a network security situation awareness method based on machine learning is proposed.In this method,the network security situation awareness is abstracted as a numerical quantization problem,and a large number of test samples are used as data sources to input the situational awareness model to characterize the perceived results.Based on the linear discriminant analysis (LDA),the test data is preprocessed to optimize the sample data to obtain combined features and find out the best projection.Then the processed data are used as input of RBF neural network to find the nonlinear mapping relation of the network situation value,and the network security situation is quantified.Finally,the effectiveness of the proposed method in the security situation analysis is verified through KDD Cup99 dataset and the cyber attack data in the power information network.

Key words: network security situation awareness, power information network, cyber attack, linear discriminant analysis(LDA), RBF neural network

CLC Number:

TM732

ZHANG Xiaofei, ZHANG Daoyin, ZHENG Luolin, CHEN Decheng, FU Rong. Research on Power Information Network Security Situation Awareness Based on LDA-RBF[J]. LOW VOLTAGE APPARATUS, 2021, 0(8): 16-23.

Figures/Tables 22

References 17

[1]	李志强, 苏盛, 曾祥君, 等. 基于虚构诱骗陷阱的电力调度系统针对性攻击主动安全防护[J]. 电力系统自动化, 2016, 40(17):106-112.
[2]	黄鑫, 陈德成, 孙军, 等. 网络攻击下电力系统信息安全研究综述[J]. 电测与仪表, 2017, 54(23):68-74.
[3]	姜丽丽. 基于网络安全系统的大规模模式集合匹配算法的研究[D]. 南京:东南大学, 2015.
[4]	BASS T. Intrusion detection systems and multisensor data fusion[J]. Communications of the Acm, 2000, 43(4):99-105.
[5]	HUANG W, GUO Y, ZHUANG L, et al. Applying of network security situation awareness in smart substations[C]// International Conference on Systems and Informatics,IEEE, 2015:137-142.
[6]	杨鹏, 马志程, 靳丹, 等. 面向智能电网的网络态势评估模型及感知预测[J]. 兰州理工大学学报, 2015, 41(4):99-103.
[7]	XIAO P, XIAN M, WANG H. Network security situation prediction method based on MEA-BP[C]// International Conference on Computational Intelligence & Communication Technology,IEEE, 2017:1-5.
[8]	GAO J, XU C, ZHANG L, et al. Infrared image change detection of substation equipment in power system using markov random field[C]// International Conference on Computing Intelligence and Information System,IEEE Computer Society, 2017:332-337.
[9]	徐茹枝, 王宇飞. 面向电力信息网络的安全态势感知研究[J]. 电网技术, 2013, 37(1):53-57.
[10]	刘树鑫, 卓裕, 李津, 等. 基于随机森林算法的配电线路短路故障分类[J]. 电器与能效管理技术, 2020(8):52-57,67.
[11]	黄沙里, 郭其一, 柳悦, 等. 入侵检测技术在智能配电系统中的应用研究[J]. 电器与能效管理技术, 2020(4):23-29.
[12]	王志平. 基于指标体系的网络安全态势评估研究[D]. 长沙:国防科学技术大学, 2010.
[13]	王红旗, 毛啊敏, 李林伟. 基于线性判别分析的表面肌电信号特征识别[J]. 河南理工大学学报(自然科学版), 2015, 34(6):831-835.
[14]	MUSTAFA M W, SULAIMAN M H, SHAREEF H, et al. Reactive power tracing in pool-based power system utilising the hybrid genetic algorithm and least squares support vector machine[J]. Iet Generation Transmission & Distribution, 2012, 6(2):133-141. doi: 10.1049/iet-gtd.2011.0166
[15]	HETTICH S, BAY S D. KDD Cup99 task description[EB/OL]. http://kdd.ics.uci.edu/databases/kddcup99/task.html .
[16]	赵燕伟. 基于网络行为特征的网络安全态势研究[D]. 哈尔滨:黑龙江大学, 2018.
[17]	刘炳南, 黄沂平, 方国标. 基于一维卷积神经网络的配电网高阻接地故障识别[J]. 电器与能效管理技术, 2020(9):99-103.

类别(c)	安全指数	安全等级	详细描述
1	0~0.2	安全	没有常规恶意攻击行为存在的可能性,无病毒威胁和已发布的漏洞
2	0.2~0.4	轻度风险	少量漏洞或不必要的端口开放,存在扫描等危险行为,造成轻微影响
3	0.4~0.75	一般风险	外部攻击者入侵成功的可能性增大,较多的威胁和漏洞,会造成影响
4	0.75~0.9	中度风险	网络攻击、病毒软件等活动增多,能够引发系统故障,危及系统的稳定运行
5	0.9~1.0	高度危险	严重的病毒或大量的漏洞,随时会受到恶意破坏,威胁电力系统的正常运行

网络数据样本	网络行为
x₁₁,x₁₂,…,x₁_d	y₁
X₂₁,x₂₂,…,x₂_d	y₂
…	…
x_n₁,x_n₂,…,x_nd	y_n

各攻击类型	对应样本数量
各攻击类型	训练集	测试集
Normal	845	225
Smurf	692	138
Teardrop	77	20
Back	498	102
Neptune	593	62
Ipsweep	386	56
Portsweep	88	40
Buffer_overflow	21	9
Warezclient	144	21

方法	FNR/%	各方法的FPR/%	总正确率/%
LDA-RBF	4.91	4	95.394
RBF	6.93	4.4	94.35
文献[17]	7.41	9.16	92.37

威胁事件	威胁值	事件
Normal	0	无
Proble	0.2	端口监测、扫描
R2L	0.4	非法尝试登陆主机
Dos	0.6	进行拒绝服务攻击
U2L	0.8	非法获取主机或管理员权限