Abstract:

The network security situational awareness (NSSA) technology, which can perceive the potential network security risks globally and dynamically, is receiving more and more attention.With the help of machine learning, artificial intelligence, big data, and the other technologies, the network security situation awareness solution of power control system can learn from the process of the long-term and massive network security situation data, gain insight into the internal logical relationship implied in the data, and realize the abnormal behavior identification, intrusion intention understanding, and impact assessment of various activities in the power business network. First, the basic concept and the logical block diagram of NSSA are introduced. Then, the current situation and the risk of network security of power control system are summarized. Next, aimed at these risks and deficiencies, the key technologies involved in the network security situation awareness platform from the perspective of practice are expounded, which include the multidimensional security event correlation analysis model,the abnormal traffic and abnormal behavior detection method based on “baseline learning”,the attack chain recognition model based on attack scenario,and the power remote control security technology based on “address self verification”. Finally, the situation awareness solution and its application in power monitoring systems are stated and prospected.

Key words: network security, situation awareness, situation cognition, situation prediction, power control system