电力系统自动化2026，Vol.50Issue(3)：198-207,10.DOI:10.7500/AEPS20241209006
基于马尔可夫链的电力工控边界流量遥控行为异常检测模型
A Markov Chain-based Anomaly Detection Model for Remote Control Behaviors in Power Industrial Control Boundary Traffic
摘要
Abstract
With the evolution of smart grids,the cybersecurity of power industrial control systems has gained paramount importance.As the core of power industrial control systems,power dispatching automation system is now confronted with severe challenges such as customized false data injection attacks.Furthermore,the massive scale and diversity of smart device models,coupled with the access of heterogeneous communication links in the smart grid,significantly complicates threat detection at the network edge.This paper proposes a Markov chain-based anomaly detection model for IEC 60870-5-104 protocol used remote control behaviors that is deployed at the boundary of the power communication network.Firstly,the IEC 60870-5-104 protocol is analyzed in detail to extract key features of its remote-control behaviors.Secondly,Markov chain theory is employed to build a state-transition probability model that characterizes these behaviors.By monitoring the network traffic in real time and training this model online,a historical behavior baseline is established for each business.If the currently observed state sequence is different from the baseline,it is judged as an abnormal activity.Finally,it is verified through the simulation that the model can effectively detect various behaviors anomaly such as interaction behavior anomaly and operation frequency anomaly during the power dispatching process.关键词
信息安全/电力工控稳定/IEC 60870-5-104协议/遥控/异常检测/马尔可夫链Key words
power cybersecurity/power industrial control system/IEC 60870-5-104 protocol/remote control/anomaly detection/Markov chain引用本文复制引用
马力,王丹,计士禹,刘锦利,杨铭宇..基于马尔可夫链的电力工控边界流量遥控行为异常检测模型[J].电力系统自动化,2026,50(3):198-207,10.基金项目
国家电网公司科技项目(5108-202413050A-1-1-ZN). This work is supported by State Grid Corporation of China(No.5108-202413050A-1-1-ZN). （5108-202413050A-1-1-ZN）
