电力信息与通信技术2026，Vol.24Issue(6)：23-30,8.DOI:10.16543/j.2095-641x.electric.power.ict.2026.06.03
基于流量日志的电力信息网络设备异常行为检测技术研究
Research on Abnormal Behavior Detection Technology of Power Information Network Equipment Based on Traffic Log
摘要
Abstract
With the continuous advancement of power informatization and intelligence,the power information network has evolved from a traditional physical system to a complex digital ecosystem.In order to accurately identify and prevent potential threats faced by key equipment in the power information network,quickly detect and respond to abnormal situations that may affect the power system,this paper proposes an algorithm for detecting abnormal behavior of similar equipment in the power information network.Firstly,the original traffic access logs are used to construct a equipment access sequence tree,describe equipment access behavior,calculate the edit distance matrix of the equipment access sequence tree,and characterize the behavioral differences and similarities between different equipments.On this basis,the automatic adjustment on stable-membership-based auto-tuning multi-peak clustering algorithm(SMMP)is improved and density based outlier detection algorithm is introduced to discover abnormal equipment behavior.The effectiveness of the proposed method is verified by collecting equipment access traffic log datasets in the power information network.The experimental results show that the method performs well in processing large datasets,and compared with methods such as One Class SVM and Isolation Forest,it shows significant improvements in accuracy,recall,F1 index,false alarm rate,and other indicators.It can provide technical support for identifying equipment abnormal behavior risks in the power information network.关键词
电力信息网络/设备访问序列树/自动调整多峰聚类/离群度/异常行为检测Key words
power information network/equipment access sequence tree/SMMP/outlier score/abnormal behavior detection分类
信息技术与安全科学引用本文复制引用
陈石,赵新建,张颂,袁国泉..基于流量日志的电力信息网络设备异常行为检测技术研究[J].电力信息与通信技术,2026,24(6):23-30,8.基金项目
国网江苏省电力有限公司科技项目"基于大数据的网络安全情报分析与行为检测技术研究"(J2022109). （J2022109）
