A method for rapidly detecting illegal cross-area network linkages in power monitoring systems

The network security of power monitoring systems is related to national security, and illegal cross-area linkages are one of its key risks. Therefore, how to effectively and accurately locate illegal cross-area linkages in power monitoring systems is studied deeply in this paper. In this paper, through research and extensive data collection, the types of computer services commonly used in power monitoring systems and their characteristics acquisition methods are determined. Then the uniqueness of service characteristics among different devices is given. On this basis, the weighted Hamming distance is used to calculate the similarity between the service feature sets of devices on isolated network areas, where the weight is directly proportional to the uniqueness of the service feature. Through testing in the real environment of thermal power plants, wind power plants, hydropower plants, substations, and dispatching master stations with 40 to 260 devices, under the premise of reasonable setting of service feature weights, the scope of suspicious cross-area connected devices can be reduced to less than 3. The method proposed in this paper is suitable for on-site inspection of illegal cross-area linkages in power monitoring systems, which improves the accuracy and efficiency of risk investigation.