Research on Security Auditing Scheme of Intelligent Substation Communication Network

This paper puts forward a security audit scheme that combines SCD configuration file parsing with network traffic identification. Obtain a pre-defined network topology and virtual link logic loop by parsing the SCD file and establish a security baseline for the service. Identify and capture generic object-oriented substation event (GOOSE) messages, sampled value (SV) messages, manufacturing message specification (MMS) messages, and the information of devices connected to the switch to obtain the actual network topology, and virtual link physical loop. When an unknown system IP, communication protocol, or message occurs, the device protocol auditing alarm can be triggered. And when the device polling data traffic is missing, the offline disconnection alarm of the auditing device can be triggered. The manipulation of industrial control command parameters caused by Trojans, computer viruses, and man-in-the-middle attack, and the abnormal state caused by operators’ misoperation also can trigger the legal abnormal alarm. In this way, real-time monitoring and security auditing of intelligent substation network threats can be realized.