• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

计算机工程与科学 ›› 2023, Vol. 45 ›› Issue (07): 1197-1208.

• 计算机网络与信息安全 • 上一篇    下一篇

基于电力网络态势感知平台的告警信息关联分析

雷轩1,2,3,程光1,2,3,张玉健1,2,3,郭靓4,张付存4   

  1. (1.东南大学网络空间安全学院,江苏 南京 211189;2.东南大学网络空间国际治理研究基地,江苏 南京 211189;
    3.江苏省泛在网络安全工程研究中心,江苏 南京 211189;4.南京南瑞信息通信科技股份有限公司,江苏 南京 210000) 

  • 收稿日期:2023-01-10 修回日期:2023-03-16 接受日期:2023-07-25 出版日期:2023-07-25 发布日期:2023-07-11
  • 基金资助:
    国家工业与信息化部创新发展工程(6709010003)

Association analysis of alarm information based on power network situation awareness platform

LEI Xuan1,2,3,CHENG Guang1,2,3,ZHANG Yu-jian1,2,3,GUO Liang4,ZHANG Fu-cun4   

  1. (1.School of Cyber Science and Engineering,Southeast University,Nanjing 211189;
    2.Research Base of International Cyberspace Governance,Southeast University,Nanjing 211189;
    3.Jiangsu Province Engineering Research Center of Security for Ubiquitous Network,Nanjing 211189;
    4.Nanjing NARI Information & Communication Technology Co.,Ltd.,Nanjing 210000,China)
  • Received:2023-01-10 Revised:2023-03-16 Accepted:2023-07-25 Online:2023-07-25 Published:2023-07-11

摘要: 电力网络作为工业控制领域的重要一环,其安全性与稳定性已经上升到了非常重要的地位。传统的电力网络告警分析过分依赖于专家知识,同时现有的分析模型存在算法复杂度和规则冗余度过高的问题。针对上述问题,结合电力网络自身特点,提出了一种先进的告警信息关联分析方法。首先,通过预处理模块消除原始告警日志中含噪声的部分;然后,采用提出的基于动态滑动时间窗口的算法来生成告警事务集合;接着,采用FP-Growth算法来挖掘电力网络告警关联规则;最后,提出一种基于时序的告警规则过滤算法消除无效规则。通过在某电网公司部署的态势感知平台采集的告警数据进行实验,结果表明,提出的方法相较于其他同类关联分析方法告警规则冗余程度平均减少了30%左右,并且能够有效提取出电力网络中的关键告警规则,进而指导电力网络故障预警。

关键词: 电力网络, 告警信息, 关联分析, 数据挖掘, FP-Growth

Abstract: The safety and stability of power networks have become increasingly important in the field of industrial control. Traditional information analysis for power networks overly relies on expert know- ledge, and existing analysis models suffer from problems such as high algorithm complexity and rule redundancy. To address these issues, this paper proposes an advanced alarm information correlation analysis method that takes into account the characteristics of power networks. The method first eliminates noisy parts in the original alarm logs through a pre-processing module, then generates alarm transaction sets using a proposed method based on dynamic sliding time window, and subsequently applies the FP-Growth algorithm to mine alarm association rules for power networks. Finally, a time-based alarm rule filtering algorithm is proposed to eliminate invalid rules. Experiments conducted on alarm data collected from a situation awareness platform deployed in a power grid company show that this method reduces the redundancy of alarm rules by an average of about 30% compared to other similar association analysis method, and can effectively extract key alarm rules in power networks to guide fault warning.

Key words: power internet, alarm information, association analysis, data mining, FP-Growth