Network Attack Tracking Method for Digital Substation Power Industry Control System Based on Apriori Algorithm
Minhui Ge, Daojuan Zhang, Gang Qu, Tianqi Wu, Longxi Han, Hongbin Wu · 2023
The safety of power system is directly related to people’s lives, property and social stability, and even directly affects national security. Because of its importance, power system can easily become the main target of cyber attacks and cyber wars. Constructing the tracing method of power system network attack based on Apriori algorithm is convenient to protect the network assets of substation power industry control system and resist the increasingly hidden network attack. Snort, as a probe for traffic collection and analysis, uses the attack detection of existing and partially customized packets to be detected in official website to extract all kinds of attack information. Snort detection method decomposes the obtained data packets according to the key information of the rules and matches them with all the rules in the rule base respectively. If they meet any rules, it is an attack. The Apriori algorithm is used to mine the detected attacks, and the correlation between them is mined in the data through association rules, and the attacks can be traced back according to the correlation.