A Malicious Attack Correlation Analysis Method Integrating Interaction Process of Source-Grid-Load System

The key to deal with cyber security threats of gird is making full use of cyber and electrical information, and improving the ability of self-adaptation and automation for malicious attack event identification. In this Paper, the malicious attack correlation analysis method integrating the interaction process of Source-Grid-Load System (SGLS) is proposed. Firstly, the electrical events and information events in the source network are uniformly preprocessed. Secondly, based on the neural network model, the fused events are trained and classified according to the attack scenarios. Thirdly, combined with electrical abnormal events, the genetic algorithm’s initialization scheme, the selection operator and cross genetic probability are improved. The association rules for different attack scenarios are automatically generated based on the classification results. Finally, the proposed method is verified to be effective in the Source-Grid-Load simulation experiment system. The method utilizes the abnormal events of the cyber layer and the electrical layer comprehensively, and improves the identification accuracy of cyber attacks, realizes automatic event classification and correlation rule generation, showing great potential in engineering application.