IEC60870-5-104 protocol abnormal behavior identification method based on service logic

IEC60870-5-104 (IEC 104 for short) protocol is widely used in the electric power industry, mainly for the communication between the master station and the sub-station. At present, the attack detection of IEC 104 protocol in the industry is mainly based on the traffic analysis of protocol characteristics and packet field content, and fails to fully consider the service logic, so it is difficult to effectively identify the electric power service packet attack. To solve this problem, this paper proposes a method of abnormal behavior recognition based on service logic. The method firstly analyzes the IEC 104 protocol layer by layer to realize the full parsing of application layer packets and the precise identification of service instructions. Secondly, on the basis of in-depth analysis of the normal service behavior mode of the protocol, a detection model based on the service timing logic and the service behavior baseline is constructed, which can effectively identify the service packet attack against the IEC 104 protocol.