WPD-ResNeSt: Substation station level network anomaly traffic detection based on deep transfer learning

With the advancement of new infrastructure, the digitalization of the substation communication network has rapidly increased, and its information security risks have become increasingly prominent. Accurate and reliable substation communication network flow models and flow anomaly detection methods have become an important means to prevent network security problems and identify network anomalies. The existing substation network analyzers and flow anomaly detection algorithms are usually based on threshold determination, which cannot reflect the inherent characteristics of substation automation flow based on IEC 61850 and have low detection accuracy. To effectively detect abnormal traffic, this paper fully explores the substation network traffic rules, extracts the frequency domain features of the station level network, and designs an abnormal traffic identification model based on the ResNeSt convolutional neural network. Transfer learning is used to solve the problem of insufficient abnormal traffic labeled samples in substation. Finally, a new method of abnormal traffic detection in smart substation station level communication network based on deep transfer learning is proposed. The T1-1 substation communication network is constructed on OPNET for abnormal simulation, and the actual network traffic in a 110kV substation is fused with CIC DDoS2019 and KDD99 data sets for algorithm performance test, respectively. The accuracy reached 98.73% and 98.95%, indicating that the detection model proposed in this paper has higher detection accuracy than existing algorithms.