Abstract: The key for the power grid to deal with cyber security threats is to make full use of cyber and electrical information to improve the self-adaptation ability and automation for identification of malicious attack event. In this paper, a malicious attack correlation analysis method of source-grid-load system under specific attack scenarios is proposed. Firstly, an attribute-based multi-source event fusion model is constructed to perform multi-source data fusion processing on abnormal events of cyber layer and electrical layer. And then, based on the neural network model, the fused events are trained and classified according to the attack scenarios. Thirdly, combined with electrical abnormal events, the genetic algorithm's initialization scheme, the selection operator and cross genetic probability are improved. The correlation rules for different attack scenarios are automatically generated based on the classification results. Fourthly, the number of events to be matched is gradually reduced through timing, business logic and IP classification, and the speed of event matching is improved based on vector calculation. A timing- and business logic-based correlation matching algorithm is proposed to realize the high-speed matching of correlation rules. Finally, the effectiveness and applicability of the proposed method is verified in the source-grid-load simulation experiment system. The proposed method utilizes comprehensively the abnormal events of the cyber layer and electrical layer to further improve the identification accuracy of cyber attacks, and automatically realizes the events classification and correlation rule generation, showing great potential for engineering application.

Key words: source-grid-load system, malicious attack, correlation rules, improved genetic algorithm, matching algorithm