Application of cyber security event logs in secure communication in substation

Abstract

The cyber security event log method stipulated in the IEC 62351-14 standard defines and describes the cyber security events that might be encountered in the cyber security of the power system substation and gives an approach on how to map these cyber security events to the Syslog protocol for transmission and recording. Based on this theory, the cyber security process based on application-layer authentication has been deeply researched, cyber security events for application-layer authentication have been expanded and defined, the content of the standard has been improved, its application scope has been expanded, and its application scenarios have been enriched. Cyber security event log technology has been applied in actual substations, which has effectively improved the monitoring capability of cyber security conditions in power system substations, enhanced the level of analysis and diagnosis of cyber security failures, and made it more convenient to further promote the engineering of cyber security in substations.