Substation Alarm Association Method Based on ATT&CK Framework

Aiming at the problems of island, fragmentation and redundancy of smart substation alarm information, this paper proposes a substation alarm correlation method based on ATT&CK framework by introducing ATT&CK threat intelligence, which is used to correlate and fuse the alarm information in the smart substation station to improve the efficiency of security protection. The method describes the attack technique by constructing semantic rule model and generating semantic rule graph. Then, a semantic rule extraction framework is constructed to extract knowledge from ATT&CK framework's attack technology text, from which semantic rules are extracted, covering 14 attack tactics and 244 attack technologies of ATT&CK framework, to realize automatic analysis and processing of high-level threat intelligence. Finally, the proposed method is tested in the simulation environment of simulated intelligent substation, and compared with the current mainstream IOC indicators to test the effectiveness of the proposed method.