| 摘要 |
<p>Disclosed are an intrusion detection apparatus and a method thereof capable of detecting various abnormal patterns caused by cyberattack and malfunctions by using normal communication traffic practice at IEC 61850 protocol-based digital substation. According to the present invention, the intrusion detection apparatus comprises: a normal behavior patterning unit for producing normal behavior patterns by collecting and grouping communication packets transmitted from a normal state network; and an abnormal symptom detection unit for detecting abnormal symptoms in the network communication packets collected in real time based on the normal behavior patterns produced by the normal behavior patterning unit.</p> |
