Abstract:Aiming at the problem of illegal intrusion of power information collection system, it is proposed to construct an intrusion detection system by analyzing the abnormality of SIM card behavior in the concentrator. The scheme utilizes an illegal terminal to obtain the use of a SIM card during the intrusion of the primary station. And a series of abnormal behaviors will occur in this process. Therefore, these behaviors are captured in the intrusion detection system. It is stored in the form of a log for real-time modeling and analyzed with a modified k-means clustering algorithm. After an abnormal point is found, warnings, alarms, and the like are issued according to the level threat. Through simulation analysis, the scheme can resist the behavior of the current power collection system illegally invading the primary station. And has a very good expansion and forward-looking..