Abstract:At present, there is a lack of unified management and statistical analysis for the security protection of the secondary system in substations,so the internal network security monitoring device for substations is developed for this situation. The device realizes the real-time monitoring of the running status of the mainframe equipment, network equipment and security protection equipment. The device displays the security events in a centralized way, the real-time alarm and the quantitative analysis, the topology of the substation network architecture, and send the station information to the safety supervision platform through the dispatching data network. Uploading provides reliable information sources and effective analytical tools for the secondary system security audit evaluation. The operation practice of the pilot station in State Grid shows that the internal network security monitoring device is of great significance for the operators to master and analyze the operation of the safety equipment in time, find and deal with the hidden danger of security, and ensure the stable operation of the substation.