Network security and situation awareness equipment data monitoring and early warning system for centralized control system

Abstract

The invention discloses a network security and situation awareness equipment data monitoring and early warning system for a centralized control system, and relates to the technical field of equipment situation monitoring, and the monitoring system monitors the risks in the aspects of time synchronization, port activity, electronic element corrosion, part supply chain and memory resource management of equipment in real time. And an alarm is given out in time by rapidly flickering the warning lamps with different colors. And the strategy module automatically generates corresponding coping strategies according to different early warning alarms, such as triggering of a time synchronization mechanism, blocking of abnormal ports, arrangement of equipment maintenance, replacement of parts, adjustment of memory allocation and the like. The comprehensive management scheme not only can effectively prevent system faults, but also can ensure that actions can be taken quickly when abnormity occurs, so that potential safety hazards and operation interruption are reduced. Through automated risk management and response, the system facilitates the improvement of the reliability of device operation and the security of the network.

Description

Technical Field

[0001] The present invention relates to the technical field of equipment situation monitoring, and in particular to a network security and situation awareness equipment data monitoring and early warning system for a centralized control system. Background Art

[0002] In modern centralized control systems, especially in the management of hydropower plant power generation equipment, network security and situational awareness are key links to ensure the normal operation of equipment and system stability. The centralized control system is responsible for real-time monitoring and control of the operating status of power generation equipment, and its stability is directly related to the safety and efficiency of the entire power system. With the increase in the number of equipment and system complexity, traditional monitoring methods and technologies face many challenges in dealing with equipment status and security issues.

[0003] Traditional time synchronization technology usually relies on a single time synchronization source, which may cause time drift problems in the device network, thus affecting the collaborative work of devices and data consistency. Time drift may cause task scheduling errors, data inconsistency, and system performance degradation. Traditional port management and monitoring methods usually lack real-time monitoring of port status, scanning events, and abnormal activation times of unused ports, leading to security risks. For example, unauthorized port scanning and abnormal activation may trigger network attacks or data leakage. In addition, the imbalance of port traffic distribution may also affect network performance and the normal operation of devices. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a network security and situation awareness equipment data monitoring and early warning system for a centralized control system to solve the problems mentioned in the background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network security and situation awareness equipment data monitoring system for a centralized control system, comprising a first monitoring module, a second monitoring module, a third monitoring module, a fourth monitoring module, a fifth monitoring module and a situation prediction module;

[0006] The first monitoring module is used to monitor the time drift information and related time impact information of several devices connected to the centralized control center in real time to construct a time drift index Tpy;

[0007] The second monitoring module is used to monitor the port opening status, port scanning events and abnormal activation times of unused ports of several devices connected to the centralized control center in real time, analyze and calculate to obtain the port situation index UPS; and detect and obtain the port traffic distribution information to construct the port traffic balance index Phzs; and associate the obtained port situation index UPS with the port traffic balance index Phzs to calculate and obtain the port risk index Dkfx;

[0008] The third monitoring module is used to monitor the electronic component corrosion information of several devices connected to the centralized control center in real time to construct the electronic component corrosion index Fszs;

[0009] The fourth monitoring module is used to monitor the sources of several equipment parts and supply chain path tracking information connected to the centralized control center in real time to construct a parts source tracking index Lyzs;

[0010] The fifth monitoring module is used to monitor the memory resource locking information, process priority information, memory usage and allocation information, and cache information of several devices connected to the centralized control center in real time, and to build a memory resource database to build a resource locking state index Zysd, a process priority conflict index Jc, a memory allocation anomaly index Ncfp, and a cache consistency error index Cce; and to associate the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation anomaly index Ncfp, and the cache consistency error index Cce, and to calculate and obtain the memory risk index Ncfx;

[0011] The situation prediction module is used to evaluate the time drift index Tpy, the port risk index Dkfx, the electronic component corrosion index Fszs, the parts source tracking index Lyzs and the memory risk index Ncfx to obtain corresponding analysis results, so as to comprehensively analyze the stability of the current equipment operation situation, and display the comparative analysis results on the user monitoring interface in real time. The user monitoring interface will receive the feedback content and take corresponding remote monitoring measures.

[0012] Preferably, the first monitoring module includes a time drift acquisition unit, a device time synchronization unit, an oscillator monitoring unit and a delay monitoring unit;

[0013] The time drift acquisition unit is used to monitor the time drift information of several devices connected to the centralized control center in real time, and calculate the clock drift value of the jth device in the i-th region through the following formula:

[0014]

[0015] Where, T device Indicates the current time of the device, T reference is the time of the standard time source;

[0016] The device time synchronization unit is used to record the time point when the device is synchronized with the standard time source, and the synchronization time difference of the jth device in the i-th region is calculated by the following formula:

[0017]

[0018] Where, T sync,next is the time of next synchronization, T sync,last is the time of the last synchronization;

[0019] The oscillator monitoring unit is used to collect the frequency of the oscillator, and the oscillator frequency increment value of the jth device in the i-th region is calculated by the following formula:

[0020]

[0021] In the formula, F devicet is the current frequency of the device oscillator, F reference is the device oscillator reference frequency threshold;

[0022] The delay monitoring unit is used to send a timestamp data packet and measure the time interval from the device sending to receiving, and calculate the transmission time delay value of the jth device in the i-th region through the following formula

[0023]

[0024] Where, T send Indicates the time when the data packet is sent, T receive is the time when the packet is received.

[0025] Preferably, the first monitoring module further includes a jitter monitoring unit and a fitting calculation unit;

[0026] The jitter monitoring unit is used to collect and obtain the time signal value of the jth device in the i-th region at the nth measurement through a jitter detection tool, and calculate and obtain the time signal jitter index of the jth device in the i-th region through the following steps:

[0027] S1. First, calculate the deviation ΔT of each time signal from its mean ij (n):

[0028]

[0029] Where, T ij (n) is the time signal value of the jth device in the i-th region at the nth measurement, which is collected and obtained through the network measurement tool. It represents the mean time signal of the jth device in the i-th region at all measurement times, which is calculated by the following formula: N represents the total number of data points at all measurement moments;

[0030] S2, and calculate the square of each time signal deviation

[0031]

[0032] In the formula, through the square operation, all time signal deviations are made positive to eliminate the influence of negative values;

[0033] S3. Square all the measured time signal deviations Perform a weighted sum to obtain the weighted sum WS through the following formula:

[0034]

[0035] S4. And based on the weighted sum WS, calculate and obtain the time signal jitter index of the jth device in the ith region through the following formula

[0036]

[0037] In the formula, Wn represents the weighting factor for the nth measurement;

[0038] The fitting calculation unit is used to make dimensionless the clock drift value of the jth device in the ith region The synchronization time difference of the jth device in the ith region The oscillator frequency increment value of the jth device in the ith region The transmission time delay value of the jth device in the ith region and the time signal jitter index of the jth device in the ith region After dimensionless processing, calculate and obtain the time drift index Tpy through the following fitting formula:

[0039]

[0040] In the formula, a1, a2, a3, a4, and a5 respectively represent the clock drift value of the jth device in the ith region The synchronization time difference of the jth device in the ith region The oscillator frequency increment value of the jth device in the ith region The transmission time delay value of the jth device in the ith region and the time signal jitter index of the jth device in the ith region The weight values, which are adjusted and set by the user, 0 < a1 < 1, 0 < a2 < 1, 0 < a3 < 1, 0 < a4 < 1, 0 < a5 < 1, and a1 + a2 + a3 + a4 + a5 = 1, and b1 represents the first correction value.

[0041] Preferably, the second monitoring module includes a port status monitoring unit, a port situation analysis unit, and a first associated unit;

[0042] The port status monitoring unit is used to monitor in real time the port opening status, port scanning events, and the number of abnormal activations of unused ports of several devices connected to the centralized control center. After dimensionless processing, the port situation index UPS is obtained through the following formula analysis and calculation:

[0043]

[0044] In the formula, smcs m represents the occurrence frequency of the m-th port scanning event of the device, and ycqy n represents the number of abnormal activations of the n-th unused port of the device; a6 and a7 represent weight values, and 0 < a6 < 1, 0 < a7 < 1, and a6 + a7 = 1;

[0045] The port situation analysis unit is used to monitor and obtain the port traffic distribution information in real time to obtain port traffic data. After dimensionless processing, the port traffic balance index Phzs is obtained through the following formula analysis and calculation;

[0046]

[0047] In the formula, maxF represents the maximum value among all port traffic of the device, and minF represents the minimum value among all port traffic of the device, represents the total sum of all port traffic, F k represents the traffic value of the k-th port, and a8 and a9 represent weight values, and 0 < a8 < 1, 0 < a9 < 1, and a8 + a9 = 1;

[0048] The first correlation unit is used to calculate the port risk index Dkfx by the following correlation formula for the port situation index UPS and the port traffic balance index Phzs;

[0049] Dkfx = a 10 *UPS + a 11 *Phzs;

[0050] In the formula, a 10 and a 11 represent the weight values of the port situation index UPS and the port traffic balance index Phzs, and 0 < a 10 < 1, 0 < a 11 < 1, and a 10 + a 11 = 1.

[0051] Preferably, the third monitoring module is used to monitor the corrosion information of electronic components of several devices connected to the centralized control center in real time through a humidity and temperature sensor, an electrochemical corrosion sensor, and a surface resistivity sensor, and obtain a humidity value sdc, a temperature value wdz, a corrosion current lcorr, and a surface resistivity dzl; after dimensionless processing, the electronic component corrosion index Fszs is calculated through the following formula;

[0052]

[0053] In the formula, represents a preset humidity threshold, represents a preset temperature threshold, and d1, d2, d3, and d4 respectively represent weight values, which are adjusted and set by the user, 0 < d1 < 1, 0 < d2 < 1, 0 < d3 < 1, 0 < d4 < 1, and d1 + d2 + d3 + d4 = 1.

[0054] Preferably, the fourth monitoring module is used to monitor the sources of several device components connected to the centralized control center and the supply chain path tracking information in real time. After dimensionless processing, the component source tracking index Lyzs is calculated through the following formula;

[0055]

[0056] In the formula, hgsl represents the historical frequency of unqualified products of component suppliers, zsl represents the number of third-party certifications of component suppliers, L R represents the transportation distance of the Rth node of the component, bgcs represents the number of supplier changes per year; d5 and d6 respectively represent weight values, which are adjusted and set by the user, 0 < d5 < 1, 0 < d6 < 1, and d5 + d6 = 1.

[0057] Preferably, the fifth monitoring module includes a memory acquisition unit, an analysis and calculation unit, and a second associated unit;

[0058] The memory acquisition unit is used to monitor the memory resource locking information, process priority information, memory usage and allocation information, and cache information of several devices connected to the centralized control center in real time, and construct a memory resource database;

[0059] The memory resource database includes: the number of resource locks Sd d , the locking duration Sd T , the number of timeout locks CSd d , the number of process conflicts Cf CS , the total number of processes P jc , the number of allocation failures A l , the amount of memory leakage A u , the total number of resource allocation attempts A jc , the number of consistency errors Ce and consistency check times C c ;

[0060] The analysis and calculation unit is used to perform data preprocessing on the memory resource database, and standardize the processed related data information according to the dimensionless processing technology. After unifying the units, the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation exception index Ncfp and the cache consistency error index Cce are calculated by the following formula:

[0061]

[0062] The second associating unit is used to calculate the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation exception index Ncfp and the cache consistency error index Cce through the following associating formula to obtain the memory risk index Ncfx:

[0063]

[0064] Where H1, H2, H3 and H4 represent the weight values ​​of resource lock state index Zysd, process priority conflict index Jc, memory allocation anomaly index Ncfp and cache consistency error index Cce respectively, which are adjusted and set by the user.

[0065] Preferably, the situation prediction module includes a first risk prediction unit, a second risk prediction unit, a third risk prediction unit, a fourth risk prediction unit and a fifth risk prediction unit;

[0066] The first risk prediction unit is used to preset a first synchronization threshold value X1, and compare the time drift index Tpy with the first synchronization threshold value X1 to obtain a first risk prediction result, including:

[0067] If the time drift index Tpy> the first synchronization threshold X1, it means that the deviation between the current device internal time and the standard time exceeds the set first synchronization threshold X1, and there is a risk of failure of the time-sensitive task;

[0068] If the time drift index Tpy ≤ the first synchronization threshold X1, it means that the internal time synchronization mechanism of the current device works normally;

[0069] The second risk prediction unit is used to preset a second risk threshold value X2, and compare the port risk index Dkfx with the second risk threshold value X2 to obtain a second risk prediction result, including:

[0070] ​If the port risk index Dkfx> the second risk threshold X2, it means that the current device port activity and traffic distribution are abnormal, and there is a risk of unauthorized port scanning, abnormal port activation, or traffic imbalance;

[0071] If the port risk index Dkfx ≤ the second risk threshold X2, it means that the current device port activity and traffic distribution are normal;

[0072] The third risk prediction unit is used to preset a third risk threshold value X3, and compare the electronic component corrosion index Fszs with the third risk threshold value X3 to obtain a third risk prediction result, including:

[0073] If the electronic component corrosion index Fszs> the third risk threshold X3, it means that the current equipment corrosion has the risk of causing short circuit or failure;

[0074] If the electronic component corrosion index Fszs ≤ the third risk threshold X3, it means that the current equipment corrosion does not cause the risk of short circuit or failure;

[0075] The fourth risk prediction unit is used to preset a fourth risk threshold value X4, and compare the component source tracking index Lyzs with the fourth risk threshold value X4 to obtain a fourth risk prediction result, including:

[0076] If the component source tracking index Lyzs> the fourth risk threshold X4, it means: there is a risk in the supply chain traceability of the current equipment components;

[0077] If the parts source tracking index Lyzs ≤ the fourth risk threshold X4, it means that there is no equipment maintenance and operation risk in the current equipment parts supply chain;

[0078] The fifth risk prediction unit is used to preset a fifth risk threshold value X5, and compare the memory risk index Ncf with the fifth risk threshold value X5 to obtain a fifth risk prediction result, including:

[0079] If the memory risk index Ncf is greater than the fifth risk threshold X5, it means that the memory resources of the current device have the risk of frequent resource locking, process priority conflict, memory allocation failure or cache consistency error;

[0080] If the memory risk index Ncf ≤ the fifth risk threshold X5, it means that the current device memory resource management is normal.

[0081] A network security and situation awareness equipment data early warning system for a centralized control system, comprising an early warning module and a strategy module;

[0082] The early warning module is used to generate corresponding early warning alarms according to the first risk prediction result, the second risk prediction result, the third risk prediction result, the fourth risk prediction result and the fifth risk prediction result, including:

[0083] If the time drift index Tpy> the first synchronization threshold X1, a time synchronization alarm is generated, and the warning light will flash blue quickly at a frequency of 4 times per second;

[0084] If the port risk index Dkfx> the second risk threshold X2, an abnormal port activity alarm is generated, and the warning light will flash red quickly at a frequency of 6 times per second;

[0085] If the electronic component corrosion index Fszs> the third risk threshold X3, a corrosion risk alarm is generated and the warning light will flash yellow quickly at a frequency of 5 times per second;

[0086] If the component source tracking index Lyzs> the fourth risk threshold X4, a supply chain traceability risk alarm is generated, and the warning light will flash orange at a frequency of 2 times per second;

[0087] If the memory risk index Ncf> the fifth risk threshold X5, a memory resource management risk alarm is generated, and the warning light will flash green quickly at a frequency of 6 times per second.

[0088] Preferably, the strategy module is used to generate a corresponding strategy according to the corresponding early warning alarm, including:

[0089] Generate the first strategy based on the time synchronization alarm, including: the system automatically triggers the time synchronization mechanism and attempts to resynchronize with the master clock or time server; record all relevant time drift information for further analysis and tracking, and inform relevant management personnel to perform manual calibration or inspection through SMS, email or system notification;

[0090] Generate a second strategy based on the abnormal port activity alarm, including: immediately scan and identify the ports with abnormal activities, temporarily block the abnormal ports to prevent further threats, and reallocate traffic to other ports, start the security audit process to check whether there is unauthorized port activity or attack behavior, and block unauthorized ports if there are any;

[0091] The third strategy is generated based on the corrosion risk alarm, including: immediately stopping the operation of related equipment and arranging emergency repairs or replacing severely corroded electronic components according to the degree of corrosion; checking the humidity and temperature of the environment where the equipment is located, and adjusting the temperature and humidity within the threshold range through temperature control equipment;

[0092] The fourth strategy is generated based on the supply chain traceability risk alert, including: checking the current inventory of parts to ensure that there is enough inventory to cope with supply chain disruptions;

[0093] A fifth strategy is generated based on the memory resource management risk alert, including: immediately checking the priority configuration of the current process, adjusting the priority of the conflicting process, releasing the locked memory resources, and reallocating the memory; starting the cache consistency check and repairing the consistency errors that have been found.

[0094] The present invention provides a network security and situation awareness equipment data monitoring and early warning system for a centralized control system. It has the following beneficial effects:

[0095] (1) This network security and situational awareness equipment data monitoring and early warning system for centralized control systems can effectively identify and prevent potential security threats and system failures by real-time monitoring of key indicators such as time drift, port status, electronic component corrosion, parts source, and memory resources, and ensure the stable operation of the equipment. The first monitoring module monitors time drift information and related time impact information, constructs a time drift index Tpy, which helps reduce equipment coordination errors and data inconsistencies caused by time synchronization problems, thereby improving the time accuracy and reliability of the system. The second monitoring module monitors the port opening status, port scanning events, and the number of abnormal activations of unused ports in real time. By constructing the port situation index UPS and the port traffic balance index Phzs, it can timely discover and respond to port security risks and reduce the risk of network attacks. The third monitoring module monitors the electronic component corrosion information and constructs the electronic component corrosion index Fszs, which can identify the corrosion problem of electronic components in the equipment early, so as to take preventive maintenance measures and extend the service life of the equipment. The fourth monitoring module tracks the source of parts and the supply chain path, and constructs the component source tracking index Lyzs, which helps to ensure the quality and reliability of the source of parts and reduce equipment failures caused by supply chain problems. The fifth monitoring module builds multiple memory-related indicators (such as resource lock status index Zysd, process priority conflict index Jc, memory allocation anomaly index Ncfp and cache consistency error index Cce) by monitoring memory resource lock, process priority, memory usage and allocation, etc., which can timely identify abnormal situations in memory resource usage, optimize memory management and improve system performance. The situation prediction module comprehensively evaluates the data of each monitoring module and provides a comprehensive analysis result of the equipment operation situation. Users can obtain real-time feedback on the stability of the situation through the monitoring interface and take corresponding remote monitoring measures to improve the controllability and response capabilities of the system status.

[0096] (2) This network security and situational awareness equipment data early warning system for centralized control systems generates corresponding early warning alarms through multiple risk prediction results, which can significantly improve the security and stability of the system. The early warning module intuitively conveys different types of risk alarms by flashing warning lights of different colors and frequencies, allowing operators to quickly identify and respond to potential threats. The system can detect time synchronization problems, abnormal port activity, electronic component corrosion risks, supply chain traceability issues, and memory resource management risks in real time to ensure the safe operation of equipment and network environments. This multi-level early warning mechanism helps to take timely response measures to prevent equipment failures or security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 The present invention is a schematic diagram of a block diagram of a network security and situational awareness equipment data monitoring and early warning system for a centralized control system. DETAILED DESCRIPTION

[0098] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0099] Example 1

[0100] See also Figure 1 , the present invention provides a network security and situation awareness equipment data monitoring system for a centralized control system, comprising a first monitoring module, a second monitoring module, a third monitoring module, a fourth monitoring module, a fifth monitoring module and a situation prediction module;

[0101] The first monitoring module is used to monitor the time drift information and related time impact information of several devices connected to the centralized control center in real time to construct a time drift index Tpy;

[0102] The second monitoring module is used to monitor the port opening status, port scanning events and abnormal activation times of unused ports of several devices connected to the centralized control center in real time, analyze and calculate to obtain the port situation index UPS; and detect and obtain the port traffic distribution information to construct the port traffic balance index Phzs; and associate the obtained port situation index UPS with the port traffic balance index Phzs to calculate and obtain the port risk index Dkfx;

[0103] The third monitoring module is used to monitor the electronic component corrosion information of several devices connected to the centralized control center in real time to construct the electronic component corrosion index Fszs;

[0104] The fourth monitoring module is used to monitor the sources of several equipment parts and supply chain path tracking information connected to the centralized control center in real time to construct a parts source tracking index Lyzs;

[0105] The fifth monitoring module is used to monitor the memory resource locking information, process priority information, memory usage and allocation information, and cache information of several devices connected to the centralized control center in real time, and to build a memory resource database to build a resource locking state index Zysd, a process priority conflict index Jc, a memory allocation anomaly index Ncfp, and a cache consistency error index Cce; and to associate the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation anomaly index Ncfp, and the cache consistency error index Cce, and to calculate and obtain the memory risk index Ncfx;

[0106] The situation prediction module is used to evaluate the time drift index Tpy, the port risk index Dkfx, the electronic component corrosion index Fszs, the parts source tracking index Lyzs and the memory risk index Ncfx to obtain corresponding analysis results, so as to comprehensively analyze the stability of the current equipment operation situation, and display the comparative analysis results on the user monitoring interface in real time. The user monitoring interface will receive the feedback content and take corresponding remote monitoring measures.

[0107] In this embodiment, by real-time monitoring of key indicators such as time drift, port status, electronic component corrosion, parts source, and memory resources, the system can effectively identify and prevent potential security threats and system failures to ensure the stable operation of the equipment. The first monitoring module monitors time drift information and related time impact information, constructs the time drift index Tpy, and helps reduce equipment coordination errors and data inconsistencies caused by time synchronization problems, thereby improving the time accuracy and reliability of the system. The second monitoring module monitors the port opening status, port scanning events, and the number of abnormal activations of unused ports in real time. By constructing the port status index UPS and the port traffic balance index Phzs, it can timely discover and respond to port security risks and reduce the risk of network attacks. The third monitoring module monitors the electronic component corrosion information and constructs the electronic component corrosion index Fszs, which can identify the corrosion problem of electronic components in the equipment early, so as to take preventive maintenance measures and extend the service life of the equipment. The fourth monitoring module tracks the source of parts and the supply chain path, and constructs the part source tracking index Lyzs, which helps to ensure the quality of parts and the reliability of the source, and reduce equipment failures caused by supply chain problems. The fifth monitoring module builds multiple memory-related indicators (such as resource lock status index Zysd, process priority conflict index Jc, memory allocation anomaly index Ncfp and cache consistency error index Cce) by monitoring memory resource lock, process priority, memory usage and allocation, etc., which can timely identify abnormal situations in memory resource usage, optimize memory management and improve system performance. The situation prediction module comprehensively evaluates the data of each monitoring module and provides a comprehensive analysis result of the equipment operation situation. Users can obtain real-time feedback on the stability of the situation through the monitoring interface and take corresponding remote monitoring measures to improve the controllability and response capabilities of the system status.

[0108] Example 2, please refer to Figure 1 , the first monitoring module includes a time drift acquisition unit, a device time synchronization unit, an oscillator monitoring unit and a delay monitoring unit;

[0109] The time drift acquisition unit is used to monitor the time drift information of several devices connected to the centralized control center in real time, and calculate the clock drift value of the jth device in the i-th region through the following formula:

[0110]

[0111] Where, T device Indicates the current time of the device, T reference is the time of the standard time source;

[0112] The device time synchronization unit is used to record the time point when the device is synchronized with the standard time source, and the synchronization time difference of the jth device in the i-th region is calculated by the following formula:

[0113]

[0114] Where, T sync,next is the time of next synchronization, T sync,last is the time of the last synchronization;

[0115] The oscillator monitoring unit is used to collect the frequency of the oscillator, and the oscillator frequency increment value of the jth device in the i-th region is calculated by the following formula:

[0116]

[0117] In the formula, F devicet is the current frequency of the device oscillator, F reference is the device oscillator reference frequency threshold;

[0118] The delay monitoring unit is used to send a timestamp data packet and measure the time interval from the device sending to receiving, and calculate the transmission time delay value of the jth device in the i-th region through the following formula

[0119]

[0120] Where, T send Indicates the time when the data packet is sent, T receive is the time when the packet is received.

[0121] The first monitoring module also includes a jitter monitoring unit and a fitting calculation unit;

[0122] The jitter monitoring unit is used to collect and obtain the time signal value of the jth device in the i-th region at the nth measurement through a jitter detection tool, and calculate and obtain the time signal jitter index of the jth device in the i-th region through the following steps:

[0123] S1. First, calculate the deviation ΔT of each time signal from its mean ij (n):

[0124]

[0125] Where, T ij (n) is the time signal value of the jth device in the i-th region at the nth measurement, which is collected and obtained through the network measurement tool. It represents the mean time signal of the jth device in the i-th region at all measurement times, which is calculated by the following formula: N represents the total number of data points at all measurement moments;

[0126] S2, and calculate the square of each time signal deviation

[0127]

[0128] In the formula, all time signal deviations are converted to positive values ​​through square operation to eliminate the influence of negative values;

[0129] S3, the square of the deviation of the time signal for all measurements Perform weighted sum and obtain the weighted sum WS by the following formula:

[0130]

[0131] S4, and according to the weighted sum WS, the time signal jitter index of the jth device in the i-th region is calculated by the following formula

[0132]

[0133] Where Wn represents the weighting factor of the nth measurement;

[0134] The fitting calculation unit is used to calculate the clock drift value of the jth device in the i-th region The synchronization time difference of the jth device in the i-th region The oscillator frequency increment value for the jth device in the i-th region The transmission time delay value of the jth device in the i-th region and the time signal jitter index of the jth device in the i-th region After dimensionless processing, the time drift index Tpy is calculated using the following fitting formula:

[0135]

[0136] Where a1, a2, a3, a4 and a5 represent the clock drift values ​​of the jth device in the i-th region respectively. The synchronization time difference of the jth device in the i-th region The oscillator frequency increment value for the jth device in the i-th region The transmission time delay value of the jth device in the i-th region and the time signal jitter index of the jth device in the i-th region The weight value is adjusted and set by the user. 0 < a1 < 1, 0 < a2 < 1, 0 < a3 < 1, 0 < a4 < 1, 0 < a5 < 1, and a1 + a2 + a3 + a4 + a5 = 1. b1 represents the first correction value.

[0137] In this embodiment, by monitoring the synchronization time difference, oscillator frequency increment, and transmission time delay, time synchronization problems between devices can be detected in a timely manner, and appropriate measures can be taken for correction. This is crucial for ensuring the coordinated operation between devices, especially in a complex centralized control system. The calculation of the time signal jitter index by the jitter monitoring unit can reveal the stability problems of the time signal. By optimizing the jitter of the time signal, the time management effect of the system can be further improved, and operation errors caused by time jitter can be reduced. By comprehensively considering various time drift factors through the fitting calculation unit, a quantified time drift index Tpy can be obtained. This index can be used as a comprehensive evaluation index for time synchronization accuracy, thereby improving the time synchronization accuracy and reliability of the system. The real-time monitoring and analysis of the time drift index Tpy can provide key data for the remote monitoring system, supporting the system administrator to issue early warnings and make real-time adjustments. This helps to take measures promptly when time drift problems occur and reduce the incidence of equipment failures.

[0138] Example 3, please refer to Figure 1 , the second monitoring module includes a port status monitoring unit, a port situation analysis unit, and a first associated unit;

[0139] The port status monitoring unit is used to monitor in real time the port opening status, port scanning events, and the number of abnormal enabling times of unused ports of several devices connected to the centralized control center. After dimensionless processing, the port situation index UPS is obtained through the following formula for analysis and calculation:

[0140]

[0141] In the formula, smcs m represents the occurrence frequency of the mth port scanning event of the device, and ycqy n represents the number of abnormal enabling times of the nth unused port of the device; a6 and a7 represent weight values, and 0 < a6 < 1, 0 < a7 < 1, and a6 + a7 = 1;

[0142] The port situation analysis unit is used to monitor in real time the port traffic distribution information to obtain port traffic data. After dimensionless processing, the port traffic balance index Phzs is obtained through the following formula for analysis and calculation;

[0143]

[0144] Where, maxF represents the maximum value among the traffic of all ports of the device, and minF represents the minimum value among the traffic of all ports of the device. represents the total traffic of all ports, F k represents the traffic value of the k-th port, a8 and a9 represent weight values, and 0 < a8 < 1, 0 < a9 < 1, and a8 + a9 = 1;

[0145] The first associated unit is used to calculate and obtain the port risk index Dkfx by the following associated formula from the port situation index UPS and the port traffic balance index Phzs;

[0146] Dkfx = a 10 *UPS + a 11 *Phzs;

[0147] Where, a 10 and a 11 represent the weight values of the port situation index UPS and the port traffic balance index Phzs, and 0 < a 10 < 1, 0 < a 11 < 1, and a 10 + a 11 = 1.

[0148] In this embodiment, by real-time monitoring of the port status, scanning events and the number of abnormal activations, calculating the port situation index UPS and the port traffic balance index Phzs, and associating them to obtain the port risk index Dkfx, potential security threats and performance bottlenecks can be effectively identified. This method improves the network security situation awareness ability, helps to detect abnormal situations in a timely manner, and enhances the overall security and stability of the system

[0149] Embodiment 4. Traditional monitoring of electronic components usually relies on regular inspections, and this method may not be able to detect corrosion problems of electronic components in a timely manner. Corrosion of electronic components may cause equipment failures, short circuits or other operation problems, thereby affecting the stability and security of the system.

[0150] Please refer to Figure 1 , the third monitoring module is used to real-time monitor the electronic component corrosion information of several devices connected to the centralized control center through a humidity sensor, an electrochemical corrosion sensor and a surface resistivity sensor, and obtain the humidity value sdc, the temperature value wdz, the corrosion current lcorr and the surface resistivity dzl; after dimensionless processing, calculate and obtain the electronic component corrosion index Fszs through the following formula;

[0151]

[0152] Where, represents the preset humidity threshold, It represents a preset temperature threshold, and d1, d2, d3, and d4 respectively represent weight values, which are adjusted and set by the user. 0 < d1 < 1, 0 < d2 < 1, 0 < d3 < 1, 0 < d4 < 1, and d1 + d2 + d3 + d4 = 1.

[0153] In this embodiment, the humidity value sdc, temperature value wdz, corrosion current lcorr, and surface resistivity dzl of the electronic components of the real-time monitoring device are monitored in real time, and the corrosion problems caused by high temperature and high humidity can be detected in time. High temperature and high humidity will accelerate the corrosion of electronic components and affect the performance and stability of the device. By calculating the corrosion index Fszs of the electronic components, the corrosion risk can be accurately evaluated, and thus measures can be taken in advance to prevent problems such as equipment failure and short circuit, ensuring the long-term stable operation of the system.

[0154] In Embodiment 5, in the traditional technology, the tracking and monitoring of the sources of parts and their supply chain paths are not comprehensive enough, which may lead to part quality problems and supply chain interruptions. This situation may pose risks to the long-term operation and maintenance of the equipment.

[0155] Please refer to Figure 1 , the fourth monitoring module is used to monitor in real time the sources of several equipment parts connected to the centralized control center and the supply chain path tracking information. After dimensionless processing, the part source tracking index Lyzs is calculated through the following formula;

[0156]

[0157] In the formula, hgsl represents the historical unqualified product frequency of the part supplier, zsl represents the number of third-party certifications of the part supplier, L R represents the transportation distance of the Rth node of the part, bgcs represents the number of supplier changes per year; d5 and d6 respectively represent weight values, which are adjusted and set by the user. 0 < d5 < 1, 0 < d6 < 1, and d5 + d6 = 1.

[0158] In this embodiment, the real-time monitoring of the part sources and the supply chain path can effectively identify and prevent part quality problems and supply chain interruptions. By calculating the part source tracking index Lyzs, the reliability of the supplier, the transportation distance, and the supplier change frequency can be comprehensively evaluated, so as to discover potential risks in advance. If the equipment components are damaged, it can ensure effective real-time supply, ensure the part quality and the stability of the supply chain, and reduce the risks in the equipment operation and maintenance

[0159] In Embodiment 6, traditional memory resource management methods usually cannot monitor the locking, allocation, and cache consistency problems of memory resources in real time. This may lead to improper memory resource management, process priority conflicts, and cache consistency errors, thus affecting the overall performance of the system.

[0160] Please refer to Figure 1 , the fifth monitoring module includes a memory acquisition unit, an analysis and calculation unit, and a second associated unit;

[0161] The memory acquisition unit is used to monitor the memory resource locking information, process priority information, memory usage and allocation information, and cache information of several devices connected to the centralized control center in real time, and build a memory resource database;

[0162] The memory resource database includes: resource locking times Sd d , Lock duration Sd T , Timeout lock times CSd d , the number of process conflicts Cf CS , total process P jc 、Number of allocation failures A l 、Memory leak amount A u , Total number of resource allocation attempts A jc , Number of consistency errors C e and consistency check times C c ;

[0163] The analysis and calculation unit is used to perform data preprocessing on the memory resource database, and standardize the processed related data information according to the dimensionless processing technology. After unifying the units, the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation exception index Ncfp and the cache consistency error index Cce are calculated by the following formula:

[0164]

[0165] The second associating unit is used to calculate the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation exception index Ncfp and the cache consistency error index Cce through the following associating formula to obtain the memory risk index Ncfx:

[0166]

[0167] Where H1, H2, H3 and H4 represent the weight values ​​of resource lock state index Zysd, process priority conflict index Jc, memory allocation anomaly index Ncfp and cache consistency error index Cce respectively, which are adjusted and set by the user.

[0168] The lower-level parameters calculated in the formulas in the above specification are all processed without dimension after data processing, and the processed related data information is standardized according to the dimensionless processing technology, and the corresponding formula calculation is performed after the units are unified.​

[0169] In this embodiment, by real-time monitoring of memory resource locking, process priority, memory allocation and cache consistency, the usage status of memory resources can be fully understood. The memory resource database and analysis and calculation unit of the fifth monitoring module, combined with the resource locking status index Zysd, the process priority conflict index Jc, the memory allocation anomaly index Ncfp and the cache consistency error index Cce, calculate the memory risk index Ncfx, which can timely discover and warn memory management problems. This can effectively avoid the degradation of system performance caused by improper memory resource management and ensure the stable operation of the device.

[0170] Example 7, please refer to Figure 1 , the situation prediction module includes a first risk prediction unit, a second risk prediction unit, a third risk prediction unit, a fourth risk prediction unit and a fifth risk prediction unit;

[0171] The first risk prediction unit is used to preset a first synchronization threshold value X1, and compare the time drift index Tpy with the first synchronization threshold value X1 to obtain a first risk prediction result, including:

[0172] If the time drift index Tpy> the first synchronization threshold X1, it means that the deviation between the current device internal time and the standard time exceeds the set first synchronization threshold X1, and there is a risk of failure of the time-sensitive task;

[0173] If the time drift index Tpy ≤ the first synchronization threshold X1, it means that the internal time synchronization mechanism of the current device works normally;

[0174] The second risk prediction unit is used to preset a second risk threshold value X2, and compare the port risk index Dkfx with the second risk threshold value X2 to obtain a second risk prediction result, including:

[0175] If the port risk index Dkfx> the second risk threshold X2, it means that the current device port activity and traffic distribution are abnormal, and there is a risk of unauthorized port scanning, abnormal port activation, or traffic imbalance;

[0176] If the port risk index Dkfx ≤ the second risk threshold X2, it means that the current device port activity and traffic distribution are normal;

[0177] The third risk prediction unit is used to preset a third risk threshold value X3, and compare the electronic component corrosion index Fszs with the third risk threshold value X3 to obtain a third risk prediction result, including:

[0178] If the electronic component corrosion index Fszs> the third risk threshold X3, it means that the current equipment corrosion has the risk of causing short circuit or failure;

[0179] If the electronic component corrosion index Fszs ≤ the third risk threshold X3, it means that the current equipment corrosion does not cause the risk of short circuit or failure;

[0180] The fourth risk prediction unit is used to preset a fourth risk threshold value X4, and compare the component source tracking index Lyzs with the fourth risk threshold value X4 to obtain a fourth risk prediction result, including:

[0181] If the component source tracking index Lyzs> the fourth risk threshold X4, it means: there is a risk in the supply chain traceability of the current equipment components;

[0182] If the parts source tracking index Lyzs ≤ the fourth risk threshold X4, it means that there is no equipment maintenance and operation risk in the current equipment parts supply chain;

[0183] The fifth risk prediction unit is used to preset a fifth risk threshold value X5, and compare the memory risk index Ncf with the fifth risk threshold value X5 to obtain a fifth risk prediction result, including:

[0184] If the memory risk index Ncf is greater than the fifth risk threshold X5, it means that the memory resources of the current device have the risk of frequent resource locking, process priority conflict, memory allocation failure or cache consistency error;

[0185] If the memory risk index Ncf ≤ the fifth risk threshold X5, it means that the current device memory resource management is normal.

[0186] In this embodiment, the situation prediction module can effectively assess the potential risks of the equipment by setting various risk thresholds. Effective combination helps to identify and respond to risks in equipment operation in real time, and enhance system stability and security.

[0187] Example 8, please refer to Figure 1 , a network security and situational awareness equipment data early warning system for a centralized control system, including an early warning module and a strategy module;

[0188] The early warning module is used to generate corresponding early warning alarms according to the first risk prediction result, the second risk prediction result, the third risk prediction result, the fourth risk prediction result and the fifth risk prediction result, including:

[0189] If the time drift index Tpy> the first synchronization threshold X1, a time synchronization alarm is generated, and the warning light will flash blue quickly at a frequency of 4 times per second;

[0190] If the port risk index Dkfx> the second risk threshold X2, an abnormal port activity alarm is generated, and the warning light will flash red quickly at a frequency of 6 times per second;

[0191] If the electronic component corrosion index Fszs> the third risk threshold X3, a corrosion risk alarm is generated and the warning light will flash yellow quickly at a frequency of 5 times per second;

[0192] If the component source tracking index Lyzs> the fourth risk threshold X4, a supply chain traceability risk alarm is generated, and the warning light will flash orange at a frequency of 2 times per second;

[0193] If the memory risk index Ncf> the fifth risk threshold X5, a memory resource management risk alarm is generated, and the warning light will flash green quickly at a frequency of 6 times per second.

[0194] In this embodiment, the network security and situational awareness equipment data early warning system generates corresponding early warning alarms through a variety of risk prediction results, which can significantly improve the security and stability of the system. The early warning module intuitively conveys different types of risk alarms by flashing warning lights of different colors and frequencies, allowing operators to quickly identify and respond to potential threats. The system can detect time synchronization problems, abnormal port activity, electronic component corrosion risks, supply chain traceability problems, and memory resource management risks in real time to ensure the safe operation of equipment and network environments. This multi-level early warning mechanism helps to take timely countermeasures to prevent equipment failures or security incidents.

[0195] Example 9, please refer to Figure 1 The strategy module is used to generate corresponding strategies according to corresponding early warning alarms, including:

[0196] The first strategy is generated based on the time synchronization alarm, including: when a time synchronization problem is detected, the system automatically starts the time synchronization mechanism to ensure that the device time is resynchronized with the master clock or time server. At the same time, the system will also record the time drift information for future analysis, and promptly inform the relevant management personnel through various notification methods for manual calibration or further inspection. This strategy can effectively prevent task failures caused by time deviation and ensure the time consistency of the system.

[0197] The second strategy is generated based on the abnormal port activity alarm, including: when abnormal port activity is found, the system will immediately scan and identify the abnormal activity port and take blocking measures to prevent the spread of potential threats. At the same time, the system will reallocate traffic to other normal ports and start the security audit process to ensure that there is no unauthorized port activity. This strategy can quickly respond to and eliminate port-related security risks and prevent network attacks and unauthorized access.

[0198] The third strategy is generated based on the corrosion risk alarm, including: for the detected electronic component corrosion problem, the system will immediately stop the operation of the relevant equipment and arrange emergency repair or replacement according to the degree of corrosion. At the same time, the system will check and adjust the temperature and humidity of the environment where the equipment is located to reduce the risk of further corrosion. This strategy can effectively avoid equipment failure caused by corrosion and extend the service life of the equipment.

[0199] The fourth strategy is generated based on the supply chain traceability risk alert, including: after the supply chain traceability risk alert is triggered, the system will check the current inventory to ensure that there is enough parts inventory to deal with the risk of supply chain disruption. This strategy helps maintain the normal operation of equipment and reduce downtime or maintenance delays caused by supply chain problems.

[0200] The fifth strategy is generated based on the memory resource management risk alert, including: In response to the risk of memory resource management, the system will immediately check the priority configuration of the current process, resolve the priority conflict, release the locked memory resources, and reallocate the memory. In addition, the system will start a cache consistency check and repair the errors found. This strategy can improve the utilization efficiency of memory resources and avoid system performance degradation or crashes caused by improper memory management.

[0201] The threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by technicians in this field for each group of sample data; as long as it does not affect the proportional relationship between the parameter and the quantized value.

[0202] The above formulas are obtained by collecting a large amount of data for software simulation and selecting a formula that is close to the actual value. The coefficients in the formula are set by technical personnel in this field according to actual conditions. The above is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited to this. Any technical personnel familiar with the technical field within the technical scope disclosed by the present invention, according to the technical solution and the inventive concept of the present invention, make equivalent replacement or change, which should be covered within the protection scope of the present invention.

Claims

1. A network security and situational awareness equipment data monitoring system for a centralized control system, characterized by: It includes a first monitoring module, a second monitoring module, a third monitoring module, a fourth monitoring module, a fifth monitoring module and a situation prediction module; The first monitoring module is used to monitor the time drift information and related time impact information of several devices connected to the centralized control center in real time to construct a time drift index Tpy; The second monitoring module is used to monitor the port opening status, port scanning events and abnormal activation times of unused ports of several devices connected to the centralized control center in real time, and analyze and calculate to obtain the port situation index UPS; And detect and obtain port traffic distribution information to build a port traffic balance index Phzs; The port situation index UPS and the port traffic balance index Phzs are correlated to calculate the port risk index Dkfx; The third monitoring module is used to monitor the electronic component corrosion information of several devices connected to the centralized control center in real time to construct the electronic component corrosion index Fszs; The fourth monitoring module is used to monitor the sources of several equipment parts and supply chain path tracking information connected to the centralized control center in real time to construct a parts source tracking index Lyzs; The fifth monitoring module is used to monitor the memory resource locking information, process priority information, memory usage and allocation information, and cache information of several devices connected to the centralized control center in real time, and to build a memory resource database to build a resource locking state index Zysd, a process priority conflict index Jc, a memory allocation anomaly index Ncfp, and a cache consistency error index Cce; and to associate the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation anomaly index Ncfp, and the cache consistency error index Cce, and to calculate and obtain the memory risk index Ncfx; The situation prediction module is used to evaluate the time drift index Tpy, the port risk index Dkfx, the electronic component corrosion index Fszs, the parts source tracking index Lyzs and the memory risk index Ncfx to obtain corresponding analysis results, so as to comprehensively analyze the stability of the current equipment operation situation, and display the comparative analysis results on the user monitoring interface in real time. The user monitoring interface will receive the feedback content and take corresponding remote monitoring measures.

2. A network security and situational awareness equipment data monitoring system for a centralized control system according to claim 1, characterized in that: The first monitoring module includes a time drift acquisition unit, a device time synchronization unit, an oscillator monitoring unit and a delay monitoring unit; The time drift acquisition unit is used to monitor the time drift information of several devices connected to the centralized control center in real time, and calculate the clock drift value of the jth device in the i-th region through the following formula: Where, T device Indicates the current time of the device, T reference is the time of the standard time source; The device time synchronization unit is used to record the time point when the device is synchronized with the standard time source, and the synchronization time difference of the jth device in the i-th region is calculated by the following formula: Where, T sync,next is the time of next synchronization, T sync,last is the time of the last synchronization; The oscillator monitoring unit is used to collect the frequency of the oscillator, and the oscillator frequency increment value of the jth device in the i-th region is calculated by the following formula: In the formula, F devicet is the current frequency of the device oscillator, F reference is the device oscillator reference frequency threshold; The delay monitoring unit is used to send a timestamp data packet and measure the time interval from the device sending to receiving, and calculate the transmission time delay value of the jth device in the i-th region through the following formula Where, T send Indicates the time when the data packet is sent, T receive is the time when the packet is received.

3. A network security and situational awareness equipment data monitoring system for a centralized control system according to claim 2, characterized in that: The first monitoring module also includes a jitter monitoring unit and a fitting calculation unit; The jitter monitoring unit is used to collect and obtain the time signal value of the jth device in the i-th region at the nth measurement through a jitter detection tool, and calculate and obtain the time signal jitter index of the jth device in the i-th region through the following steps: S1. First, calculate the deviation ΔT of each time signal from its mean ij (n): Where, T ij (n) is the time signal value of the jth device in the i-th region at the nth measurement, which is collected and obtained through the network measurement tool. It represents the mean time signal of the jth device in the i-th region at all measurement times, which is calculated by the following formula: N represents the total number of data points at all measurement moments; S2, and calculate the square of each time signal deviation In the formula, all time signal deviations are converted to positive values ​​through square operation to eliminate the influence of negative values; S3, the square of the deviation of the time signal for all measurements Perform weighted sum and obtain the weighted sum WS by the following formula: S4, and according to the weighted sum WS, the time signal jitter index of the jth device in the i-th region is calculated by the following formula Where Wn represents the weighting factor of the nth measurement; The fitting calculation unit is used to calculate the clock drift value of the jth device in the i-th region The synchronization time difference of the jth device in the i-th region The oscillator frequency increment value for the jth device in the i-th region The transmission time delay value of the jth device in the i-th region and the time signal jitter index of the jth device in the i-th region After dimensionless processing, the time drift index Tpy is calculated using the following fitting formula: Where a1, a2, a3, a4 and a5 represent the clock drift values ​​of the jth device in the i-th region respectively. The synchronization time difference of the jth device in the i-th region The oscillator frequency increment value for the jth device in the i-th region The transmission time delay value of the jth device in the i-th region and the time signal jitter index of the jth device in the i-th region The weight value of b1 represents the first correction constant value.

4. A network security and situational awareness equipment data monitoring system for a centralized control system according to claim 1, characterized in that: The second monitoring module includes a port status monitoring unit, a port situation analysis unit and a first association unit; The port status monitoring unit is used to monitor the port opening status, port scanning events and abnormal activation times of unused ports of several devices connected to the centralized control center in real time. After dimensionless processing, the port status index UPS is obtained by analysis and calculation through the following formula: Where, smcs m Indicates the frequency of the mth port scan event of the device, ycqy n Indicates the number of abnormal activations of the device's unused port for the nth time; The port situation analysis unit is used to monitor and obtain port traffic distribution information in real time to obtain port traffic data. After dimensionless processing, the port traffic balance index Phzs is obtained by analysis and calculation using the following formula; Wherein, maxF represents the maximum value among the traffic of all ports of the device, and minF represents the minimum value among the traffic of all ports of the device. represents the total traffic of all ports, F k represents the traffic value of the k-th port, a8 and a9 represent weight values, and 0 < a8 < 1, 0 < a9 < 1, and a8 + a9 = 1; The first associating unit is used to calculate the port risk index Dkfx by using the following associating formula to calculate the port situation index UPS and the port flow balance index Phzs; Dkfx=a 10 *UPS+a 11 *Phzs; In the formula, a 10 and a 11 Indicates the weight value of the port status index UPS and the port traffic balance index Phzs.

5. The network security and situational awareness equipment data monitoring system for a centralized control system according to claim 1, characterized in that: The third monitoring module is used to monitor the corrosion information of electronic components of several devices connected to the centralized control center in real time through temperature and humidity sensors, electrochemical corrosion sensors and surface resistivity sensors, and obtain the humidity value sdc, temperature value wdz, corrosion current lcorr and surface resistivity dzl; after dimensionless processing, the electronic component corrosion index Fszs is calculated by the following formula; In the formula, Indicates the preset humidity threshold, represents a preset temperature threshold, and d1, d2, d3 and d4 represent weight values ​​respectively.

6. A network security and situational awareness equipment data monitoring system for a centralized control system according to claim 1, characterized in that: The fourth monitoring module is used to monitor the sources of several equipment parts and supply chain path tracking information connected to the centralized control center in real time. After dimensionless processing, the parts source tracking index Lyzs is calculated by the following formula; In the formula, hgsl represents the historical frequency of unqualified products of the parts supplier, zsl represents the number of third-party certifications of the parts supplier, and L R represents the transportation distance of the Rth node of the component, bgcs represents the number of supplier changes per year; d5 and d6 represent the weight values ​​respectively.

7. A network security and situational awareness equipment data monitoring system for a centralized control system according to claim 1, characterized in that: The fifth monitoring module includes a memory acquisition unit, an analysis and calculation unit, and a second association unit; The memory acquisition unit is used to monitor the memory resource locking information, process priority information, memory usage and allocation information, and cache information of several devices connected to the centralized control center in real time, and build a memory resource database; The memory resource database includes: resource locking times Sd d , Lock duration Sd T , Timeout lock times CSd d , the number of process conflicts Cf CS , total process P jc 、Number of allocation failures A l 、Memory leak amount A u , Total number of resource allocation attempts A jc , Number of consistency errors C e and consistency check times C c ; The analysis and calculation unit is used to perform data preprocessing on the memory resource database, and standardize the processed related data information according to the dimensionless processing technology. After unifying the units, the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation exception index Ncfp and the cache consistency error index Cce are calculated by the following formula: The second associating unit is used to calculate the resource locking state index Zysd, the process priority conflict index Jc, the memory allocation exception index Ncfp and the cache consistency error index Cce through the following associating formula to obtain the memory risk index Ncfx: Wherein, H1, H2, H3 and H4 represent the weight values ​​of resource lock state index Zysd, process priority conflict index Jc, memory allocation anomaly index Ncfp and cache consistency error index Cce respectively, and b2 represents the second correction normal value.

8. A network security and situational awareness equipment data monitoring system for a centralized control system according to claim 7, characterized in that: The situation prediction module includes a first risk prediction unit, a second risk prediction unit, a third risk prediction unit, a fourth risk prediction unit and a fifth risk prediction unit; The first risk prediction unit is used to preset a first synchronization threshold value X1, and compare the time drift index Tpy with the first synchronization threshold value X1 to obtain a first risk prediction result, including: If the time drift index Tpy> the first synchronization threshold X1, it means that the deviation between the current device internal time and the standard time exceeds the set first synchronization threshold X1, and there is a risk of failure of the time-sensitive task; If the time drift index Tpy ≤ the first synchronization threshold X1, it means that the internal time synchronization mechanism of the current device works normally; The second risk prediction unit is used to preset a second risk threshold value X2, and compare the port risk index Dkfx with the second risk threshold value X2 to obtain a second risk prediction result, including: If the port risk index Dkfx> the second risk threshold X2, it means that the current device port activity and traffic distribution are abnormal, and there is a risk of unauthorized port scanning, abnormal port activation, or traffic imbalance; If the port risk index Dkfx ≤ the second risk threshold X2, it means that the current device port activity and traffic distribution are normal; The third risk prediction unit is used to preset a third risk threshold value X3, and compare the electronic component corrosion index Fszs with the third risk threshold value X3 to obtain a third risk prediction result, including: If the electronic component corrosion index Fszs> the third risk threshold X3, it means that the current equipment corrosion has the risk of causing short circuit or failure; If the electronic component corrosion index Fszs ≤ the third risk threshold X3, it means that the current equipment corrosion does not cause the risk of short circuit or failure; The fourth risk prediction unit is used to preset a fourth risk threshold value X4, and compare the component source tracking index Lyzs with the fourth risk threshold value X4 to obtain a fourth risk prediction result, including: If the component source tracking index Lyzs> the fourth risk threshold X4, it means: there is a risk in the supply chain traceability of the current equipment components; If the parts source tracking index Lyzs ≤ the fourth risk threshold X4, it means that there is no equipment maintenance and operation risk in the current equipment parts supply chain; The fifth risk prediction unit is used to preset a fifth risk threshold value X5, and compare the memory risk index Ncf with the fifth risk threshold value X5 to obtain a fifth risk prediction result, including: If the memory risk index Ncf is greater than the fifth risk threshold X5, it means that the memory resources of the current device have the risk of frequent resource locking, process priority conflict, memory allocation failure or cache consistency error; If the memory risk index Ncf ≤ the fifth risk threshold X5, it means that the current device memory resource management is normal.

9. A network security and situational awareness equipment data early warning system for a centralized control system, applied to a network security and situational awareness equipment data monitoring system for a centralized control system according to any one of claims 1 to 8, characterized in that: Includes early warning module and strategy module; The early warning module is used to generate corresponding early warning alarms according to the first risk prediction result, the second risk prediction result, the third risk prediction result, the fourth risk prediction result and the fifth risk prediction result, including: If the time drift index Tpy> the first synchronization threshold X1, a time synchronization alarm is generated, and the warning light will flash blue quickly at a frequency of 4 times per second; If the port risk index Dkfx> the second risk threshold X2, an abnormal port activity alarm is generated, and the warning light will flash red quickly at a frequency of 6 times per second; If the electronic component corrosion index Fszs> the third risk threshold X3, a corrosion risk alarm is generated and the warning light will flash yellow quickly at a frequency of 5 times per second; If the component source tracking index Lyzs> the fourth risk threshold X4, a supply chain traceability risk alarm is generated, and the warning light will flash orange at a frequency of 2 times per second; If the memory risk index Ncf> the fifth risk threshold X5, a memory resource management risk alarm is generated, and the warning light will flash green quickly at a frequency of 6 times per second.

10. A network security and situation awareness equipment data early warning system for a centralized control system according to claim 9, characterized in that: The strategy module is used to generate corresponding strategies according to corresponding early warning alarms, including: Generate the first strategy based on the time synchronization alarm, including: the system automatically triggers the time synchronization mechanism and attempts to resynchronize with the master clock or time server; record all relevant time drift information for further analysis and tracking, and inform relevant management personnel to perform manual calibration or inspection through SMS, email or system notification; Generate a second strategy based on the abnormal port activity alarm, including: immediately scan and identify the ports with abnormal activities, temporarily block the abnormal ports to prevent further threats, and reallocate traffic to other ports, start the security audit process to check whether there is unauthorized port activity or attack behavior, and block unauthorized ports if there are any; The third strategy is generated based on the corrosion risk alarm, including: immediately stopping the operation of related equipment and arranging emergency repairs or replacing severely corroded electronic components according to the degree of corrosion; checking the humidity and temperature of the environment where the equipment is located, and adjusting the temperature and humidity within the threshold range through temperature control equipment; The fourth strategy is generated based on the supply chain traceability risk alert, including: checking the current inventory of parts to ensure that there is enough inventory to cope with supply chain disruptions; A fifth strategy is generated based on the memory resource management risk alert, including: immediately checking the priority configuration of the current process, adjusting the priority of the conflicting process, releasing the locked memory resources, and reallocating the memory; starting the cache consistency check and repairing the consistency errors that have been found.

Images