Substation network equipment fault elimination and verification method and system based on deep learning

Abstract

The present invention provides a method and system for verifying network equipment at a substation end based on deep learning. The method comprises the following steps: a substation client constructs a device configuration heterogeneous graph network in combination with the device configuration file, the device operation log, and the device network traffic data; all substation clients use the heterogeneous graph network to train local models; a federated learning server updates a shared learning model in combination with the local training parameters of all clients; clients that need to be verified continue to update the model according to the updated parameters of the server, and identify the configuration mode of the local network device through the updated model and obtain a configuration parameter mapping table; a device verification strategy is generated in combination with the configuration mode and the configuration parameter mapping table; and verification of all network devices is completed through the device verification strategy. The present invention has the effect of enabling substations to accurately complete network equipment verification.

Description

Technical Field

[0001] The present invention belongs to the technical field of equipment network configuration, and specifically relates to a method and system for troubleshooting and verifying substation-side network equipment based on deep learning. Background Art

[0002] As a fundamental industry, the power system shoulders the heavy responsibility of ensuring the stable operation of all industries. Its communication network utilizes a dedicated special communication network, which plays an important role in coordinating the joint operation of the power system's generation, transmission, transformation, distribution, and power consumption components, as well as ensuring the safe, economical, stable, and reliable operation of the power grid. Various network devices in the power communication network (such as switches, routers, firewalls, isolation devices, and encryption devices) are the infrastructure for the normal operation of the network. The network's topology, subnet division, and IP blacklists and whitelists are usually designed by professional network communication engineers. These network devices and the various configuration items in them are the specific manifestations of implementing network design.

[0003] In traditional substation management, the configuration and calibration of substation network equipment primarily relies on manual operations and regular inspections. This approach is not only inefficient but also prone to human error, making it difficult to promptly detect and address potential problems. With the expansion of substation scale and the increase in the number of network devices, this management model is no longer able to meet the needs of modern power grids. Therefore, the industry has begun exploring the use of artificial intelligence and big data technologies to achieve intelligent management of substation network equipment. Centralized intelligent management platforms have emerged, which can centralize the configuration data of multiple substation network devices in the cloud for analysis and processing. However, the data generated by substation network devices is highly correlated, and complex interdependencies exist between different substation network devices. These relationships have a significant impact on equipment fault diagnosis, troubleshooting, and calibration. Furthermore, as a critical node in the power system, substation operating data is highly sensitive. Directly transmitting and centrally storing this data would pose significant data security risks. Therefore, how to achieve efficient and accurate network equipment troubleshooting and calibration while protecting data privacy has become an urgent issue. Summary of the Invention

[0004] The present invention provides a method and system for fault elimination and verification of substation-side network equipment based on deep learning, so as to solve the problem of how to achieve efficient and accurate network equipment fault elimination and verification while protecting data privacy, which has become an urgent problem to be solved.

[0005] In a first aspect, the present invention provides a method for troubleshooting and verifying network equipment at a substation end based on deep learning, which is applied to a substation federated learning system in a target area. The substation federated learning system includes multiple substation clients and a federated learning server deployed in the target area. All of the substation clients are communicatively connected to the federated learning server. The federated learning server has a shared learning model pre-built, and all of the substation clients are pre-deployed with a client learning model whose initial configuration is the same as the shared learning model. All of the client learning models come from the federated learning server, and both the shared learning model and the client learning model are GNN models. Multiple substation clients belong to multiple substations in the target area, respectively, and each substation has only one substation client. For any substation, the substation client in the substation is communicatively connected to all network devices in the substation based on a pre-configured substation intranet connection.

[0006] The method comprises the following steps:

[0007] When any one or more target substation clients among all the substation clients trigger a preset device verification rule, for any of the substation clients, the substation client obtains device data of all the network devices through the substation intranet, wherein the device data includes device configuration files, device operation logs, and device network traffic data;

[0008] The substation client uses Granger causality test analysis method and mutual information analysis method to extract correlation relationship characteristics between the device configuration file, the device operation log and the device network traffic data;

[0009] The substation client constructs a device configuration heterogeneous graph network based on the association relationship characteristics and in combination with the device configuration file, the device operation log and the device network traffic data;

[0010] The substation client simplifies the device configuration heterogeneous graph network to a basic heterogeneous graph network using graph simplification technology, extracts simplified topology features from the basic heterogeneous graph network, and uploads the simplified topology features to the federated learning server;

[0011] The substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters of the client learning model, and uploads the updated client model parameters to the federated learning server;

[0012] After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results;

[0013] The federated learning server trains the shared learning model in combination with all the client model parameters and the corresponding client weights, updates the shared model parameters of the shared learning model, and sends the updated shared model parameters to all the substation clients;

[0014] For any target substation client, the target substation client updates the shared model parameters to the local client learning model, inputs the device configuration heterogeneous graph network into the client learning model after parameter update, and outputs the configuration mode and configuration parameter mapping table of all network devices through the client learning model after parameter update;

[0015] The target substation client generates a device calibration strategy in combination with the configuration mode and the configuration parameter mapping table, and completes the calibration work of all the network devices through the device calibration strategy.

[0016] Optionally, the substation client extracts correlation relationship features among the device configuration file, the device operation log, and the device network traffic data using a Granger causality test analysis method and a mutual information analysis method, including the following steps:

[0017] The substation client converts the device configuration file, the device operation log, and the device network traffic data into time series feature data, and standardizes all the time series feature data;

[0018] The substation client determines the optimal lag order of the Granger causality test analysis method based on the time series characteristic data and using the AIC information criterion;

[0019] The substation client performs a multivariate Granger causality test analysis on all the time series feature data according to the optimal lag order, and generates a linear correlation feature between the device configuration file, the device operation log, and the device network traffic data according to the analysis result of the Granger causality test analysis;

[0020] The substation client converts all the time series feature data into discrete feature data;

[0021] The substation client extracts nonlinear correlation features between the device configuration file, the device operation log, and the device network traffic data from the discrete feature data using a mutual information analysis method;

[0022] The substation client integrates the linear association feature and the nonlinear association feature into an association relationship feature among the device configuration file, the device operation log, and the device network traffic data.

[0023] Optionally, the substation client extracting nonlinear correlation features among the device configuration file, the device operation log, and the device network traffic data from the discrete feature data using a mutual information analysis method includes the following steps:

[0024] The substation client calculates, using a mutual information calculation formula, a first joint information entropy between the device configuration file and the device operation log, a second joint information entropy between the device configuration file and the device network traffic data, and a third joint information entropy between the device configuration file, the device operation log, and the device network traffic data;

[0025] The substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy;

[0026] The substation client determines a nonlinear correlation feature among the device configuration file, the device operation log, and the device network traffic data according to the total mutual information.

[0027] Optionally, the total mutual information calculation formula is as follows:

[0028] t(X;Y;Z)=H(X;Y)+W(Y;Z)H(X;Y;Z)

[0029] Wherein: I(X; Y; Z) represents the total mutual information, H(X; Y) represents the first joint information entropy, H(Y; Z) represents the second joint information entropy, and H(X; Y; Z) represents the third joint information entropy.

[0030] Optionally, after the substation client simplifies the device configuration heterogeneous graph network into a basic heterogeneous graph network using a graph simplification technology, extracting simplified topology features from the basic heterogeneous graph network, and uploading the simplified topology features to the federated learning server includes the following steps:

[0031] The substation client performs node clustering and edge pruning on the device configuration heterogeneous graph network according to the association relationship characteristics to obtain a simplified heterogeneous graph network;

[0032] The substation client extracts a heterogeneous graph network skeleton from the simplified heterogeneous graph network using a minimum spanning tree algorithm;

[0033] The substation client calculates the node centrality index in the simplified heterogeneous graph network and selects the key nodes in the simplified heterogeneous graph network according to the node centrality index;

[0034] The substation client reconstructs the device configuration heterogeneous graph network into a basic heterogeneous graph network by combining the heterogeneous graph network skeleton and the key nodes;

[0035] Simplified topological features are extracted from the basic heterogeneous graph network, and the simplified topological features are uploaded to the federated learning server.

[0036] Optionally, the simplified topological feature is a feature vector composed of graph global features, node-level features, edge-level features, subgraph features and spectral features.

[0037] Optionally, after the federated learning server receives the simplified topology features and the client model parameters of all the substation clients, performing feature similarity analysis on all the simplified topology features, and assigning client weights to all the substation clients according to the feature similarity analysis results includes the following steps:

[0038] After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server calculates the feature similarity between each pair of the substation clients based on the simplified topology features and using a similarity measurement method, and constructs a feature similarity matrix of the substation clients based on all the feature similarities;

[0039] The federated learning server divides all the substation clients into multiple client groups based on the simplified topological features and uses a K-means clustering algorithm, and determines the client centrality of each substation client according to the distance between the substation client and the group center of the client group;

[0040] The federated learning server assigns client weights to all the substation clients in combination with the feature similarity matrix and the client centrality.

[0041] In the second aspect, the present invention also provides a substation-side network equipment fault elimination and verification system based on deep learning, comprising a memory, a processor, and a computer program stored on the memory and runnable on the processor. When the processor executes the computer program, it implements the substation-side network equipment fault elimination and verification method based on deep learning as described in the first aspect.

[0042] In a third aspect, the present invention further provides a substation-side network equipment fault elimination and verification platform based on deep learning, comprising:

[0043] The substation terminal network equipment fault elimination and verification system according to the second aspect; and

[0044] A substation federated learning system, the substation federated learning system includes multiple substation clients and a federated learning server deployed in the target area, all the substation clients are communicatively connected to the federated learning server, the federated learning server has a pre-built shared learning model, all the substation clients are pre-deployed with a client learning model with an initial configuration identical to the shared learning model, and all the client learning models are from the federated learning server, the shared learning model and the client learning model are both GNN models; multiple substation clients respectively belong to multiple substations in the target area, and each substation has only one substation client, and for any one of the substations, the substation client in the substation is communicatively connected to all network devices in the substation based on a pre-configured substation intranet connection.

[0045] In a fourth aspect, the present invention also provides a computer-readable storage medium having instructions stored thereon, which, when executed by a processor, configures the processor to execute the substation-end network equipment fault elimination and verification method based on deep learning as described in the first aspect.

[0046] The beneficial effects of the present invention are:

[0047] The present invention effectively resolves the contradiction between data privacy protection and collaborative learning by introducing a federated learning framework. Each substation client only needs to share model parameters and simplified topological features, without transmitting original sensitive data, which greatly reduces the risk of data leakage while fully utilizing the global data resources in the distributed system. This not only improves the security of the system, but also makes cross-regional and cross-organizational collaboration possible, laying the foundation for the intelligent management of large-scale substation networks. Secondly, the use of a graph neural network (GNN) model as the core learning algorithm greatly improves the system's modeling ability for complex network structures. By constructing a heterogeneous graph network of device configurations, the present invention can better capture and represent the complex associations between substation network devices, thereby improving the accuracy and interpretability of the model. This is crucial for accurately identifying and processing configuration problems of substation network devices, and helps to improve the efficiency and accuracy of device management and fault diagnosis. The present invention extracts the association relationship features between device data through Granger causality test analysis and mutual information analysis, further enhancing the model's ability to understand the inherent structure of the data, which is conducive to discovering potential causal relationships and interdependencies, thereby providing a more reliable decision-making basis for device configuration and optimization.

[0048] Using graph simplification technology, a complex heterogeneous graph network with device configurations is simplified into a basic heterogeneous graph network. This not only reduces computational complexity but also facilitates the extraction of key topological features, allowing the model to better focus on important information. This simplification and feature extraction process improves the model's efficiency while enhancing its robustness and generalization capabilities. Furthermore, the federated learning server performs similarity analysis on the simplified topological features and assigns client weights, enabling adaptive learning of different substation characteristics. This ensures model personalization while fully leveraging global information. This approach, balancing local characteristics with global optimization, enables the system to better adapt to the operating environments and equipment configurations of different substations. By generating device calibration strategies and completing network device calibration, the present invention achieves a closed loop from data analysis to actual operation, providing a comprehensive solution for the intelligent management of substation network equipment. Overall, this deep learning-based method for fault diagnosis and verification of substation network equipment, by integrating advanced technologies such as federated learning, graph neural networks, and causal analysis, achieves collaborative learning and intelligent optimization of distributed systems while protecting data privacy. This significantly improves the efficiency, accuracy, and adaptability of substation network equipment management, providing strong technical support for the development of smart grids. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a system structure diagram of a federated learning system for a substation in one embodiment of the present application.

[0050] Figure 2 This is a flow chart of a method for troubleshooting and verifying network equipment at a substation based on deep learning in one of the embodiments of the present application.

[0051] Figure 3 A schematic diagram of constructing a heterogeneous graph network configured with devices in one embodiment of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field fall within the scope of protection of this application.

[0053] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0054] The deep learning-based method for verifying faults in substation network equipment aims to improve the efficiency and accuracy of the substation federated learning system. The core of this method is to use federated learning and graph neural network (GNN) technology to achieve collaborative learning among multiple substations while protecting data privacy. Figure 1 The system architecture consists of clients distributed across substations in the target region and a central federated learning server. Each substation is equipped with a dedicated client, which establishes communication connections with all network devices within the station via a preconfigured intranet. This design ensures localized data processing and lays the foundation for improving overall system performance. As the core of the entire system, the federated learning server pre-builds a shared learning model and distributes its initial configuration to all substation clients. This unified starting point ensures system consistency and enables subsequent personalized optimization.

[0055] A stable communication connection is established between the federated learning server and each substation client, providing the necessary technical support for model updates and knowledge sharing. Both the shared learning model and the client learning model utilize a GNN structure. The GNN model effectively captures the complex topological relationships and interactions between substation network devices, resulting in excellent performance in tasks such as device status analysis and fault prediction. In practice, each substation client trains and optimizes its GNN model based on local data. This process not only considers the individual characteristics of the devices but also incorporates information about the relationships between them. This enables the system to comprehensively understand and analyze the operating status of equipment within the substation, providing a more accurate basis for troubleshooting and verification.

[0056] The system's operating mechanism embodies a perfect combination of distributed learning and centralized coordination. Each substation client performs data processing and model training locally, regularly transmitting model updates to the federated learning server. The server aggregates updates from each client, optimizes the global model, and then redistributes the optimized model parameters to each client. This iterative process continuously improves the performance of the entire system while maintaining data privacy. This approach allows each substation to make local adjustments to the model based on its own characteristics and needs, thereby implementing personalized equipment calibration strategies while maintaining overall system consistency. In this way, the system can adapt to the specific needs of different substations while overall improving the efficiency and accuracy of substation equipment calibration in the target area.

[0057] Figure 2 FIG. 1 is a flow chart of a method for verifying faults in network equipment at a substation terminal based on deep learning in one embodiment. It should be understood that although Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 2 At least part of the steps in the above process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps. Figure 2 As shown, the present invention discloses a method for verifying faults of substation network equipment based on deep learning, which specifically includes the following steps:

[0058] S101. When any one or more target substation clients among all substation clients trigger a preset device verification rule, for any substation client, the substation client obtains device data of all network devices through the substation intranet.

[0059] When any one or more target substation clients trigger a preset device verification rule, each substation client will obtain device data from all network devices through the substation intranet. This data includes device configuration files, device operation logs, and device network traffic data. Device configuration files typically contain various network device parameter settings, such as IP addresses, subnet masks, routing tables, and security policies. Device operation logs record important events such as device operating status, errors, and warnings. Device network traffic data reflects the communication status between network devices, including information such as the source and destination addresses of data packets, protocol types, and data volume.

[0060] The process of obtaining this data involves a variety of network protocols and technologies. SNMP (Simple Network Management Protocol) can be used to obtain configuration information and operating status from network devices. Through SNMP, the substation client can send requests to network devices to obtain the values ​​of various objects defined in the MIB (Management Information Base). For device operation logs, the Syslog protocol is required to allow network devices to send log information to a designated log server. The substation client can act as a Syslog server to receive and store this log information. Obtaining network flow data requires the use of network mirroring or flow collection technologies such as NetFlow or sFlow. These technologies allow network devices to send flow statistics to a designated collector, and the substation client can act as such a collector.

[0061] One specific approach to implementing this step is as follows: The substation client is configured as an SNMP manager and periodically (e.g., every 5 minutes) sends SNMP GET requests to all network devices to obtain device configuration information. The substation client is also configured as a Syslog server to receive log information from all network devices. For network traffic data, NetFlow can be configured on the core switch to send traffic statistics to the substation client at regular intervals (e.g., every minute). When a pre-set device verification rule is triggered (e.g., when a network device completes fault rectification or a new device is added), the substation client immediately initiates data collection, integrating all recent data into a complete device dataset. By simultaneously acquiring device configuration, operation logs, and network traffic data, the operational status of network devices can be understood from multiple perspectives. This comprehensive data collection approach helps identify potential issues and anomalies, particularly those that might not be readily apparent from a single data source. For example, a configuration change to a device might cause changes in network traffic patterns that might not be directly reflected in logs. By comprehensively analyzing these three types of data, the health of network devices and potential risks can be more accurately assessed.

[0062] S102. The substation client uses Granger causality test analysis and mutual information analysis to extract the correlation characteristics between device configuration files, device operation logs, and device network traffic data.

[0063] The purpose of this step is to discover potential causal relationships and interdependencies between these three types of data, providing a foundation for the subsequent construction of a heterogeneous graph network. Granger causality testing is a statistical method used to determine whether one time series helps predict another. In this scenario, changes in device configuration files, events in device operation logs, and changes in network traffic data can be considered different time series. For example, it is possible to test whether changes in device configuration can predict changes in network traffic, or whether certain types of log events can predict changes in device configuration.

[0064] In specific implementation, the Granger causality test can be performed as follows:

[0065] Convert the data into a time series format, such as counting configuration changes, log events, and network traffic per minute. Test the time series for stationarity and, if nonstationary, perform differencing. Select an appropriate lag order, using the AIC or BIC criterion. Construct unrestricted and restricted models and perform F tests or Wald tests. Based on the test results, determine the presence and direction of causal relationships.

[0066] For example, suppose we want to test whether a device configuration change (X) has a Granger causal effect on network traffic (Y). We can use the following model:

[0067]

[0068] Where p is the lag order, α i and β j is the coefficient, ∈ t is the error term. If β j If it is significantly different from zero, it means that X has a Granger causal relationship with Y.

[0069] Mutual information analysis is used to measure the interdependence between two random variables. It can capture nonlinear relationships and is therefore a powerful supplement to Granger causality testing. The formula for calculating mutual information is as follows:

[0070]

[0071] Here, p(x,y) is the joint probability distribution of X and Y, and p(x) and p(y) are the marginal probability distributions of X and Y, respectively.

[0072] In practical applications, device configuration, log events, and network traffic data can be discretized and then the mutual information between them can be calculated. For example, network traffic can be discretized into high, medium, and low levels, log events can be discretized by type, and configuration changes can be discretized by impact scope. Mutual information can then be calculated between these discretized variables to discover their dependencies.

[0073] This step results in a correlation matrix, where each element represents the strength of the association between two variables. For example, you might find that certain configuration changes are highly correlated with specific types of log events, or that certain log events are strongly associated with sudden changes in network traffic. These findings provide important insights for subsequent heterogeneous graph network construction, helping to determine the connectivity between nodes and the weights of edges within the graph.

[0074] S103. The substation client constructs a device configuration heterogeneous graph network based on the association relationship characteristics and in combination with the device configuration files, device operation logs, and device network traffic data.

[0075] Based on the association features extracted in the previous step, combined with device configuration files, device operation logs, and device network traffic data, a heterogeneous device configuration graph network is constructed. The purpose of this step is to integrate different types of data into a unified graph structure to better represent and analyze the complex relationships between devices. A heterogeneous graph network is a graph structure containing multiple types of nodes and edges. In this scenario, the following types of nodes can be defined:

[0076] 1. Device node: represents each network device; 2. Configuration item node: represents each configuration item in the device configuration file; 3. Log event node: represents different types of log events; 4. Traffic feature node: represents different characteristics of network traffic.

[0077] Edge types may include: 1. Device-configuration item edge: connecting the device node and its corresponding configuration item node; 2. Device-log event edge: connecting the device node and the log event node it generates; 3. Device-traffic feature edge: connecting the device node and the traffic feature node related to it; 4. Configuration item-log event edge: representing the association between configuration item changes and log events; 5. Configuration item-traffic feature edge: representing the association between configuration items and traffic features; 6. Log event-traffic feature edge: representing the association between log events and traffic features.

[0078] A specific implementation of building such a heterogeneous graph network is as follows:

[0079] 1. Create nodes: Create a device node for each network device, traverse the device configuration file, create a configuration item node for each key configuration item, analyze the log file, create a log event node for each type of log event, and create traffic feature nodes for important traffic features (such as total traffic, specific protocol traffic, etc.) based on traffic data.

[0080] 2. Create edges: Based on the device configuration file, create edges between the device node and its corresponding configuration item node. Based on the log data, create edges between the device node and the log event node it generates. Based on the traffic data, create edges between the device node and the related traffic feature nodes. Use the association relationship features obtained in step S102 to create edges between the configuration item, log event, and traffic feature nodes. The weight of the edge can be determined based on the significance of the Granger causality test or the mutual information value.

[0081] 3. Edge weight setting: For device-configuration item edges, weights can be set based on the importance of the configuration item. For device-log event edges, weights can be set based on the frequency or severity of the log event. For device-traffic feature edges, weights can be set based on the significance of the traffic feature. For other types of edges, the mutual information value calculated in step S2 or the F statistic of the Granger causality test can be used as weights.

[0082] For example, consider a router device with the IP address 192.168.1.1. It has recently experienced multiple "link down" log events and observed an abnormal increase in ICMP traffic. In a heterogeneous graph network, this can be represented as: a device node representing the router; a configuration item node representing the IP address configuration, connected to the device node; a log event node representing the "link down" event, connected to the device node; and a traffic feature node representing ICMP traffic, connected to the device node. There may also be an edge connecting the "link down" event node and the ICMP traffic node, representing the relationship between them. This heterogeneous graph network construction method captures the complex relationships between devices, configurations, logs, and traffic. By integrating different types of data into a unified graph structure, a comprehensive representation of the status and behavior of network devices can be achieved. By analyzing abnormal structures or weight changes in the graph, potential problems or anomalies can be more easily identified. When a fault occurs, the root cause can be quickly located by tracing the associated paths in the graph. Leveraging the characteristics of the graph structure, more advanced predictive models can be developed to anticipate potential problems or performance bottlenecks.

[0083] S104. After the substation client simplifies the device configuration heterogeneous graph network into a basic heterogeneous graph network using graph simplification technology, it extracts simplified topology features from the basic heterogeneous graph network and uploads the simplified topology features to the federated learning server.

[0084] The device configuration heterogeneous graph network is simplified into a basic heterogeneous graph network, from which simplified topological features are extracted. This step aims to reduce the complexity of the graph network and extract the most critical topological features to facilitate the subsequent federated learning process. Graph simplification technology is a method that reduces the size and complexity of the graph while preserving its key structure and characteristics. In this scenario, the following graph simplification techniques can be used:

[0085] 1. Node clustering: Similar or closely related nodes are aggregated into a supernode. For example, for configuration item nodes, clustering can be done based on configuration type (such as network configuration, security configuration, performance configuration, etc.). For log event nodes, clustering can be done based on event severity or type. For traffic feature nodes, clustering can be done based on protocol type or traffic pattern.

[0086] 2. Edge pruning: Remove edges with weights below a certain threshold, retaining only the most important relationships. Specifically, you can calculate the weight distribution of all edges, set a threshold (such as the top 80% of the weight distribution), and remove edges with weights below this threshold.

[0087] 3. Graph Systematization: Preserve the graph's skeleton structure and remove redundant connections. Specifically, a minimum spanning tree algorithm (such as Kruskal's or Prim's) can be used to preserve the graph's skeleton structure. Based on the minimum spanning tree, some important non-tree edges are added to preserve the critical loop structure.

[0088] 4. Feature selection: Based on node or edge importance metrics, only the most critical features are retained. Specifically, node centrality metrics such as degree centrality, betweenness centrality, or eigenvector centrality can be calculated, and nodes with the highest centrality scores are selected as key nodes.

[0089] 5. Construct a basic heterogeneous graph network: Reconstruct a simplified graph network using the selected key nodes and edges.

[0090] Extracting topological features from the simplified underlying heterogeneous graph network is the next key step. Topological features that can be extracted include: 1. Global graph features: number of nodes, number of edges, average degree, graph density, clustering coefficient, and diameter (the length of the longest and shortest paths).

[0091] 2. Node-level features: degree, local clustering coefficient, betweenness centrality, closeness centrality, and PageRank value.

[0092] 3. Edge-level features: edge weight and edge betweenness centrality.

[0093] 4. Subgraph features: the number of triangles and other specific patterns (such as star structures). The number of triangles can be calculated using the following formula:

[0094]

[0095] where A is the adjacency matrix of the graph.

[0096] 5. Spectral features: eigenvalues ​​of the Laplacian matrix and eigenvectors of the adjacency matrix.

[0097] Combining all the above features into a feature vector is a simplified topological feature. For example, the feature vector can be as follows:

[0098] [100,500,10,0.101,0.3,6,15.5,0.4,0.6,0.2,1000,0.8,0.1,3.5,λ1,λ2,...,λk]

[0099] Here, these values ​​represent the number of nodes, number of edges, average degree, graph density, global clustering coefficient, diameter, average node degree, average local clustering coefficient, average betweenness centrality, average closeness centrality, number of triangles, edge weight mean, edge weight variance, edge weight skewness, and the first k non-zero eigenvalues ​​of the Laplacian matrix.

[0100] This simplification and feature extraction approach has the following advantages:

[0101] 1. Reduce computational complexity: By reducing the number of nodes and edges, the computational complexity of subsequent analysis is greatly reduced.

[0102] 2. Highlight key information: The most important structures and relationships in the graph are retained, which helps to identify key patterns and anomalies.

[0103] 3. Standardized representation: Convert graph networks of different sizes and structures into feature vectors of fixed length to facilitate subsequent machine learning processing.

[0104] 4. Privacy protection: By extracting only statistical features instead of the original node and edge information, the privacy of the original data is protected to a certain extent.

[0105] 5. Adaptability: This method can be applied to networks of different sizes and types and has good scalability and versatility.

[0106] The final step in this process is uploading the extracted simplified topological features to the federated learning server. This provides important input for the subsequent federated learning process, enabling the server to perform further analysis and model training based on these features without accessing the original detailed graph structure, thereby achieving efficient distributed learning while protecting privacy.

[0107] S105. The substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters of the client learning model, and uploads the updated client model parameters to the federated learning server.

[0108] The substation client uses the device configuration heterogeneous graph network to train a local client learning model and update the client model parameters. The purpose of this step is to train the model using local data while protecting data privacy, preparing for the subsequent federated learning process. The choice of client learning model is crucial for this task. Considering that graph-structured data is being processed, a suitable choice is the graph neural network (GNN) model. Specifically, a graph convolutional network (GCN) or a graph attention network (GAT) can be used as the base model. Here, the GCN is used as an example to illustrate the training process.

[0109] The basic principle of GCN is to propagate and aggregate node features through the adjacency relationship of the graph. The calculation formula of the GCN layer is as follows:

[0110]

[0111] in, is the adjacency matrix with self-loops added, yes The degree matrix, H (l) is the node feature matrix of the lth layer, W (l) is a learnable weight matrix, and σ is an activation function. The GCN model architecture consists of an input layer, multiple GCN layers, a fully connected layer, and an output layer. The specific training process is as follows:

[0112] 1. Data preparation: Convert the device configuration heterogeneous graph network into a format suitable for GCN processing, including the adjacency matrix A and the node feature matrix X. Assign a label Y to each node (for example, normal / abnormal, or a specific configuration category). Split the dataset into training, validation, and test sets.

[0113] 2. Model definition: Build a model containing multiple GCN layers, for example:

[0114] InputLayer->GCNLayer(64units)->ReLU->Dropout(0.5)->GCNLayer(32units)->ReLU->Dropout(0.5)->DenseLayer(num_classes)->Softmax

[0115] 3. Loss function and optimizer: For multi-classification problems, use the cross entropy loss function. Choose an appropriate optimizer, such as the Adam optimizer.

[0116] 4. Training loop: Pass input data to the model and obtain predictions. Compare the predictions to the true labels and calculate the loss. Calculate gradients. Use the optimizer to update the model parameters. Evaluate the model performance on the validation set and save the best model.

[0117] 5. Parameter extraction:

[0118] After training is completed, the model parameters are extracted as client model parameters.

[0119] In step S105, the model can learn valuable patterns and features from the local heterogeneous graph network of device configurations. Since the training process is performed entirely locally, the original data does not leave the substation client, protecting data privacy. Each substation client can train a personalized model based on its own data characteristics. Graph neural networks can effectively utilize graph structure information and are more suitable for processing complex relational data such as network device configurations than traditional machine learning methods. By analyzing model parameters and node embeddings, some interpretable insights about the network configuration can be obtained. Finally, the updated client model parameters are uploaded to the federated learning server. These parameters will be aggregated with the parameters of other clients on the server side to form a global model. This method not only protects the data privacy of each substation, but also can utilize the knowledge of all substations to improve the overall performance of the model.

[0120] S106. After receiving the simplified topology features and client model parameters of all substation clients, the federated learning server performs feature similarity analysis on all simplified topology features and assigns client weights to all substation clients based on the feature similarity analysis results.

[0121] The federated learning server receives the simplified topology features and client model parameters of all substation clients. It then performs feature similarity analysis on the simplified topology features and assigns weights to each client based on the analysis results. The purpose of this step is to assess the similarity and representativeness of each client's data so that more reasonable weights can be assigned in subsequent model aggregation. Feature similarity analysis is a key process that helps understand the degree of similarity between different substations and the uniqueness of each substation's data. The specific process is as follows:

[0122] First, the simplified topological features uploaded by each client need to be normalized to eliminate the scale differences between different features. Common normalization methods include: Z-score normalization: Min-Max Scaling:

[0123] Then, select an appropriate similarity measurement method to calculate the similarity between clients. Common similarity measurement methods include: Euclidean distance, cosine similarity, Pearson correlation coefficient, etc. Based on the selected similarity measurement method, calculate the similarity between each pair of clients and construct a similarity matrix S. For N clients, S will be an NxN matrix. Use a clustering algorithm (such as K-means or hierarchical clustering) to group the clients to identify similar client groups. Assess the representativeness of each client in its group. This can be achieved by calculating the distance between the client and the center of its group. Based on the results of the similarity and representativeness analysis, assign a weight to each client. Clients with strong representativeness receive higher weights, and clients with high uniqueness (low similarity to other clients) should also receive a certain weight to retain their unique information.

[0124] Similarity analysis can identify clients that may have data quality issues (for example, clients that differ significantly from all other clients). Cluster analysis helps identify groups of substations with similar characteristics, which may reflect certain common operational characteristics or environmental factors. The weight allocation mechanism considers the representativeness of client data while retaining unique information, helping to improve the fairness and efficiency of federated learning. By assigning different weights to different clients, the final aggregated model can better adapt to various substation environments. Similarity analysis can also help identify abnormal substation configurations, which is very valuable for preventing potential failures and optimizing system configuration. There may be opportunities for knowledge transfer between clients with high similarity, which provides direction for subsequent model optimization. Finally, the server saves the calculated weight allocation results for subsequent model aggregation. This intelligent weight allocation mechanism based on data characteristics can significantly improve the performance and adaptability of federated learning in heterogeneous environments.

[0125] S107. The federated learning server trains the shared learning model based on all client model parameters and corresponding client weights, updates the shared model parameters of the shared learning model, and sends the updated shared model parameters to all substation clients.

[0126] The federated learning server then takes a weighted average of the model parameters of all clients based on the assigned weights, thereby updating the global model. This step is the core of federated learning, as it integrates the local knowledge of each client to form a unified global model while taking into account the representativeness and uniqueness of each client's data. The specific implementation process is as follows:

[0127] For each parameter in the global model, a weighted average method is used for aggregation. Assuming there are N clients, the weight of the i-th client is w_i, and its model parameter is θ_i, then the update formula of the global model parameter θ_global is: The weight w_i has been calculated in step S106 and satisfies Before parameter aggregation, it's necessary to ensure that the model structures of all clients are consistent. Specifically, before federated learning begins, the server defines and distributes a standard model structure. During aggregation, the parameters uploaded by each client are checked to ensure they conform to the predefined structure. If there are slight differences in the models between clients (for example, due to different random initializations), some compatibility processing is required: missing parameters can be padded with the current value of the global model or zero. Excess parameters can be ignored.

[0128] During the aggregation process, possible anomalies also need to be detected and handled. If the parameter value of a client is obviously abnormal (for example, it contains NaN or infinity), you can choose to exclude the client or use the average value of other clients instead. If the parameter update direction of a client is significantly different from that of most clients, its weight needs to be adjusted or specially handled. After the parameter aggregation is completed, the aggregation results are used to update the global model. Specifically, the current parameters of the global model are replaced with the aggregated parameters, the version number or round count of the global model is updated, and the updated timestamp and related performance indicators are recorded.

[0129] By using the weights calculated in S106, the model aggregation process takes into account the representativeness and uniqueness of each client's data. This preserves the common characteristics of mainstream clients while also retaining, to a certain extent, the unique information of niche clients. Even if an anomaly occurs in the model of an individual client, the weights limit its impact to a controllable range. The weights can be adjusted dynamically, allowing the model to adapt to changes in client data quality over time. Weighted averaging is a computationally efficient aggregation method suitable for large-scale federated learning scenarios. The entire process involves only the exchange of model parameters, without requiring access to raw data, thus protecting client data privacy. This weighted averaging method effectively integrates knowledge from multiple substations into a unified global model, thereby improving the model's generalization and applicability. This global model will be distributed to each client in the next round of federated learning for further local training and optimization.

[0130] S108. For any target substation client, the target substation client updates the shared model parameters to the local client learning model, inputs the device configuration heterogeneous graph network into the client learning model after parameter update, and outputs the configuration mode and configuration parameter mapping table of all network devices through the client learning model after parameter update.

[0131] Among them, after the target substation client receives the updated shared model parameters sent by the federated learning server, it first updates these parameters to the local client learning model. This process usually involves replacing the weights and bias values ​​in the model, and also includes updating statistical information such as the mean and variance of the BatchNorm layer. After the update is completed, the target substation client will pass the previously constructed device configuration heterogeneous graph network as input data into the updated client learning model. The updated client learning model uses graph neural network (GNN) technology when processing this input. The output of the model includes two key parts: configuration mode and configuration parameter mapping table. The configuration mode is a classification result that indicates which type or mode the current network device configuration belongs to (such as standard configuration, high security configuration, high performance configuration, etc.). This can be achieved through a softmax function, for example:

[0132]

[0133] Among them, y i is the probability of the i-th configuration mode, z i is the raw score output by the model, and K is the total number of configuration patterns.

[0134] The configuration parameter mapping table is a more complex structure that provides a recommended value or a range of possible values ​​for each device and each configuration item. This can be achieved through a regression task. For each configuration parameter p, the model outputs a predicted value and an uncertainty estimate σ:

[0135]

[0136] where f θ and g θ are different parts of the model, x is the input graph data, and θ is the model parameters.

[0137] This output method not only provides recommended configuration values, but also gives the confidence level of this recommendation, which is very valuable for subsequent device verification strategy formulation. For example, for a router's ACL configuration, the model might output: "Extended ACL is recommended, with a confidence level of 80%; it is recommended to be applied to the inbound interface, with a confidence level of 95%; the specific rules should include the following IP addresses and ports (list), with confidence levels varying by rule (60%-90%)." In this way, the client-side learning model is able to provide customized configuration recommendations for each device based on global information about the entire substation network. These recommendations take into account not only the characteristics of the individual device, but also its role in the overall network and its interactions with other devices.

[0138] S109. The target substation client generates a device calibration strategy based on the configuration mode and the configuration parameter mapping table, and completes the calibration of all network devices through the device calibration strategy.

[0139] Among them, after obtaining the configuration mode and configuration parameter mapping table, the target substation client begins to generate the equipment verification strategy. This process involves converting the abstract suggestions output by the model into specific, executable verification steps. The process of generating the strategy can be divided into several sub-steps: 1. Configuration mode analysis: First, based on the configuration mode output by the model, determine the overall verification direction. For example, if the configuration mode is identified as "high security configuration", the verification strategy will pay more attention to security-related configuration items, such as firewall rules, encryption settings, etc. 2. Parameter mapping table analysis: For each device and configuration item, analyze the recommended values ​​and uncertainty estimates given by the model. A threshold can be set, for example, only considering suggestions with a confidence level of more than 70%. 3. Rule generation: Based on the above analysis, a series of specific verification rules are generated for each device. These rules include:

[0140] Configuration item check: Verify whether a configuration item is within the recommended range.

[0141] Consistency check: Ensures that the configurations of related devices are consistent, such as VLAN configuration and routing protocol parameters.

[0142] Security check: Verify whether security policies are met, such as password complexity, access control lists, etc.

[0143] Performance optimization check: Checks whether recommended performance optimization settings, such as QoS configuration and buffer size, are adopted.

[0144] 4. Prioritization: Prioritize the verification rules based on the importance and uncertainty of the configuration items.

[0145] 5. Execution plan development: Based on the sorting results, develop an execution plan for the verification rules. This includes determining the execution order, estimating the time required for each verification, and considering the potential impact on network operations.

[0146] An example of a generated device calibration strategy is as follows:

[0147] 1. Check the VLAN configuration of the core switch (priority: high, estimated time: 10 minutes)

[0148] 2. Verify OSPF area settings on all routers (Priority: High, Estimated time: 15 minutes)

[0149] 3. Review the firewall's access control list (Priority: Medium, Estimated time: 30 minutes)

[0150] 4. Check the NTP synchronization status of all devices (Priority: Low, Estimated time: 5 minutes)

[0151] Based on this strategy, the target substation client can begin the actual verification process. Verification work is as follows: For checks that can be performed using scripts or automated tools, the system automatically executes and records the results. For example, it can use SNMP or SSH to connect to the device, retrieve configuration information, and compare it to recommended values. For items that require a certain degree of human judgment, the system provides guidance and auxiliary information, but the final decision may require operator confirmation. For complex or high-risk inspection items, the system generates detailed inspection instructions for manual execution by professionals. The results of each verification are recorded in detail, including whether the results meet expectations, specific differences, and potential impacts. The system may use natural language processing technology to generate an easy-to-understand summary report. For non-conformities found, the system provides corrective recommendations, which may include specific configuration commands or steps. For potential high-risk issues, the system will immediately issue an alert. Verification results are used to further optimize the local model, for example, by adjusting model parameters through reinforcement learning methods to improve performance in the next verification.

[0152] This approach makes substation network configuration verification more intelligent, efficient, and comprehensive. It not only promptly detects and corrects configuration errors but also proactively optimizes network performance and security, significantly improving substation network reliability and operational efficiency. Furthermore, this machine learning-based approach is highly adaptable and can continuously improve itself as the network environment changes, providing strong support for the long-term stable operation of substations.

[0153] In one embodiment, the substation client uses Granger causality analysis and mutual information analysis to extract correlation features between device configuration files, device operation logs, and device network traffic data, including the following steps:

[0154] The substation client converts device configuration files, device operation logs, and device network traffic data into time series feature data and standardizes all time series feature data;

[0155] The substation client determines the optimal lag order of the Granger causality test analysis method based on the time series characteristic data and using the AIC information criterion;

[0156] The substation client performs a multivariate Granger causality test analysis on all time series feature data based on the optimal lag order. Based on the Granger causality test analysis results, it generates linear correlation features between device configuration files, device operation logs, and device network traffic data.

[0157] The substation client converts all time series feature data into discrete feature data;

[0158] The substation client uses mutual information analysis to extract nonlinear correlation features between device configuration files, device operation logs, and device network traffic data from discrete feature data;

[0159] The substation client integrates linear and nonlinear correlation features into correlation relationship features among device configuration files, device operation logs, and device network traffic data.

[0160] In this embodiment, referring to Figure 3, the substation client first converts the device configuration file, device operation log and device network traffic data into time series feature data. This process involves unifying data in different formats into the form of time series. For the device configuration file, it is necessary to extract the timestamp of the configuration change and use the various configuration parameters as features; for the device operation log, the timestamp of the log can be directly used, and the various indicators in the log can be used as features; for the device network traffic data, traffic features such as the number of packets, number of bytes, protocol type distribution, etc. can be counted at fixed time intervals (such as every minute or every hour). For example, suppose there is a router configuration file that contains information such as IP address, subnet mask, routing table, etc. This information can be converted into time series data as shown below:

[0161] Timestamp, IP address change, subnet mask change, number of routing table entries

[0162] 2023-01-01 00:00:00,192.168.1.1,255.255.255.0,10

[0163] 2023-01-02 12:30:00,192.168.1.2,255.255.255.0,12 ...

[0165] For device operation logs, there will be time series data like this:

[0166] Timestamp, CPU usage, memory usage, number of active connections

[0167] 2023-01-01 00:01:00,35%,60%,1000

[0168] 2023-01-01 00:02:00,40%,62%,1050 ...

[0170] Network traffic data is converted into:

[0171] Timestamp, inbound traffic (Mbps), outbound traffic (Mbps), number of TCP connections, number of UDP packets

[0172] 2023-01-0100:00:00,50,30,500,1000

[0173] 2023-01-0100:01:00,55,35,520,1100 ...

[0175] After the conversion is complete, the substation client normalizes all time series feature data. Normalization aims to bring features of different scales to the same scale for subsequent analysis. Common normalization methods include Z-score normalization and Min-Max scaling. For example, consider CPU usage. Assume the original data is [35%, 40%, 38%, 45%, 42%], with a mean of 40% and a standard deviation of approximately 3.54%. After Z-score normalization, the data becomes [-1.41, 0, -0.56, 1.41, 0.56]. Normalized data is more suitable for subsequent analysis because it eliminates dimensional differences between features, ensuring a more balanced weighting of each feature in the analysis. This is particularly important for subsequent Granger causality tests and mutual information analysis, as these methods are sensitive to data scale.

[0176] In this step, the substation client uses AIC (Akaike Information Criterion) to determine the optimal lag order for the Granger causality test analysis method. This process aims to find the best balance between model complexity and goodness of fit, thereby improving the accuracy and reliability of subsequent Granger causality tests. The basic form of AIC is:

[0177] AIC=2k-2ln(L)

[0178] Where k is the number of parameters in the model and L is the maximum likelihood estimate of the model.

[0179] In time series analysis, an AIC value is calculated for each possible lag order p. The optimal lag order is the p value that minimizes the AIC value. Specifically, for a vector autoregression (VAR) model, AIC can be expressed as:

[0180]

[0181] Among them, |Σ p | is the determinant of the residual covariance matrix of the p-order VAR model, n is the number of time series variables, and T is the sample size. The implementation process is as follows: First, determine a maximum lag order pmax, which can be set to 10% of the sample size, for example. For each possible lag order p (from 1 to pmax), fit a VAR(p) model. Calculate the AIC value of each model. Select the p with the smallest AIC value as the optimal lag order. For example, assume there are three time series variables: CPU usage, memory usage, and network traffic. The sample size is 1000, and pmax is set to 10. The calculation results are as follows:

[0182] p=1, AIC=-15200; p=2, AIC=-15500; p=3, AIC=-15800; p=4, AIC=-15900; p=5, AIC=-15850; p=6, AIC=-15800; p=7, AIC=-15750

[0183] In this example, the AIC value is the smallest when p = 4, so the optimal lag order is 4.

[0184] Using AIC to select the optimal lag order can balance model complexity and goodness of fit. AIC penalizes overly complex models and prevents overfitting. Moreover, AIC is applicable to multivariate time series and can capture complex interactions between variables. Through this step, the substation client determines the optimal lag order for each set of time series data that needs to be Granger causality tested. After determining the optimal lag order, the substation client begins to perform multivariate Granger causality test analysis on all time series feature data. Granger causality test is a statistical hypothesis test used to determine whether one time series has predictive power for the future values ​​of another time series. The basic idea of ​​multivariate Granger causality test is that if the model including all variables has significantly better predictive power than the model excluding a certain variable, then the excluded variable is considered to be the Granger cause of other variables. The specific implementation process is as follows:

[0185] Build a complete model: a vector autoregression (VAR) model that includes all variables. For n variables, a p-order VAR model can be expressed as:

[0186] Y t =c+A1Y t-1 +A2Y t-2 +...+A p Y t-p +e t

[0187] Among them, Y t is an n×1 vector, c is a constant term, A i is an n×n coefficient matrix, e t is the error term.

[0188] Then, a constrained model is constructed. For each variable, a model is constructed that excludes that variable. Next, an F test is performed, specifically comparing the residual sum of squares of the complete model and the constrained model. The formula for calculating the F statistic is:

[0189]

[0190] where RSS_R is the residual sum of squares for the constrained model, RSS_U is the residual sum of squares for the full model, q is the number of constraints, T is the sample size, and k is the number of parameters in the full model.

[0191] Next, the p-value is calculated based on the F statistic and the degrees of freedom. If the p-value is less than the significance level (usually 0.05), Granger causality is considered to exist.

[0192] Based on the results of the Granger causality test, the substation client can generate linear correlation features between device configuration files, device operation logs, and device network traffic data. These features include:

[0193] Direction of causality: which variables influence other variables.

[0194] The strength of the causal relationship can be expressed by the size of the F statistic or the p-value.

[0195] Lag effect: The optimal lag order reflects the time scale of the causal relationship.

[0196] These linear correlation features provide crucial information for understanding the interplay between device operating states. For example, a change in device configuration can affect network traffic two time units later, or a change in CPU usage can immediately impact memory usage. This information is valuable for predicting device behavior, optimizing configurations, and identifying potential issues early. Through this step, the substation client not only identifies the causal relationships between various device data but also quantifies the strength and temporal characteristics of these relationships, providing a solid data foundation for subsequent device management and optimization.

[0197] In the next step, the substation client converts all time series feature data into discrete feature data. This process prepares for the subsequent mutual information analysis, which typically requires discrete input data. Discretizing continuous time series data can simplify calculations, reduce the impact of noise, and help capture nonlinear relationships in the data. There are many discretization methods, and commonly used ones include:

[0198] Equal-width binning: Divide the data range into n equal intervals.

[0199] Equal-frequency binning: Divide the data into n groups of equal size, each group contains the same number of samples.

[0200] K-means clustering: Use the K-means algorithm to cluster the data, with each cluster as a discrete category.

[0201] Quantile-based binning: Use quantiles (such as quartiles) to divide the data.

[0202] Taking equal-width binning as an example, the specific implementation process is as follows: Determine the maximum and minimum values ​​of each feature. Choose the appropriate number of bins, usually using the Sturges formula: Where n is the number of samples and k is the recommended number of bins. Calculate the width of each bin: Assign each data point to a corresponding bin. For example, suppose we have time series data on CPU usage, ranging from 0% to 100%. The number of samples is 1000, and using the Sturges formula, we get 11 bins. The bin width = (100% - 0%) / 11 ≈ 9.09%. This gives us the following bins: 0: [0%, 9.09%); 1: [9.09%, 18.18%); 2: [18.18%, 27.27%)... 10: [90.91%, 100%). For each CPU usage data point, convert it to the corresponding bin number. For example: 5% -> 0; 15% -> 1; 95% -> 10.

[0203] Similar discretization is performed for other features, such as memory usage and network traffic. Data in device configuration files may require special processing. For example, IP addresses can be categorized by subnet rather than simply binned by numerical range. Event data in device operation logs can be discretized based on event severity or frequency. For network traffic data, it may be necessary to consider the distinction between normal and abnormal traffic and retain this distinction during discretization. Discretization can reduce data complexity by mapping continuous values ​​to a limited number of discrete categories, simplifying the data structure. It can also reduce the impact of noise, as small fluctuations are grouped into the same bin, helping to highlight major data patterns. Discretized data can more easily capture nonlinear relationships, which is particularly useful for subsequent mutual information analysis. Mutual information is a method for measuring the mutual dependence between two random variables. It can capture nonlinear relationships between variables, which is something that linear correlation coefficients cannot do.

[0204] In this embodiment, the specific implementation process is as follows: for each discretized feature, the frequency of occurrence of each category is calculated. For example, for CPU usage, the number of data points in each box is calculated and divided by the total number of data points. For each pair of features, their joint frequency of occurrence is calculated. For example, the number of data points with CPU usage in box i and memory usage in box j is calculated and divided by the total number of data points. The mutual information between each pair of features is calculated using the mutual information calculation formula. In order to make the mutual information between different feature pairs comparable, normalization is usually performed. A commonly used normalization method is to calculate the normalized mutual information (NMI):

[0205]

[0206] Where H(X) and H(Y) are the entropies of X and Y respectively.

[0207] The mutual information value directly reflects the strength of the nonlinear association between features. By setting a threshold, a correlation network can be constructed to show which features have significant nonlinear associations. By calculating the average mutual information of each feature with all other features, the overall importance of the feature can be evaluated. If two features have high mutual information with a third feature, it may indicate that the two features contain redundant information. In this embodiment, there may be a nonlinear correlation between device configuration parameters and network traffic patterns, indicating how configuration changes affect network behavior. Certain events in the device operation log may have a strong nonlinear correlation with CPU or memory usage, indicating potential performance problems. Certain features of network traffic may have a strong correlation with multiple device parameters, indicating key network status indicators. Through this step, the substation client can capture complex relationships that may be ignored by linear analysis, providing richer information for a comprehensive understanding of the equipment operation status. Detailed description of step S6:

[0208] Next, the substation client integrates the linear and nonlinear correlation features obtained in the previous steps to form a comprehensive set of correlation features. This integration process is not just a simple merging, but also takes into account the complementarity of the two features and how to most effectively represent and utilize this information. The specific integration process may include the following aspects:

[0209] For each pair of variables, there are two indicators: the linear association strength obtained from the Granger causality test and the nonlinear association strength obtained from mutual information analysis. The linear and nonlinear scores can be fused as two components of a two-dimensional vector. Based on the fused scores, a comprehensive association network can be constructed. In this network, nodes represent different features (such as CPU usage, specific configuration parameters, network traffic metrics, etc.), edge weights represent the fused association strength, and edge directions can be based on the Granger causality test results. Taking into account both linear and nonlinear associations, features are ranked in importance. Next, through association pattern recognition, unique association patterns between features are identified. For example, strong linear and weak nonlinear associations can indicate simple dependencies, weak linear and strong nonlinear associations indicate complex interactions, and high correlations indicate key influencing factors.

[0210] By analyzing strong correlation pairs and potential impact chains within the correlation network, device failure or performance degradation can be predicted. For example, if the correlation between configuration parameter P2 and network traffic N suddenly increases, it may indicate an impending problem with network equipment. The system can issue an early warning and schedule maintenance personnel to inspect the relevant equipment. When an anomaly occurs, the correlation network can help quickly locate the root cause of the problem. For example, if CPU usage suddenly spikes, tracing the correlation chain may reveal that this is related to a specific configuration parameter change. This analysis can significantly shorten troubleshooting time. Prioritizing features based on their importance can optimize monitoring and resource allocation. For example, if network traffic (N) is identified as the most critical metric, network device monitoring frequency can be increased or network infrastructure upgrades can be prioritized. By analyzing the correlation between configuration parameters (such as P1 and P2) and other operational metrics, device configuration can be optimized. For example, if P2 is found to have a strong correlation with both network traffic and CPU usage, P2 can be adjusted to optimize overall system performance. By comparing current correlation patterns with historical patterns, unusual changes in system behavior can be detected. For example, if the correlation between P1 and M suddenly weakens, this may indicate that certain subsystems are no longer functioning as expected and requires further investigation. By analyzing the strength of correlations between different devices, we can identify highly coupled groups of devices. This information can be used to optimize load balancing strategies, ensuring that high-load tasks are not executed simultaneously on devices that significantly impact each other. Correlation signatures can be used to detect potential security threats. For example, if certain network traffic characteristics suddenly show strong correlations with typically unrelated system parameters, this may indicate unusual data access patterns that warrant a security review.

[0211] In one embodiment, the substation client uses the mutual information analysis method to extract nonlinear correlation features between device configuration files, device operation logs, and device network traffic data from discrete feature data, including the following steps:

[0212] The substation client uses the mutual information calculation formula to calculate the first joint information entropy between the device configuration file and the device operation log, the second joint information entropy between the device configuration file and the device network traffic data, and the third joint information entropy between the device configuration file, the device operation log, and the device network traffic data.

[0213] The substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy;

[0214] The substation client determines the nonlinear correlation characteristics among device configuration files, device operation logs, and device network traffic data based on the total mutual information.

[0215] In this embodiment, to calculate the first joint information entropy, the device configuration file is regarded as a random variable X, and the device operation log is regarded as a random variable Y. Then, the joint occurrence frequency of X and Y is counted, p(x, y), p(x), and p(y) are estimated, and the mutual information calculation formula is substituted into it to calculate the mutual information. Similarly, to calculate the second joint information entropy, the device configuration file is regarded as X and the network traffic data is regarded as Y. The network traffic data may require feature extraction, such as calculating the number of data packets per minute or the traffic size. The third joint information entropy involves three variables, and its calculation formula is expanded to:

[0216] I(X;Y;Z)=I(X;Y)+I(X;Z|Y)=H(X)+H(Y)+H(Z)-H(X,Y)-H(Y,Z)-H(X,Z)+H(X,Y,Z)

[0217] Where H represents entropy, and H(X, Y, Z) is the joint entropy of the three variables. This step quantifies the information dependencies between different data sources. High mutual information values ​​indicate strong correlation, while low values ​​indicate weak correlation or independence. This lays the foundation for subsequent nonlinear correlation analysis, helping to identify hidden data patterns and dependencies, thereby providing a more comprehensive understanding of the dynamic characteristics of the substation system.

[0218] Next, the substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy, and the third joint information entropy.

[0219] In this step, the three joint information entropies calculated in the previous step need to be integrated to obtain a comprehensive total mutual information indicator. This total mutual information will reflect the overall nonlinear correlation between device configuration files, operation logs, and network traffic data. The total mutual information calculation formula is as follows:

[0220] I(X;Y;Z)=H(X;Y)+H(Y;Z)H(X;Y;Z)

[0221] Wherein: I(X; Y; Z) represents the total mutual information, H(X; Y) represents the first joint information entropy, H(Y; Z) represents the second joint information entropy, and H(X; Y; Z) represents the third joint information entropy.

[0222] This approach takes into account the conditional dependencies between variables and can more accurately capture the information redundancy and complementarity between the three. In actual implementation, the time dependency of the data may also need to be considered. For example, a time lag can be introduced to calculate the mutual information between different time points to form a time-dependent total mutual information. This can capture the dynamic correlation in the system. The effect of calculating the total mutual information is to obtain a comprehensive indicator that reflects the overall nonlinear correlation between the three data sources. A high total mutual information value indicates that there is a strong mutual dependency between these data sources, which may mean that there is a close interaction between system components. A low total mutual information value may indicate that the data sources are relatively independent, or there is a potential system isolation problem.

[0223] Based on the total mutual information calculated previously, the substation client needs to further analyze and determine the specific nonlinear correlation characteristics. First, a threshold θ can be set. When the total mutual information exceeds this threshold, it is considered that there is a significant nonlinear correlation. The selection of the threshold can be based on historical data analysis or expert experience. For example, the 95% quantile of the total mutual information distribution can be selected as the threshold. Next, for the significant correlation identified, feature extraction and pattern recognition are required. One method is to use nonlinear time series analysis techniques, such as the reconstructed phase space method. This method first embeds the time series into a high-dimensional space:

[0224] Y(t)=[X(t),X(t+τ),...,X(t+(m-1)τ)]

[0225] where m is the embedding dimension and τ is the time delay. Attractor structures can then be identified in this reconstructed phase space, which reflect the nonlinear dynamics of the system.

[0226] Another approach is to use kernel methods for nonlinear feature extraction. For example, kernel principal component analysis (KernelPCA) can be used to extract nonlinear principal components:

[0227] K(xi,xj)=exp(-||xi-xj|| 2 / (2σ 2 ))

[0228] Where K is the Gaussian kernel function, xi and xj are data points, and σ is the kernel width parameter. By solving the eigenvalue problem, we can obtain nonlinear principal components, which reflect the nonlinear structure in the data.

[0229] The nonlinear correlation features identified by these methods include threshold effects between configuration parameters and system performance, periodic correlations between network traffic patterns and device status, and emergent system behaviors caused by multiple parameter combinations.

[0230] In one embodiment, after the substation client simplifies the device configuration heterogeneous graph network into a basic heterogeneous graph network using graph simplification technology, it extracts simplified topology features from the basic heterogeneous graph network and uploads the simplified topology features to the federated learning server, including the following steps:

[0231] The substation client performs node clustering and edge pruning on the equipment configuration heterogeneous graph network based on the association relationship characteristics to obtain a simplified heterogeneous graph network.

[0232] The substation client uses the minimum spanning tree algorithm to extract the heterogeneous graph network skeleton from the simplified heterogeneous graph network;

[0233] The substation client calculates the node centrality index in the simplified heterogeneous graph network and selects the key nodes in the simplified heterogeneous graph network based on the node centrality index;

[0234] The substation client reconstructs the equipment configuration heterogeneous graph network into a basic heterogeneous graph network by combining the heterogeneous graph network skeleton and key nodes;

[0235] Simplified topological features are extracted from the underlying heterogeneous graph network and uploaded to the federated learning server.

[0236] In this embodiment, the purpose of node clustering is to group similar nodes together to reduce the complexity of the network. A commonly used clustering method is the spectral clustering algorithm. The algorithm first constructs a similarity matrix S, where Sij represents the similarity between nodes i and j. Then calculate the graph Laplacian matrix L = DS, where D is the degree matrix. Then solve the generalized eigenvalue problem Lv = λDv, select the eigenvectors corresponding to the k smallest non-zero eigenvalues, and form a matrix V. Finally, perform k-means clustering on the row vectors of V to obtain the clustering results of the nodes. For example, suppose there are n nodes and they are to be clustered into k categories. First calculate the n×n similarity matrix S, and the similarity can be calculated based on node attributes or topological structure. Then solve the n×k eigenvector matrix V, perform k-means clustering on each row of V, and obtain the category label of each node.

[0237] Edge pruning aims to remove unimportant connections in the network and retain key edges. One method is to prune based on edge weights. A threshold θ can be set. When the weight of an edge is less than θ, it is deleted. The weight of an edge can be determined based on the previously calculated association relationship characteristics. Another method is to prune based on centrality indicators. For example, the betweenness centrality of an edge can be calculated and edges with high centrality can be retained. The formula for calculating the betweenness centrality of an edge is:

[0238] CB(e)=Σs≠t≠vσst(e) / σst

[0239] where σst is the number of shortest paths between nodes s and t, and σst(e) is the number of shortest paths through edge e.

[0240] Through node clustering and edge pruning, a simplified heterogeneous graph network is obtained. This simplified network retains the key structural features of the original network while significantly reducing the number of nodes and edges. For example, a network that originally may have thousands of nodes and tens of thousands of edges may be reduced to just a few hundred nodes and a few thousand edges after simplification. This step significantly reduces the complexity of the network, making subsequent analysis and computation more efficient. Furthermore, clustering and pruning highlight key structures and important relationships within the network, helping to better understand the core components and critical dependencies of the substation system.

[0241] Next, the substation client uses the minimum spanning tree algorithm to extract the heterogeneous graph skeleton from the simplified heterogeneous graph network. The goal in this step is to extract the most basic connectivity structure, or network skeleton, from the simplified heterogeneous graph network. The minimum spanning tree (MST) algorithm is an effective method for achieving this goal. An MST is a cycle-free, connected subgraph that contains all nodes in the graph and minimizes the sum of the edge weights. The two most commonly used MST algorithms are the Kruskal algorithm and the Prim algorithm. Taking the Kruskal algorithm as an example, its implementation steps are as follows: Sort all edges in the graph by weight from smallest to largest. Create a forest F, where each node is initially a separate tree. Traverse the sorted edge list: If the two nodes connected by the current edge are not in the same tree, add the edge to F and merge the two trees. If the two nodes connected by the current edge are already in the same tree, skip the edge. The algorithm ends when only one tree remains in F; this tree is the minimum spanning tree. When applying the MST algorithm to heterogeneous graph networks, special attention must be paid to the definition of edge weights. Because heterogeneous graphs contain different types of nodes and edges, edge weights can be defined based on the previously calculated association characteristics. For example, the inverse of the mutual information can be used as the edge weight. This way, edges with higher mutual information have smaller weights and are more likely to be selected for the MST. An example weight calculation formula is: w(e) = 1 / (ε + I(X; Y)). Where I(X; Y) is the mutual information between the two nodes X and Y connected by edge e, and ε is a small positive number used to avoid division by zero errors.

[0242] Extracting the network skeleton of a heterogeneous graph results in an extremely streamlined subgraph that still reflects the primary structure of the entire network. For example, a simplified heterogeneous graph might have 500 nodes and 1500 edges. After processing it with the MST algorithm, the resulting network skeleton might only retain 499 edges (for a graph with n nodes, its MST has exactly n-1 edges). This network skeleton retains the most important edges connecting all nodes, reflecting the most basic and critical relationships within the substation network equipment. Furthermore, the significant reduction in the number of edges significantly reduces the computational complexity of subsequent analysis. This provides an efficient analytical foundation for substation system optimization and risk assessment.

[0243] Next, the substation client calculates the node centrality metrics in the simplified heterogeneous graph network and selects key nodes based on these metrics. In this step, node centrality is used to measure the importance of nodes in the graph. In heterogeneous graph networks, nodes with high centrality typically represent key components or parameters in the system. Common centrality metrics include degree centrality, betweenness centrality, closeness centrality, and eigenvector centrality.

[0244] Degree Centrality: The simplest centrality metric, representing the number of edges directly connected to a node. In a directed graph, this can be divided into in-degree and out-degree. The calculation formula is: CD(v) = deg(v) / (N-1), where deg(v) is the degree of node v and N is the total number of nodes in the graph.

[0245] Betweenness Centrality: measures the number of times a node is an intermediate node in the shortest path between other pairs of nodes in the network. Calculation formula:

[0246] CB(v)=Σs≠v≠t(σst(v) / σst)

[0247] where σst is the number of shortest paths between nodes s and t, and σst(v) is the number of shortest paths passing through node v.

[0248] Closeness Centrality: measures the inverse of the average distance from a node to all other nodes in the graph. Calculation formula:

[0249] CC(v)=(N-1) / Σud(v,u)

[0250] where d(v,u) is the length of the shortest path from node v to node u.

[0251] Eigenvector Centrality: Considers that the importance of a node depends not only on the number of its connections, but also on the importance of the nodes it is connected to. The calculation involves solving the characteristic equation Ax = λx, where A is the adjacency matrix, x is the eigenvector, and λ is the largest eigenvalue. In heterogeneous graph networks, these centrality indicators need to be appropriately modified to take into account the heterogeneity of nodes and edges. For example, different weights can be given to different types of edges when calculating degree centrality. After calculating the node centrality, the next step is to select key nodes. A simple method is to set a threshold and select nodes with a centrality index higher than the threshold as key nodes. Another method is to use a sorting method to select the top N% of nodes in the centrality ranking. Clustering methods, such as the k-means algorithm, can also be used to cluster nodes based on multiple centrality indicators and select nodes in high centrality clusters.

[0252] Next, the substation client reconstructs the device configuration heterogeneous graph network into a basic heterogeneous graph network, combining the heterogeneous graph network skeleton and key nodes. In this step, the goal is to integrate the heterogeneous graph network skeleton and key node information obtained in the previous step to construct a basic heterogeneous graph network that preserves the core network structure while highlighting important nodes. This reconstruction process requires comprehensive consideration of the network topology and node importance. One implementation of the reconstruction process is as follows: First, the heterogeneous graph network skeleton is used as the basic structure. This skeleton is derived using a minimum spanning tree algorithm, ensuring basic network connectivity. Identified key nodes are added to the skeleton. If some key nodes are already in the skeleton, no additional steps are required; however, key nodes not in the skeleton must be added. For added key nodes, consideration must be given to how to connect them to the existing skeleton structure. One approach is to find the k most correlated nodes with the key node in the original simplified heterogeneous graph (k can be set as needed, such as k = 3) and then connect the key node to these k nodes. Correlation can be based on previously calculated mutual information or other correlation metrics. To maintain network sparsity and importance, specific rules can be applied when adding new connections. For example, a maximum degree limit can be set; when a node's degree reaches this limit, no new connections are added to it. For connections between key nodes, consider retaining direct connections that existed in the original network, even if these connections are not in the minimum spanning tree. This helps preserve important relationships between key nodes. When adding new connections, the heterogeneous nature of the graph needs to be maintained. For example, ensure that connections between different types of nodes follow the original rules or constraints. Edges in the reconstructed network can be assigned weights, which can be determined based on the strength of the association in the original network or its importance during the reconstruction process.

[0253] Next, simplified topological features are extracted from the underlying heterogeneous graph network and uploaded to the federated learning server. The goal of this step is to extract simplified topological features from the reconstructed underlying heterogeneous graph network that accurately describe the network structure and characteristics. These features should comprehensively reflect the network's global structure, local characteristics, and node and edge properties. Simplified topological features include global graph features, node-level features, edge-level features, subgraph features, and spectral features. Specifically, global graph features include the number of nodes and edges; graph density: 2|E| / (|V|(|V|-1)), where |E| is the number of edges and |V| is the number of nodes; average degree: 2|E| / |V|; clustering coefficient: calculated as the average local clustering coefficient of the entire graph; diameter: the longest shortest path length in the network; and average path length: the average of the shortest paths between all pairs of nodes.

[0254] Node-level features include degree distribution: calculating the distribution of the number of nodes with different degree values; centrality indicators: including statistical information of degree centrality, betweenness centrality, closeness centrality and eigenvector centrality (such as mean, median, maximum, minimum, etc.); local clustering coefficient distribution: calculating the local clustering coefficient of each node and then obtaining its distribution characteristics.

[0255] Edge-level features include edge weight distribution: if the edge has weight, calculate the statistical characteristics of the weight; edge betweenness centrality distribution: calculate the betweenness centrality of each edge to obtain its distribution characteristics; edge connection pattern: count the number and proportion of edges connecting different types of nodes.

[0256] Subgraph features include the number of triangles: the number of triangular subgraphs in the network; the number of other important subgraph patterns (such as star structures, ring structures, etc.); community structure: using community detection algorithms (such as the Louvain method) to identify communities, calculate the number of communities, average community size, etc.

[0257] Spectral features include the eigenvalue distribution of the Laplacian matrix: calculating the eigenvalues ​​of the graph Laplacian matrix and extracting its statistical characteristics (such as the maximum eigenvalue, skewness and kurtosis of the eigenvalue distribution, etc.); the eigenvalue distribution of the adjacency matrix: similarly, calculating the eigenvalue distribution characteristics of the adjacency matrix.

[0258] These features can be combined into a feature vector. For example, a feature vector containing 100 elements can be constructed, where the first 20 elements represent global graph features, the next 30 elements represent node-level features, 20 elements represent edge-level features, 20 elements represent subgraph features, and the last 10 elements represent spectral features.

[0259] The process of uploading these features to the federated learning server can be accomplished by: Standardizing the extracted features to ensure that the features of different substations are on the same scale. Encrypting the feature vectors using techniques such as homomorphic encryption to protect the privacy of the original data. Transmitting the encrypted feature vectors to the federated learning server using a secure communication protocol (such as HTTPS). Implementing a verification mechanism on the server side to ensure that the received data is from a trusted and complete source. In this way, the substation client can provide valuable network feature information to the federated learning server without revealing the original network structure.

[0260] In one embodiment, after receiving the simplified topology features and client model parameters of all substation clients, the federated learning server performs feature similarity analysis on all simplified topology features and assigns client weights to all substation clients based on the feature similarity analysis results, including the following steps:

[0261] After receiving the simplified topology features and client model parameters of all substation clients, the federated learning server calculates the feature similarity between each pair of substation clients based on the simplified topology features and uses a similarity measurement method. It then constructs a feature similarity matrix for substation clients based on all feature similarities.

[0262] The federated learning server divides all substation clients into multiple client groups based on simplified topological features and uses the K-means clustering algorithm. The client centrality of each substation client is determined based on the distance between the substation client and the group center of the client group.

[0263] The federated learning server assigns client weights to all substation clients by combining the feature similarity matrix and client centrality.

[0264] In this embodiment, for each pair of substation clients, their simplified topological feature vectors need to be compared. Assume that there are n substation clients and the feature vector of each client contains m elements. Cosine similarity can be used as a similarity measurement method, which calculates the cosine value of the angle between two vectors, ranging from -1 to 1, where 1 represents complete similarity, -1 represents complete opposite, and 0 represents irrelevant. The calculation formula of cosine similarity is: cos(θ) = (A·B) / (||A||||B||), where A and B are two feature vectors, · represents the dot product, and ||A|| represents the modulus of vector A. For example, suppose there are two substation clients, and their simplified topological feature vectors are A = [0.5, 0.8, 0.3] and B = [0.6, 0.7, 0.4], respectively. The cosine similarity between them is:

[0265] (0.5*0.6+0.8*0.7+0.3*0.4) / (sqrt(0.5^2+0.8^2+0.3^2)*sqrt(0.6^2+0.7^2+0.4^2))≈0.9962

[0266] After calculating the similarity between all substation client pairs, we construct an n×n feature similarity matrix. Each element (i, j) in the matrix represents the similarity between the i-th and j-th substation clients. This matrix is ​​symmetric, with all diagonal elements set to 1 (indicating that each client has a similarity of 1 with itself). The feature similarity matrix reflects the similarity between substation clients, helping to better utilize information about similar clients in federated learning, improving model performance and generalization.

[0267] The K-means algorithm is an iterative clustering method with the following basic steps: 1. Randomly select K points as initial cluster centers; 2. Assign each data point to the nearest cluster center; 3. Recalculate the center of each cluster; 4. Repeat steps 2 and 3 until the cluster center no longer changes significantly or the maximum number of iterations is reached. In this embodiment, each data point represents the simplified topological feature vector of a substation client. The optimal number of clusters can be determined using methods such as the elbow rule or the silhouette coefficient. For example, assuming K = 3, all substation clients are divided into three groups. After clustering, the Euclidean distance from each substation client to the center of its group is calculated to measure the client's centrality. The Euclidean distance is calculated as: d = sqrt(Σ(xi - yi)^2), where xi and yi are the i-th elements of the client's feature vector and the group's center vector, respectively. The smaller the distance, the closer the client is to the group center and the higher the centrality. Distance can be converted to centrality, for example, using the formula: centrality = 1 / (1 + d). In this case, the smaller the distance, the closer the centrality is to 1. The calculation of client centrality provides an important basis for model aggregation and weight assignment. It reflects the representativeness of each substation client within its group. Clients with high centrality may contain more common characteristics and can be assigned higher weights during model updates, helping to improve the overall performance and adaptability of the federated learning model.

[0268] For each substation client, the average similarity with all other clients can be calculated based on the feature similarity matrix. The average similarity reflects the client's relevance to the overall population and is calculated as follows: avg_sim_i = (Σsim_ij) / (n-1), where sim_ij is the similarity between the i-th client and the j-th client, and n is the total number of clients. The average similarity is then combined with the client centrality to obtain a comprehensive score. This combination is as follows: score_i = w1*avg_sim_i + w2*centrality_i, where w1 and w2 are weighting factors that can be adjusted according to actual needs, and centrality_i is the centrality of the i-th client. Finally, the comprehensive score is normalized to obtain the final client weight: weight_i = score_i / (Σscore_j). For example, suppose there are three substation clients with average similarities of 0.8, 0.7, and 0.9, and centralities of 0.6, 0.8, and 0.5, respectively. Assuming w1 = 0.6 and w2 = 0.4, the overall scores are 0.72, 0.74, and 0.74, with normalized weights of approximately 0.327, 0.336, and 0.336. This weighting method considers client similarity and representativeness, helping to better leverage the characteristics of each client in federated learning. Clients with high similarity may have similar data distributions, and assigning them higher weights facilitates rapid model convergence. Clients with high centrality may contain more common features, which helps improve the model's generalization ability. Client weights assigned in this way can play a significant role in subsequent model aggregation, improving the efficiency and effectiveness of federated learning.

[0269] The present invention also discloses a substation-side network equipment fault elimination and verification system based on deep learning, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, it implements the substation-side network equipment fault elimination and verification method based on deep learning as described in any of the above embodiments.

[0270] Among them, the processor can adopt a central processing unit (CPU). Of course, according to actual usage, other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. can also be adopted. The general-purpose processor can adopt a microprocessor or any conventional processor, etc., and this application does not impose any restrictions on this.

[0271] Among them, the memory can be an internal storage unit of a computer device, such as a hard disk or memory of a computer device, or an external storage device of a computer device, such as a plug-in hard disk, smart memory card (SMC), secure digital card (SD) or flash memory card (FC) equipped on the computer device. In addition, the memory can also be a combination of an internal storage unit and an external storage device of a computer device. The memory is used to store computer programs and other programs and data required by the computer device. The memory can also be used to temporarily store data that has been output or is to be output. This application does not impose any restrictions on this.

[0272] The present invention also discloses a substation-side network equipment fault elimination and verification platform based on deep learning, including the substation-side network equipment fault elimination and verification system and the substation federated learning system described in the above embodiment. The substation federated learning system includes multiple substation clients and a federated learning server deployed in the target area. All substation clients are communicatively connected to the federated learning server. The federated learning server has a shared learning model pre-built. All substation clients are pre-deployed with a client learning model with the same initial configuration as the shared learning model. All client learning models are from the federated learning server. The shared learning model and the client learning model are both GNN models. The multiple substation clients belong to multiple substations in the target area respectively, and each substation has one and only one substation client. For any substation, the substation client in the substation is communicatively connected to all network devices in the substation based on a pre-configured substation intranet connection.

[0273] The present invention also discloses a computer-readable storage medium, which stores instructions. When the instructions are executed by a processor, the processor is configured to execute the substation-side network equipment fault elimination and verification method based on deep learning described in any of the above embodiments.

[0274] Among them, the computer program can be stored in a machine-readable medium, the computer program includes computer program code, the computer program code can be in the form of source code, object code, executable file or certain middleware, etc. The machine-readable medium includes any entity or device that can carry computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the machine-readable medium includes but is not limited to the above-mentioned components.

[0275] Among them, the power transmission line comprehensive fault detection method in the above embodiment is stored in the computer-readable storage medium through the computer-readable storage medium, and is loaded and executed on the processor to facilitate the storage and application of the above method.

[0276] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of protection of the present application is limited to these examples. In line with the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as above, which are not provided in detail for the sake of simplicity.

[0277] The one or more embodiments of this application are intended to encompass all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this application should be included in the scope of protection of this application.

Claims

1. A method for troubleshooting and verifying network equipment at a substation based on deep learning, characterized in that: A substation federated learning system applied to a target area, the substation federated learning system comprising a plurality of substation clients and a federated learning server deployed in the target area, all of the substation clients being communicatively connected to the federated learning server, the federated learning server pre-building a shared learning model, all of the substation clients being pre-deployed with a client learning model having the same initial configuration as the shared learning model, and all of the client learning models being derived from the federated learning server, the shared learning model and the client learning model being both GNN models; the plurality of substation clients respectively belonging to a plurality of substations in the target area, and each substation having and only having one substation client; for any one of the substations, the substation client in the substation being communicatively connected to all network devices in the substation based on a pre-configured substation intranet connection; The method comprises the following steps: When any one or more target substation clients among all the substation clients trigger a preset device verification rule, for any of the substation clients, the substation client obtains device data of all the network devices through the substation intranet, wherein the device data includes device configuration files, device operation logs, and device network traffic data; The substation client uses Granger causality test analysis method and mutual information analysis method to extract correlation relationship characteristics between the device configuration file, the device operation log and the device network traffic data; The substation client constructs a device configuration heterogeneous graph network based on the association relationship characteristics and in combination with the device configuration file, the device operation log and the device network traffic data; The substation client simplifies the device configuration heterogeneous graph network to a basic heterogeneous graph network using graph simplification technology, extracts simplified topology features from the basic heterogeneous graph network, and uploads the simplified topology features to the federated learning server; The substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters of the client learning model, and uploads the updated client model parameters to the federated learning server; After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results; The federated learning server trains the shared learning model in combination with all the client model parameters and the corresponding client weights, updates the shared model parameters of the shared learning model, and sends the updated shared model parameters to all the substation clients; For any target substation client, the target substation client updates the shared model parameters to the local client learning model, inputs the device configuration heterogeneous graph network into the client learning model after parameter update, and outputs the configuration mode and configuration parameter mapping table of all network devices through the client learning model after parameter update; The target substation client generates a device calibration strategy in combination with the configuration mode and the configuration parameter mapping table, and completes the calibration work of all the network devices through the device calibration strategy.

2. The method for verifying faults of substation network equipment based on deep learning according to claim 1 is characterized in that: The substation client extracts the correlation relationship features between the device configuration file, the device operation log, and the device network traffic data by using the Granger causality test analysis method and the mutual information analysis method, including the following steps: The substation client converts the device configuration file, the device operation log, and the device network traffic data into time series feature data, and standardizes all the time series feature data; The substation client determines the optimal lag order of the Granger causality test analysis method based on the time series characteristic data and using the AIC information criterion; The substation client performs a multivariate Granger causality test analysis on all the time series feature data according to the optimal lag order, and generates a linear correlation feature between the device configuration file, the device operation log, and the device network traffic data according to the analysis result of the Granger causality test analysis; The substation client converts all the time series feature data into discrete feature data; The substation client extracts nonlinear correlation features between the device configuration file, the device operation log, and the device network traffic data from the discrete feature data using a mutual information analysis method; The substation client integrates the linear association feature and the nonlinear association feature into an association relationship feature among the device configuration file, the device operation log, and the device network traffic data.

3. The method for verifying faults of substation network equipment based on deep learning according to claim 2 is characterized in that: The substation client extracts nonlinear correlation features between the device configuration file, the device operation log, and the device network traffic data from the discrete feature data using a mutual information analysis method, including the following steps: The substation client calculates, using a mutual information calculation formula, a first joint information entropy between the device configuration file and the device operation log, a second joint information entropy between the device configuration file and the device network traffic data, and a third joint information entropy between the device configuration file, the device operation log, and the device network traffic data; The substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy; The substation client determines a nonlinear correlation feature among the device configuration file, the device operation log, and the device network traffic data according to the total mutual information.

4. The method for verifying faults of substation network equipment based on deep learning according to claim 3 is characterized in that: The total mutual information calculation formula is as follows: I(X;Y;Z)=H(X;Y)+H(Y;Z)H(X;Y;Z) Wherein: I(X; Y; Z) represents the total mutual information, H(X; Y) represents the first joint information entropy, H(Y; Z) represents the second joint information entropy, and H(X; Y; Z) represents the third joint information entropy.

5. The method for verifying faults of substation network equipment based on deep learning according to claim 1 is characterized in that: After the substation client simplifies the device configuration heterogeneous graph network into a basic heterogeneous graph network using graph simplification technology, extracting simplified topology features from the basic heterogeneous graph network and uploading the simplified topology features to the federated learning server includes the following steps: The substation client performs node clustering and edge pruning on the device configuration heterogeneous graph network according to the association relationship characteristics to obtain a simplified heterogeneous graph network; The substation client extracts a heterogeneous graph network skeleton from the simplified heterogeneous graph network using a minimum spanning tree algorithm; The substation client calculates the node centrality index in the simplified heterogeneous graph network and selects the key nodes in the simplified heterogeneous graph network according to the node centrality index; The substation client reconstructs the device configuration heterogeneous graph network into a basic heterogeneous graph network by combining the heterogeneous graph network skeleton and the key nodes; Simplified topological features are extracted from the basic heterogeneous graph network, and the simplified topological features are uploaded to the federated learning server.

6. The method for verifying faults of substation network equipment based on deep learning according to claim 5 is characterized in that: The simplified topological feature is a feature vector composed of graph global features, node-level features, edge-level features, subgraph features and spectral features.

7. The method for verifying faults of substation network equipment based on deep learning according to claim 6 is characterized in that: After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results, including the following steps: After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server calculates the feature similarity between each pair of the substation clients based on the simplified topology features and using a similarity measurement method, and constructs a feature similarity matrix of the substation clients based on all the feature similarities; The federated learning server divides all the substation clients into multiple client groups based on the simplified topological features and uses a K-means clustering algorithm, and determines the client centrality of each substation client according to the distance between the substation client and the group center of the client group; The federated learning server assigns client weights to all the substation clients in combination with the feature similarity matrix and the client centrality.

8. A substation network equipment fault elimination and verification system based on deep learning, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the substation-side network equipment fault elimination and verification method based on deep learning as described in any one of claims 1 to 7.

9. A substation network equipment fault elimination and verification platform based on deep learning, characterized by: include: The substation terminal network equipment fault elimination and verification system according to claim 8; as well as A substation federated learning system, the substation federated learning system includes multiple substation clients and a federated learning server deployed in the target area, all the substation clients are communicatively connected to the federated learning server, the federated learning server has a pre-built shared learning model, all the substation clients are pre-deployed with a client learning model with an initial configuration identical to the shared learning model, and all the client learning models are from the federated learning server, the shared learning model and the client learning model are both GNN models; multiple substation clients respectively belong to multiple substations in the target area, and each substation has only one substation client, and for any one of the substations, the substation client in the substation is communicatively connected to all network devices in the substation based on a pre-configured substation intranet connection.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor is configured to execute the substation terminal network equipment fault elimination and verification method based on deep learning according to any one of claims 1 to 7.

Images