Security anomaly detection method and system for SV message of digital substation

Abstract

The invention discloses a security anomaly detection method and system for an SV message of a digital substation, and belongs to the technical field of safe operation of a power distribution network. The method comprises the following steps: acquiring SV message data in a digital substation and carrying out real-time preprocessing; after historical normal SV message features are preprocessed, reconstruction errors are solved through an auto-encoder, a dynamic threshold value is solved according to the reconstruction errors, unsupervised training is carried out with the reconstruction error being minimum as the target, the dynamic threshold value is set as a security anomaly criterion of unsupervised training, and security anomaly detection is carried out. Constructing a deep auto-encoder neural network model of unsupervised learning; new normal working condition data are received, and the unsupervised learning deep auto-encoder neural network model is updated; and inputting the preprocessed SV data into the updated unsupervised learning deep auto-encoder neural network model to obtain an anomaly detection result. According to the invention, the false alarm rate and the missing report rate are obviously reduced, and powerful guarantee is provided for power distribution network safety and power system reliability.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of smart grid security, and more particularly to a security anomaly detection method for SV messages in an IEC61850 digital substation. The SV messages in the IEC61850 digital substation multicast the instantaneous values of the primary side current, voltage and the like to the digital substation network system at a 4.8K Packet rate, and provide real-time data for the power grid application scenario of protection and measurement and control devices. Since the SV message in the IEC61850 protocol lacks encryption authentication, it is vulnerable to FDIA (fake data injection), replay, denial of service, time synchronization fraud and other attacks, which poses a high risk to relay protection action and system stability. By utilizing machine deep learning technology, a low-dependence label, high real-time and strong generalization security anomaly detection method is provided for IEC61850 SV messages. BACKGROUND

[0002] Since the SV message itself does not use encryption, integrity check or identity authentication, it is extremely vulnerable to fake data injection (FDIA), replay, denial of service and even time synchronization fraud attacks. Once the attacker tampers with the sampling value or disturbs the timestamp, it will cause the relay protection to possibly mis-trip or refuse to act, thereby causing a large-scale power outage, and even damaging primary equipment. Therefore, the "credibility gap" of the SV message has been regarded as one of the biggest network security risks of the IEC61850 digital substation.

[0003] In order to solve the security defects of the SV message in the IEC61850 protocol, the industry has been looking for practical solutions. The earliest solution is to use a fixed threshold or expert rule to monitor whether the sampling value is out of limit, but this solution can only look at a single electrical parameter, and it is almost powerless against FDIA attacks of "numerical values within the legal range but overall distortion". Then machine learning methods are introduced, among which shallow learning models (such as SVM, random forest) use a small amount of statistical features selected by artificial selection to distinguish anomalies. The accuracy is acceptable on low-dimensional experimental data, but when faced with real substation with more than twenty electrical parameters and network time sequence fields, the model complexity increases sharply, and the label samples are extremely scarce, which is prone to overfitting. Convolutional network technology can extract local textures from SV waveforms, but it lacks the ability to describe the overall distribution of electrical quantities and message timing. LSTM-self-encoder introduces time sequence memory, but it generally relies on static thresholds, and when there are reasonable load changes or device maintenance scenarios, the false positive rate will increase sharply. The hybrid CNN-LSTM classifier improves the recall rate in the short term by concatenating three-phase waveforms and Ethernet features for supervised training, but once new FDIA variants or new load conditions appear, the model needs to be retrained with manually labeled samples, which is very costly to maintain.

[0004] IEC61850-9-2Sampled Values (SV) messages bear the high-speed transmission of key quantities such as instantaneous current and voltage in digital substations, but because the standard does not require encryption, integrity check and identity authentication, SV traffic is extremely vulnerable to forged data injection (FDIA), replay, denial of service or time synchronization fraud. Once the attacker tampers with the sampled values or disturbs the time stamp, the relay protection device may malfunction or refuse to act, posing a huge risk to the safe operation of digital substations. However, the existing anomaly detection methods based on threshold, shallow machine learning or fixed depth network are difficult to timely detect malicious tampering of such SV messages in high-dimensional, strongly nonlinear real-time scenarios, and have poor adaptability to unknown attacks and insufficient response speed.

[0005] The prior art document 1 (CN110086776A) discloses an intelligent substation network intrusion detection system and method based on deep learning, which has the disadvantages that only the IEC61850 full protocol traffic is parsed at the byte level, the three-phase electrical quantities and network time sequence features are not coupled, and a semi-supervised deep neural network is used in combination with a fixed threshold for discrimination, so that the sensitivity to FDIA attacks with "legal format but distorted values" is insufficient, and false positives are easily caused by static thresholds in load fluctuation or maintenance scenarios. The real-time performance indicators of the background server deployment also do not meet the 4ms closed-loop of relay protection. The SUMMARY

[0006] In view of the core vulnerability of the lack of inherent security protection in SV messages in the IEC61850 protocol, in order to solve the problems in the prior art, the present application provides a security anomaly detection method and system for SV messages in a digital substation, which collects three-phase current, voltage, power and other SV message data, and after denoising, PCA dimensionality reduction and normalization, establishes a GPU-accelerated multi-dimensional autoencoder unsupervised model to learn and build the statistical distribution trend of "normal" SV messages in real time. When the SV message data trend error deviates significantly during the reconstruction detection of the SV message trend, millisecond-level judgment and alarm of the forged or abnormal messages can be realized. The present application can dynamically adjust the threshold and high-speed edge reasoning through zero-label unsupervised learning method, realize sensitive, fast and accurate identification of FDIA and other unknown network attacks, and protect the reliable action of relay protection equipment in digital substations and the stable operation of smart grid systems.

[0007] The application adopts the following technical solutions.

[0008] The first aspect of the present application provides a security anomaly detection method for SV messages in a digital substation, comprising:

[0009] Collecting SV message data in a digital substation;

[0010] The collected SV message data is preprocessed in real time to obtain preprocessed SV data;

[0011] The historical normal SV message features are preprocessed, and the reconstruction error is solved by the self-encoder. The dynamic threshold is solved according to the reconstruction error, and the dynamic threshold is set as the safety anomaly criterion of the unsupervised training for safety anomaly detection, and a deep self-encoder neural network model of unsupervised learning is constructed.

[0012] The new normal working condition data is received, and the deep self-encoder neural network model of unsupervised learning is updated;

[0013] The preprocessed SV data is input into the updated deep self-encoder neural network model of unsupervised learning to obtain an anomaly detection result.

[0014] Preferably, the real-time preprocessing of the collected SV message data comprises:

[0015] The collected SV message is time-referenced and synchronized, and all channel timestamps are aligned to obtain time-aligned SV messages;

[0016] The time-aligned SV messages are segmented according to the set window length and sliding step by the sampling window strategy;

[0017] The segmented SV messages are dynamically sampled and cached, and the cached SV messages are quality optimized;

[0018] The optimized SV messages are identified and removed from the noise and burr by using the density clustering algorithm to obtain denoised SV messages;

[0019] The denoised SV messages are standardized, and the standardized SV messages are dimensionally reduced to obtain preprocessed SV messages.

[0020] Preferably, the dynamic sampling comprises:

[0021] When the GPU utilization is monitored to be lower than the first threshold value and the inference queue has no backlog, it is determined that the current state is a resource sufficient state, and the system performs sparse sampling according to the first proportion;

[0022] When the GPU utilization is monitored to be higher than the second threshold value or the inference queue backlog length is monitored to be higher than the set value, it is determined that the current state is a resource shortage state, and the system automatically adjusts the sampling ratio to the second proportion;

[0023] When the GPU utilization is monitored to be higher than the third threshold value or the system triggers a resource bottleneck, it is determined that the current state is a resource overload state, and the system automatically adjusts the sampling ratio to the third proportion.

[0024] Preferably, when the output frame rate after sampling according to the sampling ratio is lower than the minimum limit value specified by the Nyquist theorem, the system automatically limits the output frame rate to the minimum limit value specified by the Nyquist theorem.

[0025] Preferably, the solving of the reconstruction error comprises:

[0026] The autoencoder maps the preprocessed historical normal SV message features through an encoder, and reconstructs the mapped data using a decoder to obtain reconstructed data.

[0027] According to the reconstructed data, the regularization is performed in the BatchNorm layer to obtain regularized reconstructed data.

[0028] According to the regularized reconstructed data and the preprocessed historical normal SV message features, the reconstruction error is calculated to obtain a reconstruction error sequence.

[0029] Preferably, the autoencoder maps the preprocessed historical normal SV message features through an encoder, and reconstructs the mapped data using a decoder to obtain reconstructed data comprises:

[0030] The encoder is constructed through a one-dimensional convolutional neural network layer and a bidirectional long short-term memory neural network layer.

[0031] The preprocessed historical normal SV message features are input into the constructed encoder, and the local texture features are extracted through the one-dimensional convolutional neural network layer in the encoder.

[0032] The local texture features are input into the bidirectional long short-term memory neural network layer to capture the hidden state sequence of the cross-window timing in the local texture data.

[0033] The hidden state sequence output by the bidirectional long short-term memory neural network layer is dimensionally reduced to a latent space by global average pooling to obtain mapped data.

[0034] The decoder is constructed through an inverse convolutional layer, and the mapped data is reconstructed to the original dimension through the inverse convolutional layer of the decoder to obtain reconstructed data.

[0035] Preferably, the solving of the dynamic threshold value comprises:

[0036] The reconstruction error of the sliding window in the set time in the reconstruction error sequence is taken to calculate the sliding mean and standard deviation.

[0037] The standard deviation is multiplied by the set threshold coefficient and then added to the sliding mean to obtain a dynamic threshold value.

[0038] Preferably, setting the dynamic threshold value as the safety anomaly criterion of unsupervised training comprises:

[0039] When the reconstruction error is greater than the dynamic threshold and less than A times the dynamic threshold, a mild abnormal working condition is determined, an alarm is triggered, and the alarm type is displayed in the color corresponding to the mild abnormal working condition;

[0040] When the reconstruction error is greater than A times the dynamic threshold and less than B times the dynamic threshold, a general abnormal working condition is determined, an alarm is triggered, and the alarm type is displayed in the color corresponding to the general abnormal working condition;

[0041] When the reconstruction error is greater than B times the dynamic threshold, a serious abnormal working condition is determined, an alarm is triggered, and the alarm type is displayed in the color corresponding to the serious abnormal working condition.

[0042] Preferably, the receiving of the new normal working condition data and the updating of the unsupervised learning deep autoencoder neural network model comprise:

[0043] In each training batch, the optimal learning rate of training is solved by using a cosine annealing learning rate restart strategy;

[0044] After receiving the new normal working condition data, the convolution kernel weights of the one-dimensional convolutional neural network layer in the filter and the statistics parameters of the BatchNorm layer are frozen, the bidirectional long short-term memory neural network layer weight parameters and the decoder inverse convolution layer weight parameters are unfrozen, and the bidirectional long short-term memory neural network layer weight parameters and the decoder inverse convolution layer weight parameters are updated according to the optimal learning rate of training.

[0045] The second aspect of the application provides a security anomaly detection system for digital substation SV messages, which runs the security anomaly detection method for digital substation SV messages according to the first aspect of the application, and comprises:

[0046] A data acquisition module is configured to acquire SV message data in a digital substation;

[0047] A preprocessing module is configured to perform real-time preprocessing on the acquired SV message data to obtain preprocessed SV data;

[0048] A model construction module is configured to solve a reconstruction error by using an autoencoder on the preprocessed historical normal SV message features, solve a dynamic threshold according to the reconstruction error, perform unsupervised training with the minimum reconstruction error as the target, set the dynamic threshold as a security anomaly criterion for security anomaly detection, and construct an unsupervised learning deep autoencoder neural network model;

[0049] A model updating module is configured to receive new normal working condition data and update the unsupervised learning deep autoencoder neural network model;

[0050] An anomaly detection module is configured to input the preprocessed SV data into the updated unsupervised learning deep autoencoder neural network model to obtain an anomaly detection result.

[0051] Compared with the prior art, the present application has at least the following beneficial effects:

[0052] The present application establishes a dynamic threshold adaptive mechanism, which updates statistical parameters μt and σt in real time through a sliding window, and sets the abnormality determination threshold as ε(t) = μt + λσt. Since this threshold does not depend on manual setting, but is driven by the latest reconstruction error statistics in the current window, it can automatically drift with the changes in data distribution caused by seasonal fluctuations in grid load, changes in power flow or topology reconstruction, adapt to changing environments, reduce false positives caused by scenario drift, and reduce the false positive and false negative probabilities of IEC61850 digital substations;

[0053] Compared with the traditional method of using only reconstruction error as the discrimination method, the present application uses a heterogeneous feature tensor modeling, and captures the time sequence and spatial coupling structure through 1DCNN and BiLSTM, improving the model's expression ability for complex patterns. In the migration process, the bottom convolutional layer is frozen, only the LSTM and decoder are fine-tuned, and an unsupervised cosine annealing strategy is introduced for fast incremental update, so that the model adapts to the new site operating conditions without abnormal labels. This training strategy greatly reduces the migration cost and improves the practicability and adaptability of IEC61850 digital substation anomaly detection;

[0054] The present application models the correlation between digital substation power characteristics and network characteristics as a whole, so that no abnormal labels are needed in the training phase, only a few days of normal message data is needed, and the model automatically converges, fundamentally solving the problem of lack of SV abnormal samples. The multi-dimensional autoencoder model is used for unsupervised learning with zero labels, and the system's normal model can be learned adaptively using only normal operation data, eliminating the dependence on abnormal label data. With the help of the high computing power of edge GPU, the model reasoning delay is less than 0.5 milliseconds, which can meet the strict requirements of 4 millisecond closed-loop response of relay protection system, and realize sensitive, fast and accurate identification of FDIA and other unknown network attacks, ensuring the reliable action of relay protection equipment in digital substation and stable operation of smart grid system, and improving the reliability and stability of IEC61850 digital substation operation;

[0055] The application provides a dynamic sampling mechanism, which performs 2:1 decimation on 4000 frames per second (4kfps) SV message flow, and can dynamically adjust the sampling ratio according to the computing resources. Through the decimation mode, the key information such as power frequency signals and main harmonic components can be retained while the communication bandwidth occupation and computing load are greatly compressed, the integrity of the required features for detection is ensured, and the accuracy of the IEC61850 digital substation message anomaly detection is improved. The application realizes adaptive and millisecond-level safety anomaly detection of the SV message without labels, and builds an efficient, low-cost and sustainable last line of defense for the IEC61850 digital substation system. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 It is a schematic diagram of the step flow of the safety anomaly detection method of the SV message in the IEC61850 digital substation provided by the embodiment of the application.

[0057] Figure 2 It is a schematic diagram of the multi-dimensional autoencoder structure provided by the embodiment of the application.

[0058] Figure 3 It is a schematic diagram of the situation anomaly detection effect provided by the embodiment of the application.

[0059] Figure 4 It is a schematic diagram of the autoencoder training loss provided by the embodiment of the application.

[0060] Figure 5 It is a schematic diagram of the feature dimension reduction scheme selection provided by the embodiment of the application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical scheme and advantages of the application clearer, the technical scheme of the application will be described clearly and completely below in combination with the drawings in the embodiments of the application. The described embodiments are only a part of the embodiments of the application, not all the embodiments. All other embodiments obtained by those skilled in the art without creative labor on the basis of the spirit of the application belong to the protection scope of the application.

[0062] As shown in Figure 1 Embodiment 1 of the application provides a safety anomaly detection method of a digital substation SV message, which comprises the following steps:

[0063] Step 1: collecting SV message data in a digital substation, wherein the SV message data comprises electrical characteristics and network characteristics.

[0064] In the preferred but non-limiting embodiments of the application, step 1 comprises:

[0065] Step 1.1: Collecting electrical characteristics at the substation collection point, wherein the electrical characteristics include power data and derived quantities.

[0066] Further preferably, step 1.1 includes:

[0067] Collecting power data at a set sampling frequency of 4kfps, including three-phase currents I a / I b / I c , three-phase voltages U a / U b / U c , zero sequence quantities I0, U0.

[0068] Calculating derived quantities in real time locally, including instantaneous power P, reactive power Q, apparent power S, and power factor PF.

[0069] Step 1.2: Collecting each network time sequence at the substation collection point in parallel, including SV frame number, sending timestamp, adjacent frame interval Δt, and PTP synchronization message state, to obtain network characteristics.

[0070] Step 1.3: Combining the electrical characteristics of step 1.1 and the network characteristics of step 1.2 to form a feature vector covering the power-communication dual domain, obtaining the collected SV message.

[0071] Step 2: Real-time preprocessing of the SV message data obtained in step 1 to obtain preprocessed SV data, providing input data with format specification and complete feature set for the anomaly detection model.

[0072] In a preferred but non-limiting embodiment of the present application, step 2 includes:

[0073] Step 2.1: Time reference and synchronization of the collected SV message of step 1.1, aligning all channel timestamps to obtain time-aligned SV message.

[0074] Further preferably, step 2.1 includes:

[0075] Uniformly using PTP or GPS1PPS at the substation collection point to time-reference the SV message collected in step 1, and the time-referenced SV message enters the switching network, where Port Mirror is performed at the core switch, and the electrical data of the time-referenced SV message and its corresponding network characteristics are synchronously forwarded through the core switch port mirror, to ensure strict time alignment of multi-source characteristics, realize time consistency of electrical and network time sequence characteristics with the same source and scale, and lay a foundation for subsequent time sequence modeling.

[0076] Step 2.2: Segment the time-aligned SV packets obtained in step 2.1 according to the set window length L and sliding step S to obtain segmented SV packets.

[0077] Further preferably, step 2.2 comprises:

[0078] The sampling window strategy uniformly divides the stream data according to the window L = 160 frames and step S = 80 frames. That is, based on the time-aligned SV packet stream, a 160-frame window is cut out every 80 frames from the first frame, forming multiple time segments with 50% overlap. Under the condition of 4kfps, it is equivalent to constructing a segment of segmented SV packets every 40ms, sliding once every 20ms, ensuring that each new window contains half the data of the previous window, thereby improving the model's ability to capture transitional states and mutation points.

[0079] Step 2.3: Dynamic sampling and caching of the segmented SV packets obtained in step 2.2 to obtain cached SV packets.

[0080] Further preferably, step 2.3 comprises:

[0081] Step 2.3.1, dynamically sampling the segmented SV packets of step 2.2 according to the pre-set resource state threshold to obtain sampled SV packets.

[0082] More preferably, step 2.3.1 comprises:

[0083] For segmented SV packets up to 4kfps, a resource-aware dynamic sampling mechanism is used to periodically monitor the key resource indicators of the edge computing node, including but not limited to GPU utilization, CPU load, memory occupancy, and the backlog status of the model inference queue. According to the pre-set resource state threshold, the sampling ratio is dynamically adjusted, including:

[0084] When the GPU utilization is lower than the first threshold, for example, 70%, and the inference queue has no significant backlog, it is determined that the current state is a resource-rich state, and the system performs sparse sampling according to the first proportion of 2:1, that is, only the even-numbered frame packets (or odd-numbered frame packets) in the sequence are retained, reducing the data stream rate to about 2kfps. This sampling ratio, while meeting the Nyquist sampling theorem, can completely retain the 50Hz power frequency fundamental wave and its main harmonic components, typically up to the 13th harmonic, i.e., 650Hz, ensuring the integrity of key electrical feature information, while reducing the data volume and computational load by half.

[0085] When the GPU utilization is monitored to exceed a second threshold, for example 85%, or the inference queue backlog length exceeds a set value, for example 5 windows, it is determined that the current state is a resource shortage state, and the system automatically adjusts the sampling ratio to a second ratio 4:1, that is, 1 frame is reserved for every 4 frames, and the output frame rate is reduced to about 1kfps. At this sampling rate, the system still ensures that the Nyquist condition is met to cover the requirements of 50Hz fundamental wave and most main harmonics, to maintain the basic ability of anomaly detection, while significantly reducing the consumption of computing resources.

[0086] When the GPU utilization is monitored to exceed a third threshold, that is, to reach or approach saturation, for example ≥95%, or the system triggers an over-temperature warning and other serious resource bottlenecks, it is determined that the current state is a resource overload state, and the system can further degrade the sampling ratio to a third ratio 8:1, with an output of about 500fps, as an emergency measure to prioritize the stability of system operation. In any case, the system is forced to require that the final output frame rate is not lower than the minimum limit value specified by the Nyquist theorem (i.e. 1300Hz, corresponding to the complete reconstruction requirement of ≤13 harmonics of the 50Hz fundamental wave). If the output frame rate calculated by 8:1 sampling is lower than this limit value (500fps<1300fps), the system automatically limits the output frame rate to 1.3kfps (i.e. the sampling ratio is not lower than about 3:1).

[0087] The above dynamic adjustment process is driven by the built-in resource monitoring module of the system, and the switching and restoration of the sampling ratio are automatically executed according to the continuous monitoring of the resource state, ensuring that in the case of fluctuation of edge computing resources, the core detection function is guaranteed, and the data processing throughput and computing resource occupation are intelligently balanced.

[0088] Step 2.3.2, rolling cache the sampled SV packets to obtain cached SV packets.

[0089] More preferably, step 2.3.2 comprises:

[0090] In order to continuously feed the equal-length sequence to the GPU, a ring buffer is used to store the latest set multiple window lengths 2L (=320) frames, when new frame packets arrive, the oldest frame packets are discarded, the next window is assembled using zero-copy technology, to ensure that continuous data is provided to the GPU, and to ensure seamless connection of the data stream.

[0091] Step 2.4: quality optimization of the cached SV packets of step 2.3 to obtain optimized SV packets.

[0092] Further preferably, step 2.4 comprises:

[0093] Step 2.4.1, missing detection and duplicate frame elimination of the cached SV packets, the specific operation is:

[0094] (a) Duplicate frame identification and rejection: If the time stamp interval of adjacent frames is detected to be less than 10 μs, and the frame content hash value is consistent, it is determined that the duplicate frame is caused by network jitter, only the first frame is retained and the subsequent duplicate frame is discarded;

[0095] (b) Frame loss detection: The number of consecutive frame losses in the window is counted, and if the cumulative frame loss rate is greater than 5 ‰, the current window is marked as "quality degradation";

[0096] (c) Data filling: For the data gap caused by duplicate frame rejection or frame loss, linear interpolation is performed based on the current, voltage and network timing quantity of the previous and subsequent valid frames to generate the filled SV message.

[0097] Step 2.4.2. White noise test on the filled SV message of step 2.4.1, randomly extract 1% window during daily low load period to perform spectrum-white noise test. If the signal-to-noise ratio is monitored to be reduced by more than 3 dB compared with the initial reference value, the closed-loop optimization adjustment of Kalman filter parameters is triggered: through the iterative update of process noise covariance (Q_k) and observation noise covariance (R_k) parameters, the signal-to-noise ratio is restored to the reference value within the error range of 1 dB. Finally, the optimized SV message is obtained, which maintains the reliability and distinguishability of the original signal, thereby outputting continuous, time-consistent and high-quality sequence.

[0098] The present application sets a fast window of 40 ms to refresh the short sequence of 20 ms sliding at high frequency, to capture transient faults at millisecond level precision; at the same time, a slow window of 200 ms is configured to perform trend statistics on longer sequences, for identifying load fluctuations, harmonic accumulation and seasonal drift. The two-level windows share the same data stream, and real-time parallel processing is realized by using ring buffer and zero-copy technology, which not only ensures the fast response to the time limit of relay protection, but also provides the long-time base characteristics required for steady-state analysis. In order to further improve the judgment accuracy, the system has built-in data quality control mechanisms such as frame loss monitoring, spectrum noise evaluation and white noise test: once the continuous frame loss rate exceeds the threshold or the signal-to-noise ratio decreases by more than 3 dB, the window is automatically marked as "quality degradation" and the parameter self-adjustment is triggered, and the signal-to-noise ratio is maintained at a safe level through the above closed-loop optimization, ensuring that each frame of data entering the model is reliable and usable.

[0099] Step 2.5: The density clustering algorithm is used to identify and remove the pulse noise and burr components other than the power frequency 50 Hz and its main harmonics from the optimized SV message of step 2.4, to obtain the denoised SV message. The denoising retains the main harmonic components of the 50 Hz fundamental wave, ensuring that the subsequent model can still see the fault characteristics. This strategy not only retains the fundamental wave-harmonic information required for fault diagnosis, but also effectively suppresses high-frequency noise, laying a clean signal foundation for subsequent feature standardization and abnormal modeling.

[0100] Further preferably, step 2.5 comprises:

[0101] According to the density clustering algorithm, abnormal trajectory points far away from the main dense area in the optimized SV message are identified and excluded, and the principle is that if the e-field of sample p contains at least MinPts samples, including sample p, with sample p as the core point, the following formula is used:

[0102] N ε (p)≥MinPts (1)

[0103] In the formula,

[0104] N ε (p) represents the total number of sample points in the e-neighborhood of sample p, including p itself, and is represented by the following formula:

[0105] N ε (p)={q∈D|dist(p,q)≤ε} (2)

[0106] In the formula,

[0107] D represents the entire space where the data set is located,

[0108] dist(p,q) represents the distance function between sample point p and sample point q;

[0109] ε represents the neighborhood radius.

[0110] Step 2.6: Standardize the denoised SV message of step 2.5 to obtain a standardized SV message.

[0111] The denoised SV message is first mapped to a unified numerical interval according to the Z-Score method, completing Z-Score normalization, and different dimensions such as current, voltage, and time interval are pulled to the same numerical scale, avoiding gradient imbalance caused by dimensional differences. Among them, the formula of Z-Score method is as follows:

[0112]

[0113] Where x0 is the original value, which can be current, voltage and time, μ is the mean of the feature in the training set, σ is the standard deviation of the feature in the training set, and z0 is the normalization result.

[0114] Then apply BatchTrend in the sliding batch to remove slow drift components, so that the model focuses on sudden deviations rather than gradual trends under normal working conditions.

[0115] Step 2.7: Dimension reduction of the standardized SV message of step 2.6 to obtain the preprocessed SV message. Through PCA, the highly overlapping multi-phase and multi-index vectors are compressed into a more compact subspace, reducing redundancy while retaining main information.

[0116] Further preferably, step 2.7 comprises:

[0117] In order to reduce the time cost of abnormal monitoring of the power distribution network safety working condition, it is ensured that there is no mutual influence between electrical data components. Figure 5 According to the characteristics of the dimension reduction scheme selection and the schematic diagram, the dimension reduction scheme needs to meet the following conditions: the information amount is measured by variance, is not affected by factors outside the data set, the principal component vectors are orthogonal, the mutual influence between components is eliminated, the calculation method is simple, and the dimension reduction scheme is easy to implement.

[0118] In the dimension reduction process, a plurality of electrical variables are converted into a few comprehensive variables, i.e. principal components, and the conversion makes the original principal components have no mutual correlation, and they are linear combinations of original variables, which can transmit rich information and will not cause redundancy of electrical information.

[0119] The PCA is described in mathematical language, the data set X has n characteristics, each characteristic observes P variables, and then:

[0120]

[0121] Among them,

[0122] x i =(x 1i ,x 2i ,…x ni ) T ,i=1,2,…p。

[0123] The essence of PCA is to form P new variables from the original P electrical variables x1, x2, …x p , i.e.:

[0124]

[0125] Simplified as:

[0126] F i =w 1i x1+w 2i x2+…+w pi x p ,i=1,2,…,p (6)

[0127] Among them,

[0128] x i and F i obtained therefrom are n-dimensional vectors, and it is ensured that the new random variables obtained by transformation are mutually independent, and the variances are sequentially decreased, and then a p*p order transformation matrix W is obtained.

[0129]

[0130] So that:

[0131] F=[F1,F2,…F p ]=W T X (8)

[0132] By transforming the coordinate system, a new representation is obtained, in which the correlation between the dimensions of the electrical data is minimized. That is, the new variables obtained are mutually independent.

[0133] Through preprocessing, it is ensured that the multi-source data is compared under a unified scale, the dimension is reduced, and the interference of noise on detection is reduced.

[0134] Step 3: The historical normal SV message features are reconstructed by the self-encoder to solve the reconstruction error, and the dynamic threshold is solved according to the reconstruction error. Unsupervised training is performed with the minimum reconstruction error as the target, the dynamic threshold is set as the safety anomaly criterion of unsupervised training for safety anomaly detection, unsupervised training is performed, and a deep self-encoder neural network of unsupervised learning is constructed for anomaly detection of distribution network lines.

[0135] In the preferred but non-limiting embodiments of the present application, step 3 comprises:

[0136] Step 3.1, the self-encoder maps the historical normal SV message features by the encoder to obtain low-dimensional latent representation, i.e. mapping relationship z=f(x), obtains mapping data, and reconstructs the mapping data by the decoder to obtain reconstruction data, wherein x represents the historical normal SV message features, which are the preprocessed time window multi-dimensional input data extracted from the historical data lake.

[0137] Further preferably, step 3.1 comprises:

[0138] Step 3.1.1, the encoder is constructed by a one-dimensional convolutional neural network layer 1D CNN and a bidirectional long short-term memory neural network layer BiLSTM;

[0139] Step 3.1.2, the preprocessed historical normal SV message features are input into the encoder constructed in step 3.1.1, and the local texture is extracted by the one-dimensional convolutional neural network layer 1D CNN in the encoder. It can be expressed by the following formula:

[0140] z 1-D CNN =Conv1D(x;W conv ) (9)

[0141] In the formula,

[0142] W conv denotes the convolution kernel weight,

[0143] z 1-DCNN denotes the local texture data.

[0144] Step 3.1.3, the local texture features of step 3.1.2 are input into the BiLSTM of the bidirectional long short-term memory neural network layer to capture the hidden state sequence of the cross-window time sequence in the local texture data, which is expressed as follows:

[0145]

[0146] In the formula,

[0147] H represents the hidden state sequence output by the BiLSTM, H = H1, …, H L′ , H t represents the hidden state at time step t, and L' represents the sequence length.

[0148] W LSTM represents the LSTM weight matrix.

[0149] Step 3.1.4, the hidden state sequence output by the BiLSTM of the bidirectional long short-term memory neural network layer is reduced to the latent space of by using global average pooling, to obtain the mapping data, which is expressed as follows:

[0150]

[0151] wherein,

[0152] z latent represents the mapping data,

[0153] d is the dimension of the historical normal SV message feature,

[0154] k represents the dimension of the latent space output by the encoder.

[0155] Typically, the dimension of x can be high, and the dimension of the mapping data z output by the encoder is much smaller than x. Through such dimension reduction mapping, the model extracts the main features of the power distribution network operating state, effectively compresses the redundant information. For example, for the multi-dimensional data collected in a 3-second time window, the encoder can compress the hundreds of dimensions of the input to only tens of dimensions of z, from which the key patterns reflecting the normal working condition of the period are extracted. In normal operation, there is a stable correlation between electrical quantities, and the encoder can encode these normal patterns into z; when abnormal conditions such as overcurrent and undervoltage occur, the pattern of the input data x deviates from the normal range learned during training, and the corresponding feature z is also abnormal and cannot well represent the actual state.

[0156] In addition, the training process needs to be performed on a computing platform equipped with a high-performance graphics processing unit (GPU), such as NVIDIA Tesla T4 / V100 / A100 or an edge GPU module with equivalent computing power, such as NVIDIA Jetson AGX Orin. With the computing power of the GPU, large-scale matrix multiplication involved in the forward propagation and backward propagation processes of each layer of the encoder one-dimensional convolutional neural network (1D CNN), the bidirectional long short-term memory neural network (BiLSTM), and the decoder is performed.

[0157] Step 3.1.5, a decoder is constructed by an inverse convolution layer Deconv1D, which receives the mapping data output by step 3.1, and reconstructs the mapping data into the original dimension through the inverse convolution layer of the decoder to obtain reconstructed data.

[0158] More preferably, step 3.1.2 includes:

[0159] A decoder is constructed by an inverse convolution layer Deconv1D, which receives the mapping data z output by the encoder and reconstructs data of the original dimension, i.e., output reconstructed data, which is represented by the following formula:

[0160]

[0161] In the formula,

[0162] represents the reconstructed data,

[0163] W out represents the weight of the inverse convolution layer.

[0164] The reconstructed data contains the same electrical parameters of each dimension as the input, which is used to estimate the state of the power distribution network within the input time window. For a well-trained autoencoder, when the power distribution network is in normal operation, the decoder can accurately reproduce the input according to z, thereby obtaining a result very close to the input. That is, when the network is in normal operation and the parameter changes conform to the mode during training, each type of electrical parameter in the reconstructed value will be almost identical in amplitude and trend to the actual measured value. However, if there is an abnormal mode in the input data (which is beyond the learning range of the model for normal modes), the decoder will have difficulty in completely reconstructing the true abnormal situation, resulting in a significant difference between the reconstructed data and the input. For example, when an overcurrent fault occurs, causing a sudden surge in the current of a certain phase, the model has never seen such a high current value in normal data, and the current reconstructed by the decoder is still close to the normal level, which cannot restore the true spike, which will make the current of the phase in the reconstructed output significantly lower than the actual value.

[0165] The autoencoder model includes an encoder and a decoder, which are used to learn the feature mode of each parameter under normal operation of the power distribution network, and to judge abnormalities through reconstruction error, for identifying abnormal modes in the operation data of the power distribution network, such asFigure 2 As shown, the left input node X represents the input variable, and the model input adopts a multi-dimensional time series segment containing multiple operating parameters of the power distribution network, which is compressed into the intermediate encoded representation Z through the encoder, and then reconstructed into a multi-dimensional output through the symmetrical decoder. During the training process, the model adjusts the parameters to make the output as close as possible to the original input, i.e., to minimize the reconstruction error, thereby automatically learning the main features and correlations of the input data. The model can be trained offline using a large amount of historical normal data before deployment, thereby memorizing the rules between voltage, current, power, and other parameters in the normal state. When the model is put into online monitoring, each time a new time window data x is received, it will be processed through the autoencoder model.

[0166] Step 3.2, the reconstruction data obtained in step 3.1 is regularized by the historical statistics of the BatchNorm layer to obtain regularized reconstruction data, which is represented by the following formula:

[0167]

[0168] In the formula,

[0169] is the regularized reconstruction data,

[0170] μ0 represents the mean of the historical normal reconstruction data,

[0171] σ0 represents the standard deviation of the historical normal reconstruction data, and the historical statistics include the mean and standard deviation of the historical normal reconstruction data.

[0172] Step 3.3, according to the regularized reconstruction data obtained in step 3.2 and the historical normal SV message features, the reconstruction error is calculated.

[0173] Further preferably, step 3.3 includes:

[0174] The original input x is compared with the regularized reconstruction data Point-by-point comparison, using L2 norm to measure the reconstruction deviation of the entire time window multi-dimensional data, calculating the reconstruction error, represented by the following formula:

[0175]

[0176] Wherein,

[0177] x is the historical normal SV message feature.

[0178] The reconstruction error L reflects the difference between the actual operating condition of the power distribution network in the current time window and the expected normal state of the model.

[0179] When the power distribution network is in normal working condition, the actual measured value of each parameter is basically consistent with the model reconstruction value, and the reconstruction error is maintained in a very small numerical range; on the contrary, when an abnormality occurs, due to abnormal fluctuations in certain parameter dimensions, the reconstruction deviation of the corresponding dimension increases, thereby increasing the value of the overall error. Similarly, when an overcurrent fault occurs, causing the measured current to be much higher than the normal predicted value, it will also cause the reconstruction error to surge. As can be seen, the reconstruction error can be used as a quantitative index to judge whether the operation state of the power distribution network is abnormal, and the larger the value, the more serious the deviation from the normal mode.

[0180] Step 3.4: Solve the dynamic threshold according to the reconstruction error, and take the minimum reconstruction error constructed in step 3.3 as the training target for unsupervised training. Set the dynamic threshold as the safety anomaly criterion for unsupervised training to detect anomalies, realize automatic discrimination and alarm of anomalies, and construct a deep autoencoder neural network for unsupervised learning.

[0181] Further preferably, step 3.4 comprises:

[0182] Take the reconstruction error of the sliding window in the reconstruction error sequence within the set recent time of 5-10 min, calculate the sliding mean μ t and the standard deviation σ t , which is expressed as follows:

[0183]

[0184]

[0185] In the formula,

[0186] w represents the length of the sliding window, for example, the number of sampling points corresponding to 5-10 min;

[0187] L i represents the reconstruction error of the i-th time window in the sliding window,

[0188] t represents the latest sampling time point.

[0189] According to the sliding mean μ t and the standard deviation σ t , the dynamic threshold of the reconstruction error is solved, which is expressed as follows:

[0190] ε(t) = μ t + λδ t (17)

[0191] In the formula,

[0192] λ is a threshold coefficient, and is preferably 2-3 to balance false negatives and false positives, and is used to adjust the sensitivity of the alarm.

[0193] When the reconstruction error is greater than the dynamic threshold and less than A times the dynamic threshold, a mild abnormal working condition is determined, an alarm is triggered, and the alarm type is displayed in the color corresponding to the mild abnormal working condition. In the application, A is preferably 0.5 times the dynamic threshold, and the color corresponding to the mild abnormal working condition is green.

[0194] When the reconstruction error is greater than A times the dynamic threshold and less than B times the dynamic threshold, a general abnormal working condition is determined, an alarm is triggered, and the alarm type is displayed in the color corresponding to the general abnormal working condition. In the application, B is preferably 1 times the dynamic threshold, and the color corresponding to the general abnormal working condition is orange.

[0195] When the reconstruction error is greater than B times the dynamic threshold, a serious abnormal working condition is determined, an alarm is triggered, and the alarm type is displayed in the color corresponding to the serious abnormal working condition. In the application, the reconstruction error is greater than 1 times the dynamic threshold, an alarm is triggered, and the color corresponding to the serious abnormal working condition is red.

[0196] When the load is seasonally changed or the network is congested, the dynamic threshold will automatically drift according to the periodic sampling data, avoiding the embarrassment of "all alarms in winter and all silence in summer".

[0197] In the online monitoring process, the system continuously updates μ e and σ e in the sliding window, so as to dynamically adjust the threshold ε(t) to adapt to the slow change of the power distribution network working condition. This dynamic threshold strategy can reduce the false alarm rate while maintaining sensitivity to sudden abnormalities. When the new time window reconstruction error e exceeds the current threshold ε(t), the system determines that an abnormal working condition occurs, and triggers the alarm logic.

[0198] Step 4: When new normal working condition data is received, the unsupervised learning deep autoencoder neural network model of step 3 is updated, and the parameters are incrementally fine-tuned to adapt to the current running scene.

[0199] In a preferred but non-limiting embodiment of the application, step 4 includes:

[0200] Step 4.1, in each training batch, the cosine annealing learning rate restart strategy is used to solve the learning rate of training, which is expressed in the following formula:

[0201]

[0202] wherein,

[0203] η t represents the optimal learning rate of the t-th training batch, t represents the current training batch index,

[0204] η max represents the peak value of the learning rate, which is 3×10 -4 ,

[0205] ηmin denotes the learning rate valley value, taking 1 x 10 -5 ,

[0206] T denotes the restart cycle length, which is the number of batches within a training round, so that the parameter update converges to a new stable point within 3-5 training rounds.

[0207] The reconstruction error constructed in step 3.3 is the training target, without any exception labels, suitable for the case of real substation label scarcity. Once new normal conditions are collected, incremental fine-tuning can be quickly performed. This process only requires continuous normal operation data to complete model convergence, without any exception labels, which is very suitable for the reality of substation scenarios with scarce exception samples. When new healthy condition data is collected later, incremental fine-tuning of the trained network can be performed: freeze the low-level convolutional weights, only update the high-level LSTM and BatchNorm statistics, or use a small number of iterations of the learning rate restart strategy, so that the model can adapt to the new distribution caused by seasonal changes in substation load and equipment modification within a few minutes, thus maintaining detection sensitivity and low false alarm rate.

[0208] Step 4.2, update the parameters of the deep autoencoder neural network based on GPU unsupervised learning by running the autoencoder incremental training routine on the GPU. After receiving new healthy condition data, freeze the convolution kernel weights of the one-dimensional convolutional neural network layer 1DCNN in the filter and the statistics parameters of the BatchNorm layer, unfreeze the BiLSTM weight parameters and the decoder inverse convolution layer weights, and update the parameters of the BiLSTM layer and the decoder in the model according to the optimal learning rate η t and its corresponding gradient direction obtained in step 4.2 training process, which can be expressed as follows:

[0209]

[0210] In the formula, θ t denotes the parameters at the tth iteration, η t is the learning rate of the current iteration step, is the gradient direction with the reconstruction error of the input x and the reconstruction result as the loss function. After completion, the updated deep autoencoder model is obtained.

[0211] Step 5: input the SV data preprocessed in step 2 into the updated unsupervised learning deep autoencoder neural network model in step 4, output the anomaly detection result, and realize the safe anomaly detection of digital substation SV messages.

[0212] According to Figure 3The situation anomaly detection effect diagram shows the situation anomaly detection effect of the present application technology. Among the total of 650 test data, 225 pieces of situation anomaly data are included (accounting for 34.6%). The present application successfully detects all 225 pieces of true anomaly (zero missed detection), while detecting 2 pieces of false positives. The green waveform in the figure represents normal data, and the red waveform represents the detected anomaly data (including a small amount of model error on the left), and the overall accuracy reaches 99.69%.

[0213] Meanwhile, according to Figure 4 The autoencoder training loss diagram further confirms the efficiency and reliability of the model: the loss value quickly decreases and stabilizes after only about 15 rounds of training, indicating that the model can quickly and efficiently learn the core mode of the normal operation data of the power distribution network. This rapid convergence and excellent stability not only significantly reduces the time and computational cost of model training, but also ensures that the learned feature representation has good robustness, laying a solid foundation for subsequent high-precision and high-efficiency anomaly detection.

[0214] As Figure 1 shown, embodiment 2 of the present application provides a security anomaly detection system for digital substation SV messages, which runs a security anomaly detection method for digital substation SV messages as described in embodiment 1, including:

[0215] A data acquisition module is used to acquire SV message data in a digital substation;

[0216] A preprocessing module is used to perform real-time preprocessing on the acquired SV message data to obtain preprocessed SV data;

[0217] A model construction module is used to solve the reconstruction error of the preprocessed historical normal SV message features by an autoencoder, solve a dynamic threshold value according to the reconstruction error, perform unsupervised training with the goal of minimizing the reconstruction error, set the dynamic threshold value as the security anomaly criterion of unsupervised training for security anomaly detection, and construct a deep autoencoder neural network model of unsupervised learning;

[0218] A model updating module is used to receive new normal operating condition data and update the deep autoencoder neural network model of unsupervised learning;

[0219] An anomaly detection module is used to input the preprocessed SV data into the updated deep autoencoder neural network model of unsupervised learning to obtain an anomaly detection result.

[0220] In summary, the unsupervised learning method based on an autoencoder is used to effectively detect significant anomalies of unknown patterns in power distribution network operation data.

[0221] Compared with the prior art, the present application has at least the following beneficial effects:

[0222] The application establishes a dynamic threshold adaptive mechanism, updates statistical parameters μt and σt in real time through a sliding window, and sets the abnormality determination threshold as ε(t) = μt + λσt, since the threshold is not dependent on manual setting, but is driven by the latest reconstruction error statistics in the current window, so it can automatically drift with the data distribution changes caused by seasonal fluctuations of power grid load, power flow changes or topology reconstruction, adapt to changing environment, reduce false alarm problems caused by scene drift, and reduce the false alarm and missed alarm probability of IEC61850 digital substation;

[0223] Compared with the traditional method of using only reconstruction error as the discrimination method, the application adopts a heterogeneous feature tensor modeling, and captures the time sequence and spatial coupling structure through 1DCNN and BiLSTM, so as to improve the expression ability of the model to complex patterns; in the migration process, the bottom convolution layer is frozen, only the LSTM and the decoder are fine-tuned, and an unsupervised cosine annealing strategy is introduced for rapid incremental update, so that the model adapts to the new site operating conditions without abnormal labels, and this training strategy greatly reduces the migration cost and improves the practicability and adaptability of IEC61850 digital substation anomaly detection;

[0224] The application models the correlation between the power characteristics and the network characteristics of the digital substation as a whole, so that no abnormal label is needed in the training stage, only a few days of normal message data is needed, the model is automatically converged, and the difficulty of lack of SV abnormal samples is fundamentally solved, the multi-dimensional autoencoder model is used for unsupervised learning with zero label, and the system model is adaptively learned from the data of the normal operation day, the dependence on abnormal label data is eliminated, the efficient computing power of the edge GPU is used, the model reasoning delay is less than 0.5 milliseconds, which can meet the strict requirement of 4 millisecond closed-loop response of the relay protection system, and the FDIA and other unknown network attacks can be identified sensitively, quickly and accurately, the reliable action of the relay protection equipment in the digital substation and the stable operation of the smart grid system are ensured, and the reliability and stability of the IEC61850 digital substation operation are improved;

[0225] The application proposes a dynamic sampling mechanism, which reduces the sampling rate of 4000 frames per second (4kfps) SV message flow by 2:1, and can dynamically adjust the sampling ratio according to the computing resources, through this downsampling method, the communication bandwidth occupation and computing load are greatly compressed, while the key information such as power frequency signal and main harmonic component is still retained, the integrity of the required features for detection is ensured, and the accuracy of the IEC61850 digital substation message anomaly detection is improved.

[0226] The disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0227] It should be noted that the above-mentioned embodiments are only used to illustrate the technical solutions of the present application, not to limit it. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that the specific embodiments of the present application can be modified or equivalently replaced without departing from the spirit and scope of the present application. Any modification or equivalent replacement should be covered within the protection scope of the claims of the present application.

Claims

1. A method for detecting security anomaly of a digital substation (SV) packet, characterized in that, The method comprises the following steps: collecting SV message data in a digital substation; performing real-time preprocessing on the collected SV message data to obtain preprocessed SV data; solving reconstruction error of preprocessed historical normal SV message features by a self-encoder, solving a dynamic threshold value according to the reconstruction error, performing unsupervised training with the minimum reconstruction error as an objective, setting the dynamic threshold value as a safety anomaly criterion of the unsupervised training to perform safety anomaly detection, and constructing a deep self-encoder neural network model of unsupervised learning; receiving new normal operating condition data, and updating the deep self-encoder neural network model of unsupervised learning; inputting the preprocessed SV data into the updated deep self-encoder neural network model of unsupervised learning to obtain an anomaly detection result.

2. The safety anomaly detection method for SV messages of a digital substation according to claim 1, wherein the real-time preprocessing of the collected SV message data comprises: performing time reference and synchronization on the collected SV messages, aligning time stamps of all channels, and obtaining time-aligned SV messages; segmenting the time-aligned SV messages according to a set window length and sliding step through a sampling window strategy; performing dynamic sampling and caching on the segmented SV messages, and performing quality optimization on the cached SV messages; identifying and removing impulse noise and burrs from the optimized SV messages by using a density clustering algorithm to obtain denoised SV messages; standardizing the denoised SV messages, reducing the dimension of the standardized SV messages, and obtaining preprocessed SV messages.

3. The safety anomaly detection method for SV messages of a digital substation according to claim 2, wherein the dynamic sampling comprises: when the GPU utilization is lower than a first threshold value and there is no backlog in the inference queue, determining that the current state is a resource sufficient state, and the system performs sparse sampling according to a first proportion; when the GPU utilization exceeds a second threshold value or the backlog length of the inference queue exceeds a set value, determining that the current state is a resource shortage state, and the system automatically adjusts the sampling ratio to a second proportion; when the GPU utilization exceeds a third threshold value or the system triggers a resource bottleneck, determining that the current state is a resource overload state, and the system automatically adjusts the sampling ratio to a third proportion.

4. The safety anomaly detection method for SV messages of a digital substation according to claim 3, wherein when the output frame rate after sampling according to the sampling ratio is lower than the minimum value specified by the Nyquist theorem, the system automatically limits the output frame rate to the minimum value specified by the Nyquist theorem.

5. The safety anomaly detection method for SV messages of a digital substation according to claim 1, wherein the solving of the reconstruction error comprises: the self-encoder maps the preprocessed historical normal SV message features to a lower dimension through an encoder, reconstructs the mapped data using a decoder to obtain reconstructed data; the reconstructed data is regularized in a BatchNorm layer to obtain regularized reconstructed data; the reconstruction error is calculated according to the regularized reconstructed data and the preprocessed historical normal SV message features to obtain a reconstruction error sequence. ​ ​ ​ ​ 6. The method of claim 5, wherein the autoencoder is configured to: map the preprocessed historical normal SV message features to a lower dimension space by an encoder; and reconstruct the mapped data by a decoder.

7. The method of claim 1, wherein the solving the dynamic threshold comprises: calculating a sliding mean and a standard deviation of the reconstruction error in a sliding window within a set time in the reconstruction error sequence; and obtaining the dynamic threshold by multiplying the standard deviation by a set threshold coefficient and adding the sliding mean.

8. The method of claim 1, wherein the setting the dynamic threshold as the criterion for the unsupervised training of the security anomaly comprises: determining a mild abnormal condition when the reconstruction error is greater than the dynamic threshold and less than A times the dynamic threshold, triggering an alarm, and displaying an alarm type in a color corresponding to the mild abnormal condition; determining a general abnormal condition when the reconstruction error is greater than A times the dynamic threshold and less than B times the dynamic threshold, triggering an alarm, and displaying an alarm type in a color corresponding to the general abnormal condition; and determining a serious abnormal condition when the reconstruction error is greater than B times the dynamic threshold, triggering an alarm, and displaying an alarm type in a color corresponding to the serious abnormal condition.

9. The method of claim 1 or 6, wherein the receiving new normal condition data and updating the unsupervised learning deep autoencoder neural network model comprises: solving an optimal learning rate of the training by using a cosine annealing learning rate restart strategy in each training batch; and freezing the convolution kernel weights of the one-dimensional convolutional neural network layer and the statistics parameters of the BatchNorm layer in the filter after receiving the new normal condition data, unfreezing the weight parameters of the bidirectional long short-term memory neural network layer and the inverse convolution layer of the decoder, and updating the weight parameters of the bidirectional long short-term memory neural network layer and the inverse convolution layer of the decoder according to the optimal learning rate of the training.

10. The method of claim 1, comprising: a data acquisition module configured to acquire SV message data in a digital substation; and a preprocessing module configured to perform real-time preprocessing on the acquired SV message data to obtain preprocessed SV data. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ 10. A system for detecting security anomalies in digital substation (SV) messages, which implements the method for detecting security anomalies in digital substation (SV) messages according to any one of claims 1-9, characterized in that, ​ ​ ​ The model construction module is configured to solve a reconstruction error of historical normal SV packet features after preprocessing by using a self-encoder, solve a dynamic threshold value based on the reconstruction error, perform unsupervised training with a minimum reconstruction error as a target, set the dynamic threshold value as a safety anomaly criterion of the unsupervised training, perform safety anomaly detection, and construct a deep self-encoder neural network model of unsupervised learning. The model updating module is configured to receive new normal working condition data, and update the deep self-encoder neural network model of unsupervised learning. The anomaly detection module is configured to input the preprocessed SV data into the updated deep self-encoder neural network model of unsupervised learning, and obtain an anomaly detection result.

Images