PMU encrypted communication exception self-healing method and system based on protocol stack state machine learning

Abstract

This application relates to a PMU encrypted communication anomaly self-healing method, system, computer device, and storage medium based on protocol stack state machine learning. The method includes: when PMU encrypted communication transmits data at a preset fixed frame rate, extracting message length and arrival time to generate a protocol stack state feature sequence; constructing a baseline model based on the statistical distribution of normal states; calculating the deviation of the real-time feature sequence relative to the baseline model using a sliding window; when the deviation exceeds a threshold, comparing the dual-end encryption policy parameters to obtain a consistency judgment result; jointly analyzing the deviation and consistency results to distinguish the anomaly type; if the anomaly type is tunnel dead, sending a key exchange protocol deletion message and reconstructing the security association; if it is policy mismatch, issuing a policy correction command through the northbound interface and triggering key renegotiation. This application can distinguish the root cause of encrypted communication anomalies and repair them specifically, improving the repair efficiency of encrypted communication anomalies and the continuity of data transmission.

Description

Technical Field

[0001] This application relates to the field of power dispatch data network security technology, and in particular to a PMU encrypted communication anomaly self-healing method, system, computer equipment and storage medium based on protocol stack state machine learning. Background Technology

[0002] The Synchronous Phasor Measurement Unit (PMU) is the core equipment of a wide-area measurement system. Synchronous phasor measurement data acquired by the plant-side PMU needs to be transmitted to the master station in real time via an encrypted communication link at a preset fixed frame rate. In actual operation of PMU encrypted communication, the encrypted tunnel may experience abnormal interruptions, leading to data transmission failures. Existing technologies typically locate faults by detecting abnormal protocol stack states or comparing encryption policy configurations. However, single-dimensional detection methods are insufficient to accurately determine the root cause of the anomaly; that is, they cannot distinguish whether the anomaly is due to tunnel deadlock (security association timeout or negotiation deadlock) or inconsistency in the dual-end encryption policy parameter configurations. Maintenance personnel need to investigate both possibilities one by one, resulting in lengthy fault location and repair times, affecting the continuity and reliability of PMU data. Summary of the Invention

[0003] Therefore, it is necessary to provide a PMU encrypted communication anomaly self-healing method, system, computer device, and storage medium based on protocol stack state machine learning, which can distinguish the root causes of encrypted communication anomalies and perform targeted repairs, in order to address the above-mentioned technical problems.

[0004] Firstly, this application provides a self-healing method for PMU encrypted communication anomalies based on protocol stack state machine learning. The method includes: Under the condition that PMU encrypted communication continuously transmits synchronous phasor measurement data at a preset fixed frame rate, the message length and message arrival time in the encrypted data stream are extracted to generate a protocol stack state feature sequence. Based on the statistical distribution characteristics of the protocol stack state feature sequence under normal conditions, a statistical baseline model of protocol stack behavior is constructed. The real-time protocol stack state feature sequence is collected using a sliding time window method, and the deviation of the real-time protocol stack state feature sequence from the baseline model is calculated. When the deviation exceeds a preset deviation threshold, the encryption strategy parameters of the local encryption device and the peer encryption device are obtained and compared to obtain the strategy consistency judgment result. The deviation and the policy consistency determination results are analyzed together to distinguish the anomaly type as tunnel dead or policy mismatch. When the tunnel is determined to be dead, a key exchange protocol deletion message is sent to the peer encryption device and the security association is rebuilt. When the policy is determined to be mismatched, a policy correction instruction is sent to the encryption device with inconsistent policies through the northbound interface and key renegotiation is triggered.

[0005] In one embodiment, the construction of the protocol stack behavior statistical baseline model includes: During a continuous period when the PMU encrypted communication is in normal communication state, samples of the encrypted data stream are collected at a sampling period synchronized with the preset fixed frame rate; Extract the sample message length and sample message arrival time of each encrypted message from the sample, calculate the arrival time interval between adjacent encrypted messages, and obtain the sample message length sequence and sample message arrival interval sequence; The sample message length sequence is subjected to statistical distribution fitting to obtain the mean message length and standard deviation of message length; The arrival interval sequence of the sample messages is statistically fitted to obtain the mean and standard deviation of the arrival interval. The mean message length, the standard deviation of message length, the mean arrival interval, and the standard deviation of arrival interval are stored as parameters of the baseline model.

[0006] In one embodiment, calculating the deviation of the real-time protocol stack state feature sequence relative to the baseline model includes: Using a preset fixed-duration sliding time window as a unit, the real-time message length sequence and the real-time message arrival interval sequence within the current sliding time window are collected, wherein the duration of the sliding time window is an integer multiple of the period corresponding to the preset fixed frame rate; Calculate the absolute value of the length difference between the sample mean of the real-time message length sequence and the average message length, and the absolute value of the interval difference between the sample mean of the real-time message arrival interval sequence and the average arrival interval. Divide the absolute value of the length difference by the standard deviation of the message length to obtain the message length deviation index; Divide the absolute value of the interval difference by the standard deviation of the arrival interval to obtain the arrival interval deviation index; The deviation degree is obtained by weighting and summing the message length deviation index and the arrival interval deviation index according to a preset weight.

[0007] In one embodiment, the joint analysis of the deviation and the policy consistency determination result, distinguishing the anomaly type as tunnel dead or policy mismatch, includes: When the deviation exceeds the preset deviation threshold and the strategy consistency determination result is consistent, the anomaly type is determined to be tunnel dead. When the deviation exceeds the preset deviation threshold and the policy consistency determination result is inconsistent, the anomaly type is determined to be policy mismatch.

[0008] In one embodiment, the step of obtaining and comparing the encryption policy parameters of the local encryption device and the remote encryption device to obtain a policy consistency determination result includes: The encryption policy parameters of the local encryption device are compared with the encryption policy parameters of the peer encryption device item by item. When all the values ​​of the encryption policy parameters in the local encryption device are the same as the values ​​in the peer encryption device, the policy consistency determination result is determined to be consistent; otherwise, the policy consistency determination result is determined to be inconsistent.

[0009] In one embodiment, the step of sending a key exchange protocol deletion message to the peer encryption device and rebuilding the security association when the tunnel is determined to be dead includes: The local encryption device sends a key exchange protocol deletion message to the peer encryption device via the control link of the local encryption device, wherein the key exchange protocol deletion message carries an identifier of the security association to be deleted; After receiving the confirmation message returned by the peer encryption device, the security association to be deleted stored in the local security association database is cleared; A new key exchange protocol negotiation process is initiated with the peer encryption device. During the new key exchange protocol negotiation process, a security association is re-established, and after the new security association is established, the data transmission of the PMU encrypted communication is resumed.

[0010] In one embodiment, when a policy mismatch is determined, issuing a policy correction command to the policy-inconsistent encryption device via the northbound interface and triggering key renegotiation includes: Based on the policy consistency determination result, the target encryption device with policy inconsistency and the inconsistent encryption policy parameter items are determined. Generate a policy correction instruction message, the policy correction instruction message including the correction value corresponding to the inconsistent encryption policy parameter item; The policy correction instruction message is sent to the target encryption device through the northbound interface; After the target encryption device updates its encryption policy configuration according to the policy correction instruction message, it triggers the other encryption device in the PMU encryption communication link corresponding to the target encryption device to perform key renegotiation.

[0011] Secondly, this application also provides a PMU encrypted communication anomaly self-healing system based on protocol stack state machine learning. The system includes: The feature extraction module is used to extract the message length and message arrival time in the encrypted data stream under the condition that the PMU encrypted communication continuously transmits synchronous phasor measurement data at a preset fixed frame rate, and generate a protocol stack state feature sequence. The model building module is used to build a statistical baseline model of protocol stack behavior based on the statistical distribution characteristics of the protocol stack state feature sequence under normal conditions. The consistency judgment module is used to collect real-time protocol stack state feature sequences in a sliding time window manner, calculate the deviation of the real-time protocol stack state feature sequences from the baseline model; when the deviation exceeds a preset deviation threshold, the encryption strategy parameters of the local encryption device and the peer encryption device are obtained and compared to obtain the strategy consistency judgment result. An anomaly differentiation module is used to jointly analyze the deviation and the strategy consistency determination result to differentiate the anomaly type as tunnel dead or strategy mismatch. The repair execution module is used to send a key exchange protocol deletion message to the peer encryption device and rebuild the security association when the tunnel is determined to be dead; and to issue a policy correction instruction to the encryption device with inconsistent policies through the northbound interface and trigger key renegotiation when the policy is determined to be mismatched.

[0012] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the aforementioned PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning.

[0013] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the aforementioned PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning.

[0014] The aforementioned PMU encrypted communication anomaly self-healing method, system, computer equipment, and storage medium based on protocol stack state machine learning constructs a protocol stack state feature sequence by extracting message length and message arrival time from the encrypted data stream. It then establishes a behavioral baseline model based on the statistical distribution under normal conditions and calculates real-time deviation using a sliding time window, achieving sensitive detection of encrypted communication behavior anomalies. Furthermore, when the deviation exceeds a preset threshold, it further acquires and compares the encryption policy parameters of the local and remote encryption devices. By jointly analyzing the deviation and policy consistency judgment results, it accurately distinguishes between anomaly types such as tunnel dead or policy mismatch, avoiding misjudgments caused by single-dimensional detection. Differentiated repair actions are executed for each anomaly type: in the case of tunnel dead, a key exchange protocol deletion message is sent and the security association is rebuilt; in the case of policy mismatch, a policy correction command is issued through the northbound interface and key renegotiation is triggered. This avoids the repeated interruptions or repair failures caused by mismatch between repair actions and the root cause of the anomaly in traditional repair methods, improving the repair efficiency of PMU encrypted communication anomalies and the continuity of data transmission. Attached Figure Description

[0015] Figure 1 This is an application environment diagram of a PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning in one embodiment. Figure 2 This is a flowchart illustrating a PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning in one embodiment. Figure 3 This is a flowchart illustrating the process of constructing a protocol stack behavior statistical baseline model in one embodiment; Figure 4 This is a block diagram of a PMU encrypted communication anomaly self-healing system based on protocol stack state machine learning in one embodiment. Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. First, to facilitate understanding of the technical solutions provided by the embodiments of this application, the background technology involved in the embodiments of this application will be described below.

[0017] Synchronous phasor measurement units (PMUs) are the core sensing devices in wide-area measurement systems. Deployed at the plant / station level, PMUs continuously collect synchronous phasor measurement data at a preset fixed frame rate (e.g., 25, 30, or 50 frames per second, synchronized with the power system's power frequency) and transmit this data in real-time to the dispatch center at the master station via an encrypted communication link. To ensure data transmission security, an encrypted tunnel is typically established between the plant / station encryption device and the master station encryption device, using the IPSec protocol to encapsulate and protect the PMU data stream. In actual operation of PMU encrypted communication, this encrypted link may experience abnormal interruptions, manifesting as the master station's inability to properly receive or parse PMU data frames, thus affecting the situational awareness capabilities of the wide-area measurement system.

[0018] There are two main types of root causes for abnormal interruptions in PMU encrypted communication: The first type is tunnel deadlock, which occurs when the encrypted tunnel is normally connected at the underlying network link and IP layer, but due to Security Association (SA) timeout, session ticket expiration, or the IKE key negotiation process getting stuck, the encrypted message cannot be correctly decrypted and processed by the peer end; The second type is policy mismatch, which occurs when the encryption device at the plant end and the encryption device at the master end are configured inconsistently in terms of encryption policy parameters (such as encryption algorithm suite, SA lifecycle, forward security flag, etc.), causing the encrypted tunnel to fail to establish or message encryption / decryption verification to fail.

[0019] To address the aforementioned anomalies, existing technologies typically employ two separate detection methods: one is based on protocol stack behavior characteristics, which analyzes statistical features such as message length and arrival intervals in the encrypted data stream to determine if communication deviates from normal patterns; the other is based on policy configuration comparison, which checks for inconsistencies by reading the policy parameters of the dual-end encryption devices. However, these two detection methods operate independently and lack a fusion analysis mechanism. Specifically, protocol stack behavior-based detection can detect communication behavior anomalies (i.e., increased deviation), but it cannot distinguish whether the anomaly is caused by tunnel deadlock or policy mismatch; while policy comparison can detect configuration inconsistencies, but it cannot detect tunnel deadlock occurring when the configuration is consistent. Therefore, when encrypted communication anomalies occur, maintenance personnel often need to perform both protocol stack status diagnosis and policy configuration comparison operations sequentially to eliminate both possibilities one by one, resulting in a lengthy fault location time. More importantly, the repair methods corresponding to different root causes are fundamentally different: tunnel deadlock requires resetting the security association and rebuilding the tunnel, while policy mismatch requires correcting configuration parameters and triggering key renegotiation. If a one-size-fits-all tunnel reset operation is used to deal with policy mismatch, the rebuilt tunnel will still be interrupted again due to policy inconsistency because the root problem is not solved. Conversely, if an attempt is made to solve the tunnel deadlock by policy correction, it will not play any repair role.

[0020] Based on this, this embodiment provides a PMU encrypted communication anomaly self-healing method, system, computer device and storage medium based on protocol stack state machine learning. It aims to accurately distinguish between two types of anomalies, namely tunnel dead and policy mismatch, through joint analysis of protocol stack state characteristics and encryption policy parameters, and to perform targeted repair actions for each, thereby overcoming the technical defects of low fault location efficiency and mismatched repair actions in the prior art.

[0021] The PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning provided in this application embodiment can be applied to, for example... Figure 1The application environment shown includes two peers in an encrypted communication scenario: a local encryption device and a peer encryption device, which communicate through a power dispatch data network. Taking the substation encryption device 102 as the local encryption device and the master station encryption device 104 as the peer encryption device as an example, the substation encryption device 102 is deployed at the substation or power plant side to receive synchronization phasor measurement data from the synchronization PMU, encrypts and encapsulates it according to a preset fixed frame rate, and continuously transmits it uplink to the master station encryption device 104 through an IPSec tunnel. The master station encryption device 104 is deployed at the dispatch center or centralized control station side to decrypt and forward the PMU data to the dispatch master station system. The method described in this application embodiment can be executed on the substation encryption device 102, the master station encryption device 104, or by an independent network management server. The data storage system is used to store data such as protocol stack state feature sequences, protocol stack behavior statistical baseline model parameters, encryption strategy parameters, and operation logs. This data storage system can be integrated into the factory-side encryption device 102 or the master-side encryption device 104, or it can be deployed independently on a cloud server or a dedicated storage node. It should be noted that... Figure 1 The plant-side encryption device 102 and the master-side encryption device 104 described are merely examples. In actual deployments, the plant-side encryption device 102 can be an industrial-grade VPN gateway, an encrypted router, or a data acquisition terminal with integrated encryption functions, while the master-side encryption device 104 can be a high-performance encryption server, an encryption gateway cluster, or a virtualized network security device, as long as it supports the IPSec protocol and the IKE key negotiation mechanism. Those skilled in the art should understand that the above application environment does not constitute a limitation on the scope of protection of this application.

[0022] Firstly, in the actual operation of PMU encrypted communication, the encrypted tunnel may experience abnormal interruptions, causing the master station to be unable to receive synchronization phasor measurement data normally. Existing technologies either only detect abnormal protocol stack behavior without identifying the root cause, or only compare policy configurations without detecting tunnel deadlock, resulting in low efficiency in fault location and repair. Therefore, in one embodiment, such as... Figure 2 As shown, a self-healing method for PMU encrypted communication anomalies based on protocol stack state machine learning is provided, and this method is applied to... Figure 1 Taking the network management server in the example, the explanation includes: Step S1: Under the condition that the PMU encrypted communication continuously transmits synchronous phasor measurement data at a preset fixed frame rate, extract the message length and message arrival time in the encrypted data stream to generate a protocol stack state feature sequence. Step S2: Based on the statistical distribution characteristics of the protocol stack state feature sequence under normal conditions, construct a statistical baseline model of protocol stack behavior; Step S3: Collect the real-time protocol stack state feature sequence using a sliding time window method, and calculate the deviation of the real-time protocol stack state feature sequence from the baseline model; when the deviation exceeds the preset deviation threshold, obtain and compare the encryption strategy parameters of the local encryption device and the peer encryption device to obtain the strategy consistency judgment result. Step S4: Jointly analyze the deviation and policy consistency determination results to distinguish between the anomaly type as tunnel dead or policy mismatch; when it is determined to be tunnel dead, send a key exchange protocol deletion message to the peer encryption device and rebuild the security association; when it is determined to be policy mismatch, issue a policy correction command to the encryption device with inconsistent policies through the northbound interface and trigger key renegotiation.

[0023] In practical implementation, the preset fixed frame rate refers to the fixed frequency at which the PMU device outputs synchronized phasor measurement data to the encryption device. Typical values ​​are 25, 30, or 50 frames per second, and this frame rate is synchronized with the power system's power frequency. PMU encrypted communication typically uses the national cryptographic protocol IPSec to encapsulate and protect the original PMU data frames, generating ESP encapsulated messages. Without decryption, the following information is extracted from each ESP encapsulated message: message length, obtained by reading the frame length field provided by the network card driver, which indicates the number of bytes in the entire Ethernet frame; message arrival time, obtained through the network card hardware timestamp or the SO_TIMESTAMP mechanism provided by the operating system kernel, with an accuracy of at least milliseconds, used for subsequent calculation of message arrival intervals. Simultaneously, the security parameter index field and sequence number field in the ESP message header are read, which can be used for subsequent security association identification and management.

[0024] To generate the protocol stack state feature sequence, the message lengths of multiple consecutive encrypted messages are arranged in chronological order to form a message length sequence; the differences in arrival times of adjacent messages are arranged in chronological order to form a message arrival interval sequence. These two sequences together constitute the protocol stack state feature sequence.

[0025] The protocol stack behavior statistical baseline model is used to describe the statistical regularity of PMU encrypted communication under normal conditions. Its construction method can employ any of the existing technologies, such as a parameterized statistical model based on normal distribution, a nonparametric model based on kernel density estimation, or a predictive model based on time series analysis. This embodiment does not limit this approach. The baseline model is stored in local memory and used for subsequent calculation of real-time deviation.

[0026] The deviation can be calculated using any of a variety of sliding window statistical methods, such as Euclidean distance based on the mean, multivariate deviation based on Mahalanobis distance, or deviation index based on cumulative sum, etc. This embodiment does not limit this method. The preset deviation threshold can be determined through offline training or on-site debugging, for example, by using the 3σ principle in statistics or the percentile method based on historical data.

[0027] When the deviation exceeds a preset deviation threshold, a policy consistency determination is triggered. The encryption policy parameters of the local encryption device can be directly read by calling the local configuration management interface; the encryption policy parameters of the peer encryption device can be obtained through parsing the SA payload exchanged during IKE negotiation, or queried from the network management system via the northbound interface. The encryption policy parameters of the local and peer devices are compared. The specific comparison rules can employ item-by-item exact matching or fuzzy matching with allowed tolerance ranges; this embodiment does not limit this. The policy consistency determination result is "consistent" or "inconsistent".

[0028] The method of jointly analyzing deviation and policy consistency determination results to distinguish anomaly types can employ any of a variety of decision-making mechanisms, such as decision trees based on rule engines, probabilistic models based on Bayesian classification, or classifiers based on support vector machines. This embodiment does not limit this approach. For example, a feasible implementation is: when the deviation exceeds a threshold and the policy is consistent, it is determined to be a tunnel deadlock; when the deviation exceeds a threshold and the policy is inconsistent, it is determined to be a policy mismatch.

[0029] Based on the judgment results, perform differentiated repair actions: For tunnel deadlock, send a key exchange protocol deletion message to the peer encryption device and rebuild the security association. The specific message format and negotiation process can adopt the method defined in the IKEv2 protocol standard; For policy mismatch, issue a policy correction command to the encryption device with inconsistent policies through the northbound interface and trigger key renegotiation. The northbound interface follows the general technical specifications for smart IoT gateways in power systems (such as T / CES 271-2024).

[0030] PMU encrypted communication has fixed frame rate periods and message length characteristics, which constitute a predictable protocol stack state machine. When the encrypted tunnel is working normally, the statistical distribution of message length and arrival interval remains stable; when the tunnel malfunctions (whether due to a deadlock or policy mismatch), these statistical characteristics will deviate detectably. Based on the above, this embodiment first utilizes this physical law to construct a state feature sequence by extracting message length and arrival time, and establishes a statistical baseline model under normal conditions, quantifying the boundaries of normal communication behavior. When real-time communication behavior deviates from the baseline model, simply relying on behavior detection cannot distinguish whether the root cause of the deviation is an abnormal state inside the tunnel or an inconsistent configuration policy; this embodiment uses a comparison mechanism of encryption policy parameters. The encryption policy parameters determine the establishment and operation rules of the encrypted tunnel, and their consistency is a prerequisite for the normal operation of the tunnel; by jointly analyzing the two dimensions of behavior deviation and policy consistency, the root cause of the anomaly can be distinguished. This two-dimensional joint analysis solves the defect of traditional methods that cannot distinguish between tunnel deadlock and policy mismatch. Based on the accurate differentiation of root causes, this embodiment further performs differentiated repair actions: the essence of tunnel dead is the failure of security association or the dead negotiation process, so it is necessary to clear the old security association and rebuild it; the essence of policy mismatch is the conflict of configuration parameters, so it is necessary to correct the configuration and trigger renegotiation; these two repair actions target different failure mechanisms, avoiding the problems caused by directly resetting the tunnel.

[0031] Therefore, this embodiment forms a complete closed loop from detection and differentiation to targeted repair through joint analysis and differentiated repair, thereby improving the self-healing efficiency and reliability of PMU encrypted communication.

[0032] When constructing a protocol stack behavior statistical baseline model, if the sampling period is not synchronized with the fixed frame rate of PMU communication, the collected samples will not accurately reflect the periodic characteristics, thereby reducing the accuracy of the baseline model. Therefore, in one embodiment, a protocol stack behavior statistical baseline model is constructed, such as... Figure 3 As shown, it includes: During a continuous period when the PMU encrypted communication is in normal communication mode, samples of the encrypted data stream are collected at a sampling period synchronized with a preset fixed frame rate. Extract the sample message length and arrival time of each encrypted message from the sample, calculate the arrival time interval between adjacent encrypted messages, and obtain the sample message length sequence and sample message arrival interval sequence; Statistical distribution fitting is performed on the sample message length sequence to obtain the mean and standard deviation of message length; statistical distribution fitting is performed on the sample message arrival interval sequence to obtain the mean and standard deviation of arrival interval. The mean message length, standard deviation of message length, mean arrival interval, and standard deviation of arrival interval are stored as parameters of the baseline model.

[0033] In specific implementation, the criteria for determining normal communication status may include at least one of the following: the IPSec tunnel between the local encryption device and the peer encryption device is in the "established" state and the duration exceeds a preset stable duration (e.g., 10 minutes); the master station continuously receives valid PMU data frames without verification errors; and there are no policy change operation records in the system log. Training samples are collected within a continuous time period that meets the above conditions.

[0034] The sampling period synchronized with the preset fixed frame rate refers to: if the preset fixed frame rate is (Unit: frames / second), then the sampling period It should be set to Integer multiples of, i.e. ,in It is a positive integer. It is usually taken as... This means the sampling period equals the frame rate period, ensuring that exactly one encrypted message is captured within each sampling period. In actual PMU communication, typical frame rates are 25 frames / second, 30 frames / second, or 50 frames / second, corresponding to sampling periods of 40 milliseconds, 33.33 milliseconds, or 20 milliseconds, respectively.

[0035] The arrival time interval between adjacent messages is the difference between the arrival time of the next message and the arrival time of the previous message. N messages are collected consecutively (N is usually greater than 1000 to ensure statistical significance) to obtain the sample message length sequence and the sample message arrival interval sequence.

[0036] When performing statistical distribution fitting on the sample message length sequence, it is assumed that it follows a normal distribution, and the mean and standard deviation of the message length are calculated. Statistical distribution fitting is also performed on the sample message arrival interval sequence, and the mean and standard deviation of the arrival interval are calculated. The specific calculation method for statistical distribution fitting can be any of the existing technologies, such as the method of moments or the maximum likelihood estimation method; this embodiment does not limit this approach.

[0037] The above four statistics are used as parameters of the baseline model and stored in the non-volatile memory of the local encryption device. During the operation of PMU encrypted communication, if a significant change in the communication mode is detected (such as frame rate adjustment or PMU device replacement), the baseline model can be retrained, that is, samples under normal conditions are re-collected and the above parameters are updated.

[0038] One of the core characteristics of PMU encrypted communication is its strict periodicity: the PMU device generates data frames at a fixed frame rate, encrypts them, and sends them at the same rate. Theoretically, the message arrival interval under normal conditions should be a constant value (equal to the reciprocal of the frame rate period), and the message length is also essentially constant (depending on the original PMU frame length plus ESP encapsulation overhead). This characteristic makes statistical distribution fitting an effective tool for quantifying the boundaries of normal behavior. Based on the above, this embodiment ensures that exactly one encrypted message is collected within each sampling period by synchronizing the sampling period with the fixed frame rate, thereby eliminating phase errors caused by misaligned sampling times. If the sampling period is not synchronized with the frame rate period, for example, if the sampling period is slightly longer than the frame rate period, some sampling windows may not collect messages or may collect two messages, resulting in false arrival interval jitter in the sample sequence, which in turn distorts statistical parameters (especially the standard deviation). Synchronized sampling avoids this problem, allowing the sample message length sequence and arrival interval sequence to truly reflect the inherent laws of PMU communication. Based on this, normal distribution fitting is performed on the length sequence and the interval sequence respectively, and the mean and standard deviation are calculated. The mean reflects the typical value under normal conditions, and the standard deviation reflects the normal fluctuation range. These two statistics together constitute the baseline model, providing a normalized benchmark for subsequent deviation calculation. Compared with directly using the original feature values, the statistical description using the mean and standard deviation has stronger robustness: even if the frame rate or message length of the PMU device changes legally due to configuration changes, it can be adaptively updated by retraining the baseline model without modifying the algorithm logic.

[0039] Therefore, this embodiment constructs an accurate and robust statistical baseline model of protocol stack behavior through synchronous sampling and statistical distribution fitting, providing a reliable foundation for subsequent anomaly detection.

[0040] In real-time deviation calculation, if the duration of the sliding time window is not aligned with the fixed frame rate period of PMU communication, it will cause fluctuations in the number of packets collected within the window, thus affecting the stability of the deviation calculation. Therefore, in one embodiment, calculating the deviation of the real-time protocol stack state feature sequence relative to the baseline model includes: Using a preset fixed-duration sliding time window as a unit, the real-time message length sequence and real-time message arrival interval sequence within the current sliding time window are collected, wherein the duration of the sliding time window is an integer multiple of the period corresponding to the preset fixed frame rate; Calculate the absolute value of the length difference between the sample mean of the real-time message length sequence and the message length mean, and the absolute value of the interval difference between the sample mean of the real-time message arrival interval sequence and the arrival interval mean. The message length deviation index is obtained by dividing the absolute value of the length difference by the standard deviation of the message length; the arrival interval deviation index is obtained by dividing the absolute value of the interval difference by the standard deviation of the arrival interval. The message length deviation index and the arrival interval deviation index are weighted and summed according to preset weights to obtain the deviation degree, where the preset weights are determined based on the protocol characteristics of PMU communication.

[0041] In the specific implementation, the period corresponding to the preset fixed frame rate is: Duration of the sliding time window Set as Integer multiples of, i.e. ,in It is a positive integer. Typically, it can be 5 or 10, so that each window contains 5 or 10 encrypted messages. The sliding step size can be set to... This enables real-time detection of each newly arriving message.

[0042] Let the total number of samples collected within the current sliding time window be... Each encrypted message is processed to obtain a real-time message length sequence and a real-time message arrival interval sequence. Pre-stored message length mean, message length standard deviation, arrival interval mean, and arrival interval standard deviation are read from the baseline model. The message length deviation index is calculated as the absolute value of the difference between the sample mean of the real-time message length sequence and the actual message length mean, divided by the message length standard deviation. The arrival interval deviation index is calculated as the absolute value of the difference between the sample mean of the real-time message arrival interval sequence and the actual arrival interval mean, divided by the arrival interval standard deviation. When the standard deviation is zero (theoretically possible when all samples are exactly equal), to avoid division by zero errors, the deviation index can be directly set to a preset maximum value (e.g., 100) or other fallback strategies can be used.

[0043] When calculating the overall deviation, the preset weights ensure that the sum of the two is 1. The preset weights are determined based on the protocol characteristics of PMU communication: in PMU encrypted communication, the message length is usually a fixed value, while the message arrival interval may fluctuate slightly due to network jitter; therefore, a higher weight can be assigned to the message length deviation exponent; or the optimal weight allocation can be determined through offline testing based on actual operational experience. This embodiment does not limit the specific weight values.

[0044] In real-time anomaly detection, it is necessary to determine in a timely and accurate manner whether the current communication behavior deviates from the normal pattern. The sliding time window is a commonly used online detection mechanism, the core of which lies in the fact that the statistical characteristics of the samples within the window can represent the current short-term communication state. Based on this, this embodiment first sets the duration of the sliding time window to an integer multiple of the frame rate period, ensuring that each window contains a complete integer number of packets corresponding to frame periods. If the window duration is not an integer multiple of the frame rate period, for example, if the window boundary falls exactly between two packets, the number of packets collected by different windows may differ by one, leading to increased fluctuations in the mean of samples within the window and resulting in a false increase in the deviation. By aligning the window duration with the frame rate period, this boundary effect is eliminated, making the deviation calculation more stable. Secondly, this embodiment employs a deviation index calculation method based on standard deviation normalization. Since message length and arrival interval have different dimensions (length in bytes, time in milliseconds), directly calculating the absolute value of the difference cannot be used for fusion and comparison. By dividing by their respective standard deviations, the two features are transformed into dimensionless deviation indices, representing the multiple of the current mean relative to the normal fluctuation range. For example, a message length deviation index of 3 indicates that the average message length within the current window deviates from the normal mean by 3 times the standard deviation, which is statistically a low-probability event, indicating an abnormal state. Furthermore, this embodiment performs a weighted sum of the two deviation indices. The weights are determined based on the protocol characteristics of PMU communication. In PMU encrypted communication, message length is usually strictly fixed, while arrival interval may experience random jitter due to network queuing delays. Therefore, message length deviation has higher diagnostic value than arrival interval deviation. If the message length changes, it usually indicates an anomaly in the PMU data frame itself or an encapsulation error, rather than simple network congestion. By assigning a higher weight to the message length deviation index, the sensitivity and accuracy of anomaly detection can be improved.

[0045] Therefore, this embodiment constructs a stable, accurate, and quantifiable deviation calculation model through window alignment, normalization, and weighted fusion, providing reliable input for subsequent anomaly detection and root cause differentiation.

[0046] When jointly analyzing the deviation and policy consistency determination results, the lack of clear distinction rules can lead to ambiguity in anomaly type identification, affecting the accuracy of subsequent repair actions. Therefore, in one embodiment, the joint analysis of deviation and policy consistency determination results distinguishes between anomaly types such as tunnel deadlock or policy mismatch, including: When the deviation exceeds the preset deviation threshold and the strategy consistency determination result is consistent, the abnormal type is determined to be tunnel dead. When the deviation exceeds the preset deviation threshold and the policy consistency determination result is inconsistent, the anomaly type is determined to be policy mismatch.

[0047] In the specific implementation, the preset deviation threshold for the deviation degree is denoted as... The result of the strategy consistency determination is denoted as... The value can be either "consistent" or "inconsistent". The decision logic is as follows: like and If the result is "consistent", the anomaly type is determined to be tunnel dead. This means that the communication behavior has deviated from the normal mode, but the encryption policy configurations on both ends are completely consistent. Therefore, the cause of the anomaly is not a policy configuration problem, but a problem with the encrypted tunnel itself, such as security association timeout, IKE negotiation dead, or session ticket failure.

[0048] like and If the result is "inconsistent," the anomaly type is determined to be policy mismatch. This means that the communication behavior deviates from the normal pattern, and there are differences in the encryption policy configurations at both ends. Therefore, the root cause of the anomaly is policy mismatch, which leads to the inability to establish an encrypted tunnel or the failure of message encryption and decryption.

[0049] like In this case, regardless of the consistency of the strategy, the exception handling process will not be triggered because the communication behavior is within the normal range.

[0050] Based on the above, this embodiment constructs a two-dimensional decision matrix to jointly analyze the deviation detection results and policy consistency comparison results. From a causal perspective, there are two possible causes for encrypted communication anomalies (deviation exceeding the threshold): abnormal internal tunnel status or policy configuration conflicts. These two causes are not mutually exclusive, but in actual operation and maintenance, policy mismatch will lead to the inability to establish a tunnel or failure of message encryption and decryption, which is inevitably accompanied by inconsistency between the two ends' policies; while tunnel deadness may occur when the policies are consistent (e.g., failure to renegotiation in time after the security association naturally times out). Therefore, by simultaneously examining behavioral deviation and policy consistency, the root cause can be uniquely determined: when the policies are consistent, the possibility of policy mismatch is ruled out, and deviation exceeding the threshold must point to an internal tunnel problem (deadness); when the policies are inconsistent, policy mismatch itself is the direct cause of communication anomalies, and deviation exceeding the threshold is a result of policy mismatch. This decision logic is completely consistent with the physical mechanism and fault propagation law of PMU encrypted communication. Compared to traditional methods that either directly trigger resets based solely on behavior detection (prone to misoperation when policies mismatch occurs) or rely solely on policy comparison for alerts (unable to handle tunnel deadlock), this embodiment achieves accurate root cause attribution through joint analysis. Furthermore, this decision rule is clearly operable and has low computational overhead. Deviation and policy consistency are already calculated or acquired values ​​or states, requiring no additional probing or complex reasoning.

[0051] Therefore, this embodiment not only solves the technical problem of root cause differentiation, but also ensures the real-time requirements of online operation.

[0052] After the joint analysis initially determines the anomaly type to be tunnel dead, statistical fluctuations may lead to misjudgments (e.g., short-term network jitter causing a temporary increase in deviation). Immediately performing tunnel reconstruction operations could cause unnecessary communication interruptions. Therefore, in one embodiment, when the joint analysis classifies the anomaly type as tunnel dead, it further includes: Obtain at least one of the following auxiliary judgment features: whether the number of encrypted messages received by the local encryption device within the preset detection time is zero; whether the number of consecutive unresponsive key exchange protocol keep-alive probes of the local encryption device exceeds the preset retransmission threshold; whether the security association of PMU encrypted communication has exceeded the hard lifecycle and has not completed renegotiation. When at least one auxiliary judgment feature meets the preset condition, the anomaly type is confirmed as tunnel dead, and a key exchange protocol deletion message is sent to the peer encryption device and the security association is rebuilt; otherwise, the current communication state remains unchanged, and the deviation is recalculated in the next sliding time window.

[0053] In specific implementation, the first auxiliary judgment feature is whether the number of encrypted packets received by the local encryption device within a preset detection period is zero. The preset detection period can be set to several sliding window durations (e.g., 5 window durations). In IPSec encrypted communication, the remote encryption device will continuously send encrypted packets under normal circumstances. If the number of encrypted packets received from the remote device within the detection period is zero, it indicates that the remote device may be offline or the tunnel may have broken. This feature satisfies the preset condition of "zero quantity".

[0054] The second auxiliary judgment feature is whether the number of consecutive unresponsive attempts of the key exchange protocol keep-alive probe on the local encryption device exceeds the preset retransmission threshold. The IKE protocol typically supports a Dead Peer Detection (DPD) mechanism. The local encryption device periodically sends DPD probe messages; if it fails to receive a response from the peer multiple times consecutively, it considers the peer unreachable or the tunnel dead. The preset retransmission threshold can be set to 3 times (consistent with the default retransmission count of the IKE protocol). This feature satisfies the preset condition when "the number of consecutive unresponsive attempts exceeds the preset retransmission threshold."

[0055] The third auxiliary judgment feature is whether the security association of PMU encrypted communication has exceeded its hard lifecycle and has not completed renegotiation. IPSec security associations have a hard lifecycle; once the hard lifecycle is reached, the security association must immediately become invalid and be re-established. If the security association has exceeded its hard lifecycle but has not completed renegotiation, the tunnel is in a dead state. This feature satisfies the preset condition that "the security association has exceeded its hard lifecycle and has not completed renegotiation".

[0056] If the joint analysis initially determines that the tunnel is dead, and at least one of the three auxiliary judgment characteristics mentioned above meets the preset conditions, then the anomaly type is confirmed as tunnel dead, and a repair action is performed (sending a key exchange protocol deletion message and rebuilding the security association). If none of the above auxiliary judgment characteristics meet the preset conditions, it indicates that the current increase in deviation may be caused by instantaneous network jitter or other temporary factors, rather than a true tunnel dead. In this case, the current communication state remains unchanged, no repair operation is performed, and the deviation is recalculated in the next sliding time window, and monitoring continues.

[0057] In PMU encrypted communication, increased deviation can be caused by various factors: besides genuine tunnel deadness or policy mismatch, transient network congestion, routing jitter, and brief PMU device malfunctions can also cause temporary fluctuations in message arrival intervals, temporarily exceeding the threshold. If tunnel reconstruction is immediately performed based solely on the initial judgment of joint analysis, it may cause unnecessary interruption to normal communication. Therefore, additional auxiliary judgment features can be used to confirm whether the tunnel is truly dead. Based on the above, the auxiliary features in this embodiment reflect the tunnel's activity status from different perspectives: The number of encrypted messages from the peer is zero: If the peer continues to send messages but the local end cannot receive them, it indicates that one-way communication may be interrupted or the peer has stopped sending. This is a direct manifestation of tunnel dead. DPD keep-alive probe failure: DPD is a mechanism in the IKE protocol specifically used to detect the liveness of the peer. Continuous failure to respond indicates that the peer is unable to respond to IKE messages, and the tunnel is in a dead state; Security association exceeds hard lifecycle and renegotiation is not completed: Security association must be rebuilt after reaching hard lifecycle. If renegotiation is not completed, the tunnel will inevitably be in a state of failure.

[0058] These three features have clear physical meaning and a low false alarm rate. When the joint analysis initially determines that the tunnel is dead, these auxiliary features are then checked: if at least one of them meets the preset conditions, the judgment of tunnel dead is confirmed, and it is necessary and correct to perform the reconstruction operation at this time; if none of the auxiliary features are met, the initial judgment is likely due to a false positive caused by transient network fluctuations. In this case, no repair action is performed, but monitoring continues, and the results of the next window are awaited.

[0059] Therefore, through a two-level judgment mechanism of initial judgment plus auxiliary confirmation, this embodiment can effectively reduce false alarms and false repairs caused by statistical fluctuations while ensuring a rapid response to real tunnel deadlocks, thus improving stability and reliability.

[0060] When acquiring and comparing the parameters of the dual-end encryption strategy, if the comparison rules are unclear or the parameter items are incomplete, the strategy consistency determination result may be inaccurate, thereby affecting the differentiation of anomaly types. Therefore, in one embodiment, acquiring and comparing the encryption strategy parameters of the local encryption device and the peer encryption device to obtain the strategy consistency determination result includes: The encryption policy parameters of the local encryption device are compared with those of the remote encryption device item by item. When all encryption policy parameters have the same value in the local encryption device and the remote encryption device, the policy consistency determination result is considered consistent; otherwise, the policy consistency determination result is considered inconsistent.

[0061] In specific implementation, the encryption policy parameters are obtained in the following ways: The encryption policy parameters of the local encryption device can be read directly by calling the local configuration management interface; the encryption policy parameters of the peer encryption device can be obtained in one of the following two ways: Method 1: During the IKE negotiation process, the two parties will exchange SA payloads, which contain the encryption policy parameters supported by the other party. The local end can parse the parameters of the peer from the negotiation record; Method 2: Query the configuration information of the peer encryption device from the network management system through the northbound interface.

[0062] The specific details of the encryption strategy parameters and the comparison rules are as follows: Encryption Algorithm Suite Identifier: Used to identify the combination of algorithms used for encryption, authentication, and key derivation, such as the Chinese national cryptographic suite identifier "SM4-CBC / SM3 / HMAC-SM3". Comparison Rule: Strings must be completely equal. Key exchange protocol version number: e.g., IKEv1 or IKEv2. Comparison rule: version number values ​​must be equal; Security association lifecycle parameters: including hard lifecycle (unit: seconds or kilobytes) and soft lifecycle. Security associations must immediately expire upon the hard lifecycle; renegotiation is triggered upon the soft lifecycle. Comparison rules: Lifecycle values ​​are equal (a certain margin of error is allowed, e.g., ±1 second is considered equal); Forward safety enabled flag: Boolean value, indicating whether perfect forward safety is enabled. Comparison rule: Boolean values ​​must be equal; Anti-replay window size parameter: an integer representing the size of the IPsec anti-replay window (typically 64, 128, or 256). Comparison rule: values ​​must be equal.

[0063] Each of the above parameters is compared one by one. Only when all the selected parameters have the same value on both the local and remote ends is the strategy consistency result determined to be "consistent"; if at least one parameter has a different value, it is determined to be "inconsistent".

[0064] The establishment and normal operation of an IPSec encrypted tunnel depend on the strict matching of encryption policy parameters between the two ends. The encryption algorithm suite identifier determines the algorithm used for encryption and authentication; if the algorithms on both ends are inconsistent, the peer end cannot decrypt the encrypted messages on its own end. The key negotiation protocol version number determines the compatibility of the IKE negotiation process; different versions may not be able to negotiate properly. Based on the above, the security association lifecycle parameter affects the timing of tunnel reconstruction: if the lifecycles on both ends are inconsistent, one end may believe the security association is still valid while the other end has expired, causing communication interruption. The forward security enable flag and the anti-replay window size parameter are also key configurations affecting tunnel security and functionality. This embodiment comprehensively detects the consistency of the configuration on both ends by comparing the above key policy parameters item by item. The comparison rules are clear and unambiguous, and all parameters can be obtained through standard interfaces (the local end reads from its local configuration, and the peer end queries from the IKE negotiation record or network management system), making it highly implementable. The comparison results provide crucial decision input for subsequent joint analysis. In particular, when the policy consistency determination result is "inconsistent", the specific inconsistent parameter item can be directly located (e.g., different encryption algorithm suites or different lifecycles), providing a precise target for subsequent policy correction instructions (which parameter to correct and to what value).

[0065] Therefore, this embodiment not only achieves the determination of policy consistency, but also implicitly supports the refinement of fault location.

[0066] When the anomaly is determined to be a tunnel deadlock, a security association reconstruction operation needs to be performed to restore encrypted communication. In traditional methods, passively waiting for the security association to time out naturally can be time-consuming, leading to prolonged PMU data loss. Therefore, in one embodiment, when a tunnel deadlock is determined, a key exchange protocol deletion message is sent to the peer encryption device and the security association is reconstructed, including: The local encryption device sends a key exchange protocol deletion message to the peer encryption device through the control link of the local encryption device. The key exchange protocol deletion message carries the identifier of the security association to be deleted. After receiving a confirmation message from the peer encryption device, clear the security associations to be deleted stored in the local security association database; Initiate a new key exchange protocol negotiation process with the peer encryption device, re-establish the security association in the new key exchange protocol negotiation process, and resume PMU encrypted communication data transmission after the new security association is established.

[0067] In the specific implementation, the key exchange protocol uses the IKEv2 protocol. The key exchange protocol deletion message is an IKE Delete message, whose format conforms to the RFC 7296 specification. This message contains a deletion payload, which carries the security parameter index value of the security association to be deleted. The local encryption device sends this IKE Delete message to the remote encryption device through a pre-established control link (usually UDP port 500 or 4500).

[0068] Upon receiving the IKE Delete message, the peer encryption device locates the corresponding security association based on the security parameter index value carried in the message, marks it as pending deletion, and returns a confirmation message. Upon receiving the confirmation message, the local encryption device removes all entries for that security association from its local security association database, including information such as the encryption key, authentication key, and serial number counter.

[0069] After the cleanup is complete, the local encryption device initiates a new IKE negotiation process with the remote encryption device. This negotiation process includes two exchange phases: IKE_SA_INIT and IKE_AUTH. In the first phase, both parties negotiate the encryption algorithm, authentication algorithm, Diffie-Hellman parameters, etc. In the second phase, both parties authenticate their identities and generate sub-security associations. After successful negotiation, a new security association is generated and installed into the security association databases of both parties.

[0070] Once the new security association is established, data transmission in PMU encrypted communication resumes. The local encryption device continues to use the new security association to encapsulate PMU data frames using ESP and send them, while the remote encryption device uses the corresponding security association to decapsulate and verify them.

[0071] The essence of tunnel deadlock is that existing security associations fail or the IKE negotiation process stalls, causing encrypted messages to fail to be correctly encapsulated or decapsulated. In this case, the most direct and thorough repair method is to clear the failed security associations and re-establish new ones. Based on the above, this embodiment uses an active IKE Delete message to clear dead security associations. Compared to passively waiting for security associations to time out naturally (the hard lifecycle can be as long as several hours), active deletion can trigger the clearing operation within milliseconds after detecting tunnel deadlock. The IKE Delete message is a message type defined in the IKEv2 protocol standard, with good compatibility and reliability: after receiving the IKE Delete message, the peer will synchronously clear the corresponding security association, avoiding inconsistencies between the two ends. After clearing, a new IKE negotiation process is initiated immediately. Since the encryption strategies of both ends are consistent in the tunnel deadlock scenario, the new negotiation can succeed quickly and generate a new security association. From sending the IKE Delete message to the completion of the new security association establishment, the entire process is usually completed within a few hundred milliseconds to a few seconds, which shortens the recovery time compared to waiting for natural timeout or manually restarting the device.

[0072] Therefore, this embodiment achieves rapid self-healing in tunnel dead scenarios through a mechanism of active deletion and immediate reconstruction, reducing the time of PMU data loss and ensuring the data continuity of the wide-area measurement system.

[0073] When an anomaly is determined to be a policy mismatch, the inconsistent encryption policy parameters need to be corrected to restore communication. Traditionally, maintenance personnel must manually log into the encryption device to modify the configuration, a cumbersome and error-prone process. Therefore, in one embodiment, when a policy mismatch is determined, a policy correction command is sent to the encryption device with the inconsistent policy via the northbound interface, triggering key renegotiation, including: Based on the policy consistency determination results, the target encryption device with inconsistent policies and the inconsistent encryption policy parameter items are identified. The target encryption device can be a plant-side encryption device or a master-side encryption device. Generate a policy correction instruction message, which includes correction values ​​for inconsistent encryption policy parameter items; The policy modification instruction message is sent to the target encryption device through the northbound interface. The northbound interface is the policy configuration interface provided by the target encryption device to the power dispatch data network management system. After the target encryption device updates the encryption policy configuration according to the policy correction instruction message, it triggers the other encryption device in the PMU encryption communication link to renegotiate the key.

[0074] In practice, the policy consistency determination result records the differences between the local and remote encryption devices in various encryption policy parameters. For example, if the comparison reveals that the local encryption algorithm suite is "SM4-CBC / SM3" while the remote encryption algorithm suite is "AES-CBC / SHA1", then the inconsistent parameter item is the encryption algorithm suite identifier. In practice, an authoritative source for policy configuration can be pre-defined (e.g., based on the main station configuration or the unified configuration of the network management system) to determine the target encryption device that needs to be corrected.

[0075] The policy correction instruction message is encapsulated in JSON or XML format and includes at least the following fields: target encryption device identifier (such as IP address or device ID), name of the parameter item to be corrected, corrected parameter value, and operation timestamp. This message is sent via the northbound interface. The northbound interface conforms to the interface protocol defined in the power industry standard T / CES 271-2024 "General Technical Specification for Smart IoT Gateways in Converter (Substation) Stations," which supports configuration management methods such as RESTful API or NETCONF.

[0076] After receiving the policy modification instruction message, the target encryption device verifies the message's source and integrity, and then updates its local encryption policy configuration file according to the instruction content. Once the update is complete, the target encryption device returns an execution result confirmation to the network management system.

[0077] Subsequently, key renegotiation is triggered. Renegotiation can be initiated by the target encryption device or by the peer encryption device. Specifically, after updating the policy, the target encryption device sends an IKE SA Delete message (optional) to the peer encryption device, and then immediately initiates a new IKE negotiation process to re-establish the security association using the updated encryption policy parameters. Upon successful renegotiation, the encryption policies of both ends are agreed upon, and PMU encrypted communication returns to normal.

[0078] The root cause of policy mismatch is the inconsistency of encryption policy parameters at both ends. Therefore, the core of the repair lies in correcting the inconsistent parameters to uniform values. However, encryption devices in PMU encrypted communication may be distributed in different geographical locations (plant and master stations) and may be managed by different maintenance personnel. Manually logging into each device to modify the configuration is not only inefficient but also prone to human error. Based on the above, this embodiment utilizes the northbound interface to automate policy correction. The northbound interface is a standardized configuration interface provided by the encryption device to the network management system, following general technical specifications in the power industry. Therefore, it can remotely and uniformly manage the policy configuration of multiple encryption devices. After detecting policy mismatch and identifying inconsistent parameter items, this embodiment automatically generates a policy correction command message and sends it to the target encryption device through the northbound interface. After receiving the command, the target encryption device automatically updates its configuration, and the entire process requires no manual intervention. It is worth noting that the target encryption device can be either a plant-side encryption device or a master station encryption device, depending on which device's configuration is inconsistent with the authoritative source. For example, if the plant-side configuration is correct but the master station configuration is incorrect, then the target encryption device is the master station; otherwise, it is the plant-side. This flexibility ensures the accuracy of policy correction. After the policy configuration is updated, key renegotiation needs to be triggered for the new policy to take effect. Renegotiation can be initiated actively or waited for by the other end. After renegotiation is completed, both ends use the same policy to establish a new security association and communication is restored.

[0079] Therefore, this embodiment achieves automated closed-loop repair of policy mismatch through the northbound interface, without the need for manual intervention, which improves the efficiency and accuracy of policy correction and reduces operation and maintenance costs.

[0080] In scenarios where security-related lifecycle parameters are inconsistent, arbitrarily modifying one end could cause both ends' lifecycle parameters to change simultaneously, leading to negotiation conflicts. Therefore, in one embodiment, a target encryption device with inconsistent policies is identified based on the policy consistency determination result, including: By comparing the security association lifecycle parameters of the local encryption device with those of the remote encryption device, the encryption device with the smaller security association lifecycle parameter value is identified as the target encryption device. Furthermore, after issuing a policy modification instruction to the target encryption device, the security association lifecycle parameters of the target encryption device are modified to be consistent with the security association lifecycle parameters of another encryption device.

[0081] In practical implementation, the security-associated lifecycle parameter includes the hard lifecycle, typically measured in seconds, such as 28,800 seconds (8 hours). Comparing the security-associated hard lifecycle parameter values ​​between the two ends, assuming the hard lifecycle value of the local encryption device is... The hard lifetime value of the peer encryption device is .like Then the local encryption device is identified as the target encryption device; if If the two are equal, then the remote encryption device is identified as the target encryption device; if they are equal, then no correction is needed.

[0082] After identifying the target encryption device, a policy correction command message is generated to modify the target encryption device's security association hard lifetime parameter to the value of the other end (i.e., the larger value). For example, if the local end's hard lifetime is 7200 seconds and the peer end's is 14400 seconds, then a command is sent to the local end to modify its hard lifetime to 14400 seconds. After this modification, both ends have larger hard lifetime parameters, avoiding frequent renegotiations due to excessively short lifetimes.

[0083] After the correction is completed, trigger key renegotiation using the method described above. Since the lifecycle parameters of both ends are now consistent, the renegotiation process can proceed smoothly.

[0084] The security association lifecycle parameter is a key parameter in IPSec policies, determining the validity period of the security association. If the lifecycles of the two ends are inconsistent, the local end will consider the security association expired and attempt to renegotiate, while the remote end will consider the security association still valid, potentially leading to disordered negotiation sequences or even communication interruptions. Based on this, this embodiment proposes a clear correction strategy for scenarios with inconsistent lifecycle parameters: modifying the encryption device with the smaller lifecycle parameter value to match the larger value. The principle behind this is that modifying the larger value to a smaller value shortens the lifecycles of both ends, leading to more frequent renegotiations and increased system overhead; while increasing the smaller value to a larger value extends the unified lifecycle value, ensuring consistency and avoiding unnecessary renegotiations. Furthermore, adjusting the smaller value upwards aligns with conventional security association management practices (lifecycles should not be too short), and since only one end is modified, conflicts that might arise from simultaneous modifications on both ends are avoided.

[0085] Therefore, this embodiment ensures a smooth transition of the security-related lifecycle parameter correction through this targeted correction method, while minimizing the impact of the correction on communication.

[0086] After performing a repair action (tunnel dead reconstruction or policy mismatch correction), it is necessary to verify whether the repair was truly successful to avoid entering a silent state after a repair failure. Therefore, in one embodiment, after performing the corresponding repair action when a tunnel deadlock is determined or when a policy mismatch is determined, the method further includes: Obtain the encrypted data stream of the repaired PMU encrypted communication and recalculate the deviation of the repaired real-time protocol stack state feature sequence from the baseline model. When the corrected deviation is lower than the preset deviation threshold, the self-healing repair is considered successful; when the corrected deviation is still higher than the preset deviation threshold, an alarm notification is triggered.

[0087] In practice, after completing the repair action (rebuilding the security association or issuing a policy correction command and triggering key renegotiation), a preset recovery period (e.g., 5 sliding time windows) is waited for to allow the new security association to be stably established or the new policy configuration to take effect. After the recovery period ends, the packet length and packet arrival time in the real-time encrypted data stream are collected again, and the deviation is recalculated. .Will Deviation from preset threshold Comparison: like If the self-healing repair is successful, then a success log can be recorded, including repair time, exception type, repair actions, etc., for subsequent operation and maintenance auditing. like If the self-healing repair fails, an alarm notification is triggered. Alarm methods can include: sending an SNMP Trap alarm to the network management system, generating an alarm log locally, or pushing an alarm message (such as SMS or email) to operations personnel via a northbound interface. The alarm content should include at least: the anomaly type, the repair actions performed, the deviation value after repair, and suggested directions for manual investigation.

[0088] The core objective of self-healing is to automatically restore communication, but any repair action carries the risk of failure. For example, during tunnel rebuilding from a deadlock, network issues may cause new IKE negotiations to fail; during policy mismatch correction, northbound interface communication failures may prevent policy distribution from being successfully implemented. If verification is not performed after a repair failure, it will be mistakenly assumed that communication has been restored, when in fact PMU data is still being lost, preventing maintenance personnel from intervening in a timely manner. Based on the above, this embodiment forms a closed-loop verification mechanism by recalculating the deviation after repair. The deviation is a comprehensive indicator reflecting whether communication behavior is normal. If the repair is successful, communication behavior should return to normal mode, and the deviation should be below the threshold; if the repair fails, communication behavior remains abnormal, and the deviation remains above the threshold. By comparing the changes in deviation before and after repair, the success of self-healing can be objectively and quantitatively determined. When the repair is successful, a success log is recorded to provide data for subsequent maintenance audits; when the repair fails, an alarm notification is proactively triggered to remind maintenance personnel to manually intervene and investigate. Alarm notifications can be sent through multiple channels to ensure that maintenance personnel can be informed of anomalies in a timely manner.

[0089] Therefore, this embodiment improves the reliability and maintainability of self-healing through a closed-loop verification mechanism, avoiding the risk of self-healing entering a silent state after repair failure.

[0090] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0091] Secondly, based on the same inventive concept, this application also provides a system for implementing the above-mentioned PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning. The solution provided by this system is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more system embodiments provided below can be found in the limitations of the PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning described above, and will not be repeated here.

[0092] In one embodiment, such as Figure 4 As shown, the system includes: a feature extraction module, a model building module, a consistency judgment module, an anomaly differentiation module, and a repair execution module. Among them: The feature extraction module is used to extract the message length and message arrival time in the encrypted data stream under the condition that the PMU encrypted communication continuously transmits synchronous phasor measurement data at a preset fixed frame rate, and generate a protocol stack state feature sequence. The model building module is used to build a statistical baseline model of protocol stack behavior based on the statistical distribution characteristics of protocol stack state feature sequences under normal conditions. The consistency judgment module is used to collect real-time protocol stack state feature sequences in a sliding time window manner, calculate the deviation of the real-time protocol stack state feature sequences from the baseline model; when the deviation exceeds the preset deviation threshold, it acquires and compares the encryption strategy parameters of the local encryption device and the peer encryption device to obtain the strategy consistency judgment result. The anomaly differentiation module is used to jointly analyze the deviation and strategy consistency judgment results and differentiate the anomaly type as tunnel dead or strategy mismatch. The repair execution module is used to send a key exchange protocol deletion message to the peer encryption device and rebuild the security association when the tunnel is determined to be dead; when the policy is determined to be mismatched, it sends a policy correction command to the encryption device with inconsistent policies through the northbound interface and triggers key renegotiation.

[0093] In one embodiment, the model building module includes model building units.

[0094] The model building unit is used to collect samples of encrypted data streams at a sampling period synchronized with a preset fixed frame rate during continuous time periods when PMU encrypted communication is in normal communication mode. The model building unit extracts the sample message length and arrival time of each encrypted message from the samples, calculates the arrival time interval between adjacent encrypted messages, and obtains a sample message length sequence and a sample message arrival interval sequence. The model building unit performs statistical distribution fitting on the sample message length sequence to obtain the mean and standard deviation of the message length; it also performs statistical distribution fitting on the sample message arrival interval sequence to obtain the mean and standard deviation of the arrival interval. The model building unit stores the mean message length, standard deviation of the message length, mean arrival interval, and standard deviation of the arrival interval as parameters of the baseline model.

[0095] In one embodiment, the consistency judgment module includes a deviation calculation unit.

[0096] The deviation calculation unit collects the real-time message length sequence and real-time message arrival interval sequence within a preset fixed-length sliding time window, where the duration of the sliding time window is an integer multiple of the period corresponding to the preset fixed frame rate. The deviation calculation unit calculates the absolute value of the length difference between the sample mean of the real-time message length sequence and the average message length, as well as the absolute value of the interval difference between the sample mean of the real-time message arrival interval sequence and the average arrival interval. The deviation calculation unit divides the absolute value of the length difference by the standard deviation of the message length to obtain the message length deviation index, and divides the absolute value of the interval difference by the standard deviation of the arrival interval to obtain the arrival interval deviation index. The deviation calculation unit then performs a weighted sum of the message length deviation index and the arrival interval deviation index according to preset weights to obtain the deviation.

[0097] In one embodiment, the anomaly differentiation module includes a type determination unit.

[0098] The type determination unit is used to determine the abnormal type as tunnel dead when the deviation exceeds the preset deviation threshold and the policy consistency determination result is consistent; and to determine the abnormal type as policy mismatch when the deviation exceeds the preset deviation threshold and the policy consistency determination result is inconsistent.

[0099] In one embodiment, the consistency judgment module includes a result judgment unit.

[0100] The result determination unit is used to compare the encryption policy parameters of the local encryption device with the encryption policy parameters of the remote encryption device item by item. When all the values ​​of the encryption policy parameters in the local encryption device are the same as the values ​​in the remote encryption device, the policy consistency determination result is consistent; otherwise, the policy consistency determination result is inconsistent.

[0101] In one embodiment, the repair execution module includes a zombie handling unit.

[0102] The deadlock handling unit is used to send a key exchange protocol deletion message to the peer encryption device via the control link of the local encryption device. This message carries an identifier of the security association to be deleted. Upon receiving a confirmation message from the peer encryption device, the deadlock handling unit clears the security associations to be deleted from the local security association database. Finally, the deadlock handling unit initiates a new key exchange protocol negotiation process with the peer encryption device, re-establishes the security associations during the new negotiation process, and resumes PMU encrypted communication data transmission after the new security associations are established.

[0103] In one embodiment, the repair execution module includes a mismatch handling unit.

[0104] The mismatch handling unit is used to identify the target encryption device with a mismatched policy and the inconsistent encryption policy parameters based on the policy consistency determination result. The mismatch handling unit generates a policy correction instruction message, which includes the correction values ​​corresponding to the inconsistent encryption policy parameters. The mismatch handling unit sends the policy correction instruction message to the target encryption device via the northbound interface. After the target encryption device updates its encryption policy configuration according to the policy correction instruction message, the mismatch handling unit triggers key renegotiation at the other end of the PMU encrypted communication link corresponding to the target encryption device.

[0105] The modules in the aforementioned PMU encrypted communication anomaly self-healing system based on protocol stack state machine learning can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independent of the processor in a computer device, or stored in software within the computer device's memory, allowing the processor to invoke and execute the corresponding operations of each module.

[0106] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data such as protocol stack state characteristic sequences, protocol stack behavior statistical baseline model parameters, encryption policy parameters, and runtime logs. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning.

[0107] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0108] Thirdly, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described in the above method embodiments.

[0109] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of any of the methods described in the above method embodiments.

[0110] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0111] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0112] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A self-healing method for PMU encrypted communication anomalies based on protocol stack state machine learning, characterized in that, The method includes: Under the condition that PMU encrypted communication continuously transmits synchronous phasor measurement data at a preset fixed frame rate, the message length and message arrival time in the encrypted data stream are extracted to generate a protocol stack state feature sequence. Based on the statistical distribution characteristics of the protocol stack state feature sequence under normal conditions, a statistical baseline model of protocol stack behavior is constructed. The real-time protocol stack state feature sequence is collected using a sliding time window method, and the deviation of the real-time protocol stack state feature sequence from the baseline model is calculated. When the deviation exceeds a preset deviation threshold, the encryption strategy parameters of the local encryption device and the peer encryption device are obtained and compared to obtain the strategy consistency judgment result. The deviation and the policy consistency determination results are analyzed together to distinguish the anomaly type as tunnel dead or policy mismatch. When the tunnel is determined to be dead, a key exchange protocol deletion message is sent to the peer encryption device and the security association is rebuilt. When the policy is determined to be mismatched, a policy correction instruction is sent to the encryption device with inconsistent policies through the northbound interface and key renegotiation is triggered.

2. The method according to claim 1, characterized in that, The construction of the protocol stack behavior statistical baseline model includes: During a continuous period when the PMU encrypted communication is in normal communication state, samples of the encrypted data stream are collected at a sampling period synchronized with the preset fixed frame rate; Extract the sample message length and sample message arrival time of each encrypted message from the sample, calculate the arrival time interval between adjacent encrypted messages, and obtain the sample message length sequence and sample message arrival interval sequence; The sample message length sequence is subjected to statistical distribution fitting to obtain the mean message length and standard deviation of message length; The arrival interval sequence of the sample messages is statistically fitted to obtain the mean and standard deviation of the arrival interval. The mean message length, the standard deviation of message length, the mean arrival interval, and the standard deviation of arrival interval are stored as parameters of the baseline model.

3. The method according to claim 2, characterized in that, The calculation of the deviation of the real-time protocol stack state feature sequence from the baseline model includes: Using a preset fixed-duration sliding time window as a unit, the real-time message length sequence and the real-time message arrival interval sequence within the current sliding time window are collected, wherein the duration of the sliding time window is an integer multiple of the period corresponding to the preset fixed frame rate; Calculate the absolute value of the length difference between the sample mean of the real-time message length sequence and the average message length, and the absolute value of the interval difference between the sample mean of the real-time message arrival interval sequence and the average arrival interval. Divide the absolute value of the length difference by the standard deviation of the message length to obtain the message length deviation index; Divide the absolute value of the interval difference by the standard deviation of the arrival interval to obtain the arrival interval deviation index; The deviation degree is obtained by weighting and summing the message length deviation index and the arrival interval deviation index according to a preset weight.

4. The method according to claim 1, characterized in that, The joint analysis of the deviation and the consistency determination result of the strategy distinguishes the anomaly type as tunnel dead or strategy mismatch, including: When the deviation exceeds the preset deviation threshold and the strategy consistency determination result is consistent, the anomaly type is determined to be tunnel dead. When the deviation exceeds the preset deviation threshold and the policy consistency determination result is inconsistent, the anomaly type is determined to be policy mismatch.

5. The method according to claim 1, characterized in that, The step of obtaining and comparing the encryption policy parameters of the local encryption device and the remote encryption device to obtain a policy consistency determination result includes: The encryption policy parameters of the local encryption device are compared with the encryption policy parameters of the peer encryption device item by item. When all the values ​​of the encryption policy parameters in the local encryption device are the same as the values ​​in the peer encryption device, the policy consistency determination result is determined to be consistent; otherwise, the policy consistency determination result is determined to be inconsistent.

6. The method according to claim 1, characterized in that, When a tunnel is determined to be dead, sending a key exchange protocol deletion message to the peer encryption device and rebuilding the security association includes: The local encryption device sends a key exchange protocol deletion message to the peer encryption device via the control link of the local encryption device, wherein the key exchange protocol deletion message carries an identifier of the security association to be deleted; After receiving the confirmation message returned by the peer encryption device, the security association to be deleted stored in the local security association database is cleared; A new key exchange protocol negotiation process is initiated with the peer encryption device. During the new key exchange protocol negotiation process, a security association is re-established, and after the new security association is established, the data transmission of the PMU encrypted communication is resumed.

7. The method according to claim 1, characterized in that, When a policy mismatch is determined, the step of sending a policy correction command to the encryption device with inconsistent policies via the northbound interface and triggering key renegotiation includes: Based on the policy consistency determination result, the target encryption device with policy inconsistency and the inconsistent encryption policy parameter items are determined. Generate a policy correction instruction message, the policy correction instruction message including the correction value corresponding to the inconsistent encryption policy parameter item; The policy correction instruction message is sent to the target encryption device through the northbound interface; After the target encryption device updates its encryption policy configuration according to the policy correction instruction message, it triggers the other encryption device in the PMU encryption communication link corresponding to the target encryption device to perform key renegotiation.

8. A PMU encrypted communication anomaly self-healing system based on protocol stack state machine learning, characterized in that, The system includes: The feature extraction module is used to extract the message length and message arrival time in the encrypted data stream under the condition that the PMU encrypted communication continuously transmits synchronous phasor measurement data at a preset fixed frame rate, and generate a protocol stack state feature sequence. The model building module is used to build a statistical baseline model of protocol stack behavior based on the statistical distribution characteristics of the protocol stack state feature sequence under normal conditions. The consistency judgment module is used to collect real-time protocol stack state feature sequences in a sliding time window manner, calculate the deviation of the real-time protocol stack state feature sequences from the baseline model; when the deviation exceeds a preset deviation threshold, the encryption strategy parameters of the local encryption device and the peer encryption device are obtained and compared to obtain the strategy consistency judgment result. An anomaly differentiation module is used to jointly analyze the deviation and the strategy consistency determination results to differentiate the anomaly type as tunnel dead or strategy mismatch. The repair execution module is used to send a key exchange protocol deletion message to the peer encryption device and rebuild the security association when the tunnel is determined to be dead; and to issue a policy correction instruction to the encryption device with inconsistent policies through the northbound interface and trigger key renegotiation when the policy is determined to be mismatched.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the PMU encrypted communication anomaly self-healing method based on protocol stack state machine learning as described in any one of claims 1 to 7.

Images