A safety monitoring method and device for remote control service of power distribution automation system

Abstract

The present application provides a method and device for safety monitoring of remote control services in a distribution automation system, the method comprising: obtaining alarm information of remote control services in the distribution automation system; extracting data from the alarm information to obtain multiple alarm data; determining the data category to which each alarm data belongs according to the relationship between each alarm data; determining the corresponding target safety monitoring queue in multiple preset safety monitoring queues according to the data category to which each alarm data belongs; and performing safety monitoring on the alarm data according to the target safety monitoring queue, and generating safety monitoring results. The safety monitoring results obtained include multiple event nodes corresponding to the alarm data and event association rules between event nodes, which improves the analysis and management efficiency of the alarm information. The operator can adopt corresponding safety measures according to the safety monitoring results obtained, laying a foundation for improving the safety of the distribution network.

Description

Technical Field

[0001] The present application relates to the field of electric power safety technology, and in particular to a method and device for safety monitoring of remote control services of a distribution automation system. Background Art

[0002] At present, with the construction of smart grids, traditional distribution networks have gradually developed into active distribution networks, and open and interactive communication networks have increased infiltration paths and threat access points. The distribution automation system is responsible for monitoring and controlling the operation of the distribution network, and its information security affects the normal operation of the entire distribution network.

[0003] In the prior art, the distribution network is usually monitored for safety using sensors installed on various telemetry devices. When a safety problem is determined, an alarm message is issued. The alarm message is then manually analyzed and corresponding processing measures are taken to ensure the safety of the distribution network.

[0004] However, due to the large amount of communication data in the distribution network and the large number of installed sensors, the analysis and management efficiency of the alarm information is low and consumes a lot of human resources. Therefore, there is an urgent need for a safety monitoring method that can quickly analyze and manage the alarm information, which is of great significance to improving the safety of the distribution network. Summary of the invention

[0005] The present application provides a method and device for safety monitoring of remote control services of a distribution automation system, so as to solve the defects of low efficiency in analysis and management of alarm information in the prior art.

[0006] The first aspect of the present application provides a method for safety monitoring of remote control services of a distribution automation system, comprising:

[0007] Obtain alarm information of remote control services in distribution automation system;

[0008] Extracting data from the alarm information to obtain multiple alarm data;

[0009] According to the relationship between each alarm data, determine the data category to which each alarm data belongs;

[0010] According to the data category to which each alarm data belongs, a corresponding target security monitoring queue is determined from a plurality of preset security monitoring queues;

[0011] According to the target security monitoring queue, the alarm data is security monitored and a security monitoring result is generated.

[0012] Optionally, the step of determining a corresponding target security monitoring queue from a plurality of preset security monitoring queues according to the data category to which each alarm data belongs includes:

[0013] Inserting the alarm data as an event node into each security monitoring queue;

[0014] According to the event association rules preset in each security monitoring queue, a target security monitoring queue matching the data category of the alarm data is determined.

[0015] Optionally, the method further includes:

[0016] When there is no target security monitoring queue in the preset security monitoring queue that matches the data category of the alarm data, a target logical chain that matches the data category of the alarm data is determined in the preset security monitoring rules, and a target security monitoring queue is established for the alarm data based on the target logical chain.

[0017] Optionally, the method further includes:

[0018] When there is no target logical chain matching the data category of the alarm data in the preset security monitoring rules, an alarm message is generated.

[0019] Optionally, determining the data category to which each alarm data belongs according to the relationship between each alarm data includes:

[0020] Normalizing the alarm data;

[0021] Performing feature extraction on the normalized alarm data to obtain feature vectors corresponding to each alarm data;

[0022] The data category to which each alarm data belongs is determined according to the distances between the feature vectors corresponding to the respective alarm data.

[0023] Optionally, determining the data category to which each alarm data belongs according to the distance between the feature vectors corresponding to each alarm data includes:

[0024] Determine whether the distance between each alarm data is less than a preset distance threshold;

[0025] If the distance between at least two alarm data is smaller than the distance threshold, it is determined that the at least two alarm data belong to the same data category.

[0026] Optionally, the alarm data includes: time, source IP address and target IP address.

[0027] A second aspect of the present application provides a safety monitoring device for remote control services of a distribution automation system, comprising:

[0028] An acquisition module is used to obtain alarm information of remote control services in the power distribution automation system;

[0029] A feature extraction module, used for extracting data from the alarm information to obtain a plurality of alarm data;

[0030] A classification module, used to determine the data category to which each alarm data belongs based on the relationship between each alarm data;

[0031] A determination module, used to determine a corresponding target security monitoring queue from a plurality of preset security monitoring queues according to the data category to which each alarm data belongs;

[0032] The monitoring module is used to perform security monitoring on the alarm data according to the target security monitoring queue and generate a security monitoring result.

[0033] Optionally, the determining module is specifically used to:

[0034] Inserting the alarm data as an event node into each security monitoring queue;

[0035] According to the event association rules preset in each security monitoring queue, a target security monitoring queue matching the data category of the alarm data is determined.

[0036] Optionally, the determining module is further used to:

[0037] When there is no target security monitoring queue in the preset security monitoring queue that matches the data category of the alarm data, a target logical chain that matches the data category of the alarm data is determined in the preset security monitoring rules, and a target security monitoring queue is established for the alarm data based on the target logical chain.

[0038] Optionally, the determining module is further used to:

[0039] When there is no target logical chain matching the data category of the alarm data in the preset security monitoring rules, an alarm message is generated.

[0040] Optionally, the classification module is specifically used to:

[0041] Normalizing the alarm data;

[0042] Performing feature extraction on the normalized alarm data to obtain feature vectors corresponding to each alarm data;

[0043] The data category to which each alarm data belongs is determined according to the distances between the feature vectors corresponding to the respective alarm data.

[0044] Optionally, the classification module is specifically used to:

[0045] Determine whether the distance between each alarm data is less than a preset distance threshold;

[0046] If the distance between at least two alarm data is smaller than the distance threshold, it is determined that the at least two alarm data belong to the same data category.

[0047] Optionally, the alarm data includes: time, source IP address and target IP address.

[0048] A third aspect of the present application provides an electronic device, comprising: at least one processor and a memory;

[0049] The memory stores computer-executable instructions;

[0050] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method described in the first aspect and various possible designs of the first aspect.

[0051] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in the first aspect and various possible designs of the first aspect are implemented.

[0052] The technical solution of this application has the following advantages:

[0053] The present application provides a method and device for safety monitoring of remote control services in a distribution automation system, which obtains alarm information of remote control services in the distribution automation system; extracts data from the alarm information to obtain multiple alarm data; determines the data category to which each alarm data belongs according to the relationship between each alarm data; determines the corresponding target safety monitoring queue in multiple preset safety monitoring queues according to the data category to which each alarm data belongs; performs safety monitoring on the alarm data according to the target safety monitoring queue, and generates safety monitoring results. The safety monitoring method provided by the above scheme determines the corresponding target safety monitoring queue and performs safety monitoring on it according to the data category to which the alarm data in the distribution automation system belongs. The obtained safety monitoring results include multiple event nodes corresponding to the alarm data and event association rules between event nodes, which improves the analysis and management efficiency of the alarm information. The operator can adopt corresponding safety measures according to the obtained safety monitoring results, laying a foundation for improving the safety of the distribution network. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0055] Figure 1 This is a schematic diagram of the structure of the power distribution automation system on which the embodiments of the present application are based;

[0056] Figure 2 A flow chart of a method for safety monitoring of remote control services of a power distribution automation system provided in an embodiment of the present application;

[0057] Figure 3 A flowchart of an exemplary method for safety monitoring of remote control services of a power distribution automation system provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of the structure of a safety monitoring device for remote control services of a power distribution automation system provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0060] The above drawings have shown clear embodiments of the present application, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0062] In addition, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. In the description of the following embodiments, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0063] In the prior art, the distribution network is usually monitored for safety using sensors installed on various telemetry devices. When a safety problem is determined, an alarm message is issued, and then the alarm message is manually analyzed and corresponding processing measures are taken to ensure the safety of the distribution network. However, due to the large amount of communication data in the distribution network and the large number of sensors installed, the analysis and management efficiency of the alarm information is low and consumes a lot of human resources.

[0064] In response to the above problems, the embodiments of the present application provide a method and device for security monitoring of remote control services in a distribution automation system, which obtains alarm information of remote control services in the distribution automation system; extracts data from the alarm information to obtain multiple alarm data; determines the data category to which each alarm data belongs based on the relationship between the alarm data; determines the corresponding target security monitoring queue in multiple preset security monitoring queues based on the data category to which each alarm data belongs; performs security monitoring on the alarm data based on the target security monitoring queue, and generates security monitoring results. The security monitoring method provided by the above scheme determines the corresponding target security monitoring queue and performs security monitoring on it based on the data category to which the alarm data in the distribution automation system belongs. The obtained security monitoring results include multiple event nodes corresponding to the alarm data and event association rules between event nodes, which improves the analysis and management efficiency of the alarm information. Operators can adopt corresponding security measures based on the obtained security monitoring results, laying a foundation for improving the security of the distribution network.

[0065] The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0066] First, the structure of the distribution automation system on which this application is based is described:

[0067] The method and device for security monitoring of remote control services of a distribution automation system provided in the embodiments of the present application are suitable for security monitoring of telemetry services in a distribution automation system. Figure 1 As shown, it is a schematic diagram of the structure of the distribution automation system based on the embodiment of the present application, which mainly includes multiple sensors and a safety monitoring device for remote control services of the distribution automation system for safety monitoring of remote control services in the distribution automation system. Specifically, each sensor is used to collect telemetry services in the distribution automation system, generate alarm information according to the actual situation of each telemetry service, and send the generated alarm information to the safety monitoring device, which analyzes and manages the obtained alarm information to obtain the corresponding safety monitoring results.

[0068] The embodiment of the present application provides a method for safely monitoring remote control services of a distribution automation system, which is used to safely monitor telemetry services in a distribution automation system. The execution subject of the embodiment of the present application is an electronic device, such as a server, a desktop computer, a laptop computer, a tablet computer, and other electronic devices that can be used to safely monitor telemetry services in a distribution automation system.

[0069] like Figure 2 FIG. 1 is a flow chart of a method for safety monitoring of remote control services of a distribution automation system provided in an embodiment of the present application, the method comprising:

[0070] Step 201: Acquire alarm information of remote control services in a distribution automation system.

[0071] It should be explained that a plurality of sensors are deployed in the distribution automation system for security monitoring of remote control services in the distribution automation system and generating corresponding alarm information.

[0072] Step 202: extract data from the alarm information to obtain a plurality of alarm data.

[0073] The alarm data may include: time, source IP address and target IP address.

[0074] In the prior art, in order to save the development cost of the distribution automation system and improve the monitoring efficiency of each sensor, a plurality of alarm data are usually included in one alarm message.

[0075] It should be explained that alarm information refers to the alarm information generated by the sensor, which can be used to inform operators which distribution terminals are at risk; alarm data refers to the remote control business with safety risks in the distribution automation system, that is, the remote control business initiated by distribution terminals such as telemetry plug-ins, remote control plug-ins and remote signaling plug-ins in the distribution automation system. Among them, the remote control business includes data such as the time when the distribution terminal initiates the remote control business, the source IP address and destination IP address of the distribution terminal.

[0076] Among them, the data extraction method can be specifically set according to the data format of the alarm information, and the embodiment of the present application does not limit it.

[0077] Step 203: Determine the data category to which each alarm data belongs based on the relationship between each alarm data.

[0078] The data categories of the alarm data may include: original IP address alarm, destination IP address alarm and remote control frequency alarm.

[0079] Specifically, the data categories of multiple alarm data can be divided according to the similarity between each alarm data, and specifically, the data categories of multiple alarm data can be divided according to the distance between the feature vectors corresponding to each alarm data. Since each alarm data is classified, in the process of classification, redundant alarm data and erroneous alarm data can also be eliminated according to the similarity between each alarm data, thereby reducing the number of redundant alarm data and erroneous alarm data, avoiding the erroneous abandonment of important alarm data, and laying a foundation for improving the efficiency of safety monitoring.

[0080] Specifically, in one embodiment, the alarm data may be normalized; feature extraction may be performed on the normalized alarm data to obtain feature vectors corresponding to each alarm data; and the data category to which each alarm data belongs may be determined based on the distance between the feature vectors corresponding to each alarm data.

[0081] It should be explained that since the alarm data comes from various dispersed, independent and diverse distribution terminals in the distribution automation system, the data formats are different. In order to improve the safety monitoring efficiency, before classifying the alarm data, the alarm data can be normalized into a unified format and further feature extracted. The extracted features can be time, source IP address and target IP address in the alarm data.

[0082] Specifically, when the alarm data is a set of numerical feature content, that is, when the alarm data is an array, the original numerical feature x i After normalization, it is:

[0083]

[0084] Among them, x i Represents the i-th value in the array, a i represents the normalized x i , that is, the i-th value in the normalized array, x min Represents the minimum value in the array, x max Represents the maximum value in an array.

[0085] Similarly, when the alarm data is a set of text feature content, it can be evenly assigned values ​​within [0,1], such as "yes" and "no" are assigned values ​​of 1 and 0.

[0086] For example, if there are two alarm data, namely the first alarm data and the second alarm data, the first feature vector corresponding to the first alarm data is P=[p1 p2 … p n ], the second eigenvector corresponding to the second alarm data is Q = [q1 q2 … q n ], the distance between the first alarm data and the second alarm data can be calculated according to the following formula:

[0087]

[0088] Wherein, distance{P,Q} represents the distance between the first eigenvector P and the second eigenvector Q, that is, the distance between the first alarm data and the second alarm data.

[0089] Furthermore, in one embodiment, it can be determined whether the distance between each alarm data is less than a preset distance threshold; if the distance between at least two alarm data is less than the distance threshold, it is determined that the at least two alarm data belong to the same data category.

[0090] Specifically, if the distance between the first alarm data and the second alarm data is less than a preset distance threshold, it is determined that the first alarm data and the second alarm data belong to the same data type; when it is determined that the distance between the third alarm data and the first alarm data is greater than the distance threshold, and the distance between the third alarm data and the second alarm data is less than the distance threshold, it can be determined that the first alarm data, the second alarm data and the third alarm data belong to the same data category.

[0091] Among them, the inter-class distance between each data category and the number of data categories finally obtained can be controlled by preset different distance thresholds, and different distance thresholds will not affect the accuracy of classification. In the process of classification, noise points and error points will also be divided into a data category to facilitate screening of invalid alarm data from multiple alarm data. Among them, the distance threshold can be set according to actual conditions, and the embodiments of the present application are not limited.

[0092] Step 204 , according to the data category to which each alarm data belongs, a corresponding target security monitoring queue is determined from a plurality of preset security monitoring queues.

[0093] It needs to be explained that each security monitoring queue includes multiple event nodes and event association rules between adjacent nodes.

[0094] Specifically, in one embodiment, the alarm data may be inserted into each security monitoring queue as an event node; and according to the event association rules preset in each security monitoring queue, a target security monitoring queue matching the data category of the alarm data is determined.

[0095] For example, Figure 3 As shown, a schematic flow chart of an exemplary safety monitoring method for remote control services of a power distribution automation system provided in an embodiment of the present application is provided. Specifically, according to the data category to which the alarm data belongs, a matching current event node is determined in a plurality of preset parallel safety monitoring queues (analysis queues), and the alarm data is inserted as an event node into the position of the current event node in each safety monitoring queue. Furthermore, according to the association rules between adjacent event nodes in each safety monitoring queue, the target safety monitoring queue is determined.

[0096] For example, Figure 3As shown, if the data category of the alarm data is determined to be a remote control frequency alarm, the current event node (event node 1) corresponding to it can be the number of remote control times. If in actual application, it is set that the alarm occurs when the number of remote control times reaches five times within 1 minute, then the corresponding event association rule (association rule 1) can be the number of remote control times reaching five times, and further, the event node (event node 2) adjacent to the current event node can be a remote control cycle, and the event association rule further corresponding to it can be a remote control cycle of 1 / 5 minutes, and so on, until the last event node of the target security monitoring queue is reached.

[0097] Correspondingly, in one embodiment, when there is no target security monitoring queue in the preset security monitoring queue that matches the data category of the alarm data, a target logical chain that matches the data category of the alarm data is determined in the preset security monitoring rules, and a target security monitoring queue is established for the alarm data based on the target logical chain.

[0098] It needs to be explained that the logical chain is similar to the security monitoring queue, including event nodes and association rules between adjacent event nodes. The difference is that the logical chain includes two event association nodes and event association rules between the two nodes, while the security monitoring queue includes multiple event association nodes and multiple event association rules, that is, a security monitoring queue can be constructed using multiple logical chains.

[0099] Specifically, a rule base may be preset, in which a plurality of complete logic chains are arranged, and a matching target logic chain is determined in the database according to the data category of the alarm data, and a corresponding target security monitoring queue is further established according to the obtained target logic chain.

[0100] The rule base may be specifically set according to the event nodes, spaces and causal relationships corresponding to the remote control services in actual applications.

[0101] Accordingly, in one embodiment, when there is no target logic chain matching the data category of the alarm data in the preset security monitoring rules, an alarm message is generated.

[0102] Further, the generated alarm information is reported to remind relevant operators that the rule base can no longer meet the safety monitoring requirements and needs to be updated. The alarm information can be reported in the form of text messages, prompt sounds, or prompt lights, and the specific reporting method is not limited in the embodiment of the application.

[0103] Step 205: perform security monitoring on the alarm data according to the target security monitoring queue and generate a security monitoring result.

[0104] Exemplarily, the main contents of the security monitoring result may include: Sline = {S1, S2, ..., Sm}, Rline={R1,R2,…,R m-1}, where Sline represents the set of related event nodes, and Rline represents the set of corresponding event association rules, that is, in the security monitoring process, the event association rule between event node S1 and event node S2 that matches the alarm data is R1.

[0105] In practical applications, security events in distribution automation systems are generally composed of multiple steps, such as internal distribution terminal failures leading to system information errors and step-by-step attempts to penetrate external attacks. There are multiple logical connections between each step, such as time, space, and causality. When the distribution automation system executes a remote control command, the entire remote control process is also composed of multiple remote control steps, including selection requests, selection responses, operation requests, and operation responses. The correlation between these remote control steps can be obtained in the remote control instruction, reading the remote control information object address and the transmission reason bytes of "activation" and "activation confirmation". The security monitoring result obtained in the embodiment of the present application is specifically a kind of scene data, which reflects the holistic and logical analysis process and results of the alarm data, and provides a basis for operators to reconstruct the attack path.

[0106] The security monitoring method for remote control services of a distribution automation system provided in the embodiment of the present application obtains the alarm information of the remote control services in the distribution automation system; extracts data from the alarm information to obtain multiple alarm data; determines the data category to which each alarm data belongs based on the relationship between each alarm data; determines the corresponding target security monitoring queue in multiple preset security monitoring queues based on the data category to which each alarm data belongs; performs security monitoring on the alarm data based on the target security monitoring queue, and generates security monitoring results. The security monitoring method provided by the above scheme determines the corresponding target security monitoring queue and performs security monitoring on it based on the data category to which the alarm data in the distribution automation system belongs. The obtained security monitoring results include multiple event nodes corresponding to the alarm data and event association rules between event nodes, which improves the analysis and management efficiency of the alarm information. The operator can adopt corresponding security measures based on the obtained security monitoring results, laying a foundation for improving the security of the distribution network.

[0107] An embodiment of the present application provides a safety monitoring device for remote control services of a distribution automation system, which is used to execute the safety monitoring method for remote control services of a distribution automation system provided in the above-mentioned embodiment.

[0108] like Figure 4, which is a schematic diagram of the structure of a safety monitoring device for remote control services of a distribution automation system provided in an embodiment of the present application. The device 40 includes an acquisition module 401 , a feature extraction module 402 , a classification module 403 , a determination module 404 and a monitoring module 405 .

[0109] Among them, the acquisition module 401 is used to obtain the alarm information of the remote control service in the distribution automation system; the feature extraction module 402 is used to extract data from the alarm information to obtain multiple alarm data; the classification module 403 is used to determine the data category to which each alarm data belongs according to the relationship between each alarm data; the determination module 404 is used to determine the corresponding target safety monitoring queue in multiple preset safety monitoring queues according to the data category to which each alarm data belongs; the monitoring module 405 is used to perform safety monitoring on the alarm data according to the target safety monitoring queue and generate safety monitoring results.

[0110] Specifically, in one embodiment, the determination module 404 is specifically configured to:

[0111] Insert the alarm data as event nodes into each security monitoring queue;

[0112] According to the event association rules preset in each security monitoring queue, a target security monitoring queue matching the data category of the alarm data is determined.

[0113] Specifically, in one embodiment, the determination module 404 is further configured to:

[0114] When there is no target security monitoring queue in the preset security monitoring queue that matches the data category of the alarm data, a target logical chain that matches the data category of the alarm data is determined in the preset security monitoring rules, and a target security monitoring queue is established for the alarm data according to the target logical chain.

[0115] Specifically, in one embodiment, the determination module 404 is further configured to:

[0116] When there is no target logical chain matching the data category of the alarm data in the preset security monitoring rules, an alarm message is generated.

[0117] Specifically, in one embodiment, the classification module 403 is specifically used to:

[0118] Normalize the alarm data;

[0119] Performing feature extraction on the normalized alarm data to obtain feature vectors corresponding to each alarm data;

[0120] The data category to which each alarm data belongs is determined according to the distance between the feature vectors corresponding to each alarm data.

[0121] Specifically, in one embodiment, the classification module 403 is specifically used to:

[0122] Determine whether the distance between each alarm data is less than a preset distance threshold;

[0123] If the distance between at least two alarm data is less than the distance threshold, it is determined that the at least two alarm data belong to the same data category.

[0124] Specifically, in one embodiment, the alarm data includes: time, source IP address and target IP address.

[0125] Regarding the safety monitoring device for remote control services of the distribution automation system in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0126] The safety monitoring device for the remote control service of the distribution automation system provided in the embodiment of the present application is used to execute the safety monitoring method for the remote control service of the distribution automation system provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0127] An embodiment of the present application provides an electronic device for executing the safety monitoring method of the remote control service of the distribution automation system provided in the above embodiment.

[0128] like Figure 5 , which is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 50 includes: at least one processor 51 and a memory 52;

[0129] The memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the safety monitoring method for remote control services of the distribution automation system provided in the above embodiment.

[0130] An electronic device provided in an embodiment of the present application is used to execute the security monitoring method of the remote control service of the distribution automation system provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0131] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, a method for safely monitoring remote control services of a distribution automation system as provided in any of the above embodiments is implemented.

[0132] The storage medium containing computer executable instructions in the embodiment of the present application can be used to store computer executable instructions of the safety monitoring method of the distribution automation system remote control service provided in the aforementioned embodiment. Its implementation method and principle are the same and will not be repeated here.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for safety monitoring of remote control services of a distribution automation system, characterized in that: include: Obtain alarm information of remote control services in distribution automation system; Extracting data from the alarm information to obtain multiple alarm data; According to the relationship between each alarm data, determine the data category to which each alarm data belongs; According to the data category to which each alarm data belongs, a corresponding target security monitoring queue is determined from a plurality of preset security monitoring queues; the security monitoring queue includes a plurality of event nodes and event association rules between adjacent nodes; According to the target security monitoring queue, security monitoring is performed on the alarm data, and a security monitoring result is generated; Determining a corresponding target security monitoring queue from a plurality of preset security monitoring queues according to the data category to which each alarm data belongs includes: Inserting the alarm data as an event node into each security monitoring queue; Determine a target security monitoring queue that matches the data category of the alarm data according to event association rules preset in each security monitoring queue; When there is no target security monitoring queue in the preset security monitoring queue that matches the data category of the alarm data, determining a target logical chain that matches the data category of the alarm data in the preset security monitoring rule, and establishing a target security monitoring queue for the alarm data according to the target logical chain; When there is no target logical chain matching the data category of the alarm data in the preset security monitoring rules, an alarm message is generated; The logic chain includes two event association nodes and event association rules between the two nodes, and multiple logic chains construct a security monitoring queue.

2. The method for safety monitoring of remote control services of a distribution automation system according to claim 1, characterized in that: Determining the data category to which each alarm data belongs according to the relationship between each alarm data includes: Normalizing the alarm data; Performing feature extraction on the normalized alarm data to obtain feature vectors corresponding to each alarm data; The data category to which each alarm data belongs is determined according to the distances between the feature vectors corresponding to the respective alarm data.

3. The method for safety monitoring of remote control services of a distribution automation system according to claim 2, characterized in that: Determining the data category to which each alarm data belongs according to the distance between the feature vectors corresponding to each alarm data includes: Determine whether the distance between each alarm data is less than a preset distance threshold; If the distance between at least two alarm data is smaller than the distance threshold, it is determined that the at least two alarm data belong to the same data category.

4. The method for safety monitoring of remote control services of a distribution automation system according to claim 1, characterized in that: The alarm data includes: time, source IP address and target IP address.

5. A safety monitoring device for remote control services of a distribution automation system, characterized in that: include: An acquisition module is used to obtain alarm information of remote control services in the power distribution automation system; A feature extraction module, used for extracting data from the alarm information to obtain a plurality of alarm data; A classification module, used to determine the data category to which each alarm data belongs based on the relationship between each alarm data; A determination module is used to determine a corresponding target security monitoring queue from a plurality of preset security monitoring queues according to the data category to which each alarm data belongs; the security monitoring queue includes a plurality of event nodes and event association rules between adjacent nodes; A monitoring module, used to perform security monitoring on the alarm data according to the target security monitoring queue and generate a security monitoring result; The determining module is used to: Inserting the alarm data as an event node into each security monitoring queue; Determine a target security monitoring queue that matches the data category of the alarm data according to event association rules preset in each security monitoring queue; When there is no target security monitoring queue in the preset security monitoring queue that matches the data category of the alarm data, determining a target logical chain that matches the data category of the alarm data in the preset security monitoring rule, and establishing a target security monitoring queue for the alarm data according to the target logical chain; When there is no target logical chain matching the data category of the alarm data in the preset security monitoring rules, an alarm message is generated; The logic chain includes two event association nodes and event association rules between the two nodes, and multiple logic chains construct a security monitoring queue.

6. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when a processor executes the computer-executable instructions, the method according to any one of claims 1 to 4 is implemented.

Images