Network topology generation method and system based on substation service data stream information

Abstract

The application discloses a network topology generation method and system based on transformer substation service data stream information, and the method comprises the following steps: collecting various service stream information on the link in the transformer substation network and the switch state, including service stream five-tuple information, service stream statistical information, the input and output port numbers of the service stream on the switch, and the mac address table learned by the switch; performing path analysis and calculation of terminal equipment to the switch according to the service stream five-tuple, the statistical information, and the input and output ports of the service stream, and performing path analysis and calculation between switches according to the mac address table, the statistical information, and the input and output ports of the service stream; generating network topology information according to the path of the terminal equipment to the switch and the path between the switches, and performing network topology drawing and state display according to the generated network topology information. The application realizes network topology information collection, analysis and topology generation without relying on the link layer neighbor protocol, and provides support for improving the operation and maintenance management capability of the transformer substation.

Description

Technical Field

[0001] This invention relates to the fields of power system automation control and network communication technology, specifically to a network topology generation method and system based on substation business data flow information. Background Technology

[0002] The power system is a large-scale system involving grid dispatch automation, substation automation, relay protection, and distribution network automation. It is a key infrastructure vital to the national economy and people's livelihood; attacks on it can cause enormous losses and social impacts. Currently, attack patterns targeting the power system are gradually increasing. Minimizing the application of standard network protocols in substation communication networks can effectively reduce equipment vulnerability risks. Therefore, domestic substation communication network equipment technical specifications and owners have begun to require that substation communication networks only allow the transmission of substation business messages, disabling network protocols unrelated to substation business. Currently, smart substations rely on Link Layer Discovery Protocol (LLDP) for collecting dynamic network topology information. However, with the need to disable business-irrelevant protocols for security reasons, the operation and maintenance management of substation communication networks loses its LLDP data source. Therefore, there is an urgent need for a technology that can construct substation network topology without relying on link layer protocols. Summary of the Invention

[0003] Purpose of the invention: This invention proposes a network topology generation method and system based on substation business data flow information, which enables the collection of substation communication network topology information without relying on link layer protocols, effectively improving the operation and maintenance capabilities of substation automated communication networks and supporting the safe and stable operation of the power grid.

[0004] Technical solution: A network topology generation method based on substation business data flow information, comprising the following steps:

[0005] Collect various service flow information and switch status on the links in the substation network, including service flow five-tuple information, service flow statistics, input and output port numbers of service flows on the switches, and MAC address tables learned by the switches;

[0006] Based on the service flow quintuple information, service flow statistics, and the input / output ports of the corresponding service flow of the switch, path analysis and calculation are performed from the terminal device to the switch. Based on the MAC address table learned by the switch, service flow statistics, and the input / output ports of the corresponding service flow of the switch, path analysis and calculation are performed between switches.

[0007] Network topology information is generated based on the path from the terminal device to the switch and the path between switches. The network topology is then drawn and its status is displayed based on the generated network topology information.

[0008] Furthermore, the services in the substation network include process layer services, station control layer IP services, and station control layer GOOSE services;

[0009] The process layer business flow five-tuple information includes: source MAC, destination MAC, VLAN number, IED name, and appid;

[0010] The five-tuple information for IP service flows at the station control layer includes: source MAC address, destination MAC address, source IP address, destination IP address, IP type, and port number.

[0011] The GOOSE 5-tuple information at the station control layer includes: source MAC, destination MAC, VLAN number, IED name, and appid.

[0012] Furthermore, for station control layer IP services, path analysis and calculation include: determining the port number corresponding to the service flow based on the destination MAC, destination IP, source MAC, and source IP in the service flow 5-tuple; searching for the corresponding input and output ports in the service flow statistics table based on the port number to determine the ports connecting the switch and the terminal device; determining the cascading ports connected to other switches based on the port numbers corresponding to multiple MAC addresses in the MAC address table; if the determined input or output port is not a cascading port, then the input or output port is connected to the terminal device; if it is a cascading port, then determining the cascading port connection relationship between switches based on the input and output statistics information of the corresponding entries of the cascading ports of different switches in the service flow statistics table; and drawing the physical links of the station control layer network based on the determined ports connected to the terminal device and the cascading port connection relationship between switches.

[0013] Furthermore, for IP services at the station control layer, path analysis and calculation also include: based on physical links, service flow information, and service flow statistics, taking the service flow sending terminal as the source point, deriving the service flow path according to the collected service flow input and output statistics, and drawing the logical link topology.

[0014] Furthermore, for station control layer GOOSE services and process layer services, path analysis and calculation include: obtaining the source MAC address, VLAN number, and IED name corresponding to the appid from the collected service 5-tuple; searching for the port number corresponding to the same MAC address and VLAN number in the MAC address table based on the source MAC address and VLAN number to determine the port connected to the device with the IED name; determining the cascading port connected to other switches based on the port numbers corresponding to multiple MAC addresses in the MAC address table; determining the cascading port connection relationship between switches based on the input and output statistics of the corresponding entries of the cascading ports of different switches in the service flow statistics table; and drawing the physical links of the process layer network based on the determined connection ports of the IED devices and the cascading port connection relationship between switches.

[0015] Furthermore, for station control layer GOOSE services and process layer services, the path analysis and calculation also include: based on the physical link, taking the device corresponding to the source MAC in the service quintuple as the starting point, determining the service flow path according to the service flow input and output statistics of the corresponding appid in the service flow statistics information table, and drawing the logical link of GOOSE / SV.

[0016] A network topology generation system based on substation service data flow information includes a substation service flow acquisition system and a substation communication network management system. The substation service flow acquisition system collects substation service flow information and uploads the collected information to the substation communication network management system. The substation communication network management system collects and receives the acquisition results from the substation service flow acquisition system and performs analysis, calculation, and network topology drawing and display processing of the service flow data. The substation communication network management system includes:

[0017] The data acquisition module is used to collect various service flow information and switch status on the links in the substation network, including service flow five-tuple information, service flow statistics, input and output port numbers of service flows on the switch, and MAC address table learned by the switch.

[0018] The topology data analysis and calculation module is used to perform path analysis and calculation from terminal devices to switches based on service flow five-tuple information, service flow statistics, and the input and output ports of the corresponding service flows of the switches; to perform path analysis and calculation between switches based on the MAC address table learned by the switches, service flow statistics, and the input and output ports of the corresponding service flows of the switches; and to generate network topology information based on the paths from terminal devices to switches and the paths between switches.

[0019] The topology display module is used to draw the network topology and display its status based on the generated network topology information.

[0020] Furthermore, after the data acquisition module establishes a connection with the substation network switch, it periodically sends service flow data reading instructions to the substation network switch, receives the service flow data and actively uploaded service flow event data from the substation network switch, stores them, and hands them over to the topology data analysis and calculation module for processing.

[0021] The present invention also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the network topology generation method based on substation business data flow information as described above.

[0022] Beneficial effects: This invention addresses the characteristics of substation automation communication network switches, substation service characteristics, and operation and maintenance management needs. By collecting information on substation service flows and switch status information, and analyzing and calculating the collected information, it generates substation network topology information. This enables the collection of substation communication network topology information without relying on link layer protocols, effectively improving the operation and maintenance capabilities of substation automation communication networks and supporting the safe and stable operation of the power grid. Attached Figure Description

[0023] Figure 1 This is a network architecture diagram for collecting business data flow information in substations;

[0024] Figure 2 This is a diagram of the substation communication network management system;

[0025] Figure 3 This is a flowchart of the network topology generation process;

[0026] Figure 4 This is a network and service flow diagram based on Example 1;

[0027] Figure 5 This is a schematic diagram of the physical topology of the process layer network according to Embodiment 1;

[0028] Figure 6 This is a schematic diagram of the Goose business logic topology of the process layer protection device according to Embodiment 1;

[0029] Figure 7 This is a schematic diagram of the physical topology of the station control layer network according to Example 2;

[0030] Figure 8 This is a schematic diagram of the station control layer backend and protection device MMS business logic topology according to Embodiment 2. Detailed Implementation

[0031] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0032] The present invention discloses a network topology generation system based on substation service data flow information, comprising a substation service flow acquisition system and a substation communication network management system. The substation service flow acquisition system is used to collect substation service flow information, and the collected information is sent to the substation communication network management system by instruction or by active upload. The substation communication network management system is used to collect and receive the acquisition results of the substation service flow acquisition system, and to perform processing such as analysis, calculation, and network topology drawing display of the service flow data.

[0033] Reference Figure 1 According to an embodiment of the present invention, the substation service flow acquisition system consists of a substation network switch and connected terminal devices. The terminal devices are both producers and receivers of service flows. The switch collects service flow information on the links connecting the terminal devices and other switches. The information collected by the substation service flow acquisition system is sent up either by instruction or proactively. The substation communication network management system is a substation communication management software module deployed in the substation backend, central control station, dispatching system, or substation switch to realize information collection and monitoring of the substation communication network; in this embodiment, the substation communication network management software module is deployed in the substation monitoring backend system.

[0034] The substation communication network management system issues service flow information collection commands through the management interface address of the switch in the substation service flow acquisition system. The switch in the acquisition system receives the commands and records the address information of the network management system. The switch returns service flow information to the communication network management system according to the collection commands. Additionally, the switch actively sends service flow change events to the communication network management system. The substation communication network management system receives the switch's response data and the event data actively sent by the switch, analyzes and calculates the received service flow data, generates network topology information based on the analysis and calculation results, and draws and displays the network topology based on the generated network topology information. The network topology includes the physical network topology of the physical devices and the logical network topology of the substation service functions.

[0035] Substation construction must adhere to relevant international, industry, and enterprise standards, which specify the message transmission / reception protocols for various equipment. The IEC 61850 standard is currently the only globally accepted standard in the field of power system automation, making the implementation of smart substation projects standardized, unified, and transparent. Currently, smart substations in my country are based on the IEC 61850 standard, employing a "three-layer, two-network" structure: process layer, bay layer, and station control layer. Communication between devices in these three layers occurs through the station control layer network and the process layer network. Figure 1As shown in Table 1, substation service flows include substation application service data flows such as process layer GOOSE, process layer SV, station control layer MMS, station control layer UDP, and station control layer GOOSE. Service messages on the network are shown in Table 1.

[0036] Table 1. Description of Service Messages in Substation Networks

[0037]

[0038]

[0039] Each type of message corresponds to a specific system service function, and message flows with the same five-tuple characteristics constitute a service flow. As shown in Table 1, there are two types of message types: Layer 3 (IP messages) and Layer 2 (Ethertype). Service flow characteristics are described based on the fields of these two message types. Station control layer messages are all Layer 3 messages, and process layer messages are all Layer 2 messages, which is also specified in the IEC 61850 standard.

[0040] Substation service flow information includes: service flow 5-tuple information, service flow statistics, and inbound and outbound port numbers of the service flow at the switch. The 5-tuple information refers to five types of information, specifically as follows:

[0041] The process layer business flow five-tuple information includes: source MAC, destination MAC, VLAN number, IED name, and appid;

[0042] The five-tuple information for IP service flows at the station control layer includes: source MAC address, destination MAC address, source IP address, destination IP address, IP type, and port number.

[0043] The GOOSE 5-tuple information at the station control layer includes: source MAC address, destination MAC address, VLAN ID, IED name, and appid.

[0044] Business flow statistics include: number of input packets, number of output packets, number of input bytes, number of output bytes, number of input packet losses, and number of output packet losses by port.

[0045] The information collected by the switch specifically includes:

[0046] Switch device information: CPU utilization, storage space utilization, power status, device temperature, device MAC address, device IP address, device name, etc.

[0047] Dynamic MAC address learning results: The source MAC address information of network packets learned by the switch forwarding chip based on the port;

[0048] Terminal device learning information: Terminal device address information learned by the switch through the internal mirror port data stream; In addition to address information, the GOOSE / SV data stream learning results also include the terminal device IED name;

[0049] Service flow information: The switch learns and records the service flow 5-tuple information through its internal mirror port;

[0050] Business flow statistics: Statistical results based on the learned business flow 5-tuple results, obtained through switch ACL statistical actions or switch chip hardware sampling software statistical methods;

[0051] Switch port status: The physical link status of the communication interface of the switch device;

[0052] Port traffic statistics: Switch port statistics results;

[0053] Events actively reported by the switch include: switch device anomalies (such as dual power supply failure, device temperature exceeding limits, CPU utilization exceeding limits, memory utilization exceeding limits, etc.), switch physical interface link up / down, physical link traffic exceeding limits, service logic link traffic exceeding limits, switch configuration changes, and other event information.

[0054] For uploading information collected by the switch, the information can be modeled according to IEC61850 and sent to the backend machine using the MMS protocol; or the information collected by the switch can be modeled according to SNMPMIB and sent to the backend machine using the SNMP protocol.

[0055] like Figure 2 As shown, the substation communication network management system includes a network configuration management module, a data acquisition module, a topology data analysis and calculation module, and a topology display module. Combined with... Figure 3 The network topology generation process includes:

[0056] The network configuration management module loads the substation communication network switch management address through the configuration interface or configuration file. The data acquisition module establishes a communication connection with the substation network switch through the switch management address obtained by the network configuration management module.

[0057] After the data acquisition module establishes a connection with the substation network switch, it periodically sends service flow data reading instructions to the substation network switch, receives the service flow data and actively sent service flow event data from the substation network switch, stores them, and hands them over to the topology data analysis and calculation module for processing.

[0058] The data acquisition module periodically sends the following read commands to the switches in the service flow acquisition system: command to read switch device status, command to read dynamic MAC address learning results on the switch, command to read switch terminal device learning information, command to read service flow information, command to read service flow statistics, command to read switch port status, and command to read port statistics.

[0059] The topology data analysis and calculation module processes the data received by the data acquisition module. Based on key fields of the service flow link, such as device name, switch port number, device MAC address, and MAC information learned by the switch, the module performs topology calculations to generate the physical topology and the logical topology of the service flow. Based on event information sent by the switch, the module recalculates the corresponding physical and logical topologies and records the relevant events in the log. Specifically, the station control layer MMS topology and UDP service topology perform path analysis and calculation from the terminal to the network device based on the destination MAC, destination IP, source MAC, source IP information, statistical information, and the input / output ports of the corresponding service flow in the collected service flow information. The station control layer GOOSE service topology, process layer GOOSE service topology, and process layer SV service topology perform path analysis and calculation from the terminal to the network device based on the destination MAC, source MAC, appid, VLAN number, statistical information, and the input / output ports of the corresponding service flow in the collected service flow information. Here, "network device" refers to the switch.

[0060] Specifically, the topology data analysis and calculation module calculates the GOOSE service topology at the station control layer, the GOOSE service topology at the process layer, and the SV service topology at the process layer, including: obtaining the source MAC address, VLAN number, and IED name corresponding to the appid from the collected service 5-tuple; searching for the port number corresponding to the same MAC address and VLAN number in the MAC address table based on the source MAC address and VLAN number; and determining the IED. The device connected to the name is identified by the following steps: First, the cascading ports connected to other switches are determined based on the port numbers corresponding to multiple MAC addresses in the MAC address table. Second, the cascading port connections between switches are determined based on the input and output statistics of the corresponding entries in the service flow statistics table for the cascading ports of different switches. For example, if cascading port G1 of switch A has N1 output packets and N2 output bytes corresponding to a certain MAC or appid in the service flow statistics table, and cascading port G2 of switch B has N1 input packets and N2 input bytes corresponding to the same MAC or appid in the service flow statistics table, then it can be determined that interface G1 of switch A is connected to interface G2 of switch B. Based on the determined connection ports of the IED devices and the cascading port connections between switches, the physical links of the process layer network are drawn. Based on the physical links, starting from the device corresponding to the source MAC in the service 5-tuple, the service flow path is determined according to the service flow input and output statistics of the corresponding appid in the service flow statistics table, and the logical links of GOOSE / SV are drawn.

[0061] The topology data analysis and calculation module calculates the MMS topology and UDP service topology for the station control layer, including: determining the port number corresponding to the service flow based on the destination MAC, destination IP, source MAC, and source IP in the service flow 5-tuple; looking up the corresponding input and output ports in the service flow statistics table based on the port number; and determining the ports connecting the switch and the terminal device. For example, based on the source MAC and source IP in the service flow 5-tuple, the source port number corresponding to the service flow from source S1 is determined; based on the input port of the service flow corresponding to that source port number in the service flow statistics table, it can be determined that the input port is connected to the source S1. Alternatively, based on the destination MAC and destination IP in the service flow 5-tuple, the destination port number corresponding to the service flow from destination D1 is determined; based on the output port of the service flow corresponding to that destination port number in the service flow statistics table, it can be determined that the output port is connected to the destination D1. The phrase "connected to" here indicates that a connection exists between the two, which is a logical connection, not necessarily a direct physical connection. It is also necessary to determine whether there are intermediate devices, i.e., whether the connection is through other switches. Based on the port numbers corresponding to multiple MAC addresses in the MAC address table, determine the cascading ports connected to other switches. If the input or output port determined by the MAC address and service flow statistics table is not a cascading port, then that input or output port is connected to the terminal device switch. If it is a cascading port, determine the cascading port connection relationship between switches based on the input and output statistics of the corresponding entries in the service flow statistics table for the cascading ports of different switches. For example, if switch A's cascading port G1 has N1 output packets and N2 output bytes corresponding to a certain MAC or appid in the service flow statistics table, and switch B's cascading port G2 has N1 input packets and N2 input bytes corresponding to the same MAC or appid in the service flow statistics table, then switch A's G1 interface is connected to switch B's G2 interface. Based on the determined ports connected to the terminal device and the cascading port connection relationships between switches, draw the physical links of the station control layer network. Based on the physical topology results, and according to the service flow information and service flow statistics, the path of the service flow is derived from the service flow sending terminal as the source point, and the logical link topology is drawn.

[0062] The topology display module draws and displays the network topology diagram based on the results of the topology data analysis and calculation module, displays topology-related topology events, and displays the history of topology changes.

[0063] Example 1:

[0064] The description uses the GOOSE and SV business flows at the process layer as examples. Figure 4 As shown, the service flow information collected by process layer switch E1 is as follows:

[0065] Table 1-1 Service Flows Collected by Switch E1

[0066]

[0067] Table 2-1 Service Flow Statistics Collected by Switch E1

[0068]

[0069] Table 3-1 Device Information Collected by Switch E1

[0070]

[0071] Table 4-1 MAC Address Table Learned by Switch E1

[0072]

[0073] Table 5-1 Event Information Collected by Switch E1

[0074]

[0075] The service flow information collected by the process layer switch E2 is as follows:

[0076] Table 1-2 Service Flows Collected by Switch E2

[0077]

[0078] Table 2-2 Service Flow Statistics Collected by Switch E2

[0079]

[0080]

[0081] Table 3-2 Device Information Collected by Switch E2

[0082]

[0083] Table 4-2 MAC Address Table Learned by Switch E2

[0084]

[0085] Table 5-2 Event Information Collected by Switch E2

[0086]

[0087] The service flow information collected by the process layer switch E3 is as follows:

[0088] Table 1-3 Service Flow Collected by Switch E3

[0089]

[0090] Table 2-3 Service Flow Statistics Collected by Switch E3

[0091]

[0092] Table 3-3 Device Information Collected by Switch E3

[0093]

[0094] Table 4-3 MAC Address Table Learned by Switch E3

[0095]

[0096] Table 5-3 Event Information Collected by Switch E3

[0097]

[0098] The physical topology and logical topology of the service flow can be calculated from the service flow five-tuple information, service flow statistics, and MAC address information collected by process layer switches E1 to E3.

[0099] Based on the service flow 5-tuple information and MAC address information, it can be determined that the P2 port of device E1 is connected to terminal device IM3301A and the P5 port is connected to terminal device PT3301A. According to the mechanism that cascaded ports of switches have multiple MAC addresses, G1 is determined to be the cascaded port connected to it. Similarly, the terminal devices and cascaded ports connected to switches E2 and E3 can be deduced. Furthermore, based on the service flow statistics of switches E1, E2, and E3, it can be deduced that the G1 interface of E1 connects to the G2 interface of E2, and the G1 interface of E2 connects to the G2 interface of E3. The physical links of the process layer network are drawn according to this principle. Combining the physical topology results, based on the service flow information and service flow statistics, with the service flow sending terminal as the source point, the path of the service flow is deduced according to the collected service flow input and output statistics, and the logical link topology of Goose / SV is drawn. The station control layer physical network topology and service logical link topology are drawn according to the same principle. The physical topology in this embodiment is as follows: Figure 5 As shown, the logical link topology of appid=0x4005 issued by protection device B1 is as follows: Figure 6 As shown.

[0100] When event information from E2 and E3 is collected, it indicates a link down anomaly in the cascaded link between E2 and E3, triggering an alarm, and the corresponding physical link on the topology diagram turns red. Device information collected by the switches is used to monitor the operational status of the switch devices, and the network management system performs health checks and identifies the collected information.

[0101] Example 2:

[0102] The description takes the MMS service flow at the station control layer as an example, such as... Figure 1 The following table shows the MMS service flow of the back-end machine and protection device B1, and the information collected by the station control layer switch:

[0103] Table 1-6 Service Flows Collected by Station Control Layer Switch A

[0104]

[0105] Table 2-6 Service Flow Statistics Collected by Station Control Layer Switch A

[0106]

[0107] Table 3-6 Equipment Information Collected by Station Control Layer Switch A

[0108]

[0109] Table 4-6 MAC Addresses Learned by Station Control Layer Switch A

[0110]

[0111] Table 5-6 Event Information Collected by Station Control Layer Switch A

[0112]

[0113] The information collected by station control layer switch B is as follows:

[0114] Table 1-7 Service Flow Collected by Station Control Layer Switch B

[0115]

[0116] Table 2-7 Service Flow Statistics Table Collected by Station Control Layer Switch B

[0117]

[0118]

[0119] Table 3-7 Equipment Information Collected by Station Control Layer Switch B

[0120]

[0121] Table 4-6 MAC Addresses Learned by Station Control Layer Switch B

[0122]

[0123] Table 5-7 Event Information Collected by Station Control Layer Switch B

[0124]

[0125] The physical topology and logical topology of the service flow can be calculated from the service flow five-tuple information, service flow statistics, and MAC address information collected by station control layer switches A and B.

[0126] Based on the service flow 5-tuple information and MAC address information, it can be determined that the P4 port of station control layer switch A is connected to the terminal device with IP address 10.104.113.100 and source MAC address 1c-00-42-14-20-32. The presence of multiple MAC addresses under the G1 interface indicates that the G1 interface is a cascading port. Similarly, the interfaces and cascading ports of the terminal devices connected to station control layer switch B can be deduced. The P4 port of station control layer switch B is connected to the terminal device with IP address 10.104.113.20 and source MAC address 1c-00-42-14-20-12, and its G1 port is a cascading port. Furthermore, based on the service flow statistics of station control layer switches A and B, it can be deduced that the G1 interface of station control layer switch A connects to the G1 interface of station control layer switch B. The physical links of the station control layer network can be drawn according to this principle. Based on the physical topology results, and according to the service flow information and statistics, the service flow path is derived from the service flow sending terminal as the source point, according to the collected service flow input and output statistics, thus drawing the logical link topology of the MMS for the backend and protection device B1. The physical network topology and MMS service logical link topology for other switches and terminal devices in the station control layer are drawn using the same principle. The physical topology in this embodiment is as follows: Figure 7 As shown, the MMS logical link topology for communication between protection device B1 and the backend is as follows: Figure 8 As shown.

[0127] When event information is collected from station control layer switch A and station control layer switch B, it indicates a change in the physical links of the switches, triggering an alarm. The corresponding physical link on the topology diagram turns red, prompting maintenance personnel to check the terminal equipment or the connection status of the corresponding physical link. The device information collected by the switches is used to monitor the operating status of the switch equipment. The network management system performs health checks and identifies the collected information.

Claims

1. A network topology generation method based on substation business data flow information, characterized in that, Includes the following steps: This system collects various service flow information and switch status on links in the substation network, including service flow 5-tuple information, service flow statistics, input and output port numbers of service flows on switches, and MAC address tables learned by switches. Services in the substation network include process layer services, station control layer IP services, and station control layer GOOSE services. The process layer service flow 5-tuple information includes: source MAC, destination MAC, VLAN number, IED name, and appid; the station control layer IP service flow 5-tuple information includes: source MAC, destination MAC, source IP, destination IP, IP type, and port number; the station control layer GOOSE 5-tuple information includes: source MAC, destination MAC, VLAN number, IED name, and appid. Based on the service flow 5-tuple information, service flow statistics, and the input / output ports of the corresponding service flows on the switches, path analysis and calculation are performed from the terminal device to the switch. Based on the MAC address table learned by the switches, service flow statistics, and the input / output ports of the corresponding service flows on the switches, path analysis and calculation are performed between switches. For station control layer IP services, the path analysis and calculation includes: determining the port number corresponding to the service flow based on the destination MAC, destination IP, source MAC, and source IP in the service flow 5-tuple information; searching for the corresponding input and output ports in the service flow statistics table based on the port number to determine the ports connecting the switch and the terminal device; determining the cascading ports connecting the switch to other switches based on port numbers with multiple MAC addresses in the MAC address table; if the determined input or output port is not a cascading port, then the input or output port is connected to the terminal device; if it is a cascading port, then determining the cascading port connection relationship between switches based on the input and output statistics of the corresponding entries in the service flow statistics table for the cascading ports of different switches; and drawing the physical links of the station control layer network based on the determined ports connected to the terminal device and the cascading port connection relationship between switches. For station control layer GOOSE services and process layer services, path analysis and calculation include: obtaining the source MAC address, VLAN number, and IED name corresponding to the appid from the collected service flow 5-tuple information; searching for the port number corresponding to the same MAC address and VLAN number in the MAC address table based on the source MAC address and VLAN number to determine the port connected to the device with the IED name; determining the cascading port connected to other switches based on the port numbers corresponding to multiple MAC addresses in the MAC address table; determining the cascading port connection relationship between switches based on the input and output statistics of the corresponding entries of the cascading ports of different switches in the service flow statistics table; and drawing the physical links of the process layer network based on the determined connection ports of the IED devices and the cascading port connection relationship between switches. Network topology information is generated based on the path from the terminal device to the switch and the path between switches. The network topology is then drawn and its status is displayed based on the generated network topology information.

2. The method according to claim 1, characterized in that, For IP services at the station control layer, path analysis and calculation also include: based on physical links, service flow information, and service flow statistics, taking the service flow sending terminal as the source point, deriving the service flow path according to the collected service flow input and output statistics, and drawing the logical link topology.

3. The method according to claim 1, characterized in that, For station control layer GOOSE services and process layer services, path analysis and calculation also include: based on physical links, taking the device corresponding to the source MAC in the service flow five-tuple information as the starting point, determining the service flow path according to the service flow input and output statistics of the corresponding appid in the service flow statistics information table, and drawing the logical link of GOOSE / SV.

4. The method according to claim 1, characterized in that, The collection of various service flow information and switch status on the links in the substation network includes: periodically sending data collection commands to the switches, receiving service flow data in response to the switches, and service flow event data actively sent by the switches.

5. A network topology generation system based on substation business data flow information, characterized in that, The system includes a substation service flow acquisition system and a substation communication network management system. The substation service flow acquisition system collects substation service flow information and uploads the collected information to the substation communication network management system. The substation communication network management system collects and receives the acquisition results from the substation service flow acquisition system and performs analysis, calculation, and network topology mapping and display processing of the service flow data. The substation communication network management system includes: The data acquisition module is used to collect various service flow information and switch status on the links in the substation network, including service flow 5-tuple information, service flow statistics, input and output port numbers of service flows on the switches, and the MAC address table learned by the switches. The services in the substation network include process layer services, station control layer IP services, and station control layer GOOSE services. The process layer service flow 5-tuple information includes: source MAC, destination MAC, VLAN number, IED name, and appid; the station control layer IP service flow 5-tuple information includes: source MAC, destination MAC, source IP, destination IP, IP type, and port number; the station control layer GOOSE 5-tuple information includes: source MAC, destination MAC, VLAN number, IED name, and appid. The topology data analysis and calculation module is used to perform path analysis and calculation from terminal devices to switches based on service flow 5-tuple information, service flow statistics, and the input / output ports of the corresponding service flows on the switches; to perform path analysis and calculation between switches based on the MAC address table learned by the switches, service flow statistics, and the input / output ports of the corresponding service flows on the switches; and to generate network topology information based on the paths from terminal devices to switches and the paths between switches. For station control layer IP services, the path analysis and calculation includes: determining the port number corresponding to the service flow based on the destination MAC, destination IP, source MAC, and source IP in the service flow 5-tuple information; and based on the port number... The system searches for the corresponding input and output ports in the service flow statistics table to determine the ports connecting the switch to the terminal device. Based on the port numbers corresponding to multiple MAC addresses in the MAC address table, it identifies the cascading ports connecting to other switches. If the identified input or output port is not a cascading port, it is connected to the terminal device. If it is a cascading port, the system determines the cascading port connection relationship between switches based on the input and output statistics of the corresponding entries in the service flow statistics table. Finally, based on the identified ports connected to the terminal device and the cascading port connection relationships between switches, the system draws the physical links of the station control layer network. For station control layer GOOSE services and process layer services, path analysis and calculation include: obtaining the source MAC address, VLAN number, and IED name corresponding to the appid from the collected service flow 5-tuple information; searching for the port number corresponding to the same MAC address and VLAN number in the MAC address table based on the source MAC address and VLAN number to determine the port connected to the device with the IED name; determining the cascading ports connecting the switch to other switches based on the port numbers corresponding to multiple MAC addresses in the MAC address table; determining the cascading port connection relationship between switches based on the input and output statistics of the corresponding entries in the service flow statistics table for the cascading ports of different switches; and drawing the physical links of the process layer network based on the determined connection ports of the IED devices and the cascading port connection relationship between switches. The topology display module is used to draw the network topology and display its status based on the generated network topology information.

6. The system according to claim 5, characterized in that, After establishing a connection with the substation network switch, the data acquisition module periodically sends service flow data reading instructions to the substation network switch, receives the service flow data and actively uploaded service flow event data from the substation network switch, stores them, and hands them over to the topology data analysis and calculation module for processing.

7. A computer device, characterized in that, include: One or more processors; Memory; as well as One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the network topology generation method based on substation business data flow information as described in any one of claims 1-4.

Images