A method for identifying power grid equipment status based on finite state machine

Abstract

The present invention discloses a method for identifying the state of power grid equipment based on a finite state machine, and relates to the application technical field of finite state machines, including the following steps: obtaining access data and equipment current data in the management information area before the equipment state library constructed based on the finite state machine performs information comparison with the D5000 system in the management information area; and constructing a data interaction evaluation model based on the bp neural network algorithm to generate an interaction hidden danger coefficient; comparing the interaction hidden danger coefficient generated before the information comparison with a preset permission threshold, issuing an early warning and system maintenance for the information comparison behavior corresponding to the abnormal interaction hidden danger coefficient, and suspending the information comparison; obtaining several interaction hidden danger coefficients within the P time interval within the G time during the system maintenance process, and performing data analysis to determine whether to continue the information comparison. The present application solves the problem of data leakage in the data comparison process between the D5000 and the finite state machine in the identification of the state of power grid equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of application of finite state machines, and more specifically, to a method for identifying the state of power grid equipment based on finite state machines. Background Art

[0002] A finite state machine (FSM) is a mathematical model used to describe how an object transitions between different states and how it responds to input events. It consists of a set of states, an initial state, input events, and transition rules. State machines can be deterministic (each state has only one exit) or non-deterministic (a state may have multiple exits). They are widely used in computer science and engineering in scenarios such as simulation control systems, programming language parsing, and communication protocols.

[0003] The finite state machine combined with the state recognition of power grid equipment can abstract the working state of the equipment into different states by monitoring and analyzing the operating data of the power grid equipment. For example, the equipment may be in normal operation, failure, maintenance, etc. The finite state machine can judge the current state based on the input data (such as sensor data or equipment status information) and automatically update the state according to the predefined transfer rules. This combination can help monitor the health status of power grid equipment in real time, warn of possible failures in advance, and optimize the maintenance plan of the equipment, thereby improving the reliability and efficiency of power grid equipment.

[0004] The power grid equipment status library is a collection of various possible states of power grid equipment and their descriptions, which are usually obtained by experts and engineers based on the operating characteristics and data analysis of the equipment. These status descriptions include the normal operating state of the equipment, various possible fault states, maintenance states, and other specific operating conditions. The establishment of the power grid equipment status library helps system monitoring and management personnel to accurately identify the current operating state of the equipment and take necessary maintenance and repair measures in a timely manner to ensure the safe operation and long-term reliability of power grid equipment.

[0005] The D5000 system is a high-performance data acquisition and control system that is widely used in industrial automation and real-time control. It has powerful real-time data processing capabilities and high-precision data acquisition functions, and can support a variety of input and output modules, including analog signals, digital signals, and communication interfaces. The D5000 system is usually composed of an industrial-grade hardware platform and dedicated software, which can effectively monitor and control complex industrial processes and improve production efficiency and product quality.

[0006] For example, the invention patent with announcement number: CN101915894B discloses a method for testing a real-time finite state machine in a digital logic device, including the following steps: S1, reducing test cases, completing the compilation of test cases, and generating a test sequence; S2, performing tests in a fully automatic test mode to generate test results; S3, collecting test results and sending them to a host computer. Among them, the step S1 specifically includes: S1-1, starting from the initial state S1 of power-on reset, traversing all trigger input conditions I1 of the state, and checking whether the state transfer is correct; S1-2, traversing all trigger input conditions Ii for the next state Si transferred from the initial state in a normal trigger mode, and checking whether the state transfer is correct; S1-3, testing all N states in the manner of step S1-2. S1-4, discretizing the time constraint value in the trigger input condition, solving the problem of the explosion of the number of test cases and improving the test.

[0007] For example, the invention patent with announcement number: CN109557414B discloses an integrated power system fault diagnosis and alarm processing system and method, including an artificial neural network module, which is configured to construct a forward neural network, and uses the constructed network to identify the fault type and select the fault category, find out the tripping range and possible fault components, and obtain the switch tripping information and protection action information; and a finite state machine modeling module, which is configured to construct a finite state machine, driven by the power system alarm sequence, the finite state machine identifies the order of signal state changes of each fault event, and uses a state transition diagram to represent the finite state machine identification result to form the alarm information of the whole process. The present invention has the characteristics of fast, fault-tolerant and strong learning ability for the judgment of general fault alarms in the power system.

[0008] The above disclosed technical solutions have at least the following technical problems:

[0009] The existing power grid equipment status recognition introduces a finite state machine outside the original D5000 system, which reduces the cost of power grid equipment status recognition and makes the process more concise and efficient. However, during the data comparison process between D5000 and the finite state machine, there will be a problem of data leakage in the power grid equipment status recognition, which poses a threat to the operational safety of the power dispatching and control center.

[0010] In view of the above problems, the present invention proposes a solution. Summary of the invention

[0011] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a method for identifying the status of power grid equipment based on a finite state machine. By performing data analysis and subsequent maintenance tracking on the access data and equipment current data in the management information area before the equipment identification library based on the finite state machine interacts with the D5000 system, early warning and timely termination of data leakage in the information interaction process are achieved, so as to solve the problem of data leakage in the data comparison process between D5000 and the finite state machine in the identification of the status of power grid equipment.

[0012] To achieve the above object, the present invention provides the following technical solutions:

[0013] The method for identifying the state of power grid equipment based on a finite state machine comprises the following steps: obtaining access data and equipment current data in the management information area before comparing the information between the equipment state library constructed based on the finite state machine and the D5000 system; constructing a data interaction evaluation model based on the bp neural network algorithm for the access data and equipment current data in the management information area to generate an interaction hidden danger coefficient; comparing the interaction hidden danger coefficient generated before the information comparison with a preset permission threshold, issuing an early warning and system maintenance for the information comparison behavior corresponding to the abnormal interaction hidden danger coefficient, and suspending the information comparison; obtaining a number of interaction hidden danger coefficients within a P time interval within a G time during the system maintenance process, and performing data analysis to determine whether to continue the information comparison.

[0014] In a preferred embodiment, the access data of the management information area includes a network traffic abnormal fluctuation coefficient and a security incident potential risk coefficient, and the equipment current data includes an equipment current abnormality coefficient.

[0015] In a preferred embodiment, the specific acquisition method of the data interaction evaluation model is as follows: acquiring characteristic information data from the management information area and the equipment, the characteristic information data including the network traffic abnormal fluctuation coefficient, the security incident hidden danger coefficient and the equipment current abnormality coefficient; preprocessing the characteristics, the preprocessing including data cleaning and normalization processing; the bp neural network algorithm constructs the data interaction evaluation model, the specific steps are as follows: initializing the number of layers of the neural network and the number of neurons in each layer, the neural network includes an input layer, a hidden layer and an output layer; the number of nodes in the input layer is the number of types of characteristic information data; selecting the sigmoid function as the activation function in the hidden layer and the output layer; randomly initializing the weights and biases of the neural network; selecting the cross entropy loss as the loss function; using the Adam optimizer to minimize the loss function and update the weights and biases of the neural network for model training; during the training process, dividing the characteristic information data into a training set and a validation set for model training; using the trained model as the data interaction evaluation model, and using the output result of the data interaction evaluation model as the interaction hidden danger coefficient.

[0016] In a preferred embodiment, the interaction potential risk coefficient generated before information comparison is compared with a preset permission threshold, and an early warning and system maintenance are issued for the information comparison behavior corresponding to the abnormal interaction potential risk coefficient. Specifically, the interaction potential risk coefficient is compared with the preset permission threshold. When the interaction potential risk coefficient is greater than the permission threshold, an early warning is issued, system maintenance is performed, and information comparison is suspended; when the interaction potential risk coefficient is less than the permission threshold, a signal is issued to allow information comparison.

[0017] In a preferred embodiment, the method of obtaining several interactive hidden danger coefficients within the G time interval and the P time interval during the system maintenance process for data analysis to determine whether to continue state identification is as follows: obtaining several interactive hidden danger coefficients within the G time interval and the P time interval during the system maintenance process and synthesizing them into a maintenance evaluation set, and calculating the standard deviation and average value of the data in the maintenance evaluation set; using the interactive hidden danger coefficients in the maintenance evaluation set to calculate the interactive hidden danger coefficient standard deviation and the interactive hidden danger coefficient average value, and comparing the interactive hidden danger coefficient standard deviation and the interactive hidden danger coefficient average value with a pre-set standard deviation threshold and a permission threshold, respectively, and taking corresponding measures based on the comparison results, specifically: if the interactive hidden danger coefficient average value is greater than or equal to the permission threshold, a maintenance failure warning is issued; if the interactive hidden danger coefficient average value is less than the permission threshold and the interactive hidden danger coefficient standard deviation is greater than or equal to the standard deviation threshold, information comparison is suspended and continuous monitoring is performed; if the interactive hidden danger coefficient average value is less than the permission threshold and the interactive hidden danger coefficient standard deviation is less than the standard deviation threshold, maintenance is completed.

[0018] In a preferred embodiment, the specific method for obtaining the network traffic abnormality fluctuation coefficient is as follows: obtain the real-time network traffic in the management information area within K time; calculate the traffic standard deviation and traffic average of the real-time network traffic at different times within K time; calculate the network traffic abnormality coefficient based on the traffic standard deviation and traffic average; calculate the network traffic abnormality fluctuation coefficient based on a preset network traffic abnormality fluctuation coefficient calculation formula.

[0019] In a preferred embodiment, the specific method for obtaining the security incident hidden danger coefficient is as follows: based on the records of historical security incidents, obtain a set of all security incidents before data comparison, wherein the security incident set includes security incidents that have an impact and corresponding impact ratings; use the impact ratings corresponding to various security incidents in the security incident set as security weights; construct a security incident hidden danger regression model based on the security incident set and the corresponding security weights to generate a security incident hidden danger coefficient.

[0020] In a preferred embodiment, the specific analysis method of the equipment current anomaly coefficient is as follows: obtaining the timing current waveform data of the equipment operation during the identification process of the power grid equipment, and performing frequency domain conversion to obtain frequency domain current waveform data; performing feature extraction based on the frequency domain current waveform data to obtain current characteristics, the current characteristics include frequency characteristics, electric energy distribution characteristics and spectrum characteristics; the frequency characteristics include the difference between the peak frequency and the center frequency; the electric energy distribution characteristics include the electric energy ratio; the spectrum characteristics include the spectrum energy stability value; according to the current characteristics and the expected normal waveform, the deviation value between the calculated current characteristics and the expected normal waveform based on the preset equipment current anomaly coefficient calculation formula is used as the equipment current anomaly coefficient.

[0021] The technical effects and advantages of the power grid equipment state identification method based on the finite state machine of the present invention are as follows:

[0022] 1. The present invention uses a power grid equipment status identification method based on a finite state machine, and through the comprehensive application of the network traffic abnormal fluctuation coefficient, security incident hidden danger coefficient and equipment current abnormality coefficient in the management information area, significantly improves the technical effects and advantages of the system. This method can not only monitor and analyze network traffic in real time, quickly identify abnormal patterns and data transmission anomalies, and effectively warn of possible security threats and data leakage incidents, but also quantify and evaluate security incident risks, and respond to security vulnerabilities and malicious activities in a timely manner, thereby enhancing the data security of the management information area and the stability of the system. At the same time, the introduction of the equipment current abnormality coefficient further strengthens the ability to assess data leakage risks, effectively protects the confidentiality and integrity of key information, and provides reliable technical support and guarantee for power grid equipment status management.

[0023] 2. The present invention uses a data interaction evaluation model based on the BP neural network algorithm. The model combines the access data and equipment current data of the management information area, and realizes real-time evaluation and prediction of the system security status through the process of preprocessing, neural network design and training optimization. Its advantages include the comprehensive utilization of multiple data sources, the efficient processing capability of the neural network algorithm, the strong real-time security evaluation capability and the targeted early warning and maintenance mechanism, which effectively improves the accuracy and efficiency of data security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a structural schematic diagram of the power grid equipment status identification method based on the finite state machine of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Embodiment 1, Figure 1 The present invention provides a method for identifying power grid equipment status based on a finite state machine, comprising the following steps:

[0027] S1, before the device status library built based on the finite state machine compares the information in the management information area with the D5000 system, obtains the access data and device current data in the management information area.

[0028] The access data in the management information area includes a network traffic abnormal fluctuation coefficient and a security incident potential risk coefficient, and the equipment current data includes an equipment current abnormal coefficient.

[0029] The network traffic abnormal fluctuation coefficient refers to the statistic calculated when monitoring and analyzing the internal and external network traffic in the management information area, which is used to evaluate the abnormality of the traffic data; through real-time monitoring and analysis of network traffic data, it is possible to detect unusual traffic patterns, abnormal data transmission volume or frequency, and then calculate the network traffic abnormality coefficient. This indicator helps to identify possible security threats, attacks or data leakage incidents, and helps managers take preventive measures and response strategies in a timely manner to ensure the data security of the management information area and the stable operation of the system.

[0030] The network traffic abnormal fluctuation coefficient has the following advantages for discovering data security risks:

[0031] Real-time monitoring capability: The network traffic anomaly coefficient can monitor network traffic inside and outside the management information area in real time, promptly detect abnormal activities and unusual traffic patterns, and help to quickly respond to potential security threats and attacks;

[0032] Comprehensive analysis function: By comprehensively analyzing network traffic data and calculating the anomaly coefficient, the specific characteristics of traffic anomalies can be identified, such as abnormal data volume, transmission path or frequency changes, to help determine the type and severity of security incidents;

[0033] Cross-platform applicability: The network traffic anomaly coefficient is not limited by a specific operating system or application and is applicable to a variety of network environments and device types, thereby improving its wide applicability in discovering security risks in complex network environments;

[0034] Early warning and alert function: After setting the appropriate abnormal coefficient threshold, it can automatically trigger the early warning mechanism or alert management personnel to conduct further investigation and processing, which helps to prevent potential security incidents or data leakage in time;

[0035] Enhance security awareness: The application of network traffic anomaly coefficient can enhance the attention and awareness of managers and technicians on data security, prompting them to adopt more proactive security measures and strategies to cope with increasingly complex network security threats;

[0036] To sum up, as a tool for discovering data security risks, the network traffic anomaly coefficient has the important advantages of real-time monitoring, comprehensive analysis, cross-platform applicability, early warning and alert functions, as well as enhancing security awareness. It is of great significance and practical application value for ensuring the data security of the management information area.

[0037] The specific method for obtaining the network traffic abnormal fluctuation coefficient is as follows:

[0038] Obtain the real-time network traffic of the management information area within K time;

[0039] Calculate the standard deviation and average value of the real-time network traffic at different times within K time;

[0040] Calculate the network traffic anomaly coefficient based on the traffic standard deviation and traffic average;

[0041] The network traffic anomaly coefficient is calculated based on a preset network traffic anomaly fluctuation coefficient calculation formula.

[0042] The specific calculation formula of the network traffic anomaly coefficient is as follows:

[0043]

[0044] The specific calculation formula of the network traffic abnormal fluctuation coefficient is as follows:

[0045]

[0046] In the formula, is the network traffic anomaly coefficient, is the network traffic at the jth moment, is the total number of moments collected in time G, and j is the moment number; is the network traffic abnormal fluctuation coefficient.

[0047] The security incident potential risk coefficient is an indicator for evaluating and quantifying the risk and potential degree of security incidents that may exist in the management information area. By comprehensively analyzing the data collected by security event logs, abnormal behavior detection systems and other security monitoring tools, the security incident potential risk coefficient can be calculated to identify the pattern, frequency and severity of abnormal activities, which helps to identify potential security vulnerabilities, unauthorized access or malicious activities, so as to take preventive measures and response strategies in time to strengthen the data security protection of the management information area and the overall security of the system.

[0048] The security incident hidden danger coefficient has the following advantages for discovering data security hidden dangers before information comparison:

[0049] Early threat detection: The security incident risk coefficient can timely detect and identify potential security threats and abnormal activities by analyzing the data of security event logs and abnormal behavior monitoring systems, helping to discover existing data security risks before information comparison;

[0050] Comprehensive assessment: By comprehensively analyzing the pattern, frequency and severity of security incidents, the security incident potential coefficient can provide a comprehensive assessment of security incidents. It is not limited to a single data point or event, but is based on an overall security situation analysis, which helps to identify hidden and complex security risks;

[0051] Multi-dimensional analysis: The security incident risk coefficient takes into account data on a variety of security incidents and abnormal behaviors, including unauthorized access, abnormal data transmission, malware activities, etc. Through multi-dimensional analysis, the ability and accuracy of discovering data security risks are enhanced;

[0052] Early warning and response capabilities: After setting an appropriate threshold for the potential risk factor of security incidents, the early warning mechanism or security incident response process can be triggered in a timely manner, allowing managers to quickly take necessary measures to deal with potential security threats and data leakage risks;

[0053] Continuous improvement: Regular calculation and analysis of security incident risk coefficients can help organizations continuously improve their security strategies and measures, strengthen the sustainability and effectiveness of information security management, and thus effectively prevent and reduce the occurrence of data security risks;

[0054] To sum up, the security incident risk coefficient, as a tool for discovering data security risks before information comparison, has the important advantages of early threat detection, comprehensive assessment, multi-dimensional analysis, early warning and response capabilities, and continuous improvement. It is of great significance and practical application value for ensuring data security in the management information area.

[0055] The specific method for obtaining the safety incident hidden danger coefficient is as follows:

[0056] Based on the records of historical security events, obtain a set of all security events before data comparison, wherein the set of security events includes the security events that have an impact and the corresponding impact ratings;

[0057] The impact ratings corresponding to various security events in the security event set are used as security weights;

[0058] A security incident potential risk regression model is constructed based on the security incident set and the corresponding security weights to generate a security incident potential risk coefficient.

[0059] The specific calculation formula of the safety incident hidden danger coefficient is as follows:

[0060] In the formula, is the potential safety event coefficient, … is the security weight of the corresponding security event, … is the proportion of specific security incidents in all security incidents, is the type of security event, n is a positive integer, and is the number of the security event.

[0061] The impact of the device current coefficient on the potential for data leakage in the process of evaluating information exchange is mainly reflected in its ability to identify abnormal device operation or possible failure conditions by monitoring and analyzing the waveform characteristics of the device current, including frequency components, energy distribution, and spectral characteristics. This assessment can help discover possible unauthorized operations or unauthorized data access behaviors of the device, thereby warning and preventing possible data leakage incidents. Through real-time monitoring and timely alarms, the device current coefficient can enhance data security during the information exchange process, effectively reduce the risk of data leakage, and protect the confidentiality and integrity of key information.

[0062] The device current anomaly coefficient has the following advantages for discovering data security risks before information comparison:

[0063] Real-time monitoring and alarm capabilities: The equipment current anomaly coefficient can monitor the changes in equipment current data in real time. By setting a predetermined anomaly threshold, the system can immediately trigger an alarm when the current data exceeds the normal range, allowing managers to quickly respond to potential safety issues;

[0064] Accurately identify abnormal behavior: This coefficient is based on the analysis of the time-frequency characteristics of the current waveform, such as frequency content, energy distribution, and spectral characteristics; these characteristics can help the system accurately distinguish between normal operation and abnormal behavior, including unauthorized data access or abnormal equipment operation status;

[0065] Reduce the risk of data leakage: By continuously monitoring and analyzing the current waveform, the abnormal current coefficient of the equipment can help to detect possible equipment failures or security vulnerabilities early; timely alarms and responses can effectively reduce the risk of data leakage and protect the security and integrity of key information;

[0066] Support information comparison and safety management: The equipment current abnormality coefficient provides strong support to ensure data security during information comparison; it not only maintains vigilance during data transmission and processing, but also provides reliable data support and reference for safety management decisions;

[0067] Continuous optimization and improvement: By continuously optimizing and improving the algorithm and parameter settings of the current anomaly coefficient, the accuracy and response speed of the system can be further improved, enabling it to cope with evolving security challenges and threats;

[0068] In summary, the equipment current anomaly coefficient is not only an important indicator for discovering equipment operation anomalies, but also a key tool for ensuring information security and data integrity; its powerful real-time monitoring capability and accurate anomaly identification capability give it significant advantages and value in discovering and preventing data security risks before information comparison.

[0069] The specific analysis method of the equipment current abnormal coefficient is as follows:

[0070] Acquire the timing current waveform data of the equipment during the identification process of the power grid equipment, and perform frequency domain conversion to obtain frequency domain current waveform data;

[0071] Feature extraction is performed based on the frequency domain current waveform data to obtain current features, which include frequency features, electric energy distribution features, and spectrum features;

[0072] Frequency characteristics include the peak frequency and the center frequency difference;

[0073] The characteristics of power distribution include power share;

[0074] The spectrum characteristics include the spectrum energy stability value;

[0075] According to the current characteristics and the expected normal waveform, the deviation value between the calculated current characteristics and the expected normal waveform based on the preset equipment current abnormality coefficient calculation formula is used as the equipment current abnormality coefficient.

[0076] The specific calculation formula of the frequency domain current waveform data is:

[0077]

[0078] Then the specific calculation formula of the difference between the peak frequency and the center frequency is:

[0079]

[0080] Then the calculation formula of the electric energy ratio is:

[0081]

[0082] Then the calculation formula of the spectrum energy stability value is:

[0083]

[0084] The specific calculation formula of the equipment current abnormal coefficient is as follows:

[0085]

[0086] In the formula, is the frequency domain current waveform data, is the sequential current waveform data at time t, is the transformation function, is the scale of the transformation function, is the translation parameter of the transformation function; is the difference between the peak frequency and the center frequency, is the center frequency, and are the minimum and maximum values ​​of electric energy, respectively. is the proportion of electric energy, is the stable value of spectrum energy, is the maximum electrical energy within the frequency spectrum, is the minimum electric energy within the spectrum range, is the equipment current abnormality coefficient.

[0087] This implementation uses a power grid equipment status identification method based on a finite state machine, and through the comprehensive application of the network traffic abnormal fluctuation coefficient, security incident hidden danger coefficient and equipment current abnormality coefficient in the management information area, it significantly improves the technical effects and advantages of the system. This method can not only monitor and analyze network traffic in real time, quickly identify abnormal patterns and data transmission anomalies, and effectively warn of possible security threats and data leakage incidents, but also quantify and evaluate security incident risks, and respond to security vulnerabilities and malicious activities in a timely manner, thereby enhancing the data security of the management information area and the stability of the system. At the same time, the introduction of the equipment current abnormality coefficient further strengthens the ability to assess data leakage risks, effectively protects the confidentiality and integrity of key information, and provides reliable technical support and guarantee for power grid equipment status management.

[0088] Embodiment 2, S2, constructs a data interaction evaluation model based on the BP neural network algorithm for the access data of the management information area and the equipment current data to generate an interaction hidden danger coefficient.

[0089] It should be noted that the specific method for obtaining the security assessment model is as follows:

[0090] First, we need to obtain characteristic information data from the management information area and equipment current data; including network traffic abnormal fluctuation coefficient, security incident potential coefficient and equipment current data.

[0091] The feature information data is preprocessed, including data cleaning and normalization, to ensure the stability and training effect of the neural network model.

[0092] The design of neural network is the core of building data interaction evaluation model. The specific steps are as follows:

[0093] Network structure selection: determine the number of layers of the neural network and the number of neurons in each layer. Generally, it includes input layer, hidden layer and output layer. The number of nodes in the input layer is the number of data features in the management information area plus the number of data features in the equipment current. The output layer can be one or more nodes representing the coefficient of interactive hidden dangers.

[0094] Activation function selection: Select appropriate activation functions in the hidden and output layers, such as ReLU (Rectified Linear Unit) or sigmoid function, and the appropriate activation function required for the output layer, such as linear function for regression problems or sigmoid function for classification problems.

[0095] Initializing weights and biases: Randomly initializing the weights and biases of the neural network, or using an appropriate initialization method such as Xavier initialization, can help speed up the convergence process of the network.

[0096] The training process of the neural network is achieved through the back-propagation algorithm:

[0097] Define the loss function: Choose an appropriate loss function, such as mean squared error (MSE) or cross entropy loss, depending on the nature of the problem and the type of output.

[0098] Choose an optimizer: Use a gradient descent optimizer, such as the Adam optimizer, to minimize the loss function and update the weights and biases of the neural network.

[0099] During the training process, the training set and validation set should be used to evaluate the performance of the model and avoid overfitting problems.

[0100] After training is completed, we can use the trained neural network model to perform real-time data security assessment:

[0101] Real-time prediction: Input the access data and equipment current data of the new management information area and use the neural network model to make predictions.

[0102] Generate interaction risk coefficients: Generate interaction risk coefficients based on the model output results. These coefficients can reflect the current data security status of the system and possible risks.

[0103] The specific calculation formula of the interaction hidden danger coefficient is as follows:

[0104]

[0105] In the formula, is the interaction risk coefficient, It is the preset proportional coefficient of the network traffic abnormal fluctuation coefficient. is the preset proportional coefficient of the potential safety incident coefficient. It is the preset proportional coefficient of the equipment current abnormal coefficient. is the network traffic abnormal fluctuation coefficient, is the potential safety event coefficient, is the equipment current abnormality coefficient.

[0106] S3, compare the interaction hidden danger coefficient generated before the information comparison with the preset permission threshold, issue an early warning and system maintenance for the information comparison behavior corresponding to the abnormal interaction hidden danger coefficient, and suspend the information comparison.

[0107] Compare the interaction potential risk coefficient with the preset permission threshold. When the interaction potential risk coefficient is greater than the permission threshold, issue an early warning, perform system maintenance, and suspend information comparison.

[0108] When the interaction risk coefficient is less than the permitted threshold, a signal is sent to allow information comparison.

[0109] S4, obtaining several interaction hidden danger coefficients of the time interval P within the time interval G during the system maintenance process, performing data analysis, and determining whether to continue the information comparison.

[0110] Obtain several interaction hidden danger coefficients within the time interval of G and P during the system maintenance process and synthesize them into a maintenance evaluation set, and calculate the standard deviation and mean value of the data in the maintenance evaluation set;

[0111] The interaction hidden danger coefficients in the maintenance assessment set are used to calculate the standard deviation and average value of the interaction hidden danger coefficients, and the standard deviation and average value of the interaction hidden danger coefficients are compared with the pre-set standard deviation threshold and permission threshold, respectively. According to the comparison results, corresponding measures are taken, specifically:

[0112] If the average value of the interaction hidden danger coefficient is greater than or equal to the permitted threshold, a maintenance failure warning is issued;

[0113] If the average value of the interaction hidden danger coefficient is less than the permitted threshold and the standard deviation of the interaction hidden danger coefficient is greater than or equal to the standard deviation threshold, the information comparison is suspended and continuous monitoring is performed;

[0114] If the average value of the interaction hidden danger coefficient is less than the permitted threshold and the standard deviation of the interaction hidden danger coefficient is less than the standard deviation threshold, the maintenance is completed.

[0115] This embodiment uses a data interaction evaluation model built based on the BP neural network algorithm. The model combines the access data and equipment current data in the management information area, and through the process of preprocessing, neural network design and training optimization, it realizes real-time evaluation and prediction of the system security status. Its advantages include comprehensive utilization of multiple data sources, efficient processing capabilities of neural network algorithms, strong real-time security evaluation capabilities, and targeted early warning and maintenance mechanisms, which effectively improves the accuracy and efficiency of data security management.

[0116] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0117] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0118] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0119] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0120] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0121] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying power grid equipment status based on a finite state machine, characterized in that: The steps include: Before the device status library built based on the finite state machine compares the information in the management information area with the D5000 system, the access data and device current data in the management information area are obtained; The access data of the management information area includes the network traffic abnormal fluctuation coefficient and the security incident potential risk coefficient, and the equipment current data includes the equipment current abnormal coefficient; The specific analysis method of the equipment current abnormal coefficient is as follows: Acquire the timing current waveform data of the equipment during the identification process of the power grid equipment, and perform frequency domain conversion to obtain frequency domain current waveform data; Extracting features from the frequency domain current waveform data to obtain current features, wherein the current features include frequency features, electric energy distribution features, and spectrum features, wherein the frequency features include the difference between the peak frequency and the center frequency, the electric energy distribution features include the electric energy ratio, and the spectrum features include the spectrum energy stability value; According to the current characteristics and the expected normal waveform, the deviation value between the current characteristics and the expected normal waveform is calculated as the equipment current abnormality coefficient; The specific calculation formula of the frequency domain current waveform data is: Then the specific calculation formula of the difference between the peak frequency and the center frequency is: Then the calculation formula of the electric energy ratio is: Then the calculation formula of the spectrum energy stability value is: The specific calculation formula of the equipment current abnormal coefficient is as follows: In the formula, is the frequency domain current waveform data, is the sequential current waveform data at time t, is the transformation function, is the scale of the transformation function, is the translation parameter of the transformation function; is the difference between the peak frequency and the center frequency, is the center frequency, and are the minimum and maximum values ​​of electric energy, respectively. is the proportion of electric energy, is the spectrum energy stability value, is the maximum electrical energy within the frequency spectrum, is the minimum electric energy within the spectrum range, is the equipment current abnormality coefficient; The access data of the management information area and the equipment current data are used to build a data interaction evaluation model based on the BP neural network algorithm to generate an interaction hidden danger coefficient; Compare the interaction potential risk coefficient generated before information comparison with the preset permission threshold, issue an early warning and system maintenance for the information comparison behavior corresponding to the abnormal interaction potential risk coefficient, and suspend the information comparison; Obtain several interaction hidden danger coefficients of the P time interval within the G time during the system maintenance process, and perform data analysis to determine whether to continue the information comparison.

2. The method for identifying power grid equipment status based on finite state machine according to claim 1, characterized in that: The bp neural network algorithm constructs a data interaction evaluation model, and the specific steps are as follows: Initialize the number of layers of the neural network and the number of neurons in each layer. The neural network includes input layer, hidden layer and output layer; The number of nodes in the input layer is defined as the number of types of feature information data; Select the sigmoid function as the activation function in the hidden layer and output layer; Randomly initialize the weights and biases of the neural network; Select cross entropy loss as the loss function; Use the Adam optimizer to update the weights and biases of the neural network to minimize the loss function; During the training process, the feature information data is divided into a training set and a validation set for model training; The trained model is used as the data interaction evaluation model, and the output result of the data interaction evaluation model is used as the interaction risk coefficient.

3. The method for identifying power grid equipment status based on finite state machine according to claim 2, characterized in that: The interactive hidden danger coefficient generated before the information comparison is compared with the preset permission threshold, and an early warning and system maintenance are issued for the information comparison behavior corresponding to the abnormal interactive hidden danger coefficient, specifically: Compare the interaction potential risk coefficient with the preset permission threshold. When the interaction potential risk coefficient is greater than the permission threshold, issue an early warning, perform system maintenance, and suspend information comparison. When the interaction risk coefficient is less than the permitted threshold, a signal is sent to allow information comparison.

4. The method for identifying power grid equipment status based on finite state machine according to claim 3, characterized in that: The method of obtaining several interaction hidden danger coefficients of the time interval P within the time interval G during the system maintenance process and performing data analysis is specifically as follows: Obtain several interaction hidden danger coefficients within the time interval P within the time interval G during the system maintenance process, and construct a maintenance evaluation set with the several interaction hidden danger coefficients, calculate the standard deviation and average value of the data in the maintenance evaluation set, and obtain the standard deviation and average value of the interaction hidden danger coefficients; The standard deviation of the interaction hidden danger coefficient and the average value of the interaction hidden danger coefficient are compared with the pre-set standard deviation threshold and permission threshold, and corresponding measures are taken according to the comparison results, specifically: If the average value of the interaction hidden danger coefficient is greater than or equal to the permitted threshold, a maintenance failure warning is issued; If the average value of the interaction hidden danger coefficient is less than the permitted threshold and the standard deviation of the interaction hidden danger coefficient is greater than or equal to the standard deviation threshold, the information comparison is suspended and continuous monitoring is performed; If the average value of the interaction hidden danger coefficient is less than the permitted threshold and the standard deviation of the interaction hidden danger coefficient is less than the standard deviation threshold, the maintenance is completed.

5. The method for identifying power grid equipment status based on finite state machine according to claim 4, characterized in that: The specific method for obtaining the network traffic abnormal fluctuation coefficient is as follows: Obtain the real-time network traffic of the management information area within K time; Calculate the standard deviation and average value of the real-time network traffic at different times within K time; Calculate the network traffic anomaly coefficient based on the traffic standard deviation and traffic average; The network traffic anomaly coefficient is input into the preset network traffic anomaly fluctuation coefficient calculation formula to calculate the network traffic anomaly fluctuation coefficient.

6. The method for identifying power grid equipment status based on finite state machine according to claim 5, characterized in that: The specific method for obtaining the safety incident hidden danger coefficient is as follows: Based on the records of historical security events, obtain a set of all security events before data comparison, wherein the set of security events includes the security events that have an impact and the corresponding impact ratings; The impact ratings corresponding to various security events in the security event set are used as security weights; A security incident risk regression model is constructed based on the security incident set and security weights to generate a security incident risk coefficient.

7. The method for identifying power grid equipment status based on finite state machine according to claim 6, characterized in that: The specific calculation formula of the interaction hidden danger coefficient is as follows: In the formula, is the interaction risk coefficient, It is the preset proportional coefficient of the network traffic abnormal fluctuation coefficient. is the preset proportional coefficient of the potential safety incident coefficient. It is the preset proportional coefficient of the equipment current abnormal coefficient. is the network traffic abnormal fluctuation coefficient, is the potential safety event coefficient, is the equipment current abnormality coefficient.

Images