A protective controller based on intelligent algorithm

Abstract

The present invention discloses a protective controller based on an intelligent algorithm, which relates to the field of new generation information technology related to the application of new energy wind farms, including a real controller, a controller twin, a hierarchical protection mechanism of the controller, and a minimum unit self-recovery mechanism; the controller twin has the same functions as the real controller, and under specific set circumstances, the priority and authority of the controller twin can be higher than the real controller; when the control system is attacked, the controller twin will induce a virtual attack on itself; the hierarchical protection mechanism of the controller includes device hierarchical division and security hierarchical division, and the device hierarchical division corresponds to the security hierarchical division, and protection measures are formulated for devices of different security levels; the minimum unit self-recovery mechanism has a built-in intelligent algorithm, and under the premise that the hierarchical protection mechanism of the controller fails, the real controller restores its function with the minimum unit self-recovery mechanism.

Description

Technical Field

[0001] The present invention relates to the field of new generation information technology related to the application of new energy wind farms, and in particular to a protection controller based on intelligent algorithms. Background Art

[0002] As the global ecological environment becomes increasingly severe, wind power is favored by the power market due to its flexible installation, low maintenance cost and wide range.

[0003] In recent years, the security requirements of power systems have been continuously improved. As a key component of the new power system, new energy sites, including wind farms, have a wide range of information, digital and intelligent equipment applications. Compared with traditional sites, new energy sites also face many network security threats.

[0004] In the wind farm system, the controller plays a pivotal role. It not only directly controls the operation of a single wind turbine, but also works in conjunction with other control systems in the wind farm, such as the substation automation system and energy management system, to ensure efficient and stable operation of the entire wind farm. The performance of the controller directly affects the power generation efficiency, equipment life, and maintenance cost of the wind farm.

[0005] The controller of a wind farm is the core device for monitoring, controlling and optimizing wind turbines. It collects and processes various sensor signals from wind turbines to monitor the operating status of wind turbines in real time and adjust the working mode of wind turbines according to preset control strategies. The basic functions of the controller include starting and stopping wind turbines, adjusting blade angles, monitoring grid parameters, protecting the system from overload and failure, etc., to ensure that wind turbines operate under optimal conditions to maximize power generation efficiency and protect equipment safety. The design and implementation of the controller of a wind farm take into account the harsh conditions of the on-site operating environment of wind turbines, and the reliability requirements of the control system are extremely high. Therefore, the wind power control system is specially designed for the operating requirements of large wind farms, and has a high degree of environmental adaptability and anti-electromagnetic interference capabilities to ensure the stable operation of the system and the accurate transmission of data. At the same time, the wind power generation system is monitored and diagnosed to improve the reliability and efficiency of the system. Although wind power controllers have disadvantages such as high cost, possible reduction in power generation efficiency, and high system maintenance requirements, their core role in wind power generation systems cannot be ignored and is one of the key technologies to ensure efficient and safe operation of wind farms. In addition, modern controllers also have data analysis and remote communication capabilities, which can realize intelligent management and operation and maintenance optimization of wind farms.

[0006] As a result, the controllers of wind turbines face the risk of network attacks on local area networks. The main threats come from computer viruses, malicious codes, and hackers that threaten the security of data and networks during network transmission, and secondly, threats from internal networks. These attacks and threats can cause the wind turbine cluster to shut down or fail, causing damage to the control system, or even shut down or damage regional wind turbines, causing grid paralysis. Therefore, it is extremely necessary for the wind power industry to carry out safety protection work for wind farm controllers.

[0007] At present, the main methods of wind farm network protection are:

[0008] 1. The protection effect of the controller is achieved through host protection, including malicious code protection measures adopted by the business system controllers of the production control area, and regular updates of the virus database. At the same time, security reinforcement should be carried out, and security assessment and test verification should be carried out before software upgrades and patch installation for key controllers and their hosts in the power monitoring system.

[0009] 2. Achieve network protection by using dedicated network lines. The communication network between the centralized control center and the wind farm uses the enterprise's self-built fiber-optic private network, and some use the mobile operator's dedicated VPN or power-dedicated network. At the same time, some enterprises also use public network transmission, including the controller renting the operator's dedicated line to communicate with the remote centralized control center. The wind farm implements the 16-character policy of "safe zoning, network dedicating, horizontal isolation, and vertical authentication" in accordance with national regulations. If the wind tower in the production control area uses wireless communication, a secure access area must be set up, and the leased operator's dedicated line communicates with the group's remote centralized control center through the implementation of vertical encryption authentication measures to strengthen network protection.

[0010] 3. Achieve network protection through application research and protection. New or rebuilt business application systems should implement technical measures such as security labels and two-factor authentication, and gradually improve the business system's identity authentication, security audit, access control and other modules. Conduct source code audit research on the power monitoring system, and detect pre-set vulnerabilities or malicious codes in the application system source code before the system goes online. Strictly follow the relevant requirements of the power industry and enterprises in password management, permission management, and audit management of the operating system to reduce security risks in the operating system and strengthen protection.

[0011] 4. Achieve network protection by establishing a mobile storage media management and control platform. Effectively manage mobile storage media to prevent the spread of viruses, Trojans, zombie programs and other malicious codes through mobile storage media. Back up the data of key systems and other application systems of the wind farm to ensure that data and systems can be quickly restored in the event of a system crash or other external infringement, thereby ensuring system availability.

[0012] The disadvantages of the above protection schemes are:

[0013] 1. The operation and maintenance costs are high, and improper operation and maintenance operations will increase the risk of network attacks. Regular upgrades, patch installation and other security reinforcements of wind turbine controllers require high manpower costs and may also affect the normal production process. Some wind power operation and maintenance personnel or equipment manufacturers directly perform maintenance operations such as wind farm monitoring system fault handling and program upgrades through the Internet remote operation and maintenance software, causing the production control system to be connected to the Internet, and the control system related to the wind turbine controller is completely exposed to the Internet. There is a phenomenon that some wind farm group company headquarters or third-party departments bypass the power-specific isolation device to directly maintain the wind farm data acquisition equipment. During the remote operation and maintenance process, once the operation and maintenance personnel's account is stolen, or the operation and maintenance personnel make an error or illegal operation, it will pose a threat to the wind farm controller and regional network security.

[0014] 2. Lack of relevant standards and specifications, slow technology updates and iterations. The network connection methods and security protection measures between the centralized control center and the wind farm controller monitoring system vary greatly in different wind power companies. There is a lack of relevant standards and specifications, and there are generally inadequate security protection measures. When some wind farm production control areas are directly connected to the centralized control center through non-power-dedicated networks on the network channel, there are situations where effective encryption authentication, access control and other protection measures are not adopted, and there is a threat of intrusion into the production control network and tampering with control instructions and data. In addition, some wind farm equipment has multiple network cards that cross the dispatching data network and the group centralized control private network, making it possible to attack the dispatching data network through an external network. As network threats continue to evolve, the existing network dedicated line vertical encryption protection measures may not be able to respond to new attack methods in a timely manner.

[0015] 3. Application software has vulnerabilities. Since the operation and control software used in the centralized control center and wind farms, including wind farm controllers, are mostly customized products based on the needs of different companies, there is little security design added during the software development phase, and awareness of potential safety hazards is insufficient, resulting in a large number of security vulnerabilities in the design of such software. Some high-risk ports, accounts and passwords, protocols and services of the operating system are often required by some application software and cannot be closed, resulting in some hidden dangers in the system.

[0016] 4. The investment cost is high, and the potential risk of network attacks increases. The use of mobile storage media in industrial control systems and industrial computers is not strictly managed, and the arbitrary use will also cause potential risks and threats to information security.

[0017] Therefore, technicians in this field are committed to developing a new type of controller to solve the above-mentioned defects in the prior art. Summary of the invention

[0018] In view of the above-mentioned defects in the prior art, the technical problem to be solved by the present invention is how to avoid affecting the production operation process when the relevant systems including the wind farm controller are attacked by the network.

[0019] To achieve the above-mentioned object, the present invention provides a protection controller based on an intelligent algorithm, including a real controller, a controller twin, a hierarchical protection mechanism of the controller, and a minimum unit self-recovery mechanism;

[0020] The controller twin does not participate in the actual operation of the wind farm, but shares information with the real controller through the information network. It has the same functions as the real controller and can reflect the operating status of the wind turbine in real time. Under certain set circumstances, the priority and authority of the controller twin can be higher than that of the real controller. When the control system is attacked, the controller twin will induce a virtual attack on itself.

[0021] The hierarchical protection mechanism of the controller includes device hierarchical division and security hierarchical division, the device hierarchical division corresponds to the security hierarchical division, and protection measures are formulated for devices at different security levels;

[0022] The minimum unit self-recovery mechanism has a built-in intelligent algorithm, which analyzes historical data, monitors and evaluates the security status of the real controller in real time, and identifies potential abnormal behaviors or signs of attacks. Under the premise that the hierarchical protection mechanism of the controller fails, the real controller restores its functions using the minimum unit self-recovery mechanism.

[0023] Furthermore, there are one or more controller twins.

[0024] Furthermore, the controller twin is a virtual model created by digital AI twin technology.

[0025] Furthermore, the security level is divided into three levels, including the highest security level, the second highest security level and the basic security level.

[0026] Furthermore, for the highest security level, a multiple redundant design is adopted; for the second highest security level, real-time monitoring and rapid response are carried out by deploying fault detection and diagnosis mechanisms, and encrypted communication and data verification technologies are used to ensure the security and integrity of information transmission; for the basic security level, regular maintenance and calibration procedures are set up, and basic fault protection measures are equipped.

[0027] Furthermore, the equipment hierarchy division includes a main control system, a distributed control unit and a communication interface, sensors and actuators; the main control system corresponds to the highest security level, the distributed control unit and the communication interface correspond to the second highest security level, and the sensors and actuators correspond to the basic security level.

[0028] Furthermore, the intelligent algorithm quickly recovers the system by following the steps below:

[0029] Step 1: Real-time detection and response: When not under attack, the intelligent algorithm uses the AI ​​learning model for training and learning; once the set real-time detection detects abnormal behavior, the intelligent algorithm immediately activates countermeasures to isolate the affected system;

[0030] Step 2: Problem diagnosis and classification: The intelligent algorithm analyzes the source and impact of the attack, identifies the attacked system parts and potential security threats and vulnerabilities;

[0031] Step 3: Automatic repair and update: The intelligent algorithm can automatically deploy patches or update software according to the type of attack and the weaknesses of the system to strengthen the system's ability to resist future attacks. At the same time, a corresponding database is established according to the attack source for the AI ​​learning model to train and learn, further strengthening the AI ​​and improving the security protection capabilities of the controller.

[0032] Step 4, recovery and testing: Based on the affected scope analyzed by the intelligent algorithm, a minimum unit for system recovery is formed. Under the premise of not affecting production operations to the greatest extent, the affected part is quickly restored with the minimum unit. At the same time, continuous monitoring is carried out to confirm the stability and security of the system.

[0033] Furthermore, when not under attack, the AI ​​learning model learns to start and stop wind turbines, adjust blade angles, monitor grid parameters, and protect the system from overload and failure.

[0034] Furthermore, the controller twin has the following functions: parameter monitoring of wind turbine generator sets, automatic power generation control of the sets, safety protection of the equipment of the sets, data communication of the sets, and interactive interface between the sets and humans.

[0035] Furthermore, the controller twin can reflect the operating status of the wind turbine in real time, including speed, power output, and degree of wear.

[0036] The protection controller based on intelligent algorithm provided by the present invention has at least the following technical effects:

[0037] 1. The technical solution provided by the present invention generates one or more twin controllers through digital AI technology, induces network attacks to carry out virtual attacks on the twins, and protects the real controller from the harm of network attacks;

[0038] 2. The technical solution provided by the present invention provides a hierarchical protection mechanism for the controller. The core is to classify the safety levels of the relevant equipment of the wind farm controller and formulate corresponding protection measures for equipment of different safety levels to ensure the safe and stable operation of the wind farm controller;

[0039] 3. The technical solution provided by the present invention provides a minimum unit recovery mechanism based on AI learning. For new or specific attacks, under the premise that the protection mechanism fails, the controller responds quickly based on the AI ​​learning model, and at the same time, the minimum recovery unit mechanism is used to quickly restore the relevant functions of the controller without affecting the operation to the greatest extent.

[0040] Compared with the existing wind farm controller network protection, the technical solution provided by the present invention can not only effectively reduce the possibility of the controller being effectively attacked by network viruses, but also, for new or specific virus attacks, the controller has a hierarchical protection mechanism and a minimum unit recovery mechanism based on AI algorithm, which can minimize or even not affect the normal production operation process.

[0041] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a schematic diagram of a controller twin of a preferred embodiment of the present invention;

[0043] Figure 2 yes Figure 1 A structural diagram of a hierarchical protection mechanism of a preferred embodiment is shown;

[0044] Figure 3 yes Figure 1 A flow chart of the minimum unit recovery mechanism based on AI learning of a preferred embodiment is shown. DETAILED DESCRIPTION

[0045] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0046] The purpose of the embodiment of the present invention is to solve the technical problem of safety protection of wind farm controllers. A twin controller is generated through digital AI technology. When the control system including the controller is attacked by a network attack, it is induced to carry out a virtual attack on the twin controller to protect the real controller from the impact of the network attack. For new or specific network attacks, the controller sets a hierarchical protection mechanism. Under the premise that the hierarchical protection mechanism fails, the controller has a minimum unit self-recovery mechanism based on the AI ​​algorithm, which can reduce the impact or even not affect the production operation.

[0047] Example 1

[0048] The embodiment of the present invention provides a protection controller based on an intelligent algorithm, including a real controller, a controller twin, a hierarchical protection mechanism of the controller, and a minimum unit self-recovery mechanism;

[0049] The controller twin does not participate in the actual operation of the wind farm. It shares information with the real controller through the information network. It has the same functions as the real controller and can reflect the operating status of the wind turbine in real time. Under certain set circumstances, the priority and authority of the controller twin can be higher than that of the real controller. When the control system is attacked, the controller twin will induce a virtual attack on itself.

[0050] The controller's hierarchical protection mechanism includes device hierarchical division and security hierarchical division. The device hierarchical division corresponds to the security hierarchical division, and protection measures are formulated for devices at different security levels.

[0051] The minimum unit self-recovery mechanism has a built-in intelligent algorithm. The intelligent algorithm analyzes historical data, monitors and evaluates the security status of the real controller in real time, and identifies potential abnormal behaviors or signs of attacks. If the controller's hierarchical protection mechanism fails, the real controller will restore its functions using the minimum unit self-recovery mechanism.

[0052] Example 2

[0053] Based on Example 1, the controller twin is a virtual model created by digital AI twin technology. Digital AI twin is an innovative digital mapping technology that simulates real-world objects by creating accurate virtual models of physical entities. Twins are used as a safety protection for wind farm controllers, and the number of twins is determined by the functionality of the controller. There are generally one or more controller twins.

[0054] The controller twin can have the same functions as the real controller, including: wind turbine parameter monitoring, automatic power generation control, safety protection of equipment, data communication, and interactive interface between the unit and people. The controller twin can reflect the operating status of the wind turbine in real time, including key indicators such as speed, power output, and wear degree.

[0055] When the relevant systems including the controller are attacked by the network, the attacker will identify the wind farm controller and its related control systems, including the twin, through network scanning. The network virus will look for security vulnerabilities of potential attack targets based on the degree of superposition, priority and authority of the information processed by the controller. The twin will induce these network viruses to conduct virtual attacks on themselves based on the relevant vulnerabilities they have discovered, and wait for the attacker to implant malware or use social engineering techniques to induce internal employees to install backdoor programs. Once in the twin, the attacker will try to obtain higher permissions in order to access more system resources and data. Then, through the implanted malicious code, the attacker can remotely control the twin controller to interfere with normal functions and control processes. Without being discovered, the attacker may lurk in the system for a long time, continue to steal data or wait for the opportunity to launch a larger-scale attack. Although the twin controller has higher permissions and priorities than the real controller, it does not participate in actual control, so it will not affect the production process.

[0056] When a network virus implants relevant malicious code into the twin, the background control of the twin receives the corresponding alarm information, which gives it enough time to crack the code and upgrade the cracked program to the real controller to strengthen the relevant protection. This can prevent the controller from being attacked by the first wave of attacks to the greatest extent, thus affecting the normal operation of the wind turbine.

[0057] like Figure 1 The figure shows a schematic diagram of the wind farm controller twin. The data of the real body (1) is shared with the twin (6) in real time through the information network (3) and (4). The twin (6) has a slightly higher data processing and superposition capability than the real body (1), but no real equipment action occurs. Information interaction is carried out between (2) and (3), and information interaction is carried out between (7) and (4). The blue circle (5) is the real controller, the green circle (8) is the controller twin, and the blank green twin (9) indicates that a real controller can correspond to one or more twins according to its own importance. When a network attack occurs, the twin will induce a virtual attack on it instead of attacking the controller itself.

[0058] Example 3

[0059] Computer viruses and worm programs are not quite the same. On the one hand, worm programs rely on operating systems, and on the other hand, computer viruses rely on executable programs. Once the program is running, the virus will spread inside the computer, resulting in file modifications or even file deletions, causing program errors and serious crashes, posing a serious threat to wind farm controllers and their power monitoring systems. Early hackers needed a carrier to implant viruses or obtain certain privileges to damage or clear disks and invade other devices in the network from one node. Modern hackers attack networks, obtain permissions and passwords, obtain data and decrypt it, break through firewalls, and invade more confidential information. Faced with the "Stuxbet" network virus and the "BlackEnergy" hacker attack, it is possible to bypass the protection of the controller and directly attack the main body. Therefore, a hierarchical protection mechanism is set for the controller body.

[0060] According to the equipment level division of the wind farm controller, the equipment is divided into safety levels. The basis for the division of safety levels mainly includes the degree of impact of equipment failure on the operation of the wind farm, the probability of failure, and the potential threat to personnel safety. In the equipment classification of the wind farm controller, for each category of equipment, the equipment level is divided according to its role in the system and the potential risk level. The equipment level division includes the main control system, distributed control units and communication interfaces, sensors and actuators. The main control system is the decision-making center, responsible for coordinating the operation of the entire wind farm. The failure of the main control system may cause the shutdown of the entire wind farm, corresponding to the highest safety level; the distributed control unit and communication interface respectively directly manage the operation of each wind turbine and ensure the flow of information. By deploying fault detection and diagnosis mechanisms, they can monitor the system status in real time and respond quickly when abnormalities occur. The distributed control unit and communication interface use encrypted communication and data verification technology to ensure the security and integrity of information transmission, corresponding to the second highest security level.

[0061] Sensors and actuators are the bridge between the control system and the wind turbine, responsible for collecting data and executing control commands. Although the failure of sensors and actuators will affect the accuracy of the data, it usually does not lead to immediate safety accidents, corresponding to the basic safety level. The core of the hierarchical protection strategy is to formulate corresponding protection measures for equipment at different security levels to ensure the safe and stable operation of wind farm controllers. For the main control system at the highest security level, multiple redundant designs are adopted to ensure that key components such as processors and power supplies have backup systems to prevent single point failures from causing the entire control system to fail. At the same time, strict access control and network security measures are implemented to prevent unauthorized access and network attacks. Through the above division, it is ensured that the most protection resources are invested in the most critical equipment, while the necessary protection of lower-level equipment will not be neglected.

[0062] For sensors and actuators with medium and basic safety levels, regular maintenance and calibration procedures are implemented to ensure the accuracy and reliability of sensors and actuators. At the same time, sensors and actuators are equipped with basic fault protection measures, such as short circuit protection and overload protection, to prevent damage caused by electrical problems. Each layer of protection measures is designed to reduce or eliminate specific risks, thereby improving the reliability of the overall system. The hierarchical protection structure diagram of the controller is shown in the figure below. Figure 2 As shown, the highest level is (a), the second highest level is (b), and the medium and basic levels are (c).

[0063] Based on Embodiment 1 or 2, the security level is divided into three levels, including the highest security level, the second highest security level and the basic security level. For the highest security level, multiple redundant designs are adopted; for the second highest security level, real-time monitoring and rapid response are carried out by deploying fault detection and diagnosis mechanisms, and encrypted communication and data verification technologies are used to ensure the security and integrity of information transmission; for the basic security level, regular maintenance and calibration procedures are set up, and basic fault protection measures are equipped.

[0064] Example 4

[0065] AI algorithm technology has demonstrated its great potential in many fields, including network security. Under the premise that the original network protection mechanism fails, the wind farm controller can have a minimum unit recovery mechanism based on AI algorithm. AI algorithm can monitor and evaluate the security status of the controller in real time by analyzing historical data, and promptly identify potential abnormal behavior or signs of attack. Introducing AI in the security system of wind farm controllers can greatly improve the ability to identify complex and novel attack methods, and have fast and dynamic recovery capabilities when attacked.

[0066] Based on Embodiment 1, 2 or 3, when the wind farm controller is attacked, the AI ​​algorithm can act quickly and quickly restore the system with the minimum recovery unit through the following steps:

[0067] Step 1: Instant detection and response: When not under attack, the intelligent algorithm uses the AI ​​learning model for training and learning, including starting and stopping wind turbines, adjusting blade angles, monitoring grid parameters, protecting the system from overload and failure, etc.; real-time detection is set up, and once abnormal behavior is detected, the intelligent algorithm immediately activates countermeasures to isolate the affected system and prevent further data or service loss;

[0068] Step 2: Problem diagnosis and classification: Intelligent algorithms analyze the source and impact of attacks, accurately identifying the attacked system parts and potential security threats and vulnerabilities;

[0069] Step 3: Automatic repair and update: Intelligent algorithms can automatically deploy patches or update software based on the type of attack and system weaknesses to strengthen the system's ability to resist future attacks. At the same time, a corresponding database is established based on the attack source for the AI ​​learning model to train and learn, further strengthening AI and improving the controller's security protection capabilities.

[0070] Step 4: Recovery and testing: After ensuring that all security threats have been eliminated, AI can guide the system to gradually return to normal. The smallest unit for system recovery is formed based on the affected scope analyzed by the intelligent algorithm. Under the premise of not affecting production operations to the greatest extent, the affected part is quickly restored in the smallest unit to reduce the impact on production operations. At the same time, continuous monitoring is carried out to confirm the stability and security of the system.

[0071] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A protection controller based on intelligent algorithm, including a real controller, characterized in that: It also includes controller twins, controller hierarchical protection mechanisms, and minimum unit self-recovery mechanisms; The controller twin is a virtual model created by digital AI twin technology. The controller twin does not participate in the actual operation of the wind farm. It shares information with the real controller through the information network. It has the same functions as the real controller and can reflect the operating status of the wind turbine in real time. The priority and authority of the controller twin are higher than those of the real controller. When the control system is attacked, the controller twin will induce a virtual attack on itself; when the network virus implants the relevant malicious code into the controller twin, the background control of the controller twin will receive the corresponding alarm information, and there will be enough time to crack it, and upgrade the cracked related program to the real controller to strengthen the protection; The hierarchical protection mechanism of the controller includes device hierarchical division and security hierarchical division, the device hierarchical division corresponds to the security hierarchical division, and protection measures are formulated for devices at different security levels; The minimum unit self-recovery mechanism has a built-in intelligent algorithm, which monitors and evaluates the security status of the real controller in real time by analyzing historical data, and identifies potential abnormal behaviors or signs of attacks; if the hierarchical protection mechanism of the controller fails, the real controller recovers its function by the minimum unit self-recovery mechanism; The smart algorithm quickly recovers the system by following these steps: Step 1: Real-time detection and response: When not under attack, the intelligent algorithm uses the AI ​​learning model for training and learning; once the set real-time detection detects abnormal behavior, the intelligent algorithm immediately activates countermeasures to isolate the affected system; Step 2: Problem diagnosis and classification: The intelligent algorithm analyzes the source and impact of the attack, identifies the attacked system parts and potential security threats and vulnerabilities; Step 3: Automatic repair and update: The intelligent algorithm automatically deploys patches or updates software based on the type of attack and the system's weaknesses to strengthen the system's ability to resist future attacks. At the same time, a corresponding database is established based on the attack source for the AI ​​learning model to train and learn, further strengthening the AI ​​and improving the controller's security protection capabilities. Step 4, recovery and testing: Based on the affected scope analyzed by the intelligent algorithm, a minimum unit for system recovery is formed. Under the premise of not affecting production operations to the greatest extent, the affected part is quickly restored with the minimum unit. At the same time, continuous monitoring is carried out to confirm the stability and security of the system.

2. The protection controller based on intelligent algorithm as claimed in claim 1, characterized in that: There is one or more controller twins.

3. The protection controller based on intelligent algorithm as claimed in claim 1, characterized in that: The security level is divided into three levels, including the highest security level, the second highest security level and the basic security level.

4. The protection controller based on intelligent algorithm as claimed in claim 3, characterized in that: For the highest security level, multiple redundant designs are adopted; for the second highest security level, fault detection and diagnosis mechanisms are deployed to conduct real-time monitoring and rapid response, and encrypted communication and data verification technologies are used to ensure the security and integrity of information transmission; for the basic security level, regular maintenance and calibration procedures are set up, and basic fault protection measures are equipped.

5. The protection controller based on intelligent algorithm as claimed in claim 3, characterized in that: The equipment hierarchy includes a main control system, a distributed control unit and a communication interface, sensors and actuators; the main control system corresponds to the highest security level, the distributed control unit and the communication interface correspond to the second highest security level, and the sensors and actuators correspond to the basic security level.

6. The protection controller based on intelligent algorithm as claimed in claim 1, characterized in that: When not under attack, the AI ​​learning model learns to start and stop wind turbines, adjust blade angles, monitor grid parameters, and protect the system from overload and failure.

7. The protection controller based on intelligent algorithm as claimed in claim 1, characterized in that: The functions of the controller twin include: parameter monitoring of wind turbine generator sets, automatic power generation control of the sets, safety protection of the equipment of the sets, data communication of the sets, and interactive interface between the sets and humans.

8. The protection controller based on intelligent algorithm as claimed in claim 1, characterized in that: The controller twin can reflect the operating status of the wind turbine in real time, including speed, power output, and degree of wear.

Images