Electricity utilization acquisition safety monitoring method based on intelligent remote control

Abstract

The invention discloses a power utilization acquisition safety monitoring method based on intelligent remote control, and relates to the technical field of power system safety monitoring, and the method comprises the steps: building a power utilization structure topological graph with a node structure type identifier through recognizing a distributed local power utilization structure in a power utilization jurisdiction area; on the basis of two dimensions of attack security and behavior security, situation identification and intention analysis are assisted, and an event association tree is mined. And constructing a remote monitoring platform in combination with the topological graph and the event association tree, and performing dynamic monitoring updating through an active-passive conversion unit. The platform performs sensing and acquisition safety evaluation on the power utilization network, generates a safety monitoring list, provides power utilization guidance for front-end equipment based on the safety monitoring list, and realizes remote control management at the same time. The technical problems that potential safety hazards in an existing electricity utilization collection system are difficult to recognize and respond in real time, and decision deviation exists are solved, and the technical effects of recognizing and responding potential safety hazards of an electricity utilization network in real time and effectively avoiding decision deviation are achieved.

Description

Technical Field

[0001] The present application relates to the technical field of power system safety monitoring, and in particular to a method for safety monitoring of power consumption collection based on intelligent remote control. Background Art

[0002] In the scenario of power consumption collection safety management in modern power systems, with the increase in the number of power consumption equipment and the complexity of distributed power grids, the safety issues of power consumption networks are particularly prominent, and the contradiction of resource demand for power consumption collection safety management is also more obvious. Efficient monitoring and dynamic management of distributed power consumption networks to ensure the safety of equipment in various regions has become a key link in power system management. Traditional power consumption safety management methods are relatively simple and static, often relying on fixed monitoring equipment or simple rule settings, lacking in-depth analysis and real-time response to large-scale power consumption data and potential threats, and difficult to comprehensively and accurately assess safety hazards in various regions. There are unreasonable situations in security monitoring and resource allocation, resulting in some important areas may not be effectively monitored, while resources in other areas are wasted. For sudden power consumption anomalies and potential attacks, traditional solutions have slow response speeds and inaccurate decisions, making it difficult to cope with the ever-changing actual operation of the power grid.

[0003] In the current relevant technologies, there are technical problems such as it is difficult to identify and respond to safety hazards in the electricity collection system in real time, and there are decision-making biases. Summary of the invention

[0004] This application provides a power consumption collection safety monitoring method based on intelligent remote control. It uses the method of identifying the distributed local power consumption structure within the power consumption jurisdiction area and establishing a power consumption structure topology map with node structure type identification. Based on the two dimensions of attack security and behavioral security, it assists in situation identification and intent analysis, and mines the event association tree. Combining the topology map and the event association tree, a remote monitoring platform is constructed, and dynamic monitoring and updating are performed through the active and passive conversion units. The platform perceives and collects security assessments of the power consumption network, generates a safety monitoring sheet, and provides power consumption guidance for the front-end equipment based on this, while realizing remote control management, and realizing the technical effect of real-time identification and response to potential safety hazards in the power consumption network through intelligent remote control and dynamic adjustment, and effectively avoiding decision-making bias.

[0005] The present application provides a method for safe monitoring of electricity consumption collection based on intelligent remote control, including: For the power consumption jurisdiction area, the distributed local power consumption structure is identified, and the power consumption structure topology is established, wherein the topological nodes of the power consumption structure topology are identified with the structure type; with attack security and behavioral security as the security dimensions, situation identification and intent analysis are assisted, and the event association tree is mined; combining the power consumption structure topology with the event association tree, a remote monitoring platform is constructed, wherein the remote monitoring platform performs monitoring and updating based on the active and passive conversion unit; assisting the remote monitoring platform to perform power consumption network perception and power consumption collection security assessment, and determine the safety monitoring list; based on the safety monitoring list, front-end power consumption guidance is carried out, and the remote monitoring platform is assisted in remote control and management.

[0006] The electricity consumption collection safety monitoring method based on intelligent remote control proposed in this application is to first identify the distributed local electricity consumption structure within the electricity consumption jurisdiction area, and establish a power consumption structure topology map with node structure type identification. Based on the two dimensions of attack security and behavioral security, assist situation identification and intent analysis, and mine the event association tree. Combined with the topology map and the event association tree, a remote monitoring platform is constructed, and dynamic monitoring and updating are performed through the active and passive conversion units. The platform perceives and collects security assessments of the power consumption network, generates a safety monitoring sheet, and based on this, provides power consumption guidance for the front-end equipment, while realizing remote control management. Through intelligent remote control and dynamic adjustment, it achieves real-time identification and response to potential safety hazards in the power consumption network, and effectively avoids the technical effect of decision-making bias. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0008] Figure 1 A flow chart of a method for safely monitoring electricity consumption collection based on intelligent remote control provided in an embodiment of the present application.

[0009] Figure 2 A schematic diagram of the process flow of mining event association trees for a method for safe monitoring of electricity consumption collection based on intelligent remote control provided in an embodiment of the present application. DETAILED DESCRIPTION

[0010] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0011] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0012] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0013] The present application embodiment provides a method for monitoring power consumption safety based on intelligent remote control, such as Figure 1 As shown, the method includes: Step S100, for the power consumption jurisdiction area, identify the distributed local power consumption structure and establish the power consumption structure topology, wherein the topological nodes of the power consumption structure topology are identified with structure types. Specifically, firstly, the power consumption jurisdiction area is clarified, and the distributed local power consumption structure is comprehensively and accurately identified through field surveys and equipment inventory, data monitoring and analysis, and archival material review and integration. Then, the power consumption structure topology is constructed based on the identified local power consumption structure, and is represented in a graphical manner. Each node represents a power consumption device or a key power component, and the topological hierarchy is determined. The structure type is identified for each topological node, such as industrial power equipment, commercial power equipment, residential power equipment, etc., so as to carry out subsequent targeted safety monitoring and management.

[0014] Step S200, with attack security and behavior security as security dimensions, assist situation identification and intention analysis, and mine the event association tree. Specifically, first determine the two security dimensions of attack security and behavior security. In terms of attack security, focus on external malicious attacks such as hacker attacks, malware intrusions, etc., and classify and analyze possible attack methods; in terms of behavior security, focus on internal user electricity consumption behavior, and establish a user behavior monitoring mechanism to identify abnormal electricity consumption. Then perform situation identification, use sensors and monitoring equipment to monitor the operating status of the power system in real time and establish a data acquisition and transmission system, analyze the monitoring data and use algorithm models to deeply mine to understand the overall situation of the power consumption environment and discover potential safety risks. Perform intention analysis, for the deceptiveness of malicious attacks, infer the attacker's intention by analyzing the characteristics, patterns and targets of attack behavior and establish a malicious attack feature library; for the misleading of abnormal data and fault data, deeply analyze the causes and consequences of their generation to avoid decision-making bias and establish an abnormal data processing mechanism. Retrieve electricity consumption safety records, determine the record information group, divide the intuitive and non-intuitive parts, determine their event association characteristics respectively, integrate the characteristics of the intuitive and non-intuitive parts and integrate them to determine the event association tree, and finally visualize the event association tree to better understand and analyze the safety status of the power system.

[0015] In one possible implementation, Figure 2As shown, with attack security and behavior security as security dimensions, assisting situation identification and intention analysis, and mining event association trees, step S200 further includes step S210, retrieving and retrieving power consumption collection safety records, and determining record information groups by parsing power consumption characteristics and data streams, wherein each group of record information corresponds to a record event. Specifically, the time range, power consumption jurisdiction area, and specific equipment or system range of the power consumption collection safety records to be retrieved are clarified. For example, it can be determined to retrieve the power consumption collection safety records of all enterprises in a certain industrial park in the past year. Retrieve relevant power consumption collection safety records through database query, file system retrieval, or a special security management system interface. These records may include equipment failure records, network attack records, abnormal power consumption behavior records, etc. For example, query the power consumption abnormality records of a certain area in a specific time period from the power company's security database. Parse the retrieved security records to extract power consumption characteristics and data flow information. Power consumption characteristics may include changes in parameters such as current, voltage, and power, and data flow information may include network traffic, data transmission mode, etc. For example, analyze the current change curve in a certain equipment failure record and the network data flow when the failure occurs. According to the power consumption characteristics and data flow information obtained by analysis, the relevant records are grouped to determine the record information group. Each record information group corresponds to a record event, such as an equipment failure event, a network attack event, etc. For example, if multiple records show that the current in a certain area at the same time point is abnormally increased, and the network traffic also changes abnormally, then these records can form a record information group, corresponding to a possible power system failure event.

[0016] Step S220, traverse the record information groups, and divide the intuitive part and the non-intuitive part group by group. Specifically, starting from the first record information group, each record information group is processed in turn. For each record information group, the information that is easier to understand and directly observed is divided into the intuitive part. The intuitive part is usually those obvious abnormal phenomena of power consumption, such as sudden increase of current, equipment stopping operation, etc. For example, if a record information group shows that the current of a certain device instantly rises from the normal range to a very high value, and the device issues a fault alarm, then the information of the current increase and fault alarm can be divided into the intuitive part. The information in the record information group that needs further analysis and understanding is divided into the non-intuitive part. The non-intuitive part may include some hidden factors, potential causes or non-obvious associations. For example, in a certain record information group, although the current changes abnormally, there is no obvious sign of equipment failure. At this time, there may be some hidden network problems or malicious attacks, and this information can be divided into the non-intuitive part. The non-intuitive part is marked with a bias guidance mark so that these possible directions can be focused on in subsequent analysis. For example, non-intuitive parts can be marked with guiding marks such as "may be caused by a network attack" and "need to further check the device software".

[0017] Step S230, determining the event association characteristics of the intuitive part. Specifically, the information of the intuitive part is deeply analyzed to determine the association characteristics between these intuitive phenomena. For example, if the currents of multiple devices increase at the same time and are all located in the same area, it can be inferred that there may be a problem with the power supply in the area, which is an event association characteristic. To extract the event association characteristics of the intuitive part, common characteristics or rules can be found by comparing the intuitive phenomena in different record information groups. For example, if multiple record information groups all show that devices frequently fail within a specific time period, and these devices are of the same type, then the event association characteristics of "specific types of devices are prone to failure within a specific time period" can be extracted.

[0018] Step S240, traverse the non-intuitive part, perform behavior identification and intentional understanding, and determine the event association characteristics of the non-intuitive part, wherein the non-intuitive part carries a biased guidance mark. Specifically, the divided non-intuitive parts are traversed and analyzed one by one. By analyzing the information of the non-intuitive part, possible behavior patterns are identified. For example, if the non-intuitive part shows abnormal changes in network traffic, but there are no obvious signs of attack, then by analyzing the source, destination and change pattern of the network traffic, it can be identified that the traffic increase may be caused by the automatic update of the software of a certain device, or the abnormal network behavior of internal users. On the basis of behavior identification, further understand the intentions behind these behaviors. For example, if it is identified that the automatic update of the software of a certain device has caused an increase in network traffic, it can be understood as a normal behavior performed by the device manufacturer to improve the performance of the device; if it is an abnormal network behavior of an internal user, it is necessary to further understand whether the user's intention is an unintentional operation error or an intentional violation. According to the results of behavior identification and intention understanding, determine the event association characteristics of the non-intuitive part. For example, if it is determined that a certain non-intuitive part is caused by the illegal electricity use behavior of internal users, then the event association feature of "the user's illegal electricity use behavior may cause power system safety problems" can be extracted. The non-intuitive part is marked with a bias guidance mark, and in this process, a more targeted analysis can be performed according to the direction of the mark.

[0019] Step S250, the event association features of the intuitive part and the non-intuitive part are integrated and determined, wherein the event association tree is in correspondence with the recorded event. Specifically, the event association features of the intuitive part and the non-intuitive part are compared to find out the similarities and differences between them. For example, the intuitive part may show that the equipment failure is caused by excessive current, and the non-intuitive part may show that the excessive current is caused by abnormal operation of the equipment caused by a network attack, and there is a certain correlation between the two features. According to the comparison result, the event association features of the intuitive part and the non-intuitive part are fused. The fusion can be performed by weighted average, logical merging, and the like. For example, if the feature weight of the intuitive part is 0.6 and the feature weight of the non-intuitive part is 0.4, then the features of the two parts can be weighted averaged according to the two weights to obtain the fused event association features. The fused event association features are integrated to form a complete event association tree. Each node in the event association tree represents an event association feature, and the connection between the nodes represents the association relationship between the events. For example, if the fused features show that the device failure is related to both the network attack and the excessive current, then the corresponding nodes can be established in the event association tree, and the relationship between them can be represented by connections. Determine the correspondence between each node in the event association tree and the recorded event. The corresponding recorded event can be found by comparing the event association feature with the recorded information group. For example, if a node in the event association tree indicates that "the device failure is related to the network attack", then those recorded events that show the device failure and may be related to the network attack can be found in the recorded information group, and the correspondence between them can be established. Verify the established correspondence to ensure that the event association tree can accurately reflect the logical relationship between the recorded events. This can be verified by re-analyzing the recorded information group, conducting actual case verification, or discussing with experts. For example, if it is found that a recorded event has no corresponding node in the event association tree, then it is necessary to re-check the extraction and fusion process of the event association feature to ensure that all recorded events can find the corresponding position in the event association tree. The event association tree can be mined from the power consumption collection safety record to provide strong support for power consumption safety monitoring and management.

[0020] In a possible implementation, the event association features of the intuitive part and the non-intuitive part are integrated and determined, wherein the event association tree has a corresponding relationship with the recorded event, and step S250 further includes step S251, traversing the event association features, determining the precursor node based on the risk level, wherein the time span based on the precursor node is positively correlated with the risk level. Specifically, first, traversing from the event association features that have been determined. These event association features may be obtained through steps such as analysis of power consumption collection safety records, processing of intuitive parts and non-intuitive parts, and feature fusion. For example, it is assumed that some event association features have been determined, such as "equipment failure is related to current anomaly", "network attacks may cause data anomaly", etc. Check each event association feature one by one to understand its specific content and meaning. For each feature, analyze the power safety events involved, related equipment or systems, and possible influencing factors. For example, for the feature "equipment failure is related to current anomaly", further analyze the possible causes of current anomaly, such as equipment aging, overload operation, etc., and the possible consequences of equipment failure, such as power outage, data loss, etc. Risk assessment is performed on each event correlation feature to determine its risk level. Risk assessment can consider multiple factors, such as the probability of an event occurring, the extent of the loss caused, and the impact on the stability of the power system. For example, if an event correlation feature represents a situation that is highly likely to occur and causes serious equipment damage and large-scale power outages, then its risk level will be relatively high. Precursor nodes are determined based on the risk level. Precursor nodes refer to some signs or features that may appear before an event occurs. By monitoring these precursor nodes, potential power safety risks can be warned in advance. For example, if the risk level of an event correlation feature is high, some specific current changes, network traffic anomalies, etc. may appear before the event involved in the feature occurs, which can be used as precursor nodes. The time span based on the precursor node is positively correlated with the risk level. In other words, the higher the risk level of an event, the longer the time span of its precursor node may appear. For example, for a high-risk power system failure event, some slight current fluctuations, equipment temperature rise, and other precursor nodes may appear a few days or even weeks before the failure occurs; while for a low-risk event, the precursor node may only appear a few hours or minutes before the event occurs.

[0021] Step S252, determine the precursor characteristic value based on the precursor node, mark the event association feature, and generate the event association tree. Specifically, the determined precursor node is deeply analyzed to understand its specific characteristics and manifestations. For example, if a precursor node is an abnormal change in current, it is necessary to analyze the characteristics of the amplitude, frequency, duration, etc. of the current change. According to the analysis result of the precursor node, determine the precursor characteristic value based on the precursor node. The precursor characteristic value can be a specific value, a range, or a descriptive indicator. For example, if the characteristic of the precursor node of the abnormal change in current is that the current amplitude continues to rise over a certain threshold within a certain period of time, then this threshold can be used as the precursor characteristic value. The determined precursor characteristic value can be used to mark the event association feature so that potential power safety risks can be quickly identified and judged in actual monitoring. At the same time, the precursor characteristic value can also be used as a trigger condition for the early warning system. When the monitored power consumption data meets the precursor characteristic value, the system can issue an alarm in time to remind relevant personnel to take measures. Use the determined precursor characteristic value to mark the event association feature. Marking can be adding a specific label or annotation to the event correlation feature, indicating that the feature is related to a precursor node and precursor feature value. For example, for the event correlation feature "equipment failure is related to current anomaly", a mark can be added, such as "precursor feature of continuous current rise exceeding the threshold may occur". The marked event correlation features are integrated to generate an event correlation tree. The event correlation tree is a graphical representation in which each node represents an event correlation feature and the connection between nodes represents the association relationship between events. Through the event correlation tree, the logical relationship between different power safety events and the potential risk propagation path can be clearly seen. For example, if an equipment failure represented by an event correlation feature may cause a network interruption represented by another event correlation feature, then there will be a connection between the two features in the event correlation tree. With the continuous accumulation and analysis of new power consumption collection safety records, the event correlation tree can be continuously updated and optimized. For example, if a new event-related feature or precursor node is discovered, it can be added to the event-related tree; if the risk level of an event-related feature changes, its position and mark in the event-related tree can be adjusted accordingly, which can more accurately identify and warn of electricity safety risks and provide strong guarantees for the stable operation of the power system.

[0022] In a possible implementation, the precursor feature value based on the precursor node is determined, the event association feature is marked, and the event association tree is generated. Step S252 further includes step S2521, for the attack security dimension, the attack chain is determined and the precursor node is located, the malicious code penetration feature of the precursor node is integrated, and the event association feature is compensated. Specifically, in the power collection safety monitoring, for the attack security dimension, its importance is first clarified, and various attack methods and scopes including hacker attacks are determined. Then, by collecting attack-related information such as network traffic and device logs, the source, target and path of the attack are determined, and an attack chain model is constructed, including multiple stages such as reconnaissance and weaponization. Then, the characteristics of each stage of the attack chain are analyzed to determine possible precursor nodes, such as network scanning in the reconnaissance stage, which can be used as a precursor. Then, the possible malicious code is analyzed, its penetration characteristics are understood and integrated into the precursor node to improve the accuracy of the early warning. Finally, the event correlation features are reviewed, and the precursor nodes that integrate the malicious code penetration features are compared and analyzed for compensation, making the event correlation features more complete and accurate, so as to effectively monitor and prevent the risks of attack security dimensions and improve the accuracy and reliability of power consumption collection safety monitoring.

[0023] Step S300, combining the power structure topology with the event association tree, constructing a remote monitoring platform, wherein the remote monitoring platform is monitored and updated based on the active-passive conversion unit. Specifically, in the process of constructing the remote monitoring platform, the power structure topology and the event association tree are first combined. The power structure topology shows the physical information such as the layout of power equipment and lines in the power jurisdiction area, and the event association tree presents the logical relationship and development context of different security events. After combining the two, the platform is monitored and updated with the help of the active-passive conversion unit. The active-passive conversion unit plays a key role in realizing the conversion of the monitoring mode. The passive monitoring mode determines the passive perception information through sensor networking perception, and uses various sensors and network monitoring equipment installed in the power system to collect operating parameters and network traffic in real time. After the active monitoring mode transmits the passive perception information back, it performs perception situation analysis and event association feature mining to determine the passive perception logic, and then performs minimum logical granularity decomposition and logic conversion fusion to determine the monitoring logic, and finally updates the remote monitoring platform based on this to achieve comprehensive real-time monitoring and effective management of power collection safety.

[0024] In a possible implementation, a remote monitoring platform is constructed by combining the power consumption structure topology with the event association tree, wherein the remote monitoring platform is updated based on the active-passive conversion unit, and step S300 further includes step S310, determining passive sensing information through sensor networking sensing, and the passive sensing information is. Specifically, various sensors, such as current sensors, voltage sensors, temperature sensors, etc., and networking devices are widely deployed in the power system within the power consumption jurisdiction area to ensure that the operating status and environmental parameters of the power equipment can be collected in real time. At the same time, a stable network connection is established to ensure that the sensor data can be transmitted in time. Sensors and networking devices continuously monitor the power system and collect various data, including current, voltage, power, equipment temperature, network traffic, etc. These data constitute passive sensing information, reflecting the actual operation of the power system at the current moment. For example, the current sensor monitors the current size of each device in real time, and the temperature sensor monitors the working temperature of the device. The collected passive sensing information is sorted and preliminarily analyzed to remove noise and abnormal data to ensure the accuracy and reliability of the data. For example, the noise interference in the current sensor data is removed by a data filtering algorithm, so that the data can more accurately reflect the actual current situation.

[0025] Step S320, the passive sensing information is transmitted back to the active-passive conversion unit, and the passive sensing logic is determined through the sensing situation analysis and event association feature mining. Specifically, the sorted passive sensing information is transmitted back to the active-passive conversion unit through the network connection. This unit is the core component of the remote monitoring platform and is responsible for processing and analyzing the sensing information. The active-passive conversion unit performs sensing situation analysis on the passive sensing information transmitted back. This includes analyzing the changing trend of parameters such as current and voltage to determine whether the power system is stable; analyzing the changes in network traffic to detect whether there are abnormal network activities; analyzing parameters such as device temperature to determine whether the device has abnormal conditions such as overheating. For example, if the current is found to increase suddenly and lasts for a period of time, it may mean that the power system has an increased load or a fault. At the same time, the active-passive conversion unit performs event association feature mining. Combined with the previously constructed event association tree, the association between the current passive sensing information and the known security events is analyzed. For example, if the current current change is associated with a device failure event in the event association tree, it may indicate that a similar failure is about to occur. Passive sensing logic is determined through sensing situation analysis and event association feature mining. This logic describes the power system status and possible development trends reflected by the current passive sensing information, as well as the potential association with security events. For example, if the analysis results show that the current is abnormally increased and similar to the characteristics of a historical fault event, then the passive sensing logic may indicate that there is a risk of equipment failure.

[0026] Step S330, the passive sensing logic is decomposed at the minimum logical granularity and logically converted and merged to determine the monitoring logic. Specifically, the determined passive sensing logic is decomposed at the minimum logical granularity. The passive sensing logic is decomposed into the most basic logical units for more in-depth analysis and conversion. For example, the passive sensing logic of "there is a risk of equipment failure" is decomposed into more specific logical units such as "abnormal increase in current", "temperature increase", and "abnormal network traffic". The decomposed logical units are logically converted. According to different monitoring requirements and safety standards, these logical units are converted into a form that is more suitable for monitoring. For example, "abnormal increase in current" is converted into "current change rate exceeds a certain threshold" to make it easier to monitor and judge. The converted logical units are merged to form a new monitoring logic. Through logical fusion, multiple factors can be comprehensively considered to improve the accuracy and reliability of monitoring. For example, logical units such as "current change rate exceeds a certain threshold", "temperature increase exceeds a certain range", and "network traffic is abnormal" are merged into the monitoring logic of "the device may have a fault and needs to be strengthened". After the minimum logical granularity decomposition, logical conversion and fusion, the final monitoring logic is determined. This monitoring logic will serve as the basis for updating the remote monitoring platform and guide the platform to conduct more accurate monitoring of the power system.

[0027] Step S340, based on the monitoring logic, the remote monitoring platform is updated. Specifically, according to the determined monitoring logic, the remote monitoring platform adjusts its own monitoring parameters. For example, if the monitoring logic indicates that the current monitoring of a certain device needs to be strengthened, the platform will adjust the sampling frequency and alarm threshold of the current sensor corresponding to the device. At the same time, the platform updates the monitoring strategy. According to the requirements of the monitoring logic, the monitoring focus and response measures in different situations are determined. For example, if the monitoring logic shows that there is a risk of network attack, the platform will start the network security monitoring strategy and strengthen the analysis and filtering of network traffic. The remote monitoring platform will also update the data display method to better reflect the information concerned by the monitoring logic. For example, the operating status and parameters of the key monitoring equipment are displayed on the platform interface in a more prominent way, so that the monitoring personnel can find problems in time. The updated remote monitoring platform continues to monitor the power system according to the new monitoring logic and continuously collects new passive perception information. According to the new information, the platform can further adjust and optimize the monitoring logic to form a monitoring process that is continuously cycled and optimized, realizing a complete solution process from sensor networking perception to determining the monitoring logic and then updating the remote monitoring platform, ensuring that the remote monitoring platform can monitor the safety of power collection in real time and accurately.

[0028] In a possible implementation, a remote monitoring platform is constructed by combining the power structure topology with the event association tree, wherein the remote monitoring platform is updated based on the active-passive conversion unit, and step S300 further includes step S350, which constructs a passive branch with situational awareness-situational cognition-risk disposal-risk presentation as the underlying logic. Specifically, first, a comprehensive situational awareness of the power system is performed through various monitoring means, including sensors installed on power equipment and lines for real-time collection of physical parameters such as current, voltage, and temperature; network monitoring equipment for monitoring network traffic and communication status; and a security log recording system for recording the operating status of the equipment and security events. For example, sensors can monitor the sudden increase of the current of a certain device in real time, which is an important source of information for situational awareness. The various collected information is integrated and analyzed to determine the overall state of the current power system. For example, if multiple sensors detect current anomalies at the same time, it reflects the potential faults or safety risks in the system. On the basis of situational awareness, situational cognition is carried out, and the collected information is deeply analyzed to understand the reasons and potential impacts behind the current state of the power system. For example, if the current is found to be abnormally increased, it may be determined through analysis that it is due to the overload of a certain device or the existence of a potential short circuit fault. Combined with historical data and expert knowledge, the current situation is evaluated and judged. For example, by comparing the current current value with the historical data of the same period, it is determined whether it exceeds the normal range; or based on expert experience, it is determined that a certain current change pattern may indicate what type of fault. Once the potential risk is identified, risk disposal is required. Including the formulation of corresponding emergency measures and plans to deal with possible safety incidents. For example, if it is determined that a certain device has an overload risk, measures such as reducing the load of the device and adjusting power distribution can be taken to start the risk disposal process and coordinate relevant departments and personnel for emergency response. For example, notify equipment maintenance personnel to inspect and repair equipment that may have faults; or adjust the power dispatch strategy to ensure the stable operation of the system, present the identified risks to relevant personnel in an intuitive way, and achieve this through visual monitoring platforms, alarm systems, etc. For example, display the location and change trend of abnormal current equipment in the form of charts on the remote monitoring platform; or remind staff to pay attention to potential security risks through sound and light alarm systems, provide detailed risk information and suggestions, and help relevant personnel make decisions, such as giving risk severity assessments, possible impact ranges, and recommended disposal measures, and analyze and logically mine passive monitoring information such as parts that are not covered by the model or have caused security incidents. For example, if a security incident is caused by a new attack method, and the existing monitoring model does not cover this attack, then it is necessary to conduct an in-depth analysis of the incident, find out its characteristics and laws, and convert passive monitoring information into logical features that can be actively monitored in advance.By analyzing the passive monitoring information, we can extract the features and logical relationships that can be used for early warning. For example, if we find that a security incident always occurs at a specific time and on a specific device, we can use these features as the logical basis for active monitoring, monitor and warn similar situations in advance, and use logical features to update the remote monitoring module. The converted logical features are integrated into the remote monitoring platform, so that it can more effectively monitor and prevent similar security incidents. For example, we can add a focus monitoring function for specific time and specific equipment to the remote monitoring platform.

[0029] Step S360, obtain the active-passive conversion logic library, and construct conversion branches with logic internal competition as the mode, and the conversion branches are used to mine the active-passive logical relationship. Specifically, collect and organize various active-passive conversion logic rules and cases, and establish an active-passive conversion logic library, including different types of security events, corresponding passive monitoring information, and converted active monitoring logic. For example, for network attack events, record passive monitoring information such as network traffic characteristics and device status when the attack occurs, as well as the corresponding active monitoring logic, such as strengthening network traffic monitoring, setting specific firewall rules, etc., and continuously update and improve the active and passive conversion logic library. As new security events occur and are handled, add new conversion logic to the library. For example, if a new malware attack occurs, after analysis and processing, add its passive monitoring information and the converted active monitoring logic to the logic library, and adopt a logic internal competition mode, that is, let different logic rules compete and optimize internally. For the same security event, there may be multiple different active and passive conversion logics. By comparing their effects and applicability, select the optimal logic for application. For example, for a certain equipment failure event, there are two different active monitoring logics, one is based on monitoring of equipment temperature changes, and the other is based on monitoring of current fluctuations. Through practical application and comparison, determine which logic is more accurate and effective, and build a conversion branch. The branch is specifically responsible for exploring the active and passive logical relationship. Through the analysis and processing of the active and passive conversion logic library, find out the relationship between passive monitoring information and active monitoring logic in different types of security incidents. For example, for network attack incidents, determine which network traffic characteristics can be used as passive monitoring information, and what the corresponding active monitoring logic should be.

[0030] Step S370, coordinate the passive branch and the conversion branch to determine the active-passive conversion unit. Specifically, the passive branch and the conversion branch work together to jointly determine the active-passive conversion unit. The passive branch provides actual passive monitoring information and conversion requirements, while the conversion branch provides the logic and method of active-passive conversion. For example, when the passive branch detects a new security event, it passes its information to the conversion branch. The conversion branch finds the corresponding conversion logic according to the active-passive conversion logic library and feeds it back to the passive branch. The passive branch updates the remote monitoring module according to the converted active monitoring logic. Through the collaborative work of the passive branch and the conversion branch, the active-passive conversion unit is finally determined. The unit includes the logic, method and tool of active-passive conversion, which can realize the conversion from passive monitoring to active monitoring. The active-passive conversion unit can be integrated into the remote monitoring platform. As an important part of the platform, it can automatically perform active-passive conversion according to actual security events and monitoring requirements, improve the efficiency and accuracy of monitoring, build an effective active-passive conversion unit, realize the conversion from passive monitoring to active monitoring, and improve the ability and level of power collection safety monitoring.

[0031] Step S400, assist the remote monitoring platform to conduct power network perception and power collection safety assessment, and determine the safety monitoring list. Specifically, the auxiliary remote monitoring platform needs to establish a stable connection with the platform and share the power network perception device data, and provide the platform with advanced analysis tools and algorithms. Then, power network perception is carried out, and perception devices are deployed in the power jurisdiction area to ensure their accuracy and reliability. The perception devices collect power data in real time and transmit it to the remote monitoring platform, and the collected data is pre-processed. Then, the power collection safety assessment is carried out to determine the evaluation index system including equipment, network, data security, etc., determine the evaluation criteria and weights for each indicator, adopt appropriate evaluation methods and formulate processes to ensure that the evaluation is comprehensive and accurate. Integrate the evaluation results to form a safety monitoring list, analyze and summarize to find out the safety issues and risks, generate a detailed safety monitoring list based on the integrated results, and display it in the form of a report or on the remote monitoring platform to provide support for the safety management of power collection.

[0032] In a possible implementation, the remote monitoring platform is assisted to perform the safety assessment of power network perception and power collection, and determine the safety monitoring list. Step S400 further includes step S410, which assists the remote monitoring platform to control the front-end sensor device, determine the monitoring data stream and perform the collection timestamp marking. Specifically, an effective connection and communication is established with the remote monitoring platform to ensure that the platform's instructions can be received and information can be fed back to it. For example, through a network connection or a dedicated data transmission channel, real-time interaction with the remote monitoring platform is achieved, and necessary support and assistance is provided to the remote monitoring platform, including data processing, analysis and storage. For example, after receiving the control instructions sent by the remote monitoring platform, the front-end sensor device is operated accordingly, and the collected data is preliminarily processed and then sent back to the platform. According to the instructions of the remote monitoring platform, the front-end sensor device is controlled, including starting or stopping the sensor device, adjusting the parameter settings of the device, selecting a specific monitoring mode, etc. For example, when the remote monitoring platform detects abnormal power consumption in a certain area, it can send instructions to start the specific sensor device in the area to obtain more detailed monitoring data. Ensure the normal operation and stability of the front-end sensor equipment, perform regular maintenance and inspection on the sensor equipment, and promptly handle equipment failures and abnormal situations. For example, regularly calibrate and debug the sensor equipment to ensure the accuracy and reliability of its measurement data. The front-end sensor equipment starts to collect power consumption data according to the control instructions to form a monitoring data stream. The data may include various parameters such as current, voltage, power, and temperature. For example, the current sensor collects the current value in the circuit in real time, and the voltage sensor collects the voltage value. The data is combined into a monitoring data stream. The monitoring data stream is preliminarily screened and sorted to remove noise and abnormal data to ensure the quality of the data. For example, using digital According to the filtering algorithm, noise interference in the current sensor data is removed to make the data more accurately reflect the actual power consumption. While determining the monitoring data stream, a collection timestamp is added to each data point. The timestamp can accurately record the data collection time and provide a time reference for subsequent data analysis and processing. For example, when the current sensor collects a current value, the current time is recorded as the timestamp of the data point to ensure the accuracy and consistency of the timestamp. A unified time standard and clock source are used to avoid the impact of time errors on data analysis. For example, all sensor devices use the same high-precision clock source to ensure the accuracy of the timestamp.

[0033] Step S420, transmit the monitoring data stream back, and make a decision to determine the security indicator matrix. Specifically, the monitoring data stream with a timestamp is transmitted back to the remote monitoring platform through the network or other data transmission methods to ensure the stability and reliability of data transmission and avoid data loss or transmission errors. For example, a reliable network communication protocol and data encryption technology are used to ensure that the monitoring data stream can be safely and quickly transmitted to the remote monitoring platform. During the transmission process, the monitoring data stream can be compressed and encrypted to improve data transmission efficiency and security. For example, a data compression algorithm is used to reduce the amount of data and reduce the transmission bandwidth requirement; an encryption algorithm is used to encrypt the data to prevent the data from being stolen or tampered with. After receiving the monitoring data stream, the remote monitoring platform decides to determine the security indicator matrix based on the pre-set security indicator system. The full indicator system includes safety indicators in multiple dimensions, such as voltage stability, current anomalies, power factor, equipment failure rate, etc. The monitoring data stream is analyzed and processed to calculate the value of each safety indicator. For example, the value of the voltage stability indicator is calculated by statistically analyzing the voltage data over a period of time; the value of the current anomaly indicator is determined by performing anomaly detection on the current data. Based on the calculated safety indicator values, a safety indicator matrix is ​​constructed. Each element in the matrix represents the value of a safety indicator at a specific time point or time period. For example, the safety indicator matrix can be a two-dimensional matrix, in which rows represent different safety indicators and columns represent different time points. The elements in the matrix are the values ​​of the corresponding safety indicators at that time point.

[0034] Step S430, evaluate the safety indicator matrix and determine the safety monitoring list. Specifically, the constructed safety indicator matrix is ​​evaluated, including a separate evaluation of each safety indicator and a comprehensive evaluation of the entire matrix. For example, the voltage stability indicator is evaluated to determine whether it is within the normal range; the entire safety indicator matrix is ​​comprehensively evaluated to determine the overall safety status of the power system, and appropriate evaluation methods and models are used to evaluate the safety indicator matrix using statistical methods, machine learning algorithms, etc. For example, the safety indicators are analyzed using statistics such as mean and standard deviation; the safety indicator matrix is ​​predicted and classified using a machine learning model to determine whether there is a safety risk, and the safety monitoring list is determined based on the evaluation results of the safety indicator matrix. The list includes the safety status of the power system, existing safety issues and risks, and recommended improvement measures. The evaluation results are analyzed and summarized to find out the existing safety issues and risks. For example, if a certain safety indicator exceeds the normal range, or there is an abnormal correlation between multiple safety indicators, it may indicate that there are safety issues or risks. According to the safety issues and risks, corresponding improvement measures and suggestions are proposed. For example, if the equipment failure rate is high, it can be recommended to strengthen equipment maintenance and management; if many current abnormalities are found, it can be recommended to check and optimize the line. The safety status, safety issues and risks, and improvement measures are organized into a safety monitoring list for relevant personnel to view and handle. The safety monitoring list can be presented in the form of a report or displayed through a remote monitoring platform to achieve real-time monitoring and safety assessment of the power system, providing strong support for the safety management of power collection.

[0035] In a possible implementation, the safety indicator matrix is ​​evaluated to determine a safety monitoring list, and step S430 further includes step S431, performing event correlation analysis on the safety indicator matrix to determine a first evaluation result. Specifically, the specific meaning of each indicator in the safety indicator matrix and the possible safety events involved are clarified. For example, the voltage stability indicator may be related to events such as equipment failure and power grid fluctuation; the current abnormality indicator may be related to events such as short circuit and overload. Collect historical safety event data and related cases, establish a correlation model between events and safety indicators, analyze past safety events, find out the changing rules of safety indicators when different events occur, and provide reference for current event correlation analysis. Analyze the data in the safety indicator matrix row by row and column by column, and observe the changing trends and mutual relationships of each indicator. For example, if it is found that the voltage stability indicator decreases while the current abnormality indicator also increases, it may mean that there is equipment failure or power grid instability. Combined with the event correlation model, determine whether the data in the current safety indicator matrix is ​​associated with known safety events. If there is a correlation, further determine the type and severity of the possible safety events. Consider the changes in multiple safety indicators comprehensively to determine the first evaluation result. The first evaluation result can be a preliminary judgment on the current safety status of the power system, such as the possibility of medium-risk equipment failure and low-risk power grid fluctuation.

[0036] Step S432, traverse the security indicator matrix, perform self-checking of the address of the source data, locate it in the power structure topology, and determine the address local topology. Specifically, traverse each data point in the security indicator matrix, obtain the corresponding source data address information, the end data address is the sensor number, the IP address of the device, etc., which is used to determine the source of the data, and self-check the source data address to check the legality and accuracy of the address, for example, check whether the address format is correct, whether it is within the known address range, etc. If a problem is found in the address, it needs to be corrected or the data needs to be re-acquired. Through address self-checking, ensure that the data source in the security indicator matrix is ​​reliable, and provide accurate basic data for subsequent positioning and analysis. The source data address that has undergone address self-verification is matched with the power structure topology to determine the location of the data in the power structure. The power structure topology is a description of the distributed local power structure within the power usage jurisdiction, including the location and connection relationship of each power device, line node, etc. By locating the source data address in the power structure topology, the specific device, line or area to which the data belongs can be determined. For example, if the address of a sensor corresponds to a specific transformer node in the power structure topology, it can be determined that the data collected by the sensor is related to the transformer. According to the positioning result in the power structure topology, it is determined Determine the address local topology where the source data is located. The address local topology refers to the local power consumption structure centered on the source data address, including the equipment, lines and other nodes directly connected to it. Analyze the characteristics and properties of the address local topology, such as equipment type, load conditions, connection relationships, etc. Considering that different power consumption data characteristics are located in different power consumption structures and their assessment standards and risks are different, intervene in the power structure to improve the analysis accuracy. For example, if a sensor is located in an industrial power consumption area, the assessment standard of its data may be different from that in a residential power consumption area, because the load and operating characteristics of industrial power equipment are very different from those of residential power equipment.

[0037] Step S433, based on the address local topology, compensate the first assessment result and generate the safety monitoring form. Specifically, according to the determined address local topology, analyze its impact on electricity safety, consider factors such as equipment characteristics, load conditions, and connection stability in the local topology, and assess possible safety risks. For example, if an address local topology contains old equipment or high-load equipment, the risk of equipment failure may increase; if the connection relationship is complex or there are weak links, the risk of power grid fluctuations may increase. Combined with the characteristics of the address local topology, adjust and compensate the first assessment result. If the first assessment result does not fully consider the impact of the address local topology, the assessment result can be corrected according to the analysis results of the local topology. For example, if the first assessment result shows that there is a low risk of power grid fluctuations, but there are high-load equipment and complex connection relationships in the address local topology, the risk assessment result needs to be adjusted to medium risk, and the compensated assessment result will be adjusted to medium risk. The assessment results are compiled into a safety monitoring sheet, which should include the overall safety status of the power system, existing safety issues and risks, specific risk sources (such as equipment, lines or areas), and recommended improvement measures. In the safety monitoring sheet, the impact of the address local topology on the safety assessment is clearly pointed out so that relevant personnel can better understand the safety status and take targeted measures. For example, the safety monitoring sheet states that high-load equipment in a certain area is the main factor leading to increased risk, and proposes corresponding equipment upgrades or load adjustment suggestions. The safety monitoring sheet can be presented in the form of a report or displayed through a remote monitoring platform, so that relevant personnel can promptly understand the safety status of the power system and take corresponding measures, more accurately assess the safety status of the power system, generate targeted safety monitoring sheets, and provide strong support for the safety management of power collection.

[0038] Step S500, based on the safety monitoring sheet, the front-end power consumption guidance is carried out to assist the remote monitoring platform in remote control management. Specifically, the contents of the safety monitoring sheet are analyzed to interpret the overall safety status of the power consumption system, safety problem risks, risk sources and improvement measures. Then, according to the analysis results, the specific content of the front-end power consumption guidance is determined, such as reasonable power consumption suggestions, equipment use precautions and abnormal situation handling methods, and the guidance information is delivered to the user in a suitable way to ensure clarity, understanding and practicality. At the same time, it is necessary to ensure stable connection and communication with the remote monitoring platform, and to receive platform instructions and feedback information in a timely manner. The remote monitoring platform issues remote control instructions based on the results of the safety monitoring sheet and real-time monitoring data. After receiving the instructions, the front-end device performs corresponding operations, such as adjusting equipment parameters, cutting off power or starting backup equipment, and feeding back the execution results to the platform. The platform can further adjust the control strategy based on the feedback, thereby improving the safety and management efficiency of power consumption collection.

[0039] The embodiment of the present application adopts the method of identifying the distributed local power structure within the power jurisdiction area, and establishing a power structure topology map with node structure type identification. Based on the two dimensions of attack safety and behavioral safety, it assists in situation identification and intent analysis, and mines the event association tree. Combining the topology map and the event association tree, a remote monitoring platform is constructed, and dynamic monitoring and updating are performed through the active and passive conversion units. The platform perceives and collects security assessments of the power network, generates a safety monitoring sheet, and based on this, provides power guidance for the front-end equipment, while realizing remote control management, achieving the technical effect of real-time identification and response to potential safety hazards in the power network through intelligent remote control and dynamic adjustment, and effectively avoiding decision-making bias.

[0040] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for safe monitoring of electricity consumption collection based on intelligent remote control, characterized in that: The method comprises: For the power consumption jurisdiction area, a distributed local power consumption structure is identified, and a power consumption structure topology is established, wherein the topological nodes of the power consumption structure topology are identified with a structure type; Taking attack security and behavior security as security dimensions, it assists in situation identification and intent analysis, and mines event association trees; Combining the power consumption structure topology with the event association tree, a remote monitoring platform is constructed, wherein the remote monitoring platform performs monitoring and updating based on the active-passive conversion unit; Assist the remote monitoring platform to conduct safety assessment of power network perception and power collection, and determine safety monitoring orders; The front-end electricity usage guidance is carried out based on the safety monitoring sheet, assisting the remote monitoring platform in remote control management.

2. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 1, characterized in that: The mining event association tree comprises: Retrieve and retrieve the electricity consumption collection safety record, and determine the record information group by analyzing the electricity consumption characteristics and data flow, where each group of record information corresponds to a record event; Traversing the record information groups, dividing the groups into intuitive parts and non-intuitive parts; determining event-related features of the intuitive portion; Traversing the non-intuitive part, performing behavior recognition and intentional understanding, and determining event association features of the non-intuitive part, wherein the non-intuitive part is marked with a bias guidance mark; The event association features of the intuitive part and the non-intuitive part are integrated and determined to form an event association tree, wherein the event association tree corresponds to the recorded events.

3. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 2, characterized in that: After integrating the event association features of the intuitive part and the non-intuitive part, the method includes: Traversing the event correlation features, determining a precursor node based on the risk level, wherein a time span based on the precursor node is positively correlated with the risk level; A precursor feature value based on the precursor node is determined, the event association feature is marked, and the event association tree is generated.

4. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 3, characterized in that: In terms of attack security dimension, the attack chain is determined and the precursor node is located, the malicious code penetration characteristics of the precursor node are integrated, and the event correlation characteristics are compensated.

5. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 1, characterized in that: The remote monitoring platform performs monitoring and updating based on the active-passive conversion unit, including: Determine passive sensing information through sensor networking sensing, wherein the passive sensing information is: The passive sensing information is transmitted back to the active-passive conversion unit, and the passive sensing logic is determined through sensing situation analysis and event-related feature mining; Decomposing the passive sensing logic at the minimum logic granularity and integrating the logic conversion to determine the monitoring logic; Based on the monitoring logic, the remote monitoring platform is updated.

6. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 5, characterized in that: Get the active-passive conversion unit, including: With situation awareness - situation cognition - risk disposal - risk presentation as the underlying logic, passive branches are constructed; Obtain an active-passive conversion logic library, and construct conversion branches using logic internal competition as a mode, wherein the conversion branches are used to mine active-passive logical relationships; The passive branch and the conversion branch are coordinated to determine the active-passive conversion unit.

7. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 1, characterized in that: The power consumption network perception and power consumption collection safety assessment includes: Assist the remote monitoring platform to control the front-end sensor equipment, determine the monitoring data stream and perform acquisition timestamp marking; Return the monitoring data stream and make decisions to determine the safety indicator matrix; Evaluate the safety indicator matrix and determine the safety monitoring list.

8. The method for safe monitoring of electricity consumption collection based on intelligent remote control according to claim 7, characterized in that: The evaluation of the safety indicator matrix includes: Performing event correlation analysis on the safety indicator matrix to determine a first evaluation result; Traversing the security indicator matrix, performing address self-checking of source data, locating the power structure topology, and determining the address local topology; Based on the address local area topology, the first evaluation result is compensated to generate the security monitoring list.

Images