Situation awareness system and method suitable for mass power resource access

Abstract

The invention discloses a situation awareness system and method suitable for mass power resource access, and relates to the technical field of power. Comprising a server unit and a system processing unit, and the server unit comprises a mass acquisition module, a server integration module and a server feature module; and the system processing unit comprises an identification module and a risk judgment module. A comprehensive and intelligent situation awareness system is formed, the operation efficiency and reliability of a power network are improved, a powerful guarantee is provided for safe and stable operation of a power system, and the method has important practical application value for management and optimization of a large-scale power network.

Description

Technical Field

[0001] The present invention relates to the field of electric power technology, and in particular to a situation awareness system and method suitable for accessing massive electric power resources. Background Art

[0002] With the development of power technology, more and more new technologies are integrated into the power grid, forming a "smart grid". Smart grids put forward higher requirements on the performance of the power grid.

[0003] Massive data collection terminals generate a large amount of communication traffic when reporting data. In traditional technology, the central server processes the data in a unified manner, which has relatively low processing efficiency and poor scalability.

[0004] With the increasing development of power system informatization, its operating efficiency is also constantly improving, which brings convenience to users while also increasing the potential safety hazards of the power system. The emergence of viruses has made people aware of the risks of coupling information systems and physical systems. At the same time, the security issues of CPPS have attracted widespread attention from scholars at home and abroad.

[0005] In addition, as the complexity of power systems gradually deepens, data fusion and security situation awareness have gradually become hot research issues in the field of power system security. Therefore, using data analysis technology to process massive heterogeneous log data in power systems has become a feasible solution. When processing massive resources, distributed computing has more obvious advantages than traditional single computers. However, the current log analysis strategy still cannot be well applied to power information systems. As an important basis for determining the risk level and early warning of power information systems, security situation awareness is also an important part of the system security field. Summary of the invention

[0006] In view of the problems existing in the existing data fusion and security situation awareness, the present invention is proposed.

[0007] Therefore, the problem to be solved by the present invention is how to collect, integrate, identify and judge massive resources, improve the work efficiency of related processing of massive power resources and perform different types of classification.

[0008] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0009] In a first aspect, an embodiment of the present invention provides a situational awareness system suitable for access to massive power resources, comprising a server unit and a system processing unit; the server unit comprises a massive acquisition module, which is used to acquire resources and report them to a server integration module; the server integration module is used to receive all acquired resources for analysis and proofreading, and process the proofread resources; a server feature module is used to generate a set of behavior features, and identify and judge the behavior through a behavior feature library based on role authorization; the system processing unit comprises an identification module, which is used to analyze the categories of different users through the server feature module, and compare the behavior with the resource library to determine the authorization corresponding to the behavior; and a risk judgment module, which is used to analyze the risk levels of users of different categories in the server feature module, and make fault risk judgments, and trigger an alarm mechanism in real time; the output of the massive acquisition module is connected to the input of the server integration module; the output of the server integration module is connected to the input of the server feature module; the output of the server feature module is respectively connected to the inputs of the identification module and the risk judgment module.

[0010] As a preferred solution of the situation awareness system suitable for access to massive power resources described in the present invention, the parsing and proofreading includes the following steps: format conversion and structured processing of the received original resources, including automatically mapping data fields from different sources to standardized fields through a predefined mapping table; while parsing, basic integrity and format verification of key fields; fast consistency check of multiple data of the same resource, and correction of abnormal values ​​using the median method: assuming that the data set is V1, V1, ..., V n The corrected value is V c ,but:

[0011] V c =median(V1,V1,...,V n )

[0012] Perform plausibility checks on current data based on historical data or predefined rules.

[0013] As a preferred solution of the situational awareness system suitable for access to massive power resources described in the present invention, the server integration module includes: splitting and assembling resources according to the parsed resources, including: using K-means clustering algorithm and principal component analysis to automatically classify and extract features of resources, generate multiple sub-resources, and dynamically adjust the splitting strategy according to the real-time characteristics of the sub-resources; assembling the sub-resources according to the generation time information and regional information of the sub-resources to obtain assembled resources; using the time distance function to calculate the time difference of each pair of sub-resources to obtain the time distance matrix, using the space distance function to calculate the geographical difference of each pair of sub-resources to obtain the space distance matrix, clustering the sub-resources based on the time distance and space distance to form an assembled resource set; obtaining the assembled resources, using the dynamic rule engine to dynamically adjust the processing strategy according to the real-time system status and resource characteristics; the processed resources build a resource library based on historical resources, perform association analysis on the behavior resource library, and build an identity-based behavior feature set.

[0014] As a preferred solution of the situational awareness system suitable for access to massive power resources described in the present invention, the server feature module also includes: building a behavior feature library based on role authorization based on a behavior feature set, and identifying and judging the behavior through an identity-based behavior feature set; abstracting the association analysis results, extracting the characteristic values ​​of daily behaviors, and building an identity-based behavior feature set.

[0015] As a preferred solution of the situation awareness system applicable to massive power resource access described in the present invention, the automatic classification of resources using the K-means clustering algorithm includes:

[0016]

[0017] Among them, J is the objective function, k is the preset number of clusters, C i is the i-th cluster, x belongs to cluster C i Data points, μ i Cluster C i The centroid of ; dynamically adjusted and split into:

[0018] S(t)=α×S(t-1)+(1-α)×ω i ×F i (R(t))

[0019] Among them, F i (R(t)) represents the i-th feature extracted from the current resource R(t), ω i is with the feature F iThe weight associated with (R(t)) determines the influence of the feature in the final strategy generation, S(t) is the splitting strategy at time t, α is the smoothing factor (0<α<1), and S(t-1) is the splitting strategy at the previous moment.

[0020] As a preferred solution of the situational awareness system suitable for access to massive power resources described in the present invention, wherein: the construction of a behavior feature library based on role authorization and the identification and judgment of behavior through an identity-based behavior feature set include: establishing a role-behavior matrix, defining the degree to which each role is authorized to perform various behaviors, and using a collaborative filtering algorithm to optimize the role-behavior matrix; establishing a behavior feature set B(i) for each identity, including common behavior patterns of the identity; designing a behavior recognition function, calculating the similarity between the behavior to be recognized and each behavior in the identity feature set, and assigning different importance to different behavior features, as follows:

[0021]

[0022] Among them, I(b,g) is the possibility that behavior b belongs to identity g, ω bj is the weight of the behavior feature bj, sim(b,bj) is the similarity between behavior b and feature bj; set the judgment threshold When the similarity exceeds the threshold , the behavior is considered to belong to the identity; constructing an identity-based behavior feature set includes: using the eigenvalues ​​extracted by PCA to update the behavior feature set, establishing a new behavior feature set for each identity, including the behavior and its corresponding eigenvector, establishing a mapping relationship between identity and behavior category, and forming a complete identity-behavior model.

[0023] As a preferred solution of the situation awareness system suitable for access of massive power resources described in the present invention, the server integration module also includes: for resources that have passed the proofreading, the massive resource acquisition module does not need to continue to wait for retransmission.

[0024] In a second aspect, an embodiment of the present invention provides a situational awareness method suitable for access to massive power resources, which includes: collecting resources from multiple data sources; parsing and proofreading the received resource data, and further processing the proofread resource data; generating a user behavior feature set based on the processed resource data; matching the generated behavior feature set with a behavior feature library based on role authorization, identifying the user's behavior type and judging its legitimacy; analyzing the categories of different users, comparing the analyzed user categories with the data in the behavior feature library, and determining whether the user behavior meets the corresponding authorization conditions; evaluating the user's risk level through the analyzed user category, and making a comprehensive judgment on fault and safety risks based on the user's risk level and behavior characteristics.

[0025] In a third aspect, an embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of the situational awareness system suitable for access to massive power resources as described in the first aspect of the present invention are implemented.

[0026] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of the situational awareness system suitable for access to massive power resources as described in the first aspect of the present invention are implemented.

[0027] The beneficial effects of the present invention are as follows: the situational awareness system suitable for access to massive electric power resources proposed in the present invention improves the flexibility and pertinence of data processing through resource splitting and assembly methods combined with K-means clustering algorithm and principal component analysis; the introduction of a dynamic rule engine enhances the adaptive ability of the system, enabling it to better cope with dynamic changes in the electric power network; the construction of an identity-based behavioral feature set and the design of a risk judgment module greatly improve the system's ability to identify abnormal behaviors and its level of security protection, forming a comprehensive and intelligent situational awareness system, which not only improves the operating efficiency and reliability of the electric power network, but also provides a strong guarantee for the safe and stable operation of the electric power system, and has important practical application value for the management and optimization of large-scale electric power networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 This is an overall schematic diagram of a situational awareness system suitable for access to massive power resources.

[0030] Figure 2 This is a partial flow chart of the situational awareness system server applicable to access of massive power resources.

[0031] Figure 3 A partial flow chart of the situational awareness system processing applicable to massive power resource access. DETAILED DESCRIPTION

[0032] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0033] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0034] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0035] Example 1

[0036] Reference Figure 1 to Figure 3 , which is the first embodiment of the present invention, provides a situation awareness system suitable for access to massive power resources, including a server unit and a system processing unit. The server unit includes a massive acquisition module, a server integration module and a server feature module; the system processing unit includes an identification module and a risk judgment module.

[0037] Among them, the mass collection module is used to collect resources and report them to the server integration module; the server integration module is used to receive all collected resources, parse and proofread the collected resources, and process the proofread resources; the server feature module is used to receive and process the integrated resources, generate a set of behavior features, and identify and judge the behavior through the behavior feature library based on role authorization; the identification module is used to analyze the categories of different users through the server feature module, and compare the behavior with the resource library to determine the authorization corresponding to the behavior; the risk judgment module is used to analyze the risk level of different categories of users through the server feature module, and make fault risk judgments, and trigger the alarm mechanism in real time. If no similar behavior is found in the resource library, or the authorization information exceeds the authorization scope of the actual role, the behavior is judged as high-risk behavior.

[0038] It should be noted that the output of the massive acquisition module is connected to the input of the server integration module; the output of the server integration module is connected to the input of the server feature module; and the output of the server feature module is respectively connected to the inputs of the identification module and the risk judgment module.

[0039] Furthermore, the server integration module also includes: for resources that have passed the proofreading, the massive resource acquisition module does not need to continue to wait for retransmission.

[0040] Preferably, parsing and proofreading the collected resources includes the following steps:

[0041] First, all collected resources are received from the massive data collection module. The received resources may include power data in various formats, such as voltage, current, power, load, etc. The data may come from different sensors, devices and regions.

[0042] The received raw resources are formatted and structured, including automatically mapping data fields from different sources to standardized fields through predefined mapping tables to avoid manual configuration of mapping rules. In addition, while parsing, basic integrity and format verification are performed on key fields (such as timestamps, resource IDs, etc.) to ensure the basic validity of the data.

[0043] Perform a quick consistency check on multiple pieces of data from the same resource, using simple statistical methods (such as median or mode) to correct outliers:

[0044] Suppose the data set is V1,V1,...,V n The corrected value is V c ,but:

[0045] V c =median(V1,V1,...,V n )

[0046] It can be seen that the use of the median method to correct outliers simplifies the correction process and improves accuracy.

[0047] Based on historical data or predefined rules, the current data is checked for rationality, such as whether the voltage data is within the normal operating range (e.g., 220V±10%).

[0048] Furthermore, according to the parsed resources, the resources are split and assembled, including:

[0049] After the original resource is parsed, the K-means clustering algorithm and principal component analysis are used to automatically classify and extract features from the resource, generate multiple sub-resources, and dynamically adjust the splitting strategy based on the real-time characteristics of the sub-resources;

[0050] Specifically, using the K-means clustering algorithm to automatically classify resources includes:

[0051]

[0052] Among them, J is the objective function (the overall error of clustering), k is the preset number of clusters, and C i is the i-th cluster, x belongs to cluster C i Data points, μ i Cluster C i The centroid (mean vector) of .

[0053] Dynamic adjustment is divided into:

[0054] S(t)=α×S(t-1)+(1-α)×ω i ×F i (R(t))

[0055] Among them, F i (R(t)) represents the i-th feature extracted from the current resource R(t), ω i is with the feature F i The weight associated with (R(t)) determines the influence of the feature in the final strategy generation, S(t) is the splitting strategy at time t, α is the smoothing factor (0<α<1), and S(t-1) is the splitting strategy at the previous moment.

[0056] The sub-resources are assembled according to their generation time information and region information to obtain assembled resources, as follows:

[0057] First, extract the generation time information and region information of each sub-resource, which will be used in the subsequent assembly strategy; for each sub-resource, record its generation timestamp and extract the geographic location identifier of the sub-resource, which can be longitude and latitude coordinates, region code or other forms of geographic location information.

[0058] The time distance function is used to calculate the time difference of each pair of sub-resources to obtain the time distance matrix. The spatial distance function is used to calculate the geographical difference of each pair of sub-resources to obtain the spatial distance matrix. The spatial distance can be calculated using the geographical distance formula, such as the great circle distance formula.

[0059] The sub-resources are clustered based on the temporal distance and spatial distance to form an assembled resource set.

[0060] Obtain assembled resources and use a dynamic rule engine to dynamically adjust processing strategies based on real-time system status and resource characteristics, including:

[0061] Build a dynamic rule engine using decision tree models:

[0062]

[0063] Among them, IG(S,A) is the information gain of feature A for data set S, H(S) is the entropy of data set S, Values(A) is all possible values ​​of feature A, S v is a subset of feature A with value v, |S| is the cardinality of set S, H(S v ) is a subset S v The entropy of .

[0064] Dynamically adjust the processing strategy:

[0065] P(t)=β×P(t-1)+(1-β)×(γ×G s (S(t))+(1-γ)×G R (R(t)))

[0066] Among them, P(t) is the processing strategy at time t, β is the smoothing factor (0<β<1), P(t-1) is the processing strategy at the previous moment, γ is the coefficient of balancing the influence of system state and resource characteristics, G s (S(t)) represents the features extracted from the current system state S(t), G R (R(t)) represents the features extracted from the current resource R(t).

[0067] The processed resources build a resource library based on historical resources, perform association analysis on the behavior resource library, and build an identity-based behavior feature set. The specific operations are as follows:

[0068] Define the resource library R db It is a set of all processed resource feature vectors, which contain multi-dimensional information such as spatiotemporal features and category features. db , using cosine similarity as a metric to evaluate the similarity between different resources, so as to discover potential behavioral pattern associations, the following scheme can be adopted:

[0069] For two resource feature vectors f(rj) and f(rk), their cosine similarity is defined as:

[0070]

[0071] Among them, f(rj).f(rk) represents the dot product of the eigenvectors, and ‖f(rj)‖ and ‖f(rk)‖ are the Euclidean lengths of the eigenvectors, respectively.

[0072] When the cosine similarity sim(rj, rk) exceeds the set threshold, it is considered that the resources rj and rk are associated.

[0073] After completing the association analysis of the resource library, a behavioral feature set can be constructed based on the analysis results. The behavioral feature set is used to describe the association between resource features and behavioral patterns, and classify and analyze the feature set based on user identity.

[0074] Furthermore, the server feature module also includes: building a role-authorized behavior feature library based on a behavior feature set, identifying and judging behaviors through an identity-based behavior feature set, abstracting the association analysis results, extracting feature values ​​of daily behaviors, and building an identity-based behavior feature set.

[0075] Specifically, we first build a role-behavior matrix to define the extent to which each role is authorized to perform various behaviors, and use a collaborative filtering algorithm to improve this matrix, considering that similar roles may have similar behavioral characteristics.

[0076] For each identity, a behavior feature set B(i) is established, which contains the common behavior patterns of the identity. A behavior recognition function is designed to calculate the similarity between the behavior to be recognized and each behavior in the identity feature set, and different importance is assigned to different behavior features, as follows:

[0077]

[0078] Among them, I(b,g) is the possibility that behavior b belongs to identity g, ω bj is the weight of the behavior feature bj, and sim(b,bj) is the similarity between behavior b and feature bj.

[0079] Setting judgment threshold When the similarity exceeds the threshold , the behavior is considered to belong to that identity.

[0080] Furthermore, a hierarchical clustering algorithm is used to group and abstract the association rules.

[0081] By defining the distance measure between association rules, we can gradually merge the closest clusters based on indicators such as support and confidence to form a hierarchical structure; we can cut at the appropriate level to obtain abstract behavior categories, and give a semantic description of each abstract category to facilitate understanding and application.

[0082] Constructing an identity-based behavioral feature set includes: using the eigenvalues ​​extracted by PCA to update the previous behavioral feature set, establishing a new behavioral feature set for each identity, including behaviors and their corresponding eigenvectors, establishing a mapping relationship between identities and behavioral categories, and forming a complete identity-behavior model.

[0083] Furthermore, the identification module performs identification based on the server feature module, including comparing the behavior with the resource library, and the identification module determines the authorization corresponding to the behavior based on the behavior resource library.

[0084] Furthermore, the risk assessment module conducts real-time status analysis and fault risk assessment, and promptly triggers the alarm mechanism to ensure timely response and disposal, define different levels of alarms (such as low, medium, and high), and set alarm triggering conditions and rules. For example, when no similar behavior is found in the risk assessment module resource library, the behavior is judged to be a high-risk behavior; if the authorization in the resource library exceeds the authorization information of the actual role, the behavior is judged to be a high-risk behavior; implement multi-channel alarm notifications (such as email, SMS, and management console), and record all alarm events for subsequent analysis.

[0085] Develop response plans for different risk levels. For high-risk behaviors, automatic blocking or isolation measures may be taken, relevant personnel may be notified for manual review and intervention, the incident investigation process may be initiated, and relevant evidence may be collected.

[0086] Furthermore, the present embodiment also provides a situational awareness method suitable for access to massive power resources, including collecting resources from multiple data sources; parsing and proofreading the received resource data, and further processing the proofread resource data; generating a user behavior feature set based on the processed resource data; matching the generated behavior feature set with a behavior feature library based on role authorization to identify the user's behavior type and determine its legitimacy; analyzing the categories of different users, comparing the analyzed user categories with the data in the behavior feature library to determine whether the user behavior meets the corresponding authorization conditions; evaluating the user's risk level through the analyzed user category, and making a comprehensive judgment on fault and safety risks based on the user's risk level and behavior characteristics.

[0087] This embodiment also provides a computer device, which is suitable for the situational awareness system for access to massive electric power resources, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the situational awareness system for access to massive electric power resources as proposed in the above embodiment.

[0088] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0089] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, a situational awareness system applicable to access of massive electric power resources as proposed in the above embodiment is implemented.

[0090] In summary, the situational awareness system suitable for access to massive power resources proposed in the present invention improves the flexibility and pertinence of data processing through resource splitting and assembly methods, combined with K-means clustering algorithm and principal component analysis; the introduction of the dynamic rule engine enhances the system's adaptability, enabling it to better cope with dynamic changes in the power network; the identity-based construction of a behavioral feature set and the design of a risk judgment module greatly improve the system's ability to identify abnormal behaviors and the level of security protection, forming a comprehensive and intelligent situational awareness system, which not only improves the operating efficiency and reliability of the power network, but also provides a strong guarantee for the safe and stable operation of the power system, and has important practical application value for the management and optimization of large-scale power networks.

[0091] Example 2

[0092] Referring to Table 1, which is a second embodiment of the present invention, this embodiment provides a situation awareness system suitable for access to massive power resources. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through simulation experiments.

[0093] In order to verify the effectiveness of the situational awareness system for massive power resource access proposed in this invention, a six-month practical application test was conducted in a provincial power grid company. The test environment included the power systems of five prefecture-level cities, involving 500 substations, 10,000 distribution stations, and 1 million smart meters.

[0094] First, a massive data collection module was deployed to achieve real-time data collection of power equipment across the entire network through distributed data collection nodes. The collection content includes key parameters such as voltage, current, active power, reactive power, frequency, etc., with a sampling frequency of once per second. The server integration module adopts a distributed architecture and can simultaneously process massive data from different regions and different types of equipment.

[0095] In the data preprocessing stage, the improved K-means clustering algorithm is used to automatically classify the resources. Specifically, the raw data is first converted into feature vectors, and then PCA (principal component analysis) is used for dimensionality reduction, retaining the principal components that explain 95% of the variance. Next, the optimal number of clusters K=8 is determined by the elbow rule, and finally the K-means algorithm is applied for clustering. This step divides the massive data into 8 main categories, such as substation operation data, distribution network data, user power consumption data, etc.

[0096] The resource assembly stage uses a spatiotemporal correlation analysis method. First, the time series similarity is calculated using an improved DTW (Dynamic Time Warping) algorithm, with a threshold of 0.85. Spatial correlation is calculated using the geographic information system (GIS) to calculate the physical distance between devices, with a threshold of 10 kilometers. Resources that meet both temporal and spatial correlations are assembled together to form a logically related resource group.

[0097] The dynamic rule engine is built on a decision tree model and trained using the C4.5 algorithm. The training data includes six months of system operation data, with features including 20 key indicators such as equipment load rate, failure frequency, and ambient temperature. The decision tree is updated once a week to adapt to changes in system status.

[0098] The construction of the behavior feature library adopts the role-based access control (RBAC) model combined with the collaborative filtering algorithm. First, 10 basic roles are defined, such as system administrators, operation and maintenance personnel, and ordinary users. Then, the collaborative filtering algorithm based on the user-project matrix is ​​used to calculate the similarity between roles, and the threshold is set to 0.8. Roles with high similarity will share some permissions, which improves the flexibility of authorization.

[0099] The risk judgment module uses a multi-layer perceptron (MLP) neural network model. The input layer contains 30 nodes, corresponding to 30 risk indicators. The hidden layer uses a two-layer structure with 100 nodes in each layer. The output layer has 3 nodes, corresponding to low, medium, and high risk levels. The model is trained using the back propagation algorithm, the learning rate is set to 0.01, and the number of training rounds is 1000.

[0100] After the system was in operation for 6 months, various performance indicators were collected and compared with the traditional power monitoring system and the simple rule-based situational awareness system. The results are shown in the following table:

[0101]

[0102] It can be seen that the data processing capacity of the system of the present invention reaches 2 million records per second, which is 20 times that of the traditional system and 4 times that of the simple rule system. This is mainly due to the efficient design of the massive acquisition module and the server integration module, as well as the innovative application of resource splitting and assembly methods. The efficient data processing capability lays the foundation for real-time situational awareness; the average response time of the system of the present invention is only 50ms, which is 10 times faster than the traditional system and 4 times faster than the simple rule system. This significant performance improvement stems from the overall optimization design of the system, especially the real-time adjustment capability of the dynamic rule engine, which enables the system to respond quickly to various situations.

[0103] In general, the system of the present invention has shown significant advantages in data processing efficiency, anomaly detection accuracy, system response speed, resource utilization, scalability and adaptability. It not only solves many challenges faced by the current power system situation awareness, but also points out a new direction for the development of future smart grids that integrates big data, artificial intelligence and security management.

[0104] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A situation awareness system suitable for access to massive power resources, characterized by: include, Server units and system processing units; The server unit includes a mass collection module for collecting resources and reporting them to the server integration module; The server integration module is used to receive all collected resources for parsing and proofreading, and process the resources that have passed the proofreading; The server feature module is used to generate a set of behavior features and identify and judge behaviors through a behavior feature library based on role authorization; The system processing unit includes an identification module for analyzing the categories of different users through the server feature module, and comparing the behavior with the resource library to determine the authorization corresponding to the behavior; and a risk judgment module for analyzing the risk level of different categories of users through the server feature module, and making fault risk judgments, and triggering an alarm mechanism in real time; The output of the mass acquisition module is connected to the input of the server integration module; the output of the server integration module is connected to the input of the server feature module; the output of the server feature module is respectively connected to the inputs of the identification module and the risk judgment module.

2. The situation awareness system applicable to massive power resource access as claimed in claim 1, characterized in that: The analysis and proofreading includes the following steps: Format conversion and structuring of received raw resources, including automatic mapping of data fields from different sources to standardized fields through predefined mapping tables; During parsing, basic integrity and format verification is performed on key fields; Perform a quick consistency check on multiple pieces of data from the same resource and use the median method to correct outliers: Suppose the data set is V1,V1,...,V n The corrected value is V c ,but: V c =median(V1,V1,...,V n ) Perform plausibility checks on current data based on historical data or predefined rules.

3. The situation awareness system suitable for access to massive power resources as claimed in claim 2, characterized in that: The server integration module includes: According to the parsed resources, split and assemble the resources, including: Use K-means clustering algorithm and principal component analysis to automatically classify and extract features from resources, generate multiple sub-resources, and dynamically adjust the splitting strategy based on the real-time characteristics of the sub-resources; Assemble the sub-resources according to the generation time information and the region information of the sub-resources to obtain the assembled resources; The time distance function is used to calculate the time difference of each pair of sub-resources to obtain the time distance matrix. The spatial distance function is used to calculate the geographical difference of each pair of sub-resources to obtain the spatial distance matrix. The sub-resources are clustered based on the time distance and spatial distance to form an assembled resource set. Obtain assembled resources and use a dynamic rule engine to dynamically adjust processing strategies based on real-time system status and resource characteristics; The processed resources build a resource library based on historical resources, conduct association analysis on the behavioral resource library, and build an identity-based behavioral feature set.

4. The situation awareness system suitable for access to massive power resources as claimed in claim 3, characterized in that: The server feature module also includes: By building a behavioral feature library based on role authorization based on the behavioral feature set, and identifying and judging behaviors through the identity-based behavioral feature set; Abstract the association analysis results, extract the characteristic values ​​of daily behaviors, and construct an identity-based behavioral feature set.

5. The situation awareness system applicable to massive power resource access as claimed in claim 4, characterized in that: The automatic classification of resources using the K-means clustering algorithm includes: Among them, J is the objective function, k is the preset number of clusters, C i is the i-th cluster, x belongs to cluster C i Data points, μ i Cluster C i The centroid of Dynamic adjustment is divided into: S(t)=α×S(t-1)+(1-α)×ω i ×F i (R(t)) Among them, F i (R(t)) represents the i-th feature extracted from the current resource R(t), ω i is with the feature F i The weight associated with (R(t)) determines the influence of the feature in the final strategy generation, S(t) is the splitting strategy at time t, α is the smoothing factor (0<α<1), and S(t-1) is the splitting strategy at the previous moment.

6. The situation awareness system applicable to massive power resource access as claimed in claim 5, characterized in that: The construction of a behavior feature library based on role authorization and identification and judgment of behavior through an identity-based behavior feature set includes: Establishing a role-behavior matrix, defining the extent to which each role is authorized to perform various behaviors, and optimizing the role-behavior matrix using a collaborative filtering algorithm; For each identity, establish a set of behavioral features B(i), which contains the common behavioral patterns of the identity; Design a behavior recognition function to calculate the similarity between the behavior to be recognized and each behavior in the identity feature set, and assign different importance to different behavior features, as follows: Among them, I(b,g) is the possibility that behavior b belongs to identity g, ω bj is the weight of the behavior feature bj, sim(b,bj) is the similarity between behavior b and feature bj; Setting judgment threshold When the similarity exceeds the threshold When the act is considered to belong to that identity; Constructing identity-based behavioral feature sets includes: Using the eigenvalues ​​extracted by PCA, the behavioral feature set is updated, and a new behavioral feature set is established for each identity, including the behavior and its corresponding eigenvector, to establish a mapping relationship between identity and behavior category and form a complete identity-behavior model.

7. The situation awareness system applicable to massive power resource access as claimed in claim 6, characterized in that: The server integration module also includes: For resources that have passed proofreading, the massive resource acquisition module does not need to continue waiting for retransmission.

8. A situation awareness method applicable to massive power resource access, based on the situation awareness system applicable to massive power resource access as claimed in any one of claims 1 to 7, characterized in that: Also includes, Collect resources from multiple data sources; Parse and proofread the received resource data, and further process the proofread resource data; Generate a user's behavioral feature set based on the processed resource data; Match the generated behavior feature set with the behavior feature library based on role authorization to identify the user's behavior type and determine its legitimacy; Analyze the categories of different users, compare the analyzed user categories with the data in the behavior feature library, and determine whether the user behavior meets the corresponding authorization conditions; Through the analyzed user categories, the user's risk level is assessed, and a comprehensive judgment of fault and security risks is made based on the user's risk level and behavioral characteristics.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the situation awareness system applicable to access of massive electric power resources as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the situation awareness system applicable to access of massive electric power resources as described in any one of claims 1 to 7 are implemented.

Images