Abnormal maintenance method and device of power grid fault recognition model, computer equipment and computer readable storage medium

Abstract

The invention relates to an exception maintenance method and device for a power grid fault recognition model, computer equipment and a computer readable storage medium. The method comprises the following steps: sequentially performing static analysis and dynamic analysis on a power grid fault identification model to generate a white list; the white list comprises a trusted code segment, a trusted disk access behavior and a trusted system calling range and frequency; performing real-time monitoring on the operation state of the power grid fault recognition model according to the white list to obtain a monitoring result of the power grid fault recognition model; the monitoring result comprises a normal operation condition and an abnormal condition; the normal operation condition shows that the operation state accords with the white list; if an exception exists, the running state does not conform to the white list; and under the condition that the monitoring result is abnormal, a self-adaptive strategy is adopted to maintain the power grid fault identification model. By adopting the method, the maintenance effect of the model can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence model maintenance technology, and in particular to an abnormal maintenance method, device, computer equipment and computer-readable storage medium for a power grid fault identification model. Background Art

[0002] In the power grid fault identification model, bit flip attacks may cause the power grid fault identification model to misclassify, fail to accurately identify the fault type or falsely report the normal state as a fault, affecting the normal operation of the power grid. In addition, the attack will cause the model accuracy to drop significantly, and the fault cannot be correctly detected and classified, reducing the reliability and effectiveness of fault identification. The robustness of the model will also be weakened, and it may produce false alarms for normal power grid fluctuations and noise, increasing the operation and maintenance burden. However, the current fault detection method of machine learning models is to extract the features of software anomalies and abstract them into abnormal patterns through the analysis of a large number of software anomalies, relying on manually defined thresholds of abnormal patterns, matching the model's software features with the established abnormal patterns, resulting in low anomaly detection accuracy, and thus the problem of poor model maintenance effect. Summary of the invention

[0003] Based on this, it is necessary to provide an abnormal maintenance method, device, computer equipment, computer-readable storage medium and computer program product for a power grid fault identification model that can improve the maintenance effect of the model in response to the above technical problems.

[0004] In a first aspect, the present application provides an abnormal maintenance method of a power grid fault identification model, comprising:

[0005] Static and dynamic analysis are performed on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls;

[0006] The operation status of the power grid fault identification model is monitored in real time according to the white list to obtain the monitoring result of the power grid fault identification model; the monitoring result includes two situations: normal operation and abnormality; the normal operation indicates that the operation status complies with the white list; the abnormality indicates that the operation status does not comply with the white list;

[0007] When the monitoring results show abnormalities, an adaptive strategy is used to maintain the power grid fault identification model.

[0008] In one embodiment, static analysis and dynamic analysis are performed on the power grid fault identification model to generate a whitelist, including:

[0009] Without executing the code of the power grid fault identification model, static analysis is performed on the code of the power grid fault identification model to obtain an initial whitelist;

[0010] In the case of executing the code of the power grid fault identification model, dynamically analyzing the code of the power grid fault identification model to obtain a supplementary whitelist;

[0011] A whitelist is generated according to the union of the initial whitelist and the supplementary whitelist.

[0012] In one embodiment, the operation status of the power grid fault identification model is monitored in real time according to the whitelist to obtain the monitoring result of the power grid fault identification model, including:

[0013] Real-time acquisition of the operating status of the power grid fault identification model includes: code execution path, disk access behavior and system call status;

[0014] According to the preset detection rules, the whitelist is compared with the code execution path, disk access behavior and system call situation respectively to obtain the monitoring results of the power grid fault identification model.

[0015] In one embodiment, the code execution path, disk access behavior and system call status are compared respectively according to the whitelist to obtain the monitoring results of the power grid fault identification model, including:

[0016] Calculate the similarity between the code execution path, disk access behavior, and system call situation and the whitelist data respectively;

[0017] In the case where any similarity is lower than a preset threshold, the monitoring result is determined to be abnormal;

[0018] When all similarities are higher than a preset threshold, the monitoring result is determined to be normal operation.

[0019] In one embodiment, when the monitoring result is abnormal, after the adaptive strategy is used to maintain the power grid fault identification model, the method further includes:

[0020] Based on the abnormal behavior detection results of the adaptive strategy and monitoring results, the feedback function is used to update the whitelist and detection rules;

[0021] Among them, the corresponding functions for updating the whitelist and detection rules using the feedback function include:

[0022] W'=F(W,E)

[0023] φ'=F(φ,E)

[0024] Among them, F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

[0025] In one embodiment, when the monitoring result is abnormal, an adaptive strategy is used to maintain the power grid fault identification model, including:

[0026] When the monitoring result shows that there is an abnormality, the code segment or disk memory area where the abnormality occurs is determined based on the abnormal behavior detection result;

[0027] Isolate code segments or disk memory areas and perform root cause analysis to determine the cause of the anomaly;

[0028] According to the abnormal causes, an adaptive strategy is used to maintain the power grid fault identification model.

[0029] In one embodiment, according to the abnormal cause, an adaptive strategy is used to maintain the power grid fault identification model, including:

[0030] According to the cause of the exception, the code segment or the data in the disk memory area is rolled back or repaired using the online repair function;

[0031] Among them, the functions corresponding to the online repair function include:

[0032] S repair (t)=R(S(t),E)

[0033] Among them, S(t) is the operating status of the power grid fault identification model at the current time, E represents the abnormal behavior detection result, and S repair (t) represents the operating status of the power grid fault identification model after repair, and R() represents the online repair function.

[0034] In a second aspect, the present application also provides an abnormal maintenance device for a power grid fault identification model, comprising:

[0035] A whitelist generation module is used to perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls;

[0036] The model monitoring module is used to monitor the operating status of the power grid fault identification model in real time according to the white list, and obtain the monitoring results of the power grid fault identification model; the monitoring results include two situations: normal operation and abnormality; the normal operation situation indicates that the operating status complies with the white list; the abnormal situation indicates that the operating status does not comply with the white list;

[0037] The model maintenance module is used to maintain the power grid fault identification model using an adaptive strategy when the monitoring result shows that there is an abnormality.

[0038] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0039] Static and dynamic analysis are performed on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls;

[0040] The operation status of the power grid fault identification model is monitored in real time according to the white list to obtain the monitoring result of the power grid fault identification model; the monitoring result includes two situations: normal operation and abnormality; the normal operation indicates that the operation status complies with the white list; the abnormality indicates that the operation status does not comply with the white list;

[0041] When the monitoring results show abnormalities, an adaptive strategy is used to maintain the power grid fault identification model.

[0042] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0043] Static and dynamic analysis are performed on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls;

[0044] The operation status of the power grid fault identification model is monitored in real time according to the white list to obtain the monitoring result of the power grid fault identification model; the monitoring result includes two situations: normal operation and abnormality; the normal operation indicates that the operation status complies with the white list; the abnormality indicates that the operation status does not comply with the white list;

[0045] When the monitoring results show abnormalities, an adaptive strategy is used to maintain the power grid fault identification model.

[0046] The above-mentioned abnormal maintenance method, device, computer equipment, computer-readable storage medium and computer program product of the power grid fault identification model generate a whitelist by successively performing static analysis and dynamic analysis on the power grid fault identification model. Among them, the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls. The selection of the two analysis methods comprehensively stipulates the legal behavior scope of the normal operation of the power grid fault identification model. The operation status of the power grid fault identification model is monitored in real time according to the whitelist to obtain the monitoring result of the power grid fault identification model. Among them, the monitoring result includes two situations: normal operation and abnormality. The normal operation situation indicates that the operation status conforms to the whitelist, and the abnormal situation indicates that the operation status does not conform to the whitelist. The abnormal behavior of the power grid fault identification model can be more accurately judged according to the whitelist, and the operation status of the model can be monitored. Further, when the monitoring result shows that there is an abnormality, an adaptive strategy is adopted to maintain the power grid fault identification model, avoiding manual intervention, and the adaptive strategy can be automatically adopted in time according to the abnormal situation to maintain the power grid fault identification model to ensure the normal operation of the model, thereby improving the maintenance effect of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A schematic flow chart of an abnormal maintenance method of a power grid fault identification model in one embodiment;

[0049] Figure 2 A schematic flow chart of a monitoring result determination step in one embodiment;

[0050] Figure 3 A structural block diagram of a bit flip vulnerability intrusion detection and self-healing system for a smart grid fault identification model based on a whitelist in one embodiment;

[0051] Figure 4 It is a structural block diagram of an abnormal maintenance device of a power grid fault identification model in one embodiment;

[0052] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] In one embodiment, Figure 1 As shown, an abnormal maintenance method for a power grid fault identification model is provided. This embodiment uses the method applied to a terminal as an example for illustration. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0055] Step S102, static analysis and dynamic analysis are performed on the power grid fault identification model to generate a whitelist.

[0056] Among them, the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls. A whitelist can be a security mechanism used to allow specific users, devices, network addresses, or applications to access certain resources or perform specific operations. In network security, certain IP addresses, domain names, or software applications may be whitelisted to allow them to bypass certain security checks or restrictions.

[0057] Among them, the power grid fault identification model can be an artificial intelligence model trained according to the historical parameters of the equipment included in the power grid. By inputting the real-time parameters of the power grid equipment into the power grid fault identification model in real time, the fault prediction results can be output to understand the operation status of the power grid.

[0058] Static analysis can be performed on source code or binary code without executing the program, focusing on code structure, syntax, potential errors, and compliance with code specifications. Dynamic analysis can be performed on the behavior of software when the program is executed, discovering problems by calling the program and monitoring its runtime behavior, performance, and resource usage.

[0059] Optionally, the server first performs a static analysis on the power grid fault identification model without executing the code of the power grid fault identification model, and performs a dynamic analysis on the power grid fault identification model while executing the code of the power grid fault identification model, and generates a whitelist based on the two analysis results.

[0060] Step S104: monitor the operating status of the power grid fault identification model in real time according to the white list to obtain a monitoring result of the power grid fault identification model.

[0061] Among them, the monitoring results include two situations: normal operation and abnormality. Normal operation means that the running status complies with the whitelist; abnormality means that the running status does not comply with the whitelist.

[0062] Optionally, the server monitors the operating status of the power grid fault identification model according to the data included in the whitelist, determines whether the operating status conforms to the range of the whitelist, and obtains the monitoring result of the power grid fault identification model.

[0063] Step S106: When the monitoring result shows that there is an abnormality, an adaptive strategy is used to maintain the power grid fault identification model.

[0064] Among them, the adaptive strategy can be an automatic maintenance method for the abnormal type of the monitoring results. For example, if the abnormal type is that the model code is subjected to a bit flip attack, resulting in abnormalities in some code segments, then the adaptive strategy is to automatically repair the part of the code segment or roll back the code version to the version before the bit flip attack.

[0065] Optionally, when the monitoring result shows that there is an abnormality, the server adopts a corresponding adaptive strategy to maintain the power grid fault identification model to correct the abnormality and ensure the normal operation of the power grid fault identification model.

[0066] In the above-mentioned abnormal maintenance method of the power grid fault identification model, a whitelist is generated by successively performing static analysis and dynamic analysis on the power grid fault identification model. Among them, the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls. The selection of the two analysis methods comprehensively stipulates the legal behavior scope of the normal operation of the power grid fault identification model. The operation status of the power grid fault identification model is monitored in real time according to the whitelist to obtain the monitoring result of the power grid fault identification model. Among them, the monitoring result includes two situations: normal operation and abnormality. The normal operation situation indicates that the operation status conforms to the whitelist, and the abnormal situation indicates that the operation status does not conform to the whitelist. The abnormal behavior of the power grid fault identification model can be more accurately judged according to the whitelist, and the operation status of the model can be monitored. Further, when the monitoring result shows that there is an abnormality, an adaptive strategy is adopted to maintain the power grid fault identification model, avoiding manual intervention, and the adaptive strategy can be automatically adopted in time according to the abnormal situation to maintain the power grid fault identification model to ensure the normal operation of the model, thereby improving the maintenance effect of the model.

[0067] In an exemplary embodiment, step S102 performs static analysis and dynamic analysis on the power grid fault identification model to generate a whitelist, including:

[0068] Without executing the code of the power grid fault identification model, a static analysis is performed on the power grid fault identification model to obtain an initial white list; while executing the code of the power grid fault identification model, a dynamic analysis is performed on the power grid fault identification model to obtain a supplementary white list; a white list is generated according to the union of the initial white list and the supplementary white list.

[0069] The initial whitelist may be composed of normal code execution paths, disk access and system call patterns identified after static analysis. The supplementary whitelist may be composed of normal execution paths, function call sequences, disk access behaviors and system call records of the model collected after dynamic analysis.

[0070] Optionally, without executing the code of the power grid fault identification model, the code of the power grid fault identification model is statically analyzed, including four contents: code parsing, control flow analysis, data flow analysis, and disk access and system calls. The code parsing uses a static analysis tool (such as LLVM, Low Level Virtual Machine) to parse the source code of the power grid fault identification model to generate an abstract syntax tree (AST, Abstract Syntax Tree) and a control flow graph (CFG, Control Flow Graph). The control flow analysis identifies all possible execution paths in the program according to the control flow graph (CFG), including loops, branches, exception handling, etc. The data flow analysis identifies all possible data dependencies according to the flow of data in the program to ensure the legality of data access. The disk access determines the legal disk access range and mode by analyzing the memory allocation and access operations in the code. With the help of the above static analysis content, an initial whitelist is generated. Specifically, let P be the execution path set of the program of the power grid fault identification model, p be any execution path in P, and W static The initial whitelist generated for static analysis is:

[0071] W static ={p|p∈P,static_analysis(p)}

[0072] The server further dynamically analyzes the code of the power grid fault identification model while executing the code of the power grid fault identification model to obtain a supplementary whitelist, including four processes: test case design, code instrumentation, execution monitoring, and behavior recording. The test case design covers as many comprehensive test cases as possible to ensure that the smart grid fault identification model can be fully tested under various possible input conditions. Code instrumentation includes inserting monitoring code in key code segments, function entry and exit, disk access points, and system call points to collect runtime data. The fault identification model is run during execution monitoring, and the execution path, function call sequence, disk access behavior, and system call records are collected with the assistance of monitoring tools. The behavior recording stage records the detailed information of the code path, function call, disk access, and system call for each run, including the call frequency and parameters. Specifically, let B be the behavior set of the power grid fault identification model under dynamic analysis, b be any behavior in B, and W dynamic The whitelist generated for dynamic analysis is:

[0073] W dynamic ={b|b∈B,dynamic_analysis(b)}

[0074] The server generates a whitelist based on the union of the initial whitelist and the supplementary whitelist. Specifically, let W static Initial whitelist generated for static analysis, W dynamic is the whitelist generated by dynamic analysis, W is the final whitelist, then

[0075] W=W static ∪W dynamic

[0076] In this embodiment, static analysis and dynamic analysis are performed on the code of the power grid fault identification model respectively, and an initial whitelist and a supplementary whitelist are generated accordingly. The union of the two is used to obtain the final whitelist to ensure the comprehensiveness and accuracy of the whitelist. At the same time, conflicts between the static analysis and dynamic analysis results are checked, possible causes are analyzed, and manual verification and correction are performed. According to the system's operating environment and application requirements, the whitelist is optimized to ensure that it is concise and effective, and avoid being too loose or strict.

[0077] In an exemplary embodiment, Figure 2 As shown, step S204 monitors the operating status of the power grid fault identification model in real time according to the white list to obtain the monitoring result of the power grid fault identification model, including the following steps S202 to S204. Among them:

[0078] Step S202, real-time acquisition of the running status of the power grid fault identification model includes: code execution path, disk access behavior and system call status.

[0079] Among them, the code execution path refers to the specific code path that the program takes when it is running, which can usually be monitored through debugging tools or performance analysis tools. The execution path may contain multiple function calls and conditional judgments, which affect the generation of the final output. Among them, disk access behavior involves the read and write operations of the model on the disk during operation. For example, the model reads files when loading a data set; during the training process, the model may save checkpoints or log files. Among them, the system call situation can be the way a program requests the operating system to perform a specific task. The power grid fault identification model may make multiple system calls, such as memory management, file operations, network requests, etc.

[0080] Optionally, the server obtains the operating status of the power grid fault identification model in real time, including using debugging tools or performance analysis tools to monitor its code execution path; using tools (such as I / O input / output analysis tools) to monitor the frequency and type of file operations (such as reading and writing) of the model accessing the disk to obtain disk access behavior; using tools (such as strace tools for tracking system calls and signals or dtrace dynamic tracing framework) to track the interaction between the model and the operating system during runtime to obtain system call status.

[0081] Step S204 , comparing the whitelist with respect to the code execution path, disk access behavior and system call situation respectively according to the preset detection rules, and obtaining the monitoring result of the power grid fault identification model.

[0082] The preset detection rule may be a comparison criterion between a preset white list and a power grid fault identification model.

[0083] Optionally, according to preset detection rules, the trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls included in the whitelist are compared with the code execution paths, disk access behaviors, and system call situations of the power grid fault identification model, and the comparison results are used as monitoring results of the power grid fault identification model.

[0084] In this embodiment, by real-time monitoring of the code execution path, disk access behavior and system call status of the power grid fault identification model and comparing them with the whitelist, abnormal behavior of the model can be discovered in time, and corresponding measures can be taken to correct the problem, thereby reducing the time of fault occurrence, improving the maintenance effect of the model, and ensuring the reliability of the power grid monitoring system.

[0085] In an exemplary embodiment, step S204 compares the whitelist with the code execution path, disk access behavior and system call status respectively according to the preset detection rules to obtain the monitoring results of the power grid fault identification model, including:

[0086] The similarities between the code execution path, disk access behavior and system call situation and the whitelist data are calculated respectively; when any similarity is lower than the preset threshold, the monitoring result is determined to be abnormal; when all similarities are higher than the preset threshold, the monitoring result is determined to be normal operation.

[0087] Similarity can be the degree of similarity between two or more objects, which is used to measure their similarity in specific features or attributes.

[0088] Optionally, the server calculates the similarity between the code execution path, disk access behavior and system call situation and the trusted code segment, trusted disk access behavior, and the range and frequency of the trusted system call in the whitelist. For example, for control flow data, the deviation value is calculated between the N most frequently called code execution paths of the monitored power grid fault identification model and the execution paths under normal circumstances recorded in the whitelist, and weights are assigned to different positions according to the calling frequency. For example, the abnormality represented by the control flow with the highest triggering frequency should be higher than the control flow with the triggering frequency ranked N. The specific weighting method can be set according to the looseness of the administrator's security policy. In this way, the abnormality T of the control flow execution data is obtained. control-flow , the higher the abnormality, the lower the similarity.

[0089] Specifically, let the control flow execution path in the whitelist be P whitelist ={p1,p2,…,p n}, the monitored control flow execution path is P monitor ={q1,q2,…,q n}, then the deviation value is defined as:

[0090]

[0091] Among them, p ij and q ij Respectively represent the path p i and q i The value at position j.

[0092] Let f i For path p i The trigger frequency, weight assignment w i Can be allocated according to the trigger frequency:

[0093]

[0094] The abnormality degree T of control flow execution data control-flow It can be calculated by weighted deviation:

[0095]

[0096] Similarly, the same whitelist matching steps are performed for data flow execution data, disk access feature data, and system call feature data, and the matching results T of each type of data are calculated. data-flow ,T read-disk and T syscall .

[0097] The final outlier calculation method is the weighted sum of the four outliers, namely:

[0098] T=n1*T control-flow +n2*T data-flow +n3*T read-disk +n4*T syscall ,

[0099] in, The weight assignment strategy is also set by the manager according to the conditions. After obtaining the abnormality T, it is compared with the abnormality threshold P to determine whether an abnormality has occurred. That is, if any similarity is lower than the preset threshold, the monitoring result is determined to be abnormal and the alarm process is entered. Specifically, let B real-time is the set of behaviors monitored when the system is running, T is the length of the monitored time series, then:

[0100] B real-time = {b t |t=1,2…,T}

[0101] For the alarm mechanism, the system reports the detected abnormal behavior through log records, real-time alarm notifications, etc., and triggers corresponding security response measures. Let E be the set of abnormal events, then When all similarities are higher than a preset threshold, the monitoring result is determined to be normal operation.

[0102] In this embodiment, by calculating the similarity between the operating status of the power grid fault identification model and the data included in the whitelist and comparing them with a preset threshold, it is determined whether there is an abnormality in the monitoring result, thereby improving the abnormal monitoring accuracy of the power grid fault identification model, paving the way for the subsequent execution of corresponding adaptive strategies for existing anomalies, and improving the maintenance effect of the power grid fault identification model.

[0103] In an exemplary embodiment, in step S206, when the monitoring result is abnormal, after using an adaptive strategy to maintain the power grid fault identification model, the method further includes:

[0104] According to the abnormal behavior detection results of the adaptive strategy and monitoring results, the feedback function is used to update the whitelist and detection rules.

[0105] Among them, the corresponding functions for updating the whitelist and detection rules using the feedback function include:

[0106] W'=F(W,E)

[0107] φ'=F(φ,E)

[0108] Among them, F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

[0109] Optionally, the server uses a feedback function to update the whitelist and detection rules based on the adaptive strategy adopted and the abnormal behavior monitoring results of the monitoring results. For example, the adaptive strategy corrects the abnormal code segment, updates the corrected code segment to the whitelist, and updates the calculation weight of the similarity included in the detection rules based on the abnormal behavior monitoring results.

[0110] In this embodiment, after the server completes the repair of the power grid fault identification model, behavioral learning will also be performed. The main content is that the server learns from the abnormal behavior monitoring results of the adaptive strategy and monitoring results, optimizes the whitelist and detection rules to improve the detection accuracy and response speed. At the same time, the system will also regularly update the whitelist and self-healing strategy according to the latest attack methods and changes in the system operating environment to maintain the system's defense capabilities.

[0111] In an exemplary embodiment, in step S206, when the monitoring result is abnormal, an adaptive strategy is used to maintain the power grid fault identification model, including:

[0112] When the monitoring results show an abnormality, the code segment or disk memory area that generates the abnormality is determined based on the abnormal behavior detection results; the code segment or disk memory area is isolated, and a root cause analysis is performed to determine the cause of the abnormality; based on the cause of the abnormality, an adaptive strategy is used to maintain the power grid fault identification model.

[0113] Among them, Root Cause Analysis (RCA) can be a systematic approach that aims to identify and solve the root causes of problems rather than just solving superficial symptoms. By finding the deep causes that led to the problem, organizations can take effective measures to prevent similar problems from happening again in the future.

[0114] Optionally, when the monitoring result of the power grid fault identification model is abnormal, the server determines the code segment or disk memory area that generates the abnormality according to the abnormal behavior detection result, isolates the code segment or disk memory area, and performs root cause analysis to determine the cause of the abnormality, such as determining whether the abnormal cause is a change in the characteristics of the input sample or the integrity of the program is destroyed. The power grid fault identification model is maintained by an adaptive strategy according to the abnormal cause. For example, when the control flow and data flow of the power grid fault identification model are detected to be abnormal, since the execution logic of the program has changed greatly in a short time, it is assumed that the abnormal behavior detection result is a bit flip attack. When the input sample is far from the historical sample, it is determined that an adversarial sample attack may have occurred, and the model needs to be retrained. For another example, the Basic Linear Algebra Subprogram (BLAS) on which the original model depends is soft-linked to the backup normal dynamic link library, etc., and the model is re-run to observe whether it is restored to normal. If it is still not restored, the preset repair plan with a lower priority is continued to be executed until the model is re-executed and enters the normal state, or the repair fails to continue to alarm the upper layer.

[0115] In this embodiment, the code segment or disk memory area that generates the exception is isolated to prevent the fault from spreading to other locations. The root cause analysis of the abnormal code segment or disk memory area is performed to obtain the corresponding abnormal cause, and an adaptive strategy is adopted to maintain the code segment and disk memory area, thereby reducing the impact of the abnormality on the model performance and further improving the maintenance effect of the power grid fault identification model.

[0116] In an exemplary embodiment, the steps of the above embodiment adopt an adaptive strategy to maintain the power grid fault identification model according to the abnormal cause, including:

[0117] Depending on the cause of the exception, the code segment or data in the disk memory area is rolled back or repaired using an online repair function.

[0118] Among them, the functions corresponding to the online repair function include:

[0119] S repair (t)=R(S(t),E)

[0120] Among them, S(t) is the operating status of the power grid fault identification model at the current time, E represents the abnormal behavior detection result, and S repair (t) represents the operating status of the power grid fault identification model after repair, and R() represents the online repair function.

[0121] Optionally, the server detects whether the abnormality is caused by a change in the input sample features or an abnormality in the model program itself, and rolls back the code segment or the data in the disk memory area or uses an online repair function to repair it. Specifically, if the code segment is abnormal, the code segment version is rolled back to the normal working code segment version, and the data in the disk memory area can also be rolled back to the data version without abnormality.

[0122] In this embodiment, according to the abnormal cause of the power grid fault identification model, a corresponding adaptive strategy is adopted to reduce the downtime, improve the availability of the model, and further improve the maintenance effect of the model.

[0123] In an exemplary embodiment, another abnormal maintenance method of a power grid fault identification model is provided, which is applied to Figure 3 The whitelist-based smart grid fault identification model bit flip vulnerability intrusion detection and self-healing system shown includes:

[0124] The system's whitelist generation module, real-time monitoring module, and adaptive and self-healing module run on the hardware device deployed with the smart grid fault identification model, while the anomaly detection and alarm module runs on the cloud server. During operation, the whitelist generation module sends the generated whitelist to the corresponding address on the cloud server. Similarly, during the model operation process, the data collected by the real-time monitoring module is also uploaded to the cloud server. At this time, the cloud server will compare the model operation status data with the whitelist, and determine whether an anomaly has occurred and whether an alarm is required. After generating the judgment result, it will be sent to the model operation device. If the server determines that an anomaly has occurred, the device will first try to self-heal, such as replacing a dynamic link library that is determined to have an anomaly with a backup normal link library. If the anomaly is not resolved, the model local device will request the cloud server for the last backup status for model status rollback. At this time, the cloud server will also extract the characteristics of this abnormal behavior and update the local whitelist of the model.

[0125] This system can also be run completely locally. The above-mentioned running of the anomaly detection and alarm module on the cloud server is based on the consideration that, on the one hand, the whitelist of all smart grid fault detection models is stored on the cloud server for easy management by administrators; on the other hand, the comparison process between real-time data and the whitelist is relatively complicated and requires greater computing power. Therefore, running it on the server can reduce the burden on the local equipment of the model and provide better real-time performance.

[0126] The present embodiment describes a whitelist-based smart grid fault identification model bit flip vulnerability intrusion detection and self-healing system, which is mainly divided into four modules, namely, a whitelist generation module, a real-time monitoring module, an anomaly detection and alarm module, and an adaptive and self-healing module. In addition, it also includes a behavior learning process, which is as follows:

[0127] Whitelist generation module: The static analysis process of the whitelist generation module successively performs four processes: code parsing, control flow analysis, data flow analysis, disk access and system call. For the code analysis process, this embodiment mainly focuses on the analysis of the underlying code library of the machine learning framework. This is because bit reversal attacks often target the underlying code library to achieve white box attacks and are more general. The smart grid fault identification model in this embodiment is an image recognition model based on a deep neural network developed using PyTorch, which is used to check whether foreign objects such as branches and plastic packaging that may cause power grid equipment failures appear on the transmission line. The model source code depends on the underlying basic linear algebra subroutines, namely the BLAS library, which is reflected in the code as the executable program depends on the libblas.so or libopenblas.so library (under Linux system). During static code analysis, the system first uses the IDA Pro tool to analyze the BLAS dynamic link library on the local device of the model, generates a control flow graph (CFG) and a data flow graph (DFG) of the dynamic link library, and then performs control flow and data flow analysis respectively.

[0128] Control flow analysis mainly extracts the program execution path at the function level based on the control flow graph generated by code analysis. Since the control flow graph can essentially be stored using a multi-branch tree data structure, with nodes being functions and edges being control flow transfer relationships, this embodiment can use reverse traversal from leaf nodes to obtain all execution paths.

[0129] Specifically, let the node be V and the edge be E, then:

[0130] CFG=(V,E)

[0131] Let P CFG is the set of all execution paths in the control flow graph, each execution path p i is a sequence of nodes, m is the tree depth, then:

[0132] P CFG ={p1,p2,…,p n}

[0133] p i =(v i1 ,v i2 ,…,v im ),v ij ∈V

[0134] By traversing backwards from the leaf node v L To start, you can get all execution paths:

[0135]

[0136] Similarly, data flow analysis uses the same processing method, starting from a leaf node and obtaining the path of all data flowing into this leaf node.

[0137] Specifically, let the node be V' and the edge be E', then we have:

[0138] DFG=(V′,E′)

[0139] Let P DFG is the set of all data flow paths in the control flow graph, each execution path d i is a sequence of nodes, m is the tree depth, then:

[0140] P DFG ={d1,d2,…,d n}

[0141] d i =(v′ i1 ,v′ i2 ,…,v′ im ),v′ ij ∈V′

[0142] By traversing backwards from the leaf node v′ L To start, you can get all execution paths:

[0143]

[0144] In addition, in the process of control flow and data flow analysis, the access situation of the intermediate code to the memory is recorded, such as at which positions of the execution path the disk is accessed, the size and frequency of the accessed space, etc., and the above steps are used to implement the static analysis of the code of the power grid fault identification model. The dynamic analysis of this embodiment includes four processes: test case design, code insertion, execution monitoring, and behavior recording. For test case design, the method in this embodiment is to input a large amount of power grid equipment monitoring image data into the model for fault identification. It should be noted that the input data needs to be representative. The implementation method is to input images with characteristics of different time periods, different regions, different equipment, different climates, etc. into the model, and cover all input image feature spaces as much as possible. The purpose of dynamic analysis is to collect the state characteristics of the model during normal operation, so as to generate a whitelist. In order to achieve this purpose, it is necessary to dynamically insert the code, such as setting a counter for a key function, and counting the number of times the function is called in a normal fault identification, the order and frequency of the calls of different functions before, etc. The execution monitoring step requires the use of the control flow graph and data flow graph obtained in the static code analysis, and the main content is to monitor the frequency information of different paths being executed during the normal operation of the model. The behavior of the monitored information is recorded. In this embodiment, the execution of the control flow path and the data flow path is recorded, and sorted according to the frequency to obtain the program characteristics when the model is executed normally. At the same time, the disk access characteristics (functions that trigger disk access, access size, number of disk accesses, etc.) and system call characteristics (functions that trigger system calls, types of system calls, number of system calls, etc.) during the execution of the path are recorded. Finally, the data obtained by static analysis and dynamic analysis are combined to generate a whitelist. In this embodiment, the whitelist is generated mainly considering four aspects: control flow path frequency, data flow path frequency, disk access characteristics, and system call characteristics. Specifically, a threshold N is set, and the control flow paths and data flow paths ranked in the top N frequencies are extracted, and the disk access and system call characteristics during the execution of the path are recorded. This is stored locally as a whitelist, or uploaded for storage when using a cloud server.

[0145] Real-time monitoring module, the real-time monitoring module in this embodiment includes three aspects: code execution monitoring, disk access monitoring and system call monitoring. The code execution monitoring in this embodiment is to collect the control flow and data flow program running path in the BLAS library part (such as libblas.so or libopenblas.so under the Linux platform) during the model running process with the help of the plug-in code, record all execution paths and extract the top N control flows and data flow paths with the highest frequency. The disk access monitoring in this embodiment is responsible for collecting the disk access characteristics during the model running process, including the size and frequency of access to memory blocks. Similarly, the system call in this embodiment mainly monitors the system call characteristics during the program running process, including the type and number of system calls triggered. Ultimately, all collected data will be transferred to the anomaly detection and alarm module of the local or cloud server for processing.

[0146] The anomaly detection and alarm module is used to compare the received smart grid fault detection model operation data with the whitelist during the anomaly detection process. Specifically, the control flow execution data, data flow execution data, disk access feature data and system call feature data are matched according to the whitelist rules. The method is to calculate the similarity between the four types of data and the whitelist data. For example, for the control flow data, the deviation value is calculated between the control flow execution path with the highest N model call frequencies and the execution path recorded in the whitelist under normal circumstances, and weights are assigned to different positions according to the call frequency. For example, the anomaly represented by the control flow with the highest trigger frequency should be higher than the control flow with the highest trigger frequency. The specific weighting method can be set according to the looseness of the manager's security policy. In this way, the anomaly degree of the control flow execution data is obtained. The abnormal values ​​of various features are used to determine which type of feature causes the anomaly, and the cause is passed to the adaptive and self-healing module together with the judgment result.

[0147] The adaptive and self-healing module is used to trigger the adaptive and self-healing module when the abnormal detection and alarm module generates an alarm message. In this embodiment, the module will perform three steps: fault isolation, root cause analysis, and automatic repair. In this embodiment, fault isolation mainly refers to that the module will immediately notify the device to stop the operation of the fault detection model to prevent the fault from spreading to other locations and causing more serious impacts. In order to restore the normal operation of the model as soon as possible, the system will first perform a root cause analysis on the model anomaly to determine whether the cause of the anomaly is due to a change in the characteristics of the input sample or the destruction of the program integrity. For example, when the control flow and data flow execution anomalies are detected, since the execution logic of the program has changed greatly in a short period of time, it is assumed that a bit flip attack has occurred. When the input sample is far away from the historical sample, it is determined that an adversarial sample attack may have occurred, and the model needs to be retrained. After obtaining the cause of the abnormality, the automatic repair process will be started, and the preset solution will be executed according to the specific cause, such as soft linking the Basic Linear Algebra Subprogram (BLAS) that the original model relies on to the backup normal dynamic link library, etc., re-run the model to observe whether it is restored to normal. If it is still not restored, continue to execute the preset repair solution with a lower priority until it enters the normal state after re-executing the model, or continue to alarm the upper layer if the repair fails. After the module successfully repairs the abnormality, it will also learn the abnormal behavior to improve the whitelist. In this embodiment, when the module performs root cause analysis and finds that the system executes a large number of write system calls during the abnormality, it will remind the whitelist generation module to appropriately limit the number or frequency of corresponding system calls in the whitelist during behavior learning, so as to achieve the purpose of more accurate identification of such attacks.

[0148] In this embodiment, by generating a whitelist based on a deep neural network (DNN) model in the smart grid, the operating behavior of the model is monitored in real time, compared with the whitelist, and abnormal behavior is detected, especially anomalies caused by bit flip attacks. Once an anomaly is detected, the system will automatically self-heal and restore the normal state of the model to ensure the accuracy and reliability of fault detection. This method improves the security and robustness of the smart grid, reduces manual intervention and maintenance costs, ensures the stable operation of the power grid, and reduces economic losses. This innovative method promotes the development of smart grid security technology and provides new ideas and methods for related research in the future.

[0149] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0150] Based on the same inventive concept, the embodiment of the present application also provides an abnormal maintenance device for a power grid fault identification model for implementing the abnormal maintenance method for the power grid fault identification model involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the abnormal maintenance device for one or more power grid fault identification models provided below can refer to the limitations of the abnormal maintenance method for the power grid fault identification model above, and will not be repeated here.

[0151] In an exemplary embodiment, Figure 4 As shown, an abnormal maintenance device 400 for a power grid fault identification model is provided, comprising: a whitelist generation module 402, a model monitoring module 404 and a model maintenance module 406, wherein:

[0152] The whitelist generation module is used to perform static analysis and dynamic analysis on the power grid fault identification model in sequence to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls.

[0153] The model monitoring module is used to monitor the operating status of the power grid fault identification model in real time according to the white list to obtain the monitoring results of the power grid fault identification model; the monitoring results include two situations: normal operation and abnormality; the normal operation situation indicates that the operating status complies with the white list; the abnormal situation indicates that the operating status does not comply with the white list.

[0154] The model maintenance module is used to maintain the power grid fault identification model using an adaptive strategy when the monitoring result shows that there is an abnormality.

[0155] Furthermore, in one embodiment, the whitelist generation module 402 is also used to perform static analysis on the code of the power grid fault identification model without executing the code of the power grid fault identification model to obtain an initial whitelist; to perform dynamic analysis on the code of the power grid fault identification model while executing the code of the power grid fault identification model to obtain a supplementary whitelist; and to generate a whitelist based on the union of the initial whitelist and the supplementary whitelist.

[0156] Furthermore, in one embodiment, the model monitoring module 404 is also used to obtain the operating status of the power grid fault identification model in real time, including: code execution path, disk access behavior and system call status; according to the preset detection rules, the whitelist is compared with the code execution path, disk access behavior and system call status respectively to obtain the monitoring result of the power grid fault identification model.

[0157] Furthermore, in one embodiment, the model monitoring module 404 is also used to respectively calculate the similarity between the code execution path, disk access behavior and system call status and the data in the whitelist; when any similarity is lower than a preset threshold, the monitoring result is determined to be abnormal; when all similarities are higher than the preset threshold, the monitoring result is determined to be normal operation.

[0158] Furthermore, in one embodiment, the model maintenance module 406 is further used to update the whitelist and the detection rules using a feedback function according to the abnormal behavior detection result of the adaptive strategy and the monitoring result; wherein the function corresponding to updating the whitelist and the detection rules using the feedback function includes:

[0159] W'=F(W,E)

[0160] φ'=F(φ,E)

[0161] Among them, F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

[0162] Furthermore, in one embodiment, the model maintenance module 406 is also used to, when the monitoring result shows that an abnormality exists, determine the code segment or disk memory area that generates the abnormality based on the abnormal behavior detection result; isolate the code segment or disk memory area, and perform root cause analysis to determine the cause of the abnormality; and maintain the power grid fault identification model using an adaptive strategy based on the cause of the abnormality.

[0163] Furthermore, in one embodiment, the model maintenance module 406 is also used to roll back the data of the code segment or the disk memory area or to repair it using an online repair function according to the cause of the exception; wherein the corresponding function to be repaired using the online repair function includes:

[0164] S repair (t)=R(S(t),E)

[0165] Among them, S(t) is the operating status of the power grid fault identification model at the current time, E represents the abnormal behavior detection result, and S repair (t) represents the operating status of the power grid fault identification model after repair, and R() represents the online repair function.

[0166] Each module in the abnormal maintenance device 400 of the power grid fault identification model can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0167] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store trusted code segments, trusted disk access behaviors, and the range and frequency data of trusted system calls. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for an abnormal maintenance device of a power grid fault identification model is implemented.

[0168] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0169] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0170] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0171] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0172] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0173] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0174] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An abnormal maintenance method for a power grid fault identification model, characterized in that: The method comprises: Static analysis and dynamic analysis are performed on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls; The operation state of the power grid fault identification model is monitored in real time according to the white list to obtain a monitoring result of the power grid fault identification model; the monitoring result includes two situations: normal operation and abnormality; the normal operation situation indicates that the operation state conforms to the white list; the abnormality situation indicates that the operation state does not conform to the white list; When the monitoring result is abnormal, an adaptive strategy is used to maintain the power grid fault identification model.

2. The method according to claim 1, characterized in that The power grid fault identification model is subjected to static analysis and dynamic analysis to generate a whitelist, including: Without executing the code of the power grid fault identification model, statically analyzing the code of the power grid fault identification model to obtain an initial whitelist; In the case of executing the code of the power grid fault identification model, dynamically analyzing the code of the power grid fault identification model to obtain a supplementary whitelist; A whitelist is generated according to the union of the initial whitelist and the supplementary whitelist.

3. The method according to claim 1, characterized in that The real-time monitoring of the operating state of the power grid fault identification model according to the whitelist to obtain the monitoring result of the power grid fault identification model includes: Real-time acquisition of the operating status of the power grid fault identification model includes: code execution path, disk access behavior and system call status; According to the preset detection rules, the whitelist is compared with the code execution path, the disk access behavior and the system call situation respectively to obtain the monitoring result of the power grid fault identification model.

4. The method according to claim 3, characterized in that The whitelist is compared with the code execution path, the disk access behavior and the system call situation respectively according to the preset detection rules to obtain the monitoring result of the power grid fault identification model, including: respectively calculating the similarity between the code execution path, the disk access behavior and the system call situation and the data in the whitelist; In the case where any of the similarities is lower than a preset threshold, determining that the monitoring result is abnormal; When all the similarities are higher than a preset threshold, it is determined that the monitoring result is normal operation.

5. The method according to claim 3, characterized in that: After the adaptive strategy is used to maintain the power grid fault identification model when the monitoring result is abnormal, the method further includes: According to the adaptive strategy and the abnormal behavior detection result of the monitoring result, the whitelist and the detection rule are updated by using a feedback function; Among them, the corresponding functions for updating the whitelist and the detection rules using the feedback function include: W ‘ =F(W,E) f ‘ =F(φ,E) Wherein, F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, and W ‘ Indicates the updated whitelist, φ ‘ Indicates the updated detection rule.

6. The method according to claim 5, characterized in that When the monitoring result is abnormal, an adaptive strategy is used to maintain the power grid fault identification model, including: In the case where the monitoring result indicates that an abnormality exists, determining the code segment or disk memory area that generates the abnormality according to the abnormal behavior detection result; Isolating the code segment or the disk memory area, and performing root cause analysis to determine the cause of the anomaly; According to the abnormal cause, an adaptive strategy is adopted to maintain the power grid fault identification model.

7. The method according to claim 6, characterized in that The maintaining the power grid fault identification model by using an adaptive strategy according to the abnormal cause includes: According to the cause of the exception, the code segment or the data in the disk memory area is rolled back or repaired using an online repair function; Among them, the functions corresponding to the online repair function include: S repair (t)=R(S(t),E) Where S(t) is the current operating state of the power grid fault identification model, E represents the abnormal behavior detection result, and S repair (t) represents the operating state of the power grid fault identification model after repair, and R() represents the online repair function.

8. An abnormal maintenance device for a power grid fault identification model, characterized in that: The device comprises: A whitelist generation module is used to perform static analysis and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls; A model monitoring module, used to monitor the operating state of the power grid fault identification model in real time according to the white list, and obtain the monitoring result of the power grid fault identification model; the monitoring result includes two situations: normal operation and abnormality; the normal operation situation indicates that the operating state conforms to the white list; the abnormality situation indicates that the operating state does not conform to the white list; The model maintenance module is used to maintain the power grid fault identification model by using an adaptive strategy when the monitoring result is abnormal.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images