A monitoring method and device based on a power distribution safety terminal module, a terminal device and a computer readable storage medium

Abstract

The application discloses a kind of based on power distribution safety terminal module monitoring method, device, terminal equipment and computer readable storage medium, method includes: obtaining the running data and flow transmission data of each power distribution safety terminal module;According to running data, the memory occupation abnormal value, process start number abnormal value and process running time abnormal value of each power distribution safety terminal module are calculated;According to flow transmission data, the flow size abnormal value and flow rate abnormal value of each power distribution safety terminal module are calculated;For each power distribution safety terminal module, according to preset proportion coefficient, each abnormal value is weighted calculation, and the comprehensive abnormal value of each power distribution safety terminal module is obtained;Whether the comprehensive abnormal value exceeds preset comprehensive abnormal threshold value is judged, if yes, the power distribution safety terminal module is regarded as abnormal;If not, continue to monitor.By implementing the application, the dynamic data of power distribution safety terminal module is directly monitored, and the terminal safety risk is more comprehensively evaluated.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of power distribution safety monitoring, and in particular to a monitoring method and device based on a power distribution safety terminal module, a terminal device and a computer readable storage medium. BACKGROUND

[0002] A power distribution network safety terminal refers to a specific device used in a power distribution automation system to ensure the security and reliability of data transmission. In modern power distribution networks, due to complex communication environments, there are many security risks such as data leakage and interference. The power distribution network safety terminal is a key device for ensuring the safe operation of the power distribution network and improving power supply reliability. It significantly improves the security of data transmission through encryption technology and other means, and is an important part of the development of power system automation and intelligentization in China.

[0003] However, current terminal security monitoring mainly relies on analyzing management data, which may not capture potential abnormal conditions in operational data and traffic data, thus failing to comprehensively assess terminal security risks. SUMMARY

[0004] The embodiments of the present application provide a monitoring method and device based on a power distribution safety terminal module, a terminal device and a computer readable storage medium, which directly monitor the dynamic data of the power distribution safety terminal module, and can comprehensively assess terminal security risks.

[0005] An embodiment of the present application provides a monitoring method based on a power distribution safety terminal module, comprising:

[0006] Obtaining real-time operational data and traffic transmission data of each power distribution safety terminal module; the operational data includes memory usage data, process startup frequency data and process running time data; the traffic transmission data includes traffic size data and traffic rate data;

[0007] According to the operational data of each power distribution safety terminal module, the memory usage abnormal value, the process startup frequency abnormal value and the process running time abnormal value of each power distribution safety terminal module are calculated;

[0008] According to the traffic transmission data of each power distribution safety terminal module, the traffic size abnormal value and the traffic rate abnormal value of each power distribution safety terminal module are calculated;

[0009] For each power distribution safety terminal module, according to the memory usage abnormal value, the process startup frequency abnormal value, the process running time abnormal value, the traffic size abnormal value and the traffic rate abnormal value, the preset proportion coefficient of each abnormal value is weighted to obtain the comprehensive abnormal value of each power distribution safety terminal module;

[0010] For each power distribution safety terminal module, it is judged whether the comprehensive abnormal value exceeds a preset comprehensive abnormal threshold value, if yes, the state of the power distribution safety terminal module is regarded as an abnormal state; if not, the monitoring is continued.

[0011] Further, according to the operation data of each power distribution safety terminal module, the memory occupation abnormal value, the process startup number abnormal value and the process running time abnormal value of each power distribution safety terminal module are calculated, including:

[0012] For each power distribution safety terminal module, according to the memory amount used in each time period and the total memory amount in the memory occupation data, the memory occupation rate of each time period is calculated;

[0013] According to the memory occupation rate of each time period, the number of time periods of collecting operation data and the standard memory occupation rate, the memory occupation abnormal value of each power distribution safety terminal module is calculated;

[0014] According to the number of time periods of collecting operation data, the standard process startup number and the process startup number of each time period in the memory occupation data, the process startup number abnormal value of each power distribution safety terminal module is calculated;

[0015] According to the number of time periods of collecting operation data, the standard process running time and the process running time of each time period in the memory occupation data, the process running time abnormal value of each power distribution safety terminal module is calculated.

[0016] Further, according to the flow transmission data of each power distribution safety terminal module, the flow size abnormal value and the flow rate abnormal value of each power distribution safety terminal module are calculated, including:

[0017] For each power distribution safety terminal module, according to the standard flow size, the total monitoring time of flow and the flow size collected at each moment in the flow size data, the flow size abnormal value of each power distribution safety terminal module is calculated;

[0018] According to the standard flow rate, the total monitoring time of flow and the flow rate collected at each moment in the flow size data, the flow rate abnormal value of each power distribution safety terminal module is calculated.

[0019] Further, the monitoring method of the power distribution safety terminal module further includes:

[0020] The IP address of the power distribution safety terminal module regarded as an abnormal state is obtained, and the IP address is taken as a positioning identifier.

[0021] On the basis of the above method embodiment, the application correspondingly provides a device embodiment, comprising: a dynamic data acquisition module, an operation abnormal value calculation module, a traffic abnormal value calculation module, a comprehensive abnormal value calculation module, and an abnormal state judgment module;

[0022] The dynamic data acquisition module is configured to acquire real-time operation data and traffic transmission data of each power distribution safety terminal module; the operation data comprises memory occupation data, process start number data, and process running duration data; and the traffic transmission data comprises traffic size data and traffic rate data.

[0023] The operation abnormal value calculation module is configured to calculate memory occupation abnormal values, process start number abnormal values, and process running duration abnormal values of each power distribution safety terminal module according to the operation data of each power distribution safety terminal module.

[0024] The traffic abnormal value calculation module is configured to calculate traffic size abnormal values and traffic rate abnormal values of each power distribution safety terminal module according to the traffic transmission data of each power distribution safety terminal module.

[0025] The comprehensive abnormal value calculation module is configured to, for each power distribution safety terminal module, calculate a comprehensive abnormal value of the power distribution safety terminal module by weighting the memory occupation abnormal value, the process start number abnormal value, the process running duration abnormal value, the traffic size abnormal value, and the traffic rate abnormal value according to preset abnormal value proportion coefficients.

[0026] The abnormal state judgment module is configured to, for each power distribution safety terminal module, judge whether the comprehensive abnormal value of the power distribution safety terminal module exceeds a preset comprehensive abnormal threshold value; if yes, the state of the power distribution safety terminal module is regarded as an abnormal state; and if no, the power distribution safety terminal module continues to be monitored.

[0027] Further, the operation abnormal value calculation module comprises a memory occupation rate calculation unit, a memory occupation abnormal value calculation unit, a process start number abnormal value calculation unit, and a process running duration abnormal value calculation unit.

[0028] The memory occupation abnormal value calculation unit is configured to calculate the memory occupation abnormal values of each power distribution safety terminal module according to the memory occupation rate of each time period, the number of time periods in which the operation data is collected, and a standard memory occupation rate.

[0029] The process start number abnormal value calculation unit is configured to calculate the process start number abnormal values of each power distribution safety terminal module according to the number of time periods in which the operation data is collected, a standard process start number, and the process start number of each time period in the memory occupation data.

[0030] The process running time length abnormal value calculation unit is configured to calculate process running time length abnormal values of each power distribution safety terminal module according to the number of time periods of collected running data, the standard process running time length, and the process running time length of each time period in the memory occupation data.

[0031] Further, the flow abnormal value calculation module comprises a flow size abnormal value calculation unit and a flow rate abnormal value calculation unit.

[0032] The flow size abnormal value calculation unit is configured to calculate flow size abnormal values of each power distribution safety terminal module according to the standard flow size, the total monitoring time length of flow, and the flow size collected at each time in the flow size data.

[0033] The flow rate abnormal value calculation unit is configured to calculate flow rate abnormal values of each power distribution safety terminal module according to the standard flow rate, the total monitoring time length of flow, and the flow rate collected at each time in the flow size data.

[0034] Further, the monitoring device based on the power distribution safety terminal module further comprises an abnormality positioning module.

[0035] The abnormality positioning module is configured to acquire the IP address of the power distribution safety terminal module regarded as an abnormal state, and take the IP address as a positioning identifier.

[0036] On the basis of the above-mentioned method embodiment, the present application correspondingly provides a terminal device embodiment, which comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the steps of the monitoring method based on the power distribution safety terminal module are implemented.

[0037] On the basis of the above-mentioned method embodiment, the present application correspondingly provides a computer readable storage medium embodiment, which comprises a stored computer program, and when the computer program runs, the device where the computer readable storage medium is located is controlled to execute the steps of the monitoring method based on the power distribution safety terminal module.

[0038] Compared with the prior art, the beneficial effects of the present application embodiment are as follows:

[0039] The application calculates memory occupation data abnormal values, process start number abnormal values, process running time abnormal values, flow size abnormal values and flow rate abnormal values of each power distribution terminal safety module by acquiring real-time operation data and flow transmission data of each power distribution safety terminal module, so as to calculate a comprehensive abnormal value, and judges whether the power distribution safety terminal module is abnormal by judging whether the comprehensive abnormal value exceeds a preset comprehensive abnormal threshold, wherein the operation data and the flow transmission data belong to dynamic data of the power distribution terminal safety module, and potential abnormal conditions of the terminal can be directly captured through the dynamic data or combinations thereof, for example, abnormal process behavior, abnormal memory occupation and frequent process start can be detected through analysis of memory occupation data and process start number data, which may indicate the existence of malicious software or system vulnerability exploitation, and analysis of management data can provide log records and performance monitoring data, which cannot directly identify abnormal running behavior, therefore, the dynamic data of the power distribution safety terminal module can be directly monitored through the application, and the terminal safety risk can be more comprehensively evaluated. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 is a flow diagram of a monitoring method based on a power distribution safety terminal module provided by an embodiment of the application;

[0041] Figure 2 is a structural diagram of a monitoring device based on a power distribution safety terminal module provided by an embodiment of the application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application.

[0043] As shown in Figure 1 An embodiment of the application provides a monitoring method based on a power distribution safety terminal module, which at least includes the following steps:

[0044] Step S1: acquiring real-time operation data and flow transmission data of each power distribution safety terminal module; the operation data includes memory occupation data, process start number data and process running time data; the flow transmission data includes flow size data and flow rate data;

[0045] For step S1, a power distribution safety terminal module is installed on the terminal device to be monitored. This module acquires real-time operational data from the terminal device. The power distribution safety terminal module has a built-in memory monitor to monitor memory usage. Additionally, it has a built-in counter to record the number of process starts, incrementing the counter each time a process starts. Furthermore, it has a process timer to record the process start time and current time, and calculate the runtime. Through these functions, the power distribution safety terminal module can provide real-time operational data for the terminal device, including memory usage, process start count, and process runtime.

[0046] Traffic transmission data on the terminal device can be copied to the security module for monitoring and analysis using traffic mirroring technology to obtain real-time traffic transmission data. This data includes traffic size and rate, providing detailed information about the traffic, including the total number of data packets transmitted and the transmission rate.

[0047] Step S2: Based on the operating data of each power distribution safety terminal module, calculate the abnormal values ​​of memory usage, process startup count, and process runtime for each power distribution safety terminal module.

[0048] In a preferred embodiment, based on the operating data of each power distribution safety terminal module, the abnormal values ​​of memory usage, process startup count, and process runtime for each power distribution safety terminal module are calculated, including:

[0049] For each power distribution safety terminal module, the memory usage rate for each time period is calculated based on the amount of memory currently in use and the total amount of memory in each time period of the memory usage data.

[0050] Based on the memory usage rate of each time period, the number of time periods for collecting and running data, and the standard memory usage rate, the abnormal memory usage values ​​of each power distribution safety terminal module are calculated.

[0051] Based on the number of time periods for collecting operational data, the number of times the standard process is started, and the number of times the process is started in each time period in the memory usage data, the abnormal value of the number of process starts for each power distribution safety terminal module is calculated.

[0052] Based on the number of time periods for collecting operational data, the standard process runtime, and the process runtime for each time period in the memory usage data, the abnormal values ​​of the process runtime for each power distribution safety terminal module are calculated.

[0053] For step S2, firstly, the memory usage of each power distribution safety terminal module obtained in step S1, i.e., the amount of memory currently in use and the total amount of memory in each time period, is substituted into the following calculation formula to obtain the abnormal value of the memory usage rate of the power distribution safety terminal module:

[0054]

[0055] In the formula, Y nc N represents an abnormal value in memory usage. i N represents the amount of memory used during the i-th time period. R N represents the total memory usage in the i-th time period, N1 represents the standard memory utilization rate, and j represents the number of time periods for data collection and processing.

[0056] Then, substituting the process startup count of each power distribution safety terminal module obtained in step S1 into the following calculation formula, the abnormal value of the process startup count of the power distribution safety terminal module is obtained:

[0057]

[0058] In the formula, Y qd Q indicates an abnormal number of process startups. i Q1 represents the number of times the process was started during the i-th time period, Q1 represents the number of times the standard process was started, and j represents the number of time periods for collecting and running data.

[0059] Next, the process runtime of each power distribution safety terminal module obtained in step S1 is substituted into the following calculation formula to obtain the abnormal value of the process runtime of the power distribution safety terminal module:

[0060]

[0061] In the formula, Y sj S represents an abnormal value in process runtime. i S1 represents the process runtime collected within the i-th time period, S1 represents the standard process runtime, and j represents the number of time periods for collecting running data.

[0062] Finally, the calculated abnormal values ​​of memory usage, process startup count, and process runtime for each power distribution safety terminal module are weighted and calculated to obtain the abnormal operation value for each power distribution safety terminal module:

[0063]

[0064] In the formula, Y yx The values ​​represent abnormal values ​​during operation. a1 represents the memory usage ratio coefficient, a2 represents the process startup count ratio coefficient, and a3 represents the process runtime ratio coefficient. a1+a2+a3=1;

[0065] By calculating the abnormal operating values ​​of the power distribution safety terminal modules, the overall operating status of each module can be assessed, helping monitoring system administrators or maintenance personnel to quickly identify abnormal modules so that appropriate measures can be taken in a timely manner to troubleshoot or repair the fault.

[0066] When monitoring specific terminal devices, different percentage coefficients for operational data can be assigned to target specific issues, enabling more precise monitoring of potential problems in power distribution safety terminal modules and ensuring the stable operation of the power system. For example, when a server is compromised by malware or system vulnerabilities, abnormal memory usage and frequent process launches may occur. Therefore, for server network security, it is necessary to increase the percentage coefficients for memory usage and process launch frequency.

[0067] Step S3: Based on the traffic transmission data of each power distribution safety terminal module, calculate the abnormal values ​​of traffic size and traffic rate of each power distribution safety terminal module.

[0068] In a preferred embodiment, based on the traffic transmission data of each power distribution safety terminal module, the abnormal values ​​of traffic size and traffic rate of each power distribution safety terminal module are calculated, including:

[0069] For each power distribution safety terminal module, the abnormal value of the flow rate is calculated based on the standard flow rate, the total monitoring time of the flow rate, and the flow rate collected at each moment in the flow rate data.

[0070] Based on the standard flow rate, the total monitoring time of the flow, and the flow rate collected at each moment in the flow size data, the abnormal flow rate values ​​of each power distribution safety terminal module are calculated.

[0071] For step S3, firstly, substitute the flow rate data of each power distribution safety terminal module obtained in step S1 into the following calculation formula to obtain the abnormal flow rate values ​​of the power distribution safety terminal modules:

[0072]

[0073] In the formula, Y dx Indicates an outlier in the traffic volume, D t D1 represents the flow rate collected at time t, D1 represents the standard flow rate, and T represents the monitoring duration of the flow data.

[0074] Next, the flow rate data of each power distribution safety terminal module obtained in step S1 is substituted into the following calculation formula to obtain the abnormal flow rate values ​​of the power distribution safety terminal modules:

[0075]

[0076] In the formula, Y sl Indicates an abnormal flow rate value, L t L1 represents the flow rate collected at time t, L1 represents the standard flow rate, and T represents the monitoring duration of the flow data.

[0077] Finally, the abnormal flow magnitude and abnormal flow rate values ​​of each power distribution safety terminal module are weighted and calculated to obtain the abnormal flow values ​​for each power distribution safety terminal module:

[0078]

[0079] In the formula, Y ll β1 represents the proportion of traffic volume, β2 represents the proportion of traffic rate, and β1+β2=1;

[0080] By calculating the abnormal flow values ​​of the power distribution safety terminal modules, the overall flow status of each module can be assessed, helping monitoring system administrators or maintenance personnel to quickly identify abnormal modules so that appropriate measures can be taken in a timely manner to troubleshoot or repair the fault.

[0081] Step S4: For each power distribution safety terminal module, the comprehensive abnormal value of each power distribution safety terminal module is obtained by weighting the abnormal values ​​of memory usage, process start count, process runtime, traffic volume, and traffic rate according to the preset proportion coefficient of each abnormal value.

[0082] For step S4, the abnormal values ​​of memory usage, process start count, and process runtime of each power distribution safety terminal module calculated in step S2, and the abnormal values ​​of traffic volume and traffic rate of each power distribution safety terminal module calculated in step S3, are weighted according to a preset proportion coefficient to obtain a comprehensive abnormal value for evaluating the power distribution terminal equipment:

[0083]

[0084] In the formula, Y zh The total abnormal value is represented by λ1, which represents the ratio of operational abnormalities, and λ2 represents the ratio of traffic abnormalities. λ1 + λ2 = 1.

[0085] By calculating comprehensive anomaly values, multiple anomalies in power distribution terminal equipment, such as memory usage, process startup count, process runtime, traffic volume, and traffic rate, can be considered, resulting in more accurate and comprehensive assessment results. Furthermore, the operational anomaly percentage coefficient and traffic anomaly percentage coefficient can be adjusted according to the specific needs of the terminal equipment to highlight significant anomalies.

[0086] Step S5: For each power distribution safety terminal module, determine whether its comprehensive abnormal value exceeds the preset comprehensive abnormal threshold. If so, the state of the power distribution safety terminal module is regarded as abnormal; otherwise, continue monitoring.

[0087] For step S5, assuming a power distribution system contains multiple power distribution safety terminal modules, the abnormality of each module is evaluated by calculating a comprehensive abnormal value, and the status of the module is determined according to a preset comprehensive abnormal threshold. If the comprehensive abnormal value exceeds the preset threshold, it indicates that the abnormality of the module is more serious, and the status of the power distribution safety terminal module is considered to be abnormal.

[0088] Once a distribution safety terminal module is determined to be in an abnormal state, the system administrator or maintenance personnel can take appropriate measures based on this status, such as troubleshooting, repair, or maintenance operations, to restore the module to normal operation. For distribution safety terminal modules whose overall abnormal values ​​do not exceed the preset threshold, the system will continue to monitor them to ensure their normal operation. This allows for continuous monitoring of the system and timely detection of module anomalies.

[0089] In a preferred embodiment, the monitoring method based on the power distribution safety terminal module further includes:

[0090] Obtain the IP address of the power distribution safety terminal module that is considered to be in an abnormal state, and use the IP address as a location identifier.

[0091] In one embodiment of the present invention, when a power distribution safety terminal module is determined to be in an abnormal state, the system immediately obtains the IP address of the module. Each module has a unique IP address. The obtained IP address is used as a location identifier to determine the location of the abnormal module in the power distribution system. Through the network topology diagram of the power distribution system, the IP address can be mapped to the corresponding physical location or network device.

[0092] Based on the IP address location identifier, system administrators can physically inspect the abnormal terminal device to determine if there is a physical fault or connectivity problem. If the system supports remote access, the system administrator can use the IP address of the abnormal module to remotely access the module. Through remote access, the administrator can view detailed status information, logs, configurations, etc., to further analyze the problem.

[0093] like Figure 2 As shown, based on the above method embodiments, corresponding apparatus embodiments are provided;

[0094] An embodiment of the present invention provides a monitoring device based on a power distribution safety terminal module, comprising: a dynamic data acquisition module, an operation anomaly value calculation module, a flow anomaly value calculation module, a comprehensive anomaly value calculation module, and an anomaly state judgment module;

[0095] The dynamic data acquisition module is used to acquire real-time operating data and flow transmission data of each power distribution safety terminal module; the operating data includes: memory usage data, process start count data, and process runtime data; the flow transmission data includes: flow size data and flow rate data.

[0096] The outlier calculation module is used to calculate the memory usage anomaly, process start count anomaly, and process runtime anomaly of each power distribution safety terminal module based on the operating data of each power distribution safety terminal module.

[0097] The flow anomaly calculation module is used to calculate the flow magnitude anomaly value and flow rate anomaly value of each power distribution safety terminal module based on the flow transmission data of each power distribution safety terminal module.

[0098] The comprehensive outlier calculation module is used to calculate the comprehensive outlier value of each power distribution safety terminal module by weighting the outlier values ​​of memory usage, process start count, process runtime, traffic volume, and traffic rate according to the preset proportion coefficient of each outlier value.

[0099] The abnormal state judgment module is used to determine whether the comprehensive abnormal value of each power distribution safety terminal module exceeds the preset comprehensive abnormal threshold. If it does, the state of the power distribution safety terminal module is regarded as abnormal; otherwise, monitoring continues.

[0100] In a preferred embodiment, the outlier calculation module includes: a memory usage calculation unit, a memory usage outlier calculation unit, a process startup count outlier calculation unit, and a process runtime outlier calculation unit;

[0101] The memory usage anomaly calculation unit is used to calculate the memory usage anomaly value of each power distribution safety terminal module based on the memory usage rate of each time period, the number of time periods for collecting running data, and the standard memory usage rate.

[0102] The process startup count anomaly calculation unit is used to calculate the process startup count anomaly value of each power distribution safety terminal module based on the number of time periods of collected running data, the standard process startup count, and the process startup count of each time period in the memory usage data.

[0103] The process runtime anomaly calculation unit is used to calculate the process runtime anomaly value of each power distribution safety terminal module based on the number of time periods of collected running data, the standard process runtime, and the process runtime of each time period in the memory usage data.

[0104] In a preferred embodiment, the traffic anomaly calculation module includes: a traffic size anomaly calculation unit and a traffic rate anomaly calculation unit;

[0105] The flow rate anomaly calculation unit is used to calculate the flow rate anomaly value for each power distribution safety terminal module based on the standard flow rate, the total monitoring time of the flow rate, and the flow rate collected at each moment in the flow rate data.

[0106] The flow rate anomaly calculation unit is used to calculate the flow rate anomaly value of each power distribution safety terminal module based on the standard flow rate, the total monitoring time of the flow, and the flow rate collected at each moment in the flow size data.

[0107] In a preferred embodiment, the monitoring device based on the power distribution safety terminal module further includes: an anomaly location module;

[0108] The anomaly location module is used to obtain the IP address of the power distribution safety terminal module that is considered to be in an abnormal state, and use the IP address as the location identifier.

[0109] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement the monitoring method based on the power distribution safety terminal module provided by any of the above-described method embodiments of the present invention.

[0110] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0111] Based on the above embodiments of the monitoring method based on the power distribution safety terminal module, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the monitoring method based on the power distribution safety terminal module of any embodiment of the present invention.

[0112] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0113] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0114] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0115] Based on the above-described method embodiments, another embodiment is provided: another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the monitoring method based on the power distribution safety terminal module described in any of the above-described method embodiments of the present invention.

[0116] The monitoring device / terminal equipment integrated with the power distribution safety terminal module, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0117] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A monitoring method based on a power distribution safety terminal module, characterized in that, include: Acquire real-time operating data and traffic transmission data of each power distribution safety terminal module; The operational data includes: memory usage data, process startup count data, and process runtime data; the traffic transmission data includes: traffic volume data and traffic rate data. Based on the operating data of each power distribution safety terminal module, the abnormal values ​​of memory usage, process startup count, and process runtime of each power distribution safety terminal module are calculated. Based on the traffic transmission data of each power distribution safety terminal module, the abnormal values ​​of traffic size and traffic rate of each power distribution safety terminal module are calculated. For each power distribution safety terminal module, the comprehensive abnormal value of each power distribution safety terminal module is obtained by weighting the abnormal values ​​of memory usage, process start count, process runtime, traffic volume, and traffic rate according to the preset proportion coefficient of each abnormal value. For each power distribution safety terminal module, determine whether its comprehensive abnormal value exceeds the preset comprehensive abnormal threshold. If it does, then the state of the power distribution safety terminal module is considered to be abnormal; otherwise, continue monitoring. The step of calculating abnormal values ​​for memory usage, process startup count, and process runtime of each power distribution safety terminal module based on their operational data includes: For each power distribution safety terminal module, the memory usage rate for each time period is calculated based on the amount of memory currently in use and the total memory amount in the memory usage data. Based on the memory usage rate for each time period, the number of time periods for which operational data was collected, and the standard memory usage rate, the abnormal memory usage value for each power distribution safety terminal module is calculated using the following formula: In the formula, Y nc N represents an abnormal value in memory usage. i N represents the amount of memory used during the i-th time period. R N represents the total memory usage in the i-th time period, N1 represents the standard memory utilization rate, and j represents the number of time periods for data collection and processing. Based on the number of time periods for collecting operational data, the number of standard process starts, and the number of process starts in each time period of memory usage data, the abnormal value of the process start count for each power distribution safety terminal module is calculated. The calculation formula is as follows: In the formula, Y qd Q indicates an abnormal number of process startups. i Q1 represents the number of times the process was started during the i-th time period, Q1 represents the number of times the standard process was started, and j represents the number of time periods for collecting and running data. Based on the number of time periods for collecting operational data, the standard process runtime, and the process runtime for each time period in the memory usage data, the abnormal process runtime values ​​for each power distribution safety terminal module are calculated. The calculation formula is as follows: In the formula, Y sj S represents an abnormal value in process runtime. i S1 represents the process runtime collected within the i-th time period, S1 represents the standard process runtime, and j represents the number of time periods for collecting running data.

2. The monitoring method based on a power distribution safety terminal module according to claim 1, characterized in that, Based on the traffic transmission data of each power distribution safety terminal module, the abnormal values ​​of traffic size and traffic rate for each power distribution safety terminal module are calculated, including: For each power distribution safety terminal module, the abnormal value of the flow rate is calculated based on the standard flow rate, the total monitoring time of the flow rate, and the flow rate collected at each moment in the flow rate data. Based on the standard flow rate, the total monitoring time of the flow, and the flow rate collected at each moment in the flow size data, the abnormal flow rate values ​​of each power distribution safety terminal module are calculated.

3. The monitoring method based on a power distribution safety terminal module according to claim 2, characterized in that, Also includes: Obtain the IP address of the power distribution safety terminal module that is considered to be in an abnormal state, and use the IP address as a location identifier.

4. A monitoring device based on a power distribution safety terminal module, characterized in that, include: The system includes a dynamic data acquisition module, an operation anomaly calculation module, a traffic anomaly calculation module, a comprehensive anomaly calculation module, and an anomaly status judgment module. The dynamic data acquisition module is used to acquire real-time operating data and traffic transmission data of each power distribution safety terminal module; The operational data includes: memory usage data, process startup count data, and process runtime data; the traffic transmission data includes: traffic volume data and traffic rate data. The abnormal value calculation module is used to calculate the abnormal values ​​of memory usage, process start count, and process runtime of each power distribution safety terminal module based on the operating data of each power distribution safety terminal module. The flow anomaly calculation module is used to calculate the flow magnitude anomaly value and flow rate anomaly value of each power distribution safety terminal module based on the flow transmission data of each power distribution safety terminal module. The comprehensive anomaly calculation module is used to calculate the comprehensive anomaly value of each power distribution safety terminal module by weighting the anomaly values ​​of memory usage, process start count, process runtime, traffic volume, and traffic rate according to the preset proportion coefficients of each anomaly value. The abnormal state judgment module is used to determine whether the comprehensive abnormal value of each power distribution safety terminal module exceeds the preset comprehensive abnormal threshold. If it does, the state of the power distribution safety terminal module is regarded as an abnormal state; otherwise, monitoring continues. The outlier calculation module includes: a memory usage calculation unit, a memory usage outlier calculation unit, a process startup count outlier calculation unit, and a process runtime outlier calculation unit. The memory occupancy calculation unit is used to calculate the memory occupancy rate for each power distribution safety terminal module based on the amount of memory currently in use and the total amount of memory in each time period of the memory occupancy data. The memory usage anomaly calculation unit is used to calculate the memory usage anomaly value of each power distribution safety terminal module based on the memory usage rate of each time period, the number of time periods for collecting running data, and the standard memory usage rate. The calculation formula is as follows: In the formula, Y qd Q indicates an abnormal number of process startups. i Q1 represents the number of times the process was started during the i-th time period, Q1 represents the number of times the standard process was started, and j represents the number of time periods for collecting and running data. The process startup count anomaly calculation unit is used to calculate the process startup count anomaly value of each power distribution safety terminal module based on the number of time periods for collecting running data, the standard process startup count, and the process startup count for each time period in the memory usage data. The calculation formula is as follows: In the formula, Y qd Q indicates an abnormal number of process startups. i Q1 represents the number of times the process was started during the i-th time period, Q1 represents the number of times the standard process was started, and j represents the number of time periods for collecting and running data. The process runtime anomaly calculation unit is used to calculate the process runtime anomaly value of each power distribution safety terminal module based on the number of time periods of collected running data, the standard process runtime, and the process runtime of each time period in the memory usage data. The calculation formula is as follows: In the formula, Y sj S represents an abnormal value in process runtime. i S1 represents the process runtime collected within the i-th time period, S1 represents the standard process runtime, and j represents the number of time periods for collecting running data.

5. The monitoring device based on the power distribution safety terminal module according to claim 4, characterized in that, The traffic anomaly calculation module includes: a traffic size anomaly calculation unit and a traffic rate anomaly calculation unit; The abnormal flow rate calculation unit is used to calculate the abnormal flow rate value of each power distribution safety terminal module based on the standard flow rate, the total monitoring time of the flow rate, and the flow rate collected at each moment in the flow rate data. The flow rate anomaly calculation unit is used to calculate the flow rate anomaly value of each power distribution safety terminal module based on the standard flow rate, the total monitoring time of the flow, and the flow rate collected at each moment in the flow size data.

6. The monitoring device based on the power distribution safety terminal module according to claim 5, characterized in that, Also includes: Anomaly location module; The anomaly location module is used to obtain the IP address of the power distribution safety terminal module that is considered to be in an abnormal state, and use the IP address as a location identifier.

7. A terminal device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the monitoring method based on a power distribution safety terminal module as described in any one of claims 1-3.

8. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the monitoring method based on the power distribution safety terminal module as described in any one of claims 1-3.

Images