Method and system for monitoring operation state of security and protection equipment of transformer substation
By collecting and integrating multiple data from substation security equipment, an integrated monitoring model is built, and monitoring is performed using the Xgboost algorithm, the problems of high monitoring false alarm rate and omission rate in the existing technology are solved, and more accurate and comprehensive integration is achieved monitor.
Patent Information
- Application Number
- CN202411486225.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-23
- Publication Date
- 2025-02-14
AI Technical Summary
In the prior art, the monitoring methods of substation security equipment have high false alarm rates and omission rates, and the data generated by each device cannot be well integrated and analyzed, resulting in incomplete monitoring.
A method for monitoring the operating status of substation security equipment is proposed. By collecting image data, environmental data and network security data, a primary classifier with a single feature and an integrated monitoring model of multiple features is constructed, and integrated monitoring is performed using the Xgboost algorithm, and the real-time return to the control center.
It improves the accuracy of monitoring of the operating status of the substation security equipment, reduces the false alarm rate and missed alarm rate, and realizes comprehensive monitoring and real-time response to the operating status of the equipment.
Smart Images
Figure CN119442141A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of electric power technology, and in particular relates to a method and system for monitoring the operating status of security equipment in a substation. Background Art
[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.
[0003] The operation of substation security equipment directly affects the safe and stable operation of the power system and is a reflection of the unit's equipment management level. The traditional substation equipment inspection method mainly relies on manual inspection, with special inspectors checking the equipment and environmental conditions. There are problems such as low work efficiency, the quality of monitoring being greatly affected by the experience of inspectors, and high management costs.
[0004] As artificial intelligence technology continues to mature, monitoring methods using artificial intelligence are gradually being applied to the monitoring of substation equipment operating status. Although related technologies in the field of artificial intelligence have saved a lot of manpower in the inspection of substation security equipment, the current monitoring of security equipment is mostly focused on a certain attribute, and it is impossible to integrate and analyze the data generated by each device well and respond to complex situations. The false alarm rate and missed alarm rate of the monitoring method are high. Summary of the invention
[0005] In order to overcome the above-mentioned deficiencies of the prior art, the present invention proposes a method and system for monitoring the operating status of substation security equipment to solve the problems of high false alarm rate and missed alarm rate and incomplete monitoring in the prior art.
[0006] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions: In a first aspect, a method for monitoring the operating status of a substation security device is disclosed, comprising: Collect historical operation data of substation security equipment, including image data, environmental data and network security data; Preprocess the collected historical operation data; Build a primary classifier of a single feature to perform preliminary pre-monitoring on each type of data; Build a multi-feature integrated monitoring model; Use the preprocessed historical data to train the monitoring model and obtain the optimal monitoring model; Obtain the current operating data of the substation security equipment, conduct integrated monitoring on the pre-processed current operating data, and obtain the operating status of the substation security equipment; The monitoring results are returned to the control center in real time to determine whether there is any abnormality.
[0007] Furthermore, the image data specifically refers to the images collected from N monitoring devices in the monitoring system of the substation, where the monitoring devices are used to collect monitoring images of the appearance and working status of solid-state devices, including but not limited to the appearance of the security fence of the substation, the status of the infrared radiation device, the appearance of the working equipment in the station, the equipment warning lights, the lighting system, and the appearance of the fire-fighting equipment; The environmental data is collected by temperature and humidity sensors to collect temperature and humidity in the substation; The network security data is extracted through network security detection equipment to include the resource occupancy, maximum resource occupancy, average resource occupancy, node access times, electricity consumption data, equipment operating years, and number of equipment external risk network ports of each network node in the substation power system.
[0008] Further, the primary classifier comprises: The first feature initial classifier uses a residual neural network model based on the spatial attention mechanism to pre-monitor the three-dimensional image data; The second feature initial classifier uses SVM support vector machine to pre-monitor one-dimensional environmental data; The third feature initial classifier uses an integrated fully connected neural network to perform preliminary monitoring of M network security features.
[0009] Furthermore, the integrated monitoring model adopts the Xgboost model, which can not only output classification results, but also output feature rankings, feature names, and feature weight values. That is, the preliminary monitoring results of the first feature preliminary classifier, the second feature preliminary classifier, and the third feature preliminary classifier are input into the Xgboost model, and the model outputs whether the monitoring status is normal or abnormal, and outputs the importance ranking of each feature for judging the final result, thereby providing priority for troubleshooting.
[0010] In a second aspect, a substation security equipment operation status monitoring system is disclosed, comprising: A collection module, which is configured to: collect historical operation data of substation security equipment, including: image data, environmental data and network security data; Preprocessing module: preprocessing the collected historical operation data; Primary classifier building module: Build a primary classifier of a single feature to perform preliminary monitoring on each type of data; Integrated monitoring model building module: builds a multi-feature integrated monitoring model; Model training module: Use pre-processed historical data to train the monitoring model and obtain the optimal monitoring model; Real-time monitoring module: obtain the current operating data of the substation security equipment, conduct integrated monitoring of the pre-processed current operating data, and obtain the operating status of the substation security equipment; The monitoring results are returned to the control center in real time to determine whether there is any abnormality.
[0011] In a third aspect, an electronic device is disclosed, including a memory and a processor, and computer instructions stored in the memory and running on the processor, wherein when the computer instructions are run by the processor, the steps of the above-mentioned substation security equipment operation status monitoring method are completed.
[0012] In a fourth aspect, a computer-readable storage medium is disclosed for storing computer instructions, which, when executed by a processor, complete the steps of the above-mentioned substation security equipment operating status monitoring method.
[0013] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention provides a method and system for monitoring the operating status of substation security equipment, and proposes to use the xgboost algorithm as a strong learner, integrate the preliminary classification pre-monitoring results, comprehensively determine whether the substation operating status is abnormal, and improve the accuracy of classification; each primary classifier is calculated in parallel to speed up the calculation speed and realize real-time return of monitoring results; based on the output of the preliminary classification model, the input data volume of the integrated monitoring model is reduced, thereby reducing the calculation time of the total classification model and further improving the classification speed.
[0014] 2. The present invention designs a third feature initial classifier of a fully connected neural network, and calculates the abnormal probability of each network node in parallel. The parallel calculation reduces the calculation time of the model and ensures real-time monitoring and classification of the model.
[0015] 3. A neural network model based on the spatial attention mechanism is designed in the present invention. By constructing a spatial attention neural network, feature selection is focused on the position of effective information on the feature map. Since the monitoring image generally shoots a large area, the feature extraction of the entire area cannot be well focused on small-scale image features such as equipment appearance and equipment warning lights. Therefore, by improving the ability to pay attention to specific areas, the monitoring performance of the operating status of substation equipment is significantly improved.
[0016] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.
[0018] Figure 1 This is a flow chart of a method for monitoring the operating status of substation security equipment described in Embodiment 1 of the present invention.
[0019] Figure 2 This is a schematic diagram of the neural network model based on the spatial attention mechanism described in Example 1 of the present invention.
[0020] Figure 3 Schematic diagram of the spatial attention module described in Embodiment 1 of the present invention.
[0021] Figure 4 Schematic diagram of the structure of the integrated fully connected neural network described in Example 1 of the present invention. DETAILED DESCRIPTION
[0022] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.
[0023] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.
[0024] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.
[0025] Embodiment 1 In one or more embodiments, a method for monitoring the operating status of a substation security device is disclosed, such as Figure 1 As shown, the following steps are included: Step 1: Collect historical operation data of substation security equipment, including image data, environmental data and network security data; The security equipment in the substation includes: solid-state devices and network security detection equipment; among them, the solid-state devices include security fences, infrared radiation devices, substation equipment, lighting systems and fire-fighting equipment; the network security detection equipment is used to detect the status of data transmitted in the substation power system.
[0026] Specifically, the image data is the images of N monitoring devices in the monitoring system of the substation. The monitoring devices are used to collect monitoring images of the appearance and working status of solid-state devices, including but not limited to the appearance of the security fence of the substation, the status of the infrared radiation device, the appearance of the working equipment in the station, the equipment warning lights, the lighting system, and the appearance of the fire-fighting equipment. By monitoring various equipment inside the substation through image data, it can be monitored whether the appearance of the fence, working equipment, and fire-fighting equipment is intact, and whether the warning and lighting are operating normally.
[0027] Environmental data, including temperature and humidity in the substation collected through temperature and humidity sensors.
[0028] Network security data refers to the resource occupancy, maximum resource occupancy, average resource occupancy, node access times, power consumption data, equipment operating years, and number of equipment external risk network ports of each network node in the substation power system extracted through network security detection equipment.
[0029] Step 2: Preprocess the collected historical operation data; specifically: Preprocess the collected image data, stack the images at time T-1, T, and T+1 for N monitoring devices in sequence to generate three-dimensional image data, and obtain N image features. By expanding the image in the time dimension, the changes in the appearance and operating status of the equipment over time can be characterized. For example, the changes in the security rays emitted by the infrared radiation device at three time points can be used to determine whether the infrared radiation device is working stably.
[0030] The collected environmental data is preprocessed, and the temperature and humidity data at time T-1, T, and T+1 are spliced to generate one-dimensional vector data as environmental features.
[0031] Pre-process the collected network security data, and use the network security data of each node as a feature. If there are M network nodes, there are M network security features. Comprehensive monitoring of device data transmission through network security data can prevent security equipment from being remotely controlled by unknown hosts or personnel, resulting in abnormal operation; or timely discover accidents such as equipment offline operation and automation information interruption due to abnormal environmental operation.
[0032] Step 3: Build a primary classifier of a single feature to perform preliminary pre-monitoring on each type of data; Step 3.1: Construct the first feature initial classifier and use the residual neural network model based on the spatial attention mechanism to pre-monitor the three-dimensional image data.
[0033] Neural network models based on spatial attention mechanisms, such as Figure 2 As shown, specifically: input layer-convolution layer 1-convolution layer 2-spatial attention module 1-ReLU activation layer-convolution layer 3-spatial attention module 2-convolution layer 4-fully connected layer-softmax layer, where the output of convolution layer 1 jumps to the output of spatial attention module 1, and the output of ReLU activation layer jumps to the output of spatial attention module 2. The neural network based on the attention mechanism extracts features from the collected image data of solid-state devices and judges the abnormality of the appearance and operating status of the security equipment.
[0034] like Figure 3As shown in FIG. 1 , the structure of the spatial attention module is: input of the module - normalization layer - spatial concentration layer - normalization layer - convolutional layer - output, wherein the input jumps to the output of the spatial concentration layer, and weighted summation operation 1 is performed, and the output of weighted summation operation 1 jumps to the output of the convolutional layer, and weighted summation operation 2 is performed.
[0035] The expression of the spatial attention module is:
[0036] in, The abnormal feature map extracted from the image data of the solid-state device is used as the input of the spatial attention module. To standardize operations, is the spatial concentration layer, is the convolution operation.
[0037] The expression of the spatial concentration layer is:
[0038] By constructing a spatial attention neural network, feature selection is focused on the location of effective information on the feature map. Since monitoring images generally capture a large area, feature extraction of the entire area cannot focus well on small-scale image features such as equipment appearance and equipment warning lights. Therefore, by improving the ability to focus on specific areas, the monitoring performance of the operating status of substation equipment can be significantly improved.
[0039] Step 3.2: Construct the second feature initial classifier and use SVM support vector machine to pre-monitor the one-dimensional environmental data.
[0040] Step 3.3: Construct the third feature initial classifier, such as Figure 4 As shown, an integrated fully connected neural network is used to perform pre-monitoring on M network security features.
[0041] Step 3.3.1: Use a fully connected neural network, specifically, the fully connected layer 1, sigmoid activation function layer, fully connected layer 2, sigmoid activation function layer, fully connected layer 3, sigmoid activation function layer, softmax layer are connected in sequence, where the number of channels in the fully connected layer 1 is , the number of channels in the fully connected layer 2 is , the number of channels in the fully connected layer 3 is , by replacing the convolution layer with a fully connected layer, the amount of calculation is reduced. The essence of the fully connected layer is a convolution layer with a convolution kernel size of 1×1, and the network security feature is a one-dimensional vector. The fully connected layer is used to replace the convolution layer to adapt to the network security feature. The final output layer uses the output of the softmax layer as the initial classification result of extracting the network security feature. This initial classification result is the abnormal probability of each network node.
[0042] Step 3.3.2: Integrate the initial classification results of M network nodes, fully connected layer 4, ReLU activation layer, fully connected layer 5, fully connected layer 6, output layer; the number of channels of fully connected layer 4 is , the number of channels of the fully connected layer 5 is , the number of channels of fully connected layer 6 is 2.
[0043] Since there is no direct sequential meaning between each data such as resource usage and number of visits in network security data and the data connected to it, a fully connected network is used to extract features from network security data. Each fully connected layer in the fully connected network is connected to all neurons in the previous layer, so that each layer of feature learning integrates each input feature and their mutual influence, thereby reducing the influence of the order of connection between features on feature learning and enhancing the interaction between each feature, thereby improving the accuracy of pre-monitoring.
[0044] Step 4: Construct a multi-feature integrated monitoring model; use the Xgboost model, which can not only output classification results, but also feature rankings, feature names, and feature weight values. That is, the preliminary monitoring results of the first feature preliminary classifier, the second feature preliminary classifier, and the third feature preliminary classifier are input into the Xgboost model. The model outputs whether the monitoring status is normal or abnormal, and outputs the importance ranking of each feature for judging the final result, thereby providing priority for troubleshooting.
[0045] Since monitoring images, environment or network security data can only represent the operating status within a specific range, it is impossible to make a comprehensive assessment of the operating status of substation security equipment. Through the integrated monitoring model, the pre-monitoring results of the three primary classifiers are integrated and learned to improve the overall monitoring accuracy and coverage.
[0046] Step 5: Use the preprocessed historical data to train the monitoring model and obtain the optimal monitoring model; The preprocessed image features are input into the first feature preliminary classifier to obtain the first feature preliminary classification results; the environmental features are input into the second feature preliminary classifier to obtain the second feature preliminary classification results; the network security features are input into the third feature preliminary classifier to obtain the third feature preliminary classification results; the three results are input into the integrated monitoring model to obtain the final substation security equipment operation status monitoring results, and the model with the highest accuracy is saved as the optimal monitoring model.
[0047] Step 6: Obtain the current operating data of the substation security equipment, including the current data of solid-state devices and network security detection equipment; input the pre-processed current operating data into the optimal monitoring model for integrated monitoring to obtain the operating status of the substation security equipment; return the monitoring results of whether they are abnormal, and the monitoring results are returned to the control center in real time. Substation security equipment is responsible for improving the reliability and safety of the existing power system operation, preventing network attacks and theft of important data. Accurate monitoring of the operating status of security equipment and timely warning can improve the reliability of substation security equipment.
[0048] Embodiment 2 In one or more embodiments, a substation security equipment operation status monitoring system is disclosed, specifically comprising: A collection module, which is configured to: collect historical operation data of substation security equipment, including: image data, environmental data and network security data; Preprocessing module: preprocessing the collected historical operation data; Primary classifier building module: Build a primary classifier of a single feature to perform preliminary monitoring on each type of data; Integrated monitoring model building module: builds a multi-feature integrated monitoring model; Model training module: Use pre-processed historical data to train the monitoring model and obtain the optimal monitoring model; Real-time monitoring module: obtain the current operating data of the substation security equipment, conduct integrated monitoring of the pre-processed current operating data, and obtain the operating status of the substation security equipment; The monitoring results are returned to the control center in real time to determine whether there is any abnormality.
[0049] Embodiment 3 Embodiment 3 of the present invention provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are run by the processor, the steps of the above-mentioned substation security equipment operation status monitoring method are completed.
[0050] Embodiment 4 Embodiment 4 of the present invention provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the steps of the above-mentioned substation security equipment operation status monitoring method are completed.
[0051] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0052] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0053] These computer program instructions can also be loaded onto a computer or other programmable data processing device, and a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0054] The description of each embodiment in the above embodiments has different emphases. For parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0055] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A method for monitoring the operating status of a substation security device, characterized in that: include: Collect historical operation data of substation security equipment, including image data, environmental data and network security data; Preprocess the collected historical operation data; Build a primary classifier of a single feature to perform preliminary pre-monitoring on each type of data; Build a multi-feature integrated monitoring model; Use the preprocessed historical data to train the monitoring model and obtain the optimal monitoring model; Obtain the current operating data of the substation security equipment, conduct integrated monitoring on the pre-processed current operating data, and obtain the operating status of the substation security equipment; The monitoring results are returned to the control center in real time to determine whether there is any abnormality.
2. A method for monitoring the operating status of a substation security device according to claim 1, characterized in that: The primary classifier comprises: The first feature initial classifier uses a residual neural network model based on the spatial attention mechanism to pre-monitor the three-dimensional image data; The second feature initial classifier uses SVM support vector machine to pre-monitor one-dimensional environmental data; The third feature initial classifier uses an integrated fully connected neural network to perform preliminary monitoring of M network security features.
3. A method for monitoring the operating status of a substation security device according to claim 2, characterized in that: The residual neural network model based on the spatial attention mechanism is specifically: Input layer-convolution layer 1-convolution layer 2-spatial attention module 1-ReLU activation layer-convolution layer 3-spatial attention module 2-convolution layer 4-fully connected layer-softmax layer, among which the output of convolution layer 1 is jump-connected to the output of spatial attention module 1, and the output of ReLU activation layer is jump-connected to the output of spatial attention module 2.
4. A method for monitoring the operating status of a substation security device according to claim 3, characterized in that: The structure of the spatial attention module is: module input-normalization layer-spatial concentration layer-normalization layer-convolutional layer-output, where the input is jump-connected to the output of the spatial concentration layer, a weighted summation operation is performed, and the output of the weighted summation operation is jump-connected to the output of the convolutional layer, and a weighted summation operation is performed again.
5. A method for monitoring the operating status of a substation security device according to claim 2, characterized in that: The fully connected neural network is specifically: The fully connected layer 1, sigmoid activation function layer, fully connected layer 2, sigmoid activation function layer, fully connected layer 3, sigmoid activation function layer, and softmax layer are connected in sequence. The number of channels in the fully connected layer 1 is , the number of channels in the fully connected layer 2 is , the number of channels in the fully connected layer 3 is .
6. A method for monitoring the operating status of a substation security device according to claim 5, characterized in that: After each network node passes through the fully connected neural network, the output results are integrated: The initial classification results of M network nodes are integrated and passed through the fully connected layer 4, ReLU activation layer, fully connected layer 5, fully connected layer 6, and output layer in sequence; among them, the number of channels in the fully connected layer 4 is , the number of channels of the fully connected layer 5 is , the number of channels of fully connected layer 6 is 2.
7. A method for monitoring the operating status of a substation security device according to claim 1, characterized in that: The multi-feature integrated monitoring model is constructed, and the Xgboost model is used to output the classification results, as well as the feature ranking, feature name, and feature weight value; Specifically, the pre-monitoring results of the first feature classifier, the second feature classifier, and the third feature classifier are input into the Xgboost model. The model outputs whether the monitoring status is normal or abnormal, and outputs the importance ranking of each feature for determining the final result.
8. A substation security equipment operation status monitoring system, characterized in that: include: A collection module, which is configured to: collect historical operation data of substation security equipment, including: image data, environmental data and network security data; Preprocessing module: preprocessing the collected historical operation data; Primary classifier building module: Build a primary classifier of a single feature to perform preliminary pre-monitoring on each type of data; Integrated monitoring model building module: builds a multi-feature integrated monitoring model; Model training module: Use pre-processed historical data to train the monitoring model and obtain the optimal monitoring model; Real-time monitoring module: obtain the current operating data of the substation security equipment, perform integrated monitoring on the pre-processed current operating data, and obtain the operating status of the substation security equipment; return the monitoring results to determine whether there are any abnormalities, and the monitoring results are returned to the control center in real time.
9. An electronic device, characterized in that: The method comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the method for monitoring the operating status of substation security equipment according to any one of claims 1 to 7 is completed.
10. A computer-readable storage medium, characterized in that: Used to store computer instructions, which, when executed by a processor, complete the substation security equipment operating status monitoring method described in any one of claims 1-7.