A power information management system and method based on digital twin

Abstract

The present invention discloses a power information management system and method based on digital twins, which belongs to the field of power safety technology. Through the digital twins of power facilities, various power abnormal events are fed back; weakness scans are performed on power abnormal events from time to time, and the fault attribute codes fed back by various power abnormal events are scanned to integrate various power abnormal events and record them in abnormal data clusters; the first danger correlation between any two fault attribute codes is analyzed and calculated, and based on the first danger correlation, in the case of the historical process of irregularly performing weakness scans, the second danger correlation between any two fault attribute codes is analyzed and calculated to determine the fault linkage behavior relationship between the fault attribute codes; based on the fault linkage behavior relationship, a hidden danger linkage troubleshooting list is generated; based on the hidden danger linkage troubleshooting list, real-time defense response is performed; further, while realizing the boundary calibration of the weakness scan, the time of the weakness scan is reduced, and the efficiency of the power defense response is improved.

Description

Technical Field

[0001] The present invention relates to the field of electric power safety technology, and specifically to an electric power information management system and method based on digital twins. Background Art

[0002] The power system is the infrastructure of modern society, providing essential energy for people's production and life. However, various faults are inevitable in the operation of the power system, which may affect the power supply quality or even lead to power grid accidents.

[0003] In the existing technology, digital twin technology is generally used to construct digital twins of various power facilities to monitor the safety of power facilities. However, when building a power digital twin model, a large amount of data needs to be collected and organized, including grid topology, power equipment parameters, grid operation data, etc. However, these data may be inaccurate or incomplete, resulting in a decrease in the accuracy of the model and failure to truly reflect the actual situation of the power grid. When a large-scale power failure occurs, it is difficult for the power digital twin model to achieve rapid vulnerability scanning. Summary of the invention

[0004] The purpose of the present invention is to provide a power information management system and method based on digital twins to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A power information management system based on digital twins, the system includes: a data storage module, a data summary and analysis module, a weakness linkage analysis module and a defense response module;

[0007] The data storage module, through the digital twin of the power facility, feeds back each power abnormality event and uniformly encodes the power abnormality event; divides the storage space according to the fault attribute code, and the storage space is used to store each abnormal data cluster;

[0008] The data summarization and analysis module is used to perform weakness scans on power abnormal events from time to time, scan the fault attribute codes fed back by each power abnormal event, and integrate each power abnormal event through the fault attribute code, and record it into the abnormal data cluster; based on the abnormal data cluster, analyze and calculate the first risk correlation between any two fault attribute codes;

[0009] The weakness linkage analysis module analyzes and calculates the second risk correlation between any two fault attribute codes based on the first risk correlation and determines the fault linkage behavior relationship between the fault attribute codes in the case of an irregular historical process of performing weakness scanning;

[0010] The defense response module generates a hidden danger linkage checklist based on the fault linkage behavior relationship; and executes a real-time defense response based on the hidden danger linkage checklist.

[0011] Further, the data storage module includes a coding unit and a storage space unit;

[0012] The encoding unit is used to record any i-th power abnormality event as , based on the power abnormality event, compile a fault attribute code, the fault attribute is a keyword describing the power abnormality event, the types of the fault attribute include device type, fault type and fault location, wherein one fault attribute corresponds to one fault attribute code, and one fault attribute code has a unique coding value;

[0013] The storage space unit is used to record any e-th fault attribute code as , where r represents the type serial number of the fault attribute, r∈[1,3], when r=1 it represents the device type, when r=2 it represents the fault type, and when r=3 it represents the fault location; based on the fault attribute code, the storage space is divided and the fault attribute code is The corresponding divided storage space is recorded as .

[0014] Furthermore, the data summarization and analysis module includes an abnormal data classification and recording unit and a first risk correlation analysis unit;

[0015] The abnormal data classification recording unit is used to coordinate the fault attribute codes of all power abnormal events that occurred between the hth weakness scan and the h+1th weakness scan. There is a fault attribute code in the feedback , then the power abnormal event Recorded to abnormal data cluster middle, and ,in, Indicates the presence of a symbol, Indicates the total number of power anomaly events that occurred between the hth weakness scan and the h+1th weakness scan;

[0016] The first risk correlation analysis unit analyzes and calculates the first risk correlation between any two fault attribute codes based on the abnormal data cluster, and the formula is as follows:

[0017] ;

[0018] In the formula, represents the qth fault attribute code, and q≠e, Indicates the total number of power anomaly events that occurred between the h-1th vulnerability scan and the hth vulnerability scan. Indicates fault attribute code Fault attribute code The first risk correlation between Indicates fault attribute code The corresponding abnormal data clusters are Indicates abnormal data clusters With abnormal data clusters The number of power anomaly events contained in the intersection set, It represents the number of power abnormal events contained in the union set between abnormal data clusters, and all fault attribute codes fed back from the hth weakness scan to the h+1th weakness scan of the abnormal data cluster are formed in sequence.

[0019] Further, the weakness linkage analysis module includes a second risk correlation analysis unit and a linkage behavior determination unit;

[0020] The second risk correlation analysis unit analyzes and calculates the second risk correlation between any two fault attribute codes based on the first risk correlation in the case of irregularly performing the historical process of vulnerability scanning, and the formula is as follows:

[0021] ;

[0022] In the formula, Indicates fault attribute code Fault attribute code The second risk correlation between , H represents the total number of vulnerability scans, V represents the average value of the first risk correlation, represents the variance of the first hazard correlation;

[0023] The linkage behavior determination unit is used to preset a relevant threshold value. If the second risk correlation If it is greater than or equal to the relevant threshold, the fault attribute code is determined Fault attribute code Fault linkage occurs between them.

[0024] Further, the defense response module includes a hidden danger list unit and a defense response execution unit;

[0025] The hidden danger list unit is used to coordinate the fault attribute code All fault linkage objects are collected and a hidden danger linkage troubleshooting list is generated, recorded as ; Real-time acquisition of all fault attribute codes fed back during the current weakness scan, and generation of a real-time fault list recorded as ;

[0026] The defense response execution unit obtains a hidden danger linkage investigation list through matching With real-time fault list The intersection set is not an empty set to lock the fault attribute code , and lock the fault attribute code Sent to the defense response port.

[0027] A method for power information management based on digital twins, the method comprising the following steps:

[0028] Step S100: Feedback various power abnormal events through the digital twin of the power facility, and uniformly encode the power abnormal events; divide the storage space according to the fault attribute code, and the storage space is used to store various abnormal data clusters;

[0029] Step S200: irregularly performing weakness scans on power abnormal events, scanning the fault attribute codes fed back by each power abnormal event, integrating each power abnormal event by the fault attribute code, and recording them into the abnormal data cluster; based on the abnormal data cluster, analyzing and calculating the first risk correlation between any two fault attribute codes;

[0030] Step S300: Based on the first risk correlation, in the case of the historical process of irregularly executing the vulnerability scan, the second risk correlation between any two fault attribute codes is analyzed and calculated, and the fault linkage behavior relationship between the fault attribute codes is determined;

[0031] Step S400: Generate a hidden danger linkage troubleshooting list based on the fault linkage behavior relationship; and execute a real-time defense response based on the hidden danger linkage troubleshooting list.

[0032] Furthermore, the specific implementation process of step S100 includes:

[0033] Any ith power abnormality event is recorded as , based on the power abnormality event, compile a fault attribute code, the fault attribute is a keyword describing the power abnormality event, the types of the fault attribute include device type, fault type and fault location, wherein one fault attribute corresponds to one fault attribute code, and one fault attribute code has a unique coding value;

[0034] Let any e-th fault attribute code be , where r represents the type serial number of the fault attribute, r∈[1,3], when r=1 it represents the device type, when r=2 it represents the fault type, and when r=3 it represents the fault location; based on the fault attribute code, the storage space is divided and the fault attribute code is The corresponding divided storage space is recorded as .

[0035] Furthermore, the specific implementation process of step S200 includes:

[0036] The fault attribute codes of all power abnormal events that occurred between the hth vulnerability scan and the h+1th vulnerability scan are coordinated. If the power abnormal event There is a fault attribute code in the feedback , then the power abnormal event Recorded to abnormal data cluster middle, and ,in, Indicates the presence of a symbol, Indicates the total number of power anomaly events that occurred between the hth weakness scan and the h+1th weakness scan;

[0037] Based on the abnormal data cluster, the first risk correlation between any two fault attribute codes is analyzed and calculated. The formula is as follows:

[0038] ;

[0039] In the formula, represents the qth fault attribute code, and q≠e, Indicates the total number of power anomaly events that occurred between the h-1th vulnerability scan and the hth vulnerability scan. Indicates fault attribute code Fault attribute code The first risk correlation between Indicates fault attribute code The corresponding abnormal data clusters are Indicates abnormal data clusters With abnormal data clusters The number of power anomaly events contained in the intersection set, Indicates the number of power abnormal events contained in the union set between abnormal data clusters, and the abnormal data clusters are formed in sequence corresponding to all fault attribute codes fed back from the hth weakness scan to the h+1th weakness scan;

[0040] According to the above aspects, with the fault attribute code as the center, all fault attribute codes that occur when each weakness scan is performed irregularly are recorded, and by only scanning power abnormality events within an irregular range, the related fault attribute codes can be quickly found, that is, the analysis model of the first dangerous correlation. The numerator calculates the number of the same power abnormality events between the two fault attribute codes, and the denominator limits the scanned data range to an irregular range, and removes redundant data by means of union. The larger the first dangerous correlation, the higher the correlation between the two fault attribute codes within an irregular range.

[0041] Furthermore, the specific implementation process of step S300 includes:

[0042] Based on the first risk correlation, in the case of irregular execution of vulnerability scans in the history process, the second risk correlation between any two fault attribute codes is analyzed and calculated. The formula is as follows:

[0043] ;

[0044] In the formula, Indicates fault attribute code Fault attribute code The second risk correlation between , H represents the total number of vulnerability scans, V represents the average value of the first risk correlation, represents the variance of the first hazard correlation;

[0045] Preset relevant threshold, if the second risk relevance If it is greater than or equal to the relevant threshold, the fault attribute code is determined Fault attribute code Fault linkage behavior occurs between them;

[0046] According to the above method, the second risk correlation analysis model is based on the stable probability of the first risk correlation of the two fault attribute codes in each irregular situation. The larger the second risk correlation is, the longer-term fault linkage behavior of the two fault attribute codes exists.

[0047] Furthermore, the specific implementation process of step S400 includes:

[0048] Overall fault attribute code All fault linkage objects are collected and a hidden danger linkage troubleshooting list is generated, recorded as ; Real-time acquisition of all fault attribute codes fed back during the current weakness scan, and generation of a real-time fault list recorded as ;

[0049] If hidden dangers are linked to the investigation list With real-time fault list If the intersection set is not an empty set, the fault attribute code is locked. , and lock the fault attribute code Sent to the defense response port;

[0050] According to the above method, boundary calibration is performed in the form of a hidden danger linkage inspection list, which greatly reduces the time for current weakness scanning, matches the current fault attribute code with the fault attribute code of long-term fault linkage behavior, and improves the accuracy of power defense response.

[0051] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: in a power information management system and method based on digital twins provided by the present invention, each power abnormal event is fed back through the digital twin of the power facility; weakness scans are performed on power abnormal events at irregular intervals, and the fault attribute codes fed back by each power abnormal event are scanned to integrate each power abnormal event and record them in the abnormal data cluster; the first hazard correlation between any two fault attribute codes is analyzed and calculated, and based on the first hazard correlation, in the historical process of irregularly performing weakness scans, the second hazard correlation between any two fault attribute codes is analyzed and calculated to determine the fault linkage behavior relationship between the fault attribute codes; based on the fault linkage behavior relationship, a hidden danger linkage troubleshooting list is generated; based on the hidden danger linkage troubleshooting list, a real-time defense response is performed; and further, while realizing the boundary calibration of the weakness scan, the time of the weakness scan is reduced, thereby improving the efficiency of the power defense response. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0053] Figure 1 It is a structural schematic diagram of a power information management system based on digital twins of the present invention;

[0054] Figure 2 It is a schematic diagram of the steps of a power information management method based on digital twins of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] See also Figure 1 , in the first embodiment: a power information management system based on digital twin is provided, the system comprising: a data storage module, a data summarization and analysis module, a weakness linkage analysis module and a defense response module;

[0057] The data storage module uses the digital twin of the power facilities to feedback various power abnormal events and uniformly encode the power abnormal events; divides the storage space according to the fault attribute code, and the storage space is used to store various abnormal data clusters;

[0058] Preferably, the data storage module includes a coding unit and a storage space unit;

[0059] The encoding unit is used to record any i-th power abnormality event as , based on the power abnormality event, a fault attribute code is compiled. The fault attribute is a keyword describing the power abnormality event. The types of fault attributes include equipment type, fault type and fault location. Among them, one fault attribute corresponds to one fault attribute code, and one fault attribute code has a unique coding value;

[0060] Storage space unit, used to record any e-th fault attribute code as , where r represents the type serial number of the fault attribute, r∈[1,3], when r=1 it represents the device type, when r=2 it represents the fault type, and when r=3 it represents the fault location; based on the fault attribute code, the storage space is divided and the fault attribute code is The corresponding divided storage space is recorded as ;

[0061] The data summarization and analysis module is used to perform weakness scans on power abnormal events from time to time, scan the fault attribute codes fed back by each power abnormal event, and integrate each power abnormal event through the fault attribute code, and record it into the abnormal data cluster; based on the abnormal data cluster, analyze and calculate the first risk correlation between any two fault attribute codes;

[0062] Preferably, the data summarization and analysis module includes an abnormal data classification and recording unit and a first risk correlation analysis unit;

[0063] The abnormal data classification recording unit is used to coordinate the fault attribute codes of all power abnormal events that occurred between the hth weakness scan and the h+1th weakness scan. There is a fault attribute code in the feedback , then the power abnormal event Recorded to abnormal data cluster middle, and ,in, Indicates the presence of a symbol, Indicates the total number of power anomaly events that occurred between the hth weakness scan and the h+1th weakness scan;

[0064] The first risk correlation analysis unit analyzes and calculates the first risk correlation between any two fault attribute codes based on the abnormal data cluster. The formula is as follows:

[0065] ;

[0066] In the formula, represents the qth fault attribute code, and q≠e, Indicates the total number of power anomaly events that occurred between the h-1th vulnerability scan and the hth vulnerability scan. Indicates fault attribute code Fault attribute code The first risk correlation between Indicates fault attribute code The corresponding abnormal data clusters are Indicates abnormal data clusters With abnormal data clusters The number of power anomaly events contained in the intersection set, The number of power abnormal events included in the union set between abnormal data clusters is represented, and all fault attribute codes fed back from the hth weakness scan to the h+1th weakness scan of the abnormal data cluster are formed in sequence;

[0067] The weakness linkage analysis module analyzes and calculates the second risk correlation between any two fault attribute codes based on the first risk correlation and determines the fault linkage behavior relationship between the fault attribute codes in the case of irregularly executing the historical process of weakness scanning;

[0068] Preferably, the weakness linkage analysis module includes a second risk correlation analysis unit and a linkage behavior determination unit;

[0069] The second risk correlation analysis unit, based on the first risk correlation, analyzes and calculates the second risk correlation between any two fault attribute codes in the case of irregularly performing the historical process of vulnerability scanning, and the formula is as follows:

[0070] ;

[0071] In the formula, Indicates fault attribute code Fault attribute code The second risk correlation between , H represents the total number of vulnerability scans, V represents the average value of the first risk correlation, represents the variance of the first hazard correlation;

[0072] The linkage behavior determination unit is used to preset a relevant threshold value. If the second risk correlation If it is greater than or equal to the relevant threshold, the fault attribute code is determined Fault attribute code Fault linkage behavior occurs between them;

[0073] The defense response module generates a hidden danger linkage troubleshooting list based on the fault linkage behavior relationship; based on the hidden danger linkage troubleshooting list, it performs real-time defense response;

[0074] Preferably, the defense response module includes a hidden danger list unit and a defense response execution unit;

[0075] Hidden danger list unit, used to coordinate fault attribute codes All fault linkage objects are collected and a hidden danger linkage troubleshooting list is generated, recorded as ; Real-time acquisition of all fault attribute codes fed back during the current weakness scan, and generation of a real-time fault list recorded as ;

[0076] Defense response execution unit, obtains hidden danger linkage investigation list through matching With real-time fault list The intersection set is not an empty set to lock the fault attribute code , and lock the fault attribute code Sent to the defense response port.

[0077] See also Figure 2 In the second embodiment, a power information management method based on digital twin is provided, and the method comprises the following steps:

[0078] Step S100: Feedback various power abnormal events through the digital twin of the power facility, and uniformly encode the power abnormal events; divide the storage space according to the fault attribute code, and the storage space is used to store various abnormal data clusters;

[0079] For example, any i-th power abnormality event is recorded as , based on the power abnormality event, a fault attribute code is compiled. The fault attribute is a keyword describing the power abnormality event. The types of fault attributes include equipment type, fault type and fault location. Among them, one fault attribute corresponds to one fault attribute code, and one fault attribute code has a unique coding value;

[0080] Let any e-th fault attribute code be , where r represents the type serial number of the fault attribute, r∈[1,3], when r=1 it represents the device type, when r=2 it represents the fault type, and when r=3 it represents the fault location; based on the fault attribute code, the storage space is divided and the fault attribute code is The corresponding divided storage space is recorded as ;

[0081] For example, the fault attribute codes include: equipment type code, D01 (transformer), D02 (circuit breaker), etc.; fault type code, F01 (overload), F02 (short circuit), etc.; location code, L01 (substation A), L02 (transmission line B), etc.

[0082] Step S200: irregularly scan the power abnormality events for weaknesses, scan the fault attribute codes fed back by each power abnormality event, integrate each power abnormality event by the fault attribute code, and record it into an abnormal data cluster; based on the abnormal data cluster, analyze and calculate the first risk correlation between any two fault attribute codes;

[0083] For example, the fault attribute codes of all power abnormal events that occurred between the hth weakness scan and the h+1th weakness scan are coordinated. If the power abnormal event There is a fault attribute code in the feedback , then the power abnormal event Recorded to abnormal data cluster middle, and ,in, Indicates the presence of a symbol, Indicates the total number of power anomaly events that occurred between the hth weakness scan and the h+1th weakness scan;

[0084] Based on the abnormal data cluster, the first risk correlation between any two fault attribute codes is analyzed and calculated. The formula is as follows:

[0085] ;

[0086] In the formula, represents the qth fault attribute code, and q≠e, Indicates the total number of power anomaly events that occurred between the h-1th vulnerability scan and the hth vulnerability scan. Indicates fault attribute code Fault attribute code The first risk correlation between Indicates fault attribute code The corresponding abnormal data clusters are Indicates abnormal data clusters With abnormal data clusters The number of power anomaly events contained in the intersection set, It represents the number of power abnormal events contained in the union set between abnormal data clusters and all fault attribute codes fed back from the hth weakness scan to the h+1th weakness scan of the abnormal data cluster are formed in sequence.

[0087] Step S300: Based on the first risk correlation, in the case of the historical process of irregularly executing the vulnerability scan, the second risk correlation between any two fault attribute codes is analyzed and calculated, and the fault linkage behavior relationship between the fault attribute codes is determined;

[0088] Exemplarily, based on the first risk correlation, in the case of an irregular historical process of performing vulnerability scanning, the second risk correlation between any two fault attribute codes is analyzed and calculated, and the formula is as follows:

[0089] ;

[0090] In the formula, Indicates fault attribute code Fault attribute code The second risk correlation between , H represents the total number of vulnerability scans, V represents the average value of the first risk correlation, represents the variance of the first hazard correlation;

[0091] Preset relevant threshold, if the second risk relevance If it is greater than or equal to the relevant threshold, the fault attribute code is determined Fault attribute code Fault linkage occurs between them.

[0092] Step S400: generating a hidden danger linkage troubleshooting list based on the fault linkage behavior relationship; and executing a real-time defense response based on the hidden danger linkage troubleshooting list;

[0093] Exemplary, coordinated fault attribute code All fault linkage objects are collected and a hidden danger linkage troubleshooting list is generated, recorded as ; Real-time acquisition of all fault attribute codes fed back during the current weakness scan, and generation of a real-time fault list recorded as ;

[0094] If hidden dangers are linked to the investigation list With real-time fault list If the intersection set is not an empty set, the fault attribute code is locked. , and lock the fault attribute code Sent to the defense response port.

[0095] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0096] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A power information management method based on digital twins, characterized in that: The method comprises the following steps: Step S100: Feedback various power abnormal events through the digital twin of the power facility, and uniformly encode the power abnormal events; divide the storage space according to the fault attribute code, and the storage space is used to store various abnormal data clusters; Step S200: irregularly performing weakness scans on power abnormal events, scanning the fault attribute codes fed back by each power abnormal event, integrating each power abnormal event by the fault attribute code, and recording them into the abnormal data cluster; based on the abnormal data cluster, analyzing and calculating the first risk correlation between any two fault attribute codes; Step S300: Based on the first risk correlation, in the case of the historical process of irregularly executing the vulnerability scan, the second risk correlation between any two fault attribute codes is analyzed and calculated, and the fault linkage behavior relationship between the fault attribute codes is determined; Step S400: Generate a hidden danger linkage troubleshooting list based on the fault linkage behavior relationship; and execute a real-time defense response based on the hidden danger linkage troubleshooting list.

2. The power information management method based on digital twin according to claim 1 is characterized in that: The specific implementation process of step S100 includes: Any ith power abnormality event is recorded as , based on the power abnormality event, compile a fault attribute code, the fault attribute is a keyword describing the power abnormality event, the types of the fault attribute include device type, fault type and fault location, wherein one fault attribute corresponds to one fault attribute code, and one fault attribute code has a unique coding value; Let any e-th fault attribute code be , where r represents the type serial number of the fault attribute, r∈[1,3], when r=1 it represents the device type, when r=2 it represents the fault type, and when r=3 it represents the fault location; based on the fault attribute code, the storage space is divided and the fault attribute code is The corresponding divided storage space is recorded as .

3. The power information management method based on digital twin according to claim 2 is characterized in that: The specific implementation process of step S200 includes: The fault attribute codes of all power abnormal events that occurred between the hth vulnerability scan and the h+1th vulnerability scan are coordinated. If the power abnormal event There is a fault attribute code in the feedback , then the power abnormal event Recorded to abnormal data cluster middle, and ,in, Indicates the presence of a symbol, Indicates the total number of power anomaly events that occurred between the hth weakness scan and the h+1th weakness scan; Based on the abnormal data cluster, the first risk correlation between any two fault attribute codes is analyzed and calculated. The formula is as follows: ； In the formula, represents the qth fault attribute code, and q≠e, Indicates the total number of power anomaly events that occurred between the h-1th vulnerability scan and the hth vulnerability scan. Indicates fault attribute code Fault attribute code The first risk correlation between Indicates fault attribute code The corresponding abnormal data clusters are Indicates abnormal data clusters With abnormal data clusters The number of power anomaly events contained in the intersection set, It represents the number of power abnormal events contained in the union set between abnormal data clusters, and all fault attribute codes fed back from the hth weakness scan to the h+1th weakness scan of the abnormal data cluster are formed in sequence.

4. The power information management method based on digital twin according to claim 3 is characterized in that: The specific implementation process of step S300 includes: Based on the first risk correlation, in the case of irregular execution of vulnerability scans in the history process, the second risk correlation between any two fault attribute codes is analyzed and calculated. The formula is as follows: ； In the formula, Indicates fault attribute code Fault attribute code The second risk correlation between , H represents the total number of vulnerability scans, V represents the average value of the first risk correlation, represents the variance of the first hazard correlation; Preset relevant threshold, if the second risk relevance If it is greater than or equal to the relevant threshold, the fault attribute code is determined Fault attribute code Fault linkage occurs between them.

5. The power information management method based on digital twin according to claim 4 is characterized in that: The specific implementation process of step S400 includes: Overall fault attribute code All fault linkage objects are collected and a hidden danger linkage troubleshooting list is generated, recorded as ; Real-time acquisition of all fault attribute codes fed back during the current weakness scan, and generation of a real-time fault list recorded as ; If hidden dangers are linked to the investigation list With real-time fault list If the intersection set is not an empty set, the fault attribute code is locked. , and lock the fault attribute code Sent to the defense response port.

6. A power information management system based on digital twins, characterized in that: The system includes: a data storage module, a data summarization and analysis module, a weakness linkage analysis module and a defense response module; The data storage module, through the digital twin of the power facility, feeds back each power abnormality event and uniformly encodes the power abnormality event; divides the storage space according to the fault attribute code, and the storage space is used to store each abnormal data cluster; The data summarization and analysis module is used to perform weakness scans on power abnormal events from time to time, scan the fault attribute codes fed back by each power abnormal event, and integrate each power abnormal event through the fault attribute code, and record it into the abnormal data cluster; based on the abnormal data cluster, analyze and calculate the first risk correlation between any two fault attribute codes; The weakness linkage analysis module analyzes and calculates the second risk correlation between any two fault attribute codes based on the first risk correlation and determines the fault linkage behavior relationship between the fault attribute codes in the case of an irregular historical process of performing weakness scanning; The defense response module generates a hidden danger linkage checklist based on the fault linkage behavior relationship; and executes a real-time defense response based on the hidden danger linkage checklist.

7. The power information management system based on digital twin according to claim 6 is characterized in that: The data storage module includes a coding unit and a storage space unit; The encoding unit is used to record any i-th power abnormality event as , based on the power abnormality event, compile a fault attribute code, the fault attribute is a keyword describing the power abnormality event, the types of the fault attribute include device type, fault type and fault location, wherein one fault attribute corresponds to one fault attribute code, and one fault attribute code has a unique coding value; The storage space unit is used to record any e-th fault attribute code as , where r represents the type serial number of the fault attribute, r∈[1,3], when r=1 it represents the device type, when r=2 it represents the fault type, and when r=3 it represents the fault location; based on the fault attribute code, the storage space is divided and the fault attribute code is The corresponding divided storage space is recorded as .

8. The power information management system based on digital twin according to claim 7 is characterized in that: The data summarization and analysis module includes an abnormal data classification and recording unit and a first risk correlation analysis unit; The abnormal data classification recording unit is used to coordinate the fault attribute codes of all power abnormal events that occurred between the hth weakness scan and the h+1th weakness scan. There is a fault attribute code in the feedback , then the power abnormal event Recorded to abnormal data cluster middle, and ,in, Indicates the presence of a symbol, Indicates the total number of power anomaly events that occurred between the hth weakness scan and the h+1th weakness scan; The first risk correlation analysis unit analyzes and calculates the first risk correlation between any two fault attribute codes based on the abnormal data cluster, and the formula is as follows: ； In the formula, represents the qth fault attribute code, and q≠e, Indicates the total number of power anomaly events that occurred between the h-1th vulnerability scan and the hth vulnerability scan. Indicates fault attribute code Fault attribute code The first risk correlation between Indicates fault attribute code The corresponding abnormal data clusters are Indicates abnormal data clusters With abnormal data clusters The number of power anomaly events contained in the intersection set, It represents the number of power abnormal events contained in the union set between abnormal data clusters, and all fault attribute codes fed back from the hth weakness scan to the h+1th weakness scan of the abnormal data cluster are formed in sequence.

9. The power information management system based on digital twin according to claim 8, characterized in that: The weakness linkage analysis module includes a second risk correlation analysis unit and a linkage behavior determination unit; The second risk correlation analysis unit analyzes and calculates the second risk correlation between any two fault attribute codes based on the first risk correlation in the case of irregularly performing the historical process of vulnerability scanning, and the formula is as follows: ； In the formula, Indicates fault attribute code Fault attribute code The second risk correlation between , H represents the total number of vulnerability scans, V represents the average value of the first risk correlation, represents the variance of the first hazard correlation; The linkage behavior determination unit is used to preset a relevant threshold value. If the second risk correlation If it is greater than or equal to the relevant threshold, the fault attribute code is determined Fault attribute code Fault linkage occurs between them.

10. The power information management system based on digital twin according to claim 9, characterized in that: The defense response module includes a hidden danger list unit and a defense response execution unit; The hidden danger list unit is used to coordinate the fault attribute code All fault linkage objects are collected and a hidden danger linkage troubleshooting list is generated, recorded as ; Real-time acquisition of all fault attribute codes fed back during the current weakness scan, and generation of a real-time fault list recorded as ; The defense response execution unit obtains a hidden danger linkage investigation list through matching With real-time fault list The intersection set is not an empty set to lock the fault attribute code , and lock the fault attribute code Sent to the defense response port.

Images