Power network abnormal data monitoring system

Abstract

The invention discloses an abnormal data monitoring system for a power network. The abnormal data monitoring system comprises a port flow monitoring module, a flow data processing module, a data process identification module, a distribution processing module and an abnormal process processing module, the traffic data processing module is used for determining an abnormal time period when the interaction traffic is abnormal; the data process identification module is used for identifying process data corresponding to the interaction data in the abnormal time period; the distribution processing module is used for judging whether an abnormal process exists or not; the abnormal process processing module is used for performing pre-registration processing on the abnormal process according to signature items accepted by the power network abnormity monitoring system on the abnormal process, comparing the number of the signature items with the number of the registration items, and when the number of the signature items is inconsistent with the number of the registration items, executing the pre-registration processing on the abnormal process; and judging that the interaction data corresponding to the abnormal process is abnormal data. According to the invention, the overall judgment of the abnormal data of the power network can be more accurate.

Description

Technical Field

[0001] The present invention relates to the technical field of data anomaly detection, and in particular to a power network abnormal data monitoring system. Background Art

[0002] Power network security includes the deployment of network security equipment such as firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS) to prevent external attacks and malware intrusion. At the same time, encryption technology is used to protect the transmission and storage security of data; and vulnerability scanning and evaluation of power network systems are performed regularly to promptly discover and repair potential security vulnerabilities. At the same time, security management of software and hardware suppliers is strengthened to ensure the security of their products.

[0003] In the process of implementing specific security protection management, power network security generally monitors the interactive data of electricity based on the corresponding detection and protection software to assess whether there are security risks in the data. However, the original monitoring method is not comprehensive. When there are hidden startup items or registration items in some interactive data, they cannot be confirmed in real time, which leads to protection risks in the corresponding protection platform. Summary of the invention

[0004] The present invention provides a power network abnormal data monitoring system to solve the technical problem that the existing monitoring method is not comprehensive and some interactive data cannot be confirmed in real time when there are hidden startup items or registration items, resulting in protection risks in the corresponding protection platform.

[0005] In order to solve the above technical problems, an embodiment of the present invention provides a power network abnormal data monitoring system, including: a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module and an abnormal process processing module;

[0006] The port traffic monitoring module is used to monitor the interactive traffic of each interactive port in real time, and transmit the interactive traffic and interactive data of each interactive port to the traffic data processing module;

[0007] The traffic data processing module is used to determine whether the interactive traffic of each interactive port is abnormal. When it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal period to the data process identification module;

[0008] The data process identification module is used to identify the process data corresponding to the interaction data within the abnormal period, and transmit the process data to the allocation processing module;

[0009] The allocation processing module is used to determine whether there is an abnormal process according to the process data, and when it is determined that there is an abnormal process, transmit the abnormal process to the abnormal process processing module;

[0010] The abnormal process processing module is used to obtain the signature items recognized by the power network abnormality monitoring system for the abnormal process and the number of the signature items, and pre-register the abnormal process according to the signature items, obtain the registration items of the abnormal process and the number of the registration items, and then compare the number of the signature items with the number of the registration items. When the number of the signature items is inconsistent with the number of the registration items, it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0011] As a preferred solution, the abnormal process processing module is also used to obtain a first startup sequence associated with the signature items and a second startup sequence associated with the registration items when the number of the signature items is consistent with the number of the registration items, and compare the first startup sequence with the second startup sequence; when the first startup sequence is consistent with the second startup sequence, determine that the interaction data corresponding to the abnormal process is normal data; when the first startup sequence is inconsistent with the second startup sequence, determine that the interaction data corresponding to the abnormal process is abnormal data.

[0012] As a preferred solution, the abnormal process processing module is further configured to generate a corresponding data abnormality prompt when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0013] As a preferred solution, it also includes: a data display module;

[0014] The data display module is used to visually display the abnormal data and the abnormal process when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0015] As a preferred solution, the traffic data processing module is used to determine whether the interactive traffic of each interactive port is abnormal, and when it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal time period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal time period to the data process identification module, including:

[0016] The traffic data processing module is used to determine the median of the interaction traffic of each interaction port at each moment according to the interaction traffic of the interaction port;

[0017] According to the change of the median of the interaction traffic of the interaction port at different unit times before and after, it is judged whether the interaction traffic of the interaction port is abnormal. When it is determined that the interaction traffic of the interaction port is abnormal, the abnormal time period when the interaction traffic is abnormal is determined, and the interaction data in the abnormal time period is transmitted to the data process identification module.

[0018] As a preferred solution, judging whether the interactive traffic of the interactive port is abnormal according to the change of the median value of the interactive traffic of the interactive port at different times before and after, and when it is determined that the interactive traffic of the interactive port is abnormal, determining the abnormal time period when the interactive traffic is abnormal includes:

[0019] Calculate a first difference between the median of the interactive traffic of the interactive port at the current moment and the median of the interactive traffic at the previous unit moment, and a second difference between the median of the interactive traffic of the interactive port at the previous unit moment and the median of the interactive traffic of the previous two unit moments, compare the first difference with the second difference, and when the first difference is greater than the product of the second difference and a preset limit value, determine that the interactive traffic between the current moment and the previous unit moment is abnormal, and use the time period between the current moment and the previous unit moment as the abnormal time period when the interactive traffic is abnormal.

[0020] As a preferred solution, the data process identification module is used to identify the process data corresponding to the interaction data within the abnormal period and transmit the process data to the allocation processing module, including:

[0021] The data process identification module is used to use the data containing the process identifier in the interactive data within the abnormal period as corresponding process data according to a preset process identifier, and transmit the process data to the allocation processing module.

[0022] As a preferred solution, the allocation processing module is used to determine whether there is an abnormal process according to the process data, and when it is determined that there is an abnormal process, transmit the abnormal process to the abnormal process processing module, including:

[0023] The allocation processing module is used to identify the data capacity of each process data and obtain the data capacity ratio between the process data according to the data capacity;

[0024] Obtain the CPU unoccupied rate at the current moment, divide the unoccupied rate equally according to the data capacity ratio, allocate corresponding process data to each process data for data processing, and record the processing rate corresponding to each process data at each moment during the data processing process;

[0025] For each process data, calculate the average processing rate corresponding to each moment of the process data during the data processing process to obtain the corresponding processing rate average;

[0026] According to the processing rate mean, it is determined whether the process corresponding to each process data is an abnormal process, and when it is determined that an abnormal process exists, the abnormal process is transmitted to the abnormal process processing module.

[0027] As a preferred solution, judging whether the process corresponding to each process data is an abnormal process according to the processing rate mean value includes:

[0028] Perform standard deviation processing on the mean of processing rate corresponding to all process data to obtain a standard deviation parameter;

[0029] The standard deviation parameter is compared with a preset value. When the standard deviation parameter is greater than the preset value, the largest processing rate mean among the processing rate means corresponding to all process data is eliminated, and the remaining processing rate means are re-processed with the standard deviation after elimination to obtain a new standard deviation parameter, and then the new standard deviation parameter is continued to be compared with the preset value until the standard deviation parameter is no greater than the preset value, and the process corresponding to the eliminated processing rate mean is treated as an abnormal process.

[0030] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0031] The present invention provides a power network abnormal data monitoring system, comprising: a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module and an abnormal process processing module; the port flow monitoring module is used to monitor the interactive flow of each interactive port in real time, and transmit the interactive flow and interactive data of each interactive port to the flow data processing module; the flow data processing module is used to determine whether the interactive flow of each interactive port is abnormal, and when it is determined that the interactive flow of an interactive port is abnormal, determine the abnormal time period when the interactive flow is abnormal, and transmit the interactive data in the abnormal time period to the data process identification module; the data process identification module is used to identify the interactive data corresponding to the abnormal time period The process data of the abnormal process is obtained by the power network abnormality monitoring system, and the process data is transmitted to the allocation processing module; the allocation processing module is used to determine whether there is an abnormal process according to the process data, and when it is determined that there is an abnormal process, the abnormal process is transmitted to the abnormal process processing module; the abnormal process processing module is used to obtain the signature items recognized by the power network abnormality monitoring system for the abnormal process and the number of the signature items, and pre-register the abnormal process according to the signature items, obtain the registration items of the abnormal process and the number of the registration items, and then compare the number of the signature items with the number of the registration items. When the number of the signature items is inconsistent with the number of the registration items, it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0032] Different from the prior art, the present invention also includes an abnormal process processing module. After determining the abnormal process, the abnormal process processing module is used to obtain the signature items recognized by the power network abnormal monitoring system for the abnormal process and the number of the signature items, and the abnormal process is pre-registered according to the signature items to obtain the registration items of the abnormal process and the number of the registration items, and then the number of the signature items is compared with the number of the registration items. When the number of the signature items is inconsistent with the number of the registration items, the interaction data corresponding to the abnormal process is determined to be abnormal data. For the determined abnormal process, the registration items and signature items within such a process are correlated and compared to assess whether the specific number of items is consistent, so as to make a comprehensive judgment to assess whether such abnormal process has abnormal data, so as to avoid the problem that some interactive data cannot be confirmed when there are hidden startup items or registration items, resulting in the corresponding protection platform having protection risks, so that the overall judgment of abnormal data of the power network is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a structural schematic diagram of a power network abnormal data monitoring system provided by an embodiment of the present invention;

[0034] Figure 2 It is a schematic diagram of the evaluation process of data anomaly of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0037] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0038] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0039] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0040] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0041] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0042] Embodiment 1

[0043] Please refer to Figure 1 , is a schematic diagram of the structure of a power network abnormal data monitoring system provided by an embodiment of the present invention, comprising: a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module and an abnormal process processing module;

[0044] The port traffic monitoring module is used to monitor the interactive traffic of each interactive port in real time, and transmit the interactive traffic and interactive data of each interactive port to the traffic data processing module;

[0045] The traffic data processing module is used to determine whether the interactive traffic of each interactive port is abnormal. When it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal period to the data process identification module;

[0046] The data process identification module is used to identify the process data corresponding to the interaction data within the abnormal period, and transmit the process data to the allocation processing module;

[0047] The allocation processing module is used to determine whether there is an abnormal process according to the process data, and when it is determined that there is an abnormal process, transmit the abnormal process to the abnormal process processing module;

[0048] The abnormal process processing module is used to obtain the signature items recognized by the power network abnormality monitoring system for the abnormal process and the number of the signature items, and pre-register the abnormal process according to the signature items, obtain the registration items of the abnormal process and the number of the registration items, and then compare the number of the signature items with the number of the registration items. When the number of the signature items is inconsistent with the number of the registration items, it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0049] Specifically, the present invention provides a power network security management platform, including a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module, an abnormal process processing module and a data display module, wherein the port flow monitoring module, the flow data processing module, the data process identification module and the allocation processing module are electrically connected from the output node to the input node in sequence, and the data process identification module and the allocation processing module are both electrically connected to the abnormal process processing module input node, and the abnormal process processing module is electrically connected to the data display module input node. The working principle of each module is specifically described below:

[0050] (1) Port traffic monitoring module: monitors the interactive traffic of several ports that have data exchange with this platform in real time, and transmits the interactive traffic of different ports monitored in real time to the traffic data processing terminal. Specifically, each port has a corresponding transmission channel with this platform. When there is data exchange, the corresponding transmission channel will have related transmission interactive traffic.

[0051] Preferably, the traffic data processing module is used to determine whether the interactive traffic of each interactive port is abnormal; when it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal time period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal time period to the data process identification module, including: the traffic data processing module is used to determine, for each interactive port, the median value of the interactive traffic of the interactive port at each moment according to the interactive traffic of the interactive port; determine whether the interactive traffic of the interactive port is abnormal according to the change of the median value of the interactive traffic of the interactive port at different unit moments before and after; when it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal time period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal time period to the data process identification module.

[0052] Preferably, judging whether the interactive traffic of the interactive port is abnormal based on the change of the median value of the interactive traffic of the interactive port at different moments before and after, and when it is determined that the interactive traffic of the interactive port is abnormal, determining the abnormal time period when the interactive traffic is abnormal, includes: calculating a first difference between the median value of the interactive traffic of the interactive port at a current moment and the median value of the interactive traffic of a previous unit moment, and a second difference between the median value of the interactive traffic of the interactive port at a previous unit moment and the median value of the interactive traffic of the previous two unit moments, comparing the first difference with the second difference, and when the first difference is greater than the product of the second difference and a preset limit value, judging that the interactive traffic between the current moment and the previous unit moment is abnormal, and taking the time period between the current moment and the previous unit moment as the abnormal time period when the interactive traffic is abnormal.

[0053] (2) Traffic data processing module: Based on the different interactive traffic generated by each different port in real time, the median of the interactive traffic of the corresponding port is confirmed, and then based on the specific changes of the median at different times before and after, the traffic of the corresponding port is evaluated whether it is abnormal, and the abnormal period is locked. Specifically, the interactive traffic at different times is inconsistent. As long as the interactive traffic appears in more than two groups, the median of the corresponding interactive traffic can be determined. The specific method of evaluation is as follows:

[0054] For each different port, the different interactive traffic generated at different times is calibrated as Li, where i represents different times. Based on the real-time interactive traffic Li, the corresponding median Zz is confirmed, and the sum of the value differences between the interactive traffic below the median Zz and the median is confirmed and calibrated as the lower value difference sum, and the sum of the value differences between the interactive traffic above the median Zz and the median is confirmed and calibrated as the upper value difference sum. The confirmed value differences are all greater than 0, and the lower value difference sum of the median Zz at the corresponding time is equal to the upper value difference sum.

[0055] The median value Zz corresponding to the corresponding port at the corresponding time is marked as Zz i-k , where i represents different moments, k represents different ports, and identifies the median value Zz calibrated at the current moment i-k Is it abnormal?

[0056] Assume that the current time is j and j∈k, if Zz i-j -Zz i-(j-1) >(Zz i-(j-1) -Zz i-(j-2) )×C1, where C1 is the preset limit value, and Zz i-(j-1) is the median value corresponding to the unit time before the current time, and its Zz i-(j-2)The median value of the two unit moments before the current moment is determined by the operator based on experience, and C1 is generally set to 3. The period corresponding to the current moment and the previous moment is marked as the abnormal period. If the abnormal period continues to occur, several consecutive abnormal periods are integrated and re-marked. If Zz i-j -Zz i-(j-1) ≤(Zz i-(j-1) -Zz i-(j-2) )×C1, no calibration is performed. Then the port interaction data associated with the abnormal period is transmitted to the data process identification terminal.

[0057] Specifically, different ports have corresponding interactive traffic at different times. If the interactive traffic that appears is 10 and 12, and the median of 10 and 12 is 11, and the interactive traffic that appears again is 14, then the median between 10, 12 and 14 is 12. The median value changes with the subsequent real-time interactive traffic, so the median value can better display the overall numerical characteristics of several interactive traffics. When the adjacent medians are changing in correlation, it can be determined whether the traffic data change is abnormal, and then a comprehensive assessment is performed based on the specific determination results. Based on the subsequent specific comprehensive assessment results, the corresponding subsequent abnormal time period can be locked. The interactive data that is interacted exists in such abnormal time period. When the traffic is abnormal, it is caused by such interactive data. Therefore, in order to analyze whether such interactive data has security risks, it is sufficient to directly perform security analysis and management on the interactive data that appears in this time period.

[0058] Preferably, the data process identification module is used to identify the process data corresponding to the interaction data within the abnormal time period and transmit the process data to the allocation processing module, including: the data process identification module is used to identify the process data corresponding to the interaction data within the abnormal time period according to a preset process identifier, and take the data containing the process identifier in the interaction data within the abnormal time period as the corresponding process data, and transmit the process data to the allocation processing module.

[0059] (3) Data process identification module: Receive the determined interactive data, and identify the process data within such interactive data through the set process identifier, and simultaneously transmit the identified process data to the distribution processing center. Specifically, the included data process is the process that needs to be associated and processed, and its corresponding process data carries a related data identifier, and its data identifier is generally: …….exe. All related data with "…….exe" are marked as corresponding process data.

[0060] Preferably, the allocation processing module is used to determine whether there is an abnormal process based on the process data, and when it is determined that there is an abnormal process, the abnormal process is transmitted to the abnormal process processing module, including: the allocation processing module is used to identify the data capacity of each process data, and obtain the data capacity ratio between each process data based on the data capacity; obtain the CPU unoccupied rate at the current moment, divide the unoccupied rate according to the data capacity ratio, allocate corresponding process data to each process data for data processing, and record the processing rate corresponding to each process data at each moment in the data processing process; for each process data, calculate the average of the processing rates corresponding to the process data at each moment in the data processing process to obtain the corresponding processing rate average; based on the processing rate average, determine whether the process corresponding to each process data is an abnormal process, and when it is determined that there is an abnormal process, transmit the abnormal process to the abnormal process processing module.

[0061] Preferably, judging whether the process corresponding to each process data is an abnormal process based on the processing rate mean includes: performing standard deviation processing on the processing rate means corresponding to all process data to obtain a standard deviation parameter; comparing the standard deviation parameter with a preset value, and when the standard deviation parameter is greater than the preset value, eliminating the largest processing rate mean among the processing rate means corresponding to all process data, and re-performing standard deviation processing on the remaining processing rate means after elimination to obtain a new standard deviation parameter, and then continuing to compare the new standard deviation parameter with the preset value until the standard deviation parameter is no greater than the preset value, and treating the process corresponding to the eliminated processing rate mean as an abnormal process.

[0062] (4) Allocation processing module: Based on the identified process data and the CPU's unoccupied rate, the CPU's computing power resources are evenly divided, and based on the even division result, the processing rate of each group of process data is analyzed and processed to assess whether there are abnormal processes, and the assessed abnormal processes are transmitted to the abnormal process processing center. The specific method of performing the assessment is as follows:

[0063] The data capacity of the identified process data is calibrated as Rq, where q represents different process data. The data capacities of different process data are then ratio-processed to determine the capacity ratio sequence. For example, there are three groups of process data, and the data capacity of each group of process data is 20, 25, and 30 respectively; then the ratio of the three groups of data capacity is 20:25:30=4:5:6, and the capacity ratio sequence is 4:5:6.

[0064] Identify the CPU's unoccupied rate YL at the current moment, divide the unoccupied rate YL evenly according to the capacity ratio sequence, lock the occupancy rate Zq associated with each different process data, and reasonably allocate the CPU's internal computing resources based on the occupancy rate Zq to process the relevant process data (the processing process of each different process data is a processing process), and average the processing rate that appears in real time in the processing process (that is, in a processing process, the processing rate at the first moment is V1, and the processing rate at the second moment is V2, then the real-time processing rate and the processing rate that appeared before can be averaged to determine the corresponding processing rate average), and determine the processing rate average Vq of the corresponding processing process.

[0065] The different Vq corresponding to different processing processes are processed by standard deviation to determine the standard deviation parameter Fc. The variance processing method is: determine the mean of several Vq at the current moment and calibrate it as Vj, and q=1, 2,..., n, and use the corresponding standard deviation parameter Fc to determine the standard deviation parameter Fc. The determined standard deviation parameter Fc is checked with the preset correlation value Y1: if Fc>Y1, then a group is eliminated, where Y1 is a preset value, and its specific value is determined by the operator based on experience. A group of maximum processing rate Vq is eliminated, and then the variance parameters Fc of the remaining several processing rates are identified to see whether they meet: Fc≤Y1. If it is still not satisfied, then a group of minimum processing rates are eliminated, and so on. If it is still not satisfied subsequently, the maximum or minimum processing rate is eliminated in turn until it is satisfied and stops. If Fc≤Y1, continue monitoring. If Fc>Y1 does not appear, it means that the interaction data is normal data.

[0066] The process data associated with the eliminated processing process is marked as an abnormal process, and the marked abnormal process is transmitted to an abnormal process processing center.

[0067] Specifically, if there are three groups of process data, namely A, B and C, with RA = 20M, RB = 25M, RC = 30M, and each different process data corresponds to a different data capacity, and the CPU unoccupied rate is 75%, 20% of the computing power resources are allocated to process data A, 25% of the computing power resources are allocated to process data B, and 30% of the computing power resources are allocated to process data B. Because different process data belong to the same type of interactive data, when the computing power is allocated more evenly, the processing rate of the process data is almost the same, then the standard deviation of the processing rate is small, so Numerical assessment can be performed. If the standard deviation is large, it means that a certain type of processing rate has a large value or other situations, and there is a process abnormality, which means that there is a related hidden process in the corresponding process data, which may be virus data. When such process data is fully registered and then started, the processing rate of such process data is faster than other values ​​when it is processed. Because some processes are hidden but still occupy relevant data capacity, the computing power resources are more than other process data, so the processing rate is faster, and this type of processing method can be used to lock the relevant abnormal process.

[0068] Preferably, the abnormal process processing module is also used to obtain a first startup sequence associated with the signature items and a second startup sequence associated with the registration items when the number of the signature items is consistent with the number of the registration items, and compare the first startup sequence with the second startup sequence; when the first startup sequence is consistent with the second startup sequence, determine that the interaction data corresponding to the abnormal process is normal data; when the first startup sequence is inconsistent with the second startup sequence, determine that the interaction data corresponding to the abnormal process is abnormal data.

[0069] Preferably, the abnormal process processing module is further used to generate a corresponding data abnormality prompt when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0070] (5) Abnormal process processing module: please refer to Figure 2 , is a schematic diagram of the data anomaly assessment process of the present invention, wherein the abnormal process processing module identifies whether the signature item marked in the abnormal process is consistent with the actual number of registration items based on the determined abnormal process, and if they are consistent, the designated signature item and the startup item sorting in the corresponding registration item are analyzed to determine whether they are abnormal, and if they are not consistent, the abnormality determination is directly performed, and the abnormal signal is displayed through the corresponding data display terminal, wherein the specific method of identification is:

[0071] Perform preliminary processing on this abnormal process, determine the signature items recognized by this platform (when the platform receives this data, it will recognize the data based on the corresponding data protocol, and then sign it, which means that there is no problem with this type of data), and record the number of signature items GS1, perform pre-registration processing on this abnormal process, identify the registration items generated by this abnormal process, and record the number of registration items GS2 (when the relevant data is registered, registration items will be generated in the platform, and some hidden data will generate registration items by itself during the registration process, and such data will have related problems). If GS1=GS2, conduct subsequent analysis. If GS1≠GS2, generate a data abnormality signal, and display the data abnormality signal and this abnormal process through the data display terminal for external personnel to view;

[0072] The specific methods of subsequent analysis are as follows:

[0073] Select its signature item and the corresponding registration item, lock the startup sequence associated with its signature item, and then identify the startup sequence associated with its registration item to identify whether the two sets of startup sequences are consistent. If they are consistent, it means that there is no abnormality in this abnormal process and no processing is required. If they are inconsistent, it means that there is a self-starting item in the registration item (that is, a related startup item that has not been approved by the platform), and a data anomaly signal is directly generated.

[0074] Preferably, it also includes: a data display module; the data display module is used to visually display the abnormal data and the abnormal process when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0075] (6) Data display module: when it is determined that the interaction data corresponding to the abnormal process is abnormal data, the abnormal data and the abnormal process are visually displayed.

[0076] It can be seen that the present invention provides a power network abnormal data monitoring system. The present invention monitors the network traffic data of the corresponding port, and based on the specific results of real-time monitoring, locks the corresponding median, and then evaluates whether the median changes abnormally based on the associated changes of the median. Based on the specific evaluation results, the abnormal data is locked, and the abnormal processes associated with such abnormal data are initially processed to identify whether there are related abnormalities in the processing rate of such abnormal data in the actual processing process. Based on the specific identification results, it is determined whether there are discrete abnormalities in the corresponding processing rate, which can more accurately identify abnormal processes and simultaneously ensure the identification rate of abnormal processes.

[0077] Subsequently, for the identified abnormal processes, the registration items and signature items within such processes are correlated and compared to assess whether the specific number of items is consistent. If the number is consistent, the internal startup items are re-analyzed to assess whether the internal startup sequence is consistent, and a comprehensive judgment is made to assess whether such abnormal processes have abnormal data, making the overall judgment of the abnormal processes more accurate and comprehensive, and achieving better judgment and processing effects.

[0078] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A power network abnormal data monitoring system, characterized in that: include: Port traffic monitoring module, traffic data processing module, data process identification module, allocation processing module and abnormal process processing module; The port traffic monitoring module is used to monitor the interactive traffic of each interactive port in real time, and transmit the interactive traffic and interactive data of each interactive port to the traffic data processing module; The traffic data processing module is used to determine whether the interactive traffic of each interactive port is abnormal. When it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal period to the data process identification module; The data process identification module is used to identify the process data corresponding to the interaction data within the abnormal period, and transmit the process data to the allocation processing module; The allocation processing module is used to determine whether there is an abnormal process according to the process data, and when it is determined that there is an abnormal process, transmit the abnormal process to the abnormal process processing module; The abnormal process processing module is used to obtain the signature items recognized by the power network abnormality monitoring system for the abnormal process and the number of the signature items, and pre-register the abnormal process according to the signature items, obtain the registration items of the abnormal process and the number of the registration items, and then compare the number of the signature items with the number of the registration items. When the number of the signature items is inconsistent with the number of the registration items, it is determined that the interaction data corresponding to the abnormal process is abnormal data.

2. The power network abnormal data monitoring system according to claim 1, characterized in that: The abnormal process processing module is also used to, when the number of the signature items is consistent with the number of the registration items, obtain a first startup sequence associated with the signature items and a second startup sequence associated with the registration items, compare the first startup sequence with the second startup sequence, and when the first startup sequence is consistent with the second startup sequence, determine that the interaction data corresponding to the abnormal process is normal data; when the first startup sequence is inconsistent with the second startup sequence, determine that the interaction data corresponding to the abnormal process is abnormal data.

3. The power network abnormal data monitoring system according to claim 2, characterized in that: The abnormal process processing module is further configured to generate a corresponding data abnormality prompt when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

4. The power network abnormal data monitoring system according to claim 1, characterized in that: Also includes: Data display module; The data display module is used to visually display the abnormal data and the abnormal process when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

5. The power network abnormal data monitoring system according to claim 1, characterized in that: The traffic data processing module is used to determine whether the interactive traffic of each interactive port is abnormal. When it is determined that the interactive traffic of an interactive port is abnormal, determine the abnormal period when the interactive traffic is abnormal, and transmit the interactive data in the abnormal period to the data process identification module, including: The traffic data processing module is used to determine the median of the interaction traffic of each interaction port at each moment according to the interaction traffic of the interaction port; According to the change of the median of the interaction traffic of the interaction port at different unit times before and after, it is judged whether the interaction traffic of the interaction port is abnormal. When it is determined that the interaction traffic of the interaction port is abnormal, the abnormal time period when the interaction traffic is abnormal is determined, and the interaction data in the abnormal time period is transmitted to the data process identification module.

6. The power network abnormal data monitoring system according to claim 5, characterized in that: The step of judging whether the interactive traffic of the interactive port is abnormal according to the change of the median value of the interactive traffic of the interactive port at different times before and after, and when it is determined that the interactive traffic of the interactive port is abnormal, determining the abnormal time period when the interactive traffic is abnormal includes: Calculate a first difference between the median of the interactive traffic of the interactive port at the current moment and the median of the interactive traffic at the previous unit moment, and a second difference between the median of the interactive traffic of the interactive port at the previous unit moment and the median of the interactive traffic of the previous two unit moments, compare the first difference with the second difference, and when the first difference is greater than the product of the second difference and a preset limit value, determine that the interactive traffic between the current moment and the previous unit moment is abnormal, and use the time period between the current moment and the previous unit moment as the abnormal time period when the interactive traffic is abnormal.

7. The power network abnormal data monitoring system according to claim 1, characterized in that: The data process identification module is used to identify the process data corresponding to the interaction data within the abnormal period and transmit the process data to the allocation processing module, including: The data process identification module is used to use the data containing the process identifier in the interactive data within the abnormal period as corresponding process data according to a preset process identifier, and transmit the process data to the allocation processing module.

8. The power network abnormal data monitoring system according to claim 1, characterized in that: The allocation processing module is used to determine whether there is an abnormal process according to the process data, and when it is determined that there is an abnormal process, transmit the abnormal process to the abnormal process processing module, including: The allocation processing module is used to identify the data capacity of each process data and obtain the data capacity ratio between the process data according to the data capacity; Obtain the CPU unoccupied rate at the current moment, divide the unoccupied rate equally according to the data capacity ratio, allocate corresponding process data to each process data for data processing, and record the processing rate corresponding to each process data at each moment during the data processing process; For each process data, calculate the average processing rate corresponding to each moment of the process data during the data processing process to obtain the corresponding processing rate average; According to the processing rate mean, it is determined whether the process corresponding to each process data is an abnormal process, and when it is determined that an abnormal process exists, the abnormal process is transmitted to the abnormal process processing module.

9. The power network abnormal data monitoring system according to claim 8, characterized in that: The determining, based on the processing rate mean, whether the process corresponding to each process data is an abnormal process includes: Perform standard deviation processing on the mean of processing rate corresponding to all process data to obtain a standard deviation parameter; The standard deviation parameter is compared with a preset value. When the standard deviation parameter is greater than the preset value, the largest processing rate mean among the processing rate means corresponding to all process data is eliminated, and the remaining processing rate means are re-processed with the standard deviation after elimination to obtain a new standard deviation parameter, and then the new standard deviation parameter is continued to be compared with the preset value until the standard deviation parameter is not greater than the preset value, and the process corresponding to the eliminated processing rate mean is treated as an abnormal process.

Images