An electric power network anomaly data monitoring system

Abstract

The application discloses a kind of electric power network abnormal data monitoring systems, comprising: port flow monitoring module, flow data processing module, data process identification module, distribution processing module and abnormal process processing module;Flow data processing module is used to determine the abnormal period when interactive flow appears abnormal;Data process identification module is used to identify the process data corresponding to interactive data in the abnormal period;Distribution processing module is used to judge whether there is abnormal process;Abnormal process processing module is used to pre-register the abnormal process according to the signature item recognized by the electric power network abnormal monitoring system to the abnormal process, compare the number of the signature item with the number of the registered item, when the number of the signature item is inconsistent with the number of the registered item, determine that the interactive data corresponding to the abnormal process is abnormal data.Through the application, the overall determination of electric power network abnormal data can be more accurate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data anomaly detection, and particularly relates to a power network abnormal data monitoring system. BACKGROUND

[0002] Power network security includes deploying network security devices such as firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS) to prevent external attacks and malicious software intrusion. At the same time, encryption technology is used to protect the transmission and storage of data security; and the power network system is scanned and evaluated regularly to discover and repair potential security vulnerabilities in a timely manner. At the same time, the security management of software and hardware suppliers is strengthened to ensure the security of their products.

[0003] In the process of performing specific security protection management, the power network security generally monitors the interaction data of the power based on the corresponding detection protection software to evaluate whether the data has security risks. However, in the original monitoring mode, the monitoring process is not comprehensive, and some interaction data has hidden startup items or registration items, which cannot be confirmed in real time, resulting in protection risks of the corresponding protection platform. SUMMARY

[0004] The present application provides a power network abnormal data monitoring system to solve the technical problem that the existing monitoring mode is not comprehensive, some interaction data has hidden startup items or registration items, which cannot be confirmed in real time, resulting in protection risks of the corresponding protection platform.

[0005] In order to solve the above technical problem, the present application provides a power network abnormal data monitoring system, comprising: a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module and an abnormal process processing module.

[0006] The port flow monitoring module is used for monitoring the interaction flow of each interaction port in real time, and transmitting the interaction flow and interaction data of each interaction port to the flow data processing module.

[0007] The flow data processing module is used for judging whether the interaction flow of each interaction port is abnormal, determining the abnormal period when the interaction flow of the interaction port is abnormal when it is determined that the interaction flow of the interaction port is abnormal, and transmitting the interaction data in the abnormal period to the data process identification module.

[0008] The data process identification module is used for identifying the process data corresponding to the interaction data in the abnormal period, and transmitting the process data to the allocation processing module.

[0009] The distribution processing module is configured to determine whether there is an abnormal process according to the process data, and transmit the abnormal process to the abnormal process processing module when it is determined that there is an abnormal process.

[0010] The abnormal process processing module is configured to acquire a signature item and a number of the signature item of the abnormal process recognized by the power network abnormality monitoring system, and pre-register the abnormal process according to the signature item to acquire a registration item and a number of the registration item, and then compare the number of the signature item with the number of the registration item, and determine that the interaction data corresponding to the abnormal process is abnormal data when the number of the signature item is inconsistent with the number of the registration item.

[0011] As a preferred solution, the abnormal process processing module is further configured to acquire a first start sequence associated with the signature item and a second start sequence associated with the registration item when the number of the signature item is consistent with the number of the registration item, compare the first start sequence with the second start sequence, and determine that the interaction data corresponding to the abnormal process is normal data when the first start sequence is consistent with the second start sequence, and determine that the interaction data corresponding to the abnormal process is abnormal data when the first start sequence is inconsistent with the second start sequence.

[0012] As a preferred solution, the abnormal process processing module is further configured to generate a corresponding data abnormality prompt when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0013] As a preferred solution, the method further comprises a data display module.

[0014] The data display module is configured to visually display the abnormal data and the abnormal process when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0015] As a preferred solution, the traffic data processing module is configured to determine whether the interaction traffic of each interaction port is abnormal, determine an abnormal time period when the interaction traffic is abnormal when it is determined that the interaction traffic of an interaction port is abnormal, and transmit the interaction data in the abnormal time period to the data process identification module, comprising:

[0016] The traffic data processing module is configured to determine, for each interaction port, an interaction traffic median of the interaction port at each time according to the interaction traffic of the interaction port.

[0017] According to the change of the interaction flow median value of the interaction port at different unit time points, it is determined whether the interaction flow of the interaction port is abnormal, when it is determined that the interaction flow of the interaction port is abnormal, the abnormal time period when the interaction flow is abnormal is determined, and the interaction data in the abnormal time period is transmitted to the data process identification module.

[0018] As a preferred solution, according to the change of the interaction flow median value of the interaction port at different unit time points, it is determined whether the interaction flow of the interaction port is abnormal, when it is determined that the interaction flow of the interaction port is abnormal, the abnormal time period when the interaction flow is abnormal is determined, and the interaction data in the abnormal time period is transmitted to the data process identification module.

[0019] The first difference value between the interaction flow median value of the interaction port at the current time point and the interaction flow median value at the previous unit time point is calculated, and the second difference value between the interaction flow median value of the interaction port at the previous unit time point and the interaction flow median value at the previous two unit time points is calculated. When the first difference value is greater than the product of the second difference value and a preset limit value, it is determined that the interaction flow between the current time point and the previous unit time point is abnormal, and the time period between the current time point and the previous unit time point is taken as the abnormal time period when the interaction flow is abnormal.

[0020] As a preferred solution, the data process identification module is used to identify the process data corresponding to the interaction data in the abnormal time period, and transmit the process data to the allocation processing module, comprising:

[0021] The data process identification module is used to identify the process data corresponding to the interaction data in the abnormal time period, and transmit the process data to the allocation processing module, comprising:

[0022] As a preferred solution, the allocation processing module is used to determine whether there is an abnormal process according to the process data, when it is determined that there is an abnormal process, the abnormal process is transmitted to the abnormal process processing module, comprising:

[0023] The allocation processing module is used to identify the data capacity of each process data, and obtain the data capacity ratio between each process data according to the data capacity;

[0024] The unoccupied rate of the CPU at the current time point is obtained, the unoccupied rate is divided according to the data capacity ratio, each process data is allocated with corresponding process data for data processing, and the processing rate corresponding to each time point in the data processing process of each process data is recorded;

[0025] For each process data, the average value of the processing rate corresponding to each time point in the data processing process of the process data is calculated to obtain the corresponding processing rate average value;

[0026] According to the processing rate average, it is judged whether the process corresponding to each process data is an abnormal process, and when it is determined that there is an abnormal process, the abnormal process is transmitted to the abnormal process processing module.

[0027] As a preferred solution, according to the processing rate average, it is judged whether the process corresponding to each process data is an abnormal process, including:

[0028] The processing rate average corresponding to all process data is subjected to standard deviation processing to obtain a standard deviation parameter;

[0029] The standard deviation parameter is compared with a preset value, when the standard deviation parameter is greater than the preset value, the largest processing rate average in the processing rate average corresponding to all process data is removed, and after the removal, the remaining processing rate average is subjected to standard deviation processing again to obtain a new standard deviation parameter, and then the new standard deviation parameter is continuously compared with the preset value until the standard deviation parameter is not greater than the preset value, and the process corresponding to the removed processing rate average is taken as an abnormal process.

[0030] Compared with the prior art, the embodiment of the present application has the following beneficial effects:

[0031] The present application provides a kind of electric power network abnormal data monitoring system, including: port flow monitoring module, flow data processing module, data process identification module, distribution processing module and abnormal process processing module;The port flow monitoring module is used to carry out real-time monitoring to the interactive flow of each interactive port, and the interactive flow and interactive data of each interactive port are transmitted to the flow data processing module;The flow data processing module is used to judge whether the interactive flow of each interactive port is abnormal, when it is determined that the interactive flow of interactive port appears abnormal, determine the abnormal period when interactive flow appears abnormal, and the interactive data in the abnormal period is transmitted to the data process identification module;The data process identification module is used to identify the process data corresponding to the interactive data in the abnormal period, and the process data is transmitted to the distribution processing module;The distribution processing module is used to judge whether there is abnormal process according to the process data, when it is determined that there is abnormal process, abnormal process is transmitted to the abnormal process processing module;The abnormal process processing module is used to obtain the signature item and the number of signature items that the electric power network abnormal monitoring system recognizes to the abnormal process, and according to the signature item, the abnormal process is pre-registered, and the registration item and the number of registration items of the abnormal process are obtained, and then the number of signature items and the number of registration items are compared, when the number of signature items and the number of registration items are inconsistent, it is determined that the interactive data corresponding to the abnormal process is abnormal data.

[0032] Unlike the prior art, the application also includes an abnormal process processing module. After determining the abnormal process, the abnormal process processing module is used to obtain the signature items and the number of the signature items recognized by the power network anomaly monitoring system for the abnormal process, and pre-register the abnormal process according to the signature items, obtain the registration items and the number of the registration items, and then compare the number of the signature items with the number of the registration items. When the number of the signature items is inconsistent with the number of the registration items, it is determined that the interaction data corresponding to the abnormal process is abnormal data. For the determined abnormal process, the registration items and the signature items in the process are associated and compared to determine whether the specific item numbers are consistent, thereby comprehensively determining whether the abnormal process has abnormal data, avoiding the problem that some hidden startup items or registration items cannot be confirmed, leading to a protection risk of the corresponding protection platform, and making the overall determination of the power network abnormal data more accurate. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a structural schematic diagram of a power network abnormal data monitoring system provided by an embodiment of the application;

[0034] Figure 2 is a data anomaly evaluation flowchart. DETAILED DESCRIPTION

[0035] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "include" and "have" and any variations thereof in the specification and claims of the present application and the above description of drawings are intended to cover non-exclusive inclusion.

[0037] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0038] Reference to“an embodiment” or“the embodiment” herein means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase“in one embodiment” or“in at least one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all directed to the same embodiment, or to a single alternative embodiment.

[0039] In the description of the embodiments of the application, the term“and / or” is merely used to describe an associated relationship between associated objects, that is, there can be three relationships, for example, A and / or B, which can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character“ / ” herein generally represents an“or” relationship between the front and rear associated objects.

[0040] In the description of the embodiments of the application, the term“a plurality of” refers to two or more (including two), and similarly, “a plurality of groups” refers to two or more groups (including two groups), and “a plurality of pieces” refers to two or more pieces (including two pieces).

[0041] In the description of the embodiments of the application, unless otherwise explicitly specified and limited, the technical terms“mounting”,“connection”,“connection”,“fixing” and the like should be understood in a broad sense, for example, it can be fixedly connected, or it can be detachably connected, or it can be integrated; it can be mechanical connection, or it can be electrical connection; it can be directly connected, or it can be indirectly connected through an intermediate medium; it can be the internal communication of two elements or the interaction relationship between two elements. For those skilled in the art, the specific meaning of the above terms in the embodiments of the application can be understood according to the specific circumstances.

[0042] Embodiment one

[0043] Please refer to Figure 1 A structural schematic diagram of an electric power network abnormal data monitoring system provided by an embodiment of the application, comprising: a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module, and an abnormal process processing module;

[0044] The port flow monitoring module is configured to monitor the interaction flow of each interaction port in real time, and transmit the interaction flow and interaction data of each interaction port to the flow data processing module.

[0045] The flow data processing module is configured to determine whether the interaction flow of each interaction port is abnormal, and when it is determined that the interaction flow of an interaction port is abnormal, determine an abnormal period when the interaction flow is abnormal, and transmit the interaction data in the abnormal period to the data process identification module.

[0046] The data process identification module is configured to identify process data corresponding to the interaction data in the abnormal period and transmit the process data to the allocation processing module.

[0047] The allocation processing module is configured to determine whether there is an abnormal process according to the process data, and transmit the abnormal process to the abnormal process processing module when it is determined that there is an abnormal process.

[0048] The abnormal process processing module is configured to acquire a signature item and a number of the signature item recognized by the power network abnormality monitoring system for the abnormal process, and pre-register the abnormal process according to the signature item to acquire a registration item and a number of the registration item, and then compare the number of the signature item with the number of the registration item, and determine that the interaction data corresponding to the abnormal process is abnormal data when the number of the signature item is inconsistent with the number of the registration item.

[0049] Specifically, the application provides a power network security management platform, which comprises a port flow monitoring module, a flow data processing module, a data process identification module, an allocation processing module, an abnormal process processing module and a data display module, wherein the port flow monitoring module, the flow data processing module, the data process identification module and the allocation processing module are electrically connected in sequence from an output node to an input node, the data process identification module and the allocation processing module are electrically connected with an input node of the abnormal process processing module, and the abnormal process processing module is electrically connected with an input node of the data display module. The working principles of the modules are described in detail as follows:

[0050] (1) The port flow monitoring module: real-time monitoring of the interaction flow of a plurality of ports that have data interaction with the platform, and transmitting the interaction flow of different ports monitored in real time to the flow data processing end. Specifically, each port has a corresponding transmission channel with the platform, and when there is data interaction, the corresponding transmission channel has related transmission interaction flow.

[0051] Preferably, the flow data processing module is configured to determine whether the interaction flow of each interaction port is abnormal, determine an abnormal period when the interaction flow is abnormal when it is determined that the interaction flow of an interaction port is abnormal, and transmit the interaction data in the abnormal period to the data process identification module. The flow data processing module is configured to determine the interaction flow median of each interaction port at each time according to the interaction flow of the interaction port, determine whether the interaction flow of the interaction port is abnormal according to the change of the interaction flow median of the interaction port at different unit times before and after, determine an abnormal period when the interaction flow is abnormal when it is determined that the interaction flow of an interaction port is abnormal, and transmit the interaction data in the abnormal period to the data process identification module.

[0052] Preferably, the method for judging whether the interactive traffic of the interactive port is abnormal according to the change of the median value of the interactive traffic of the interactive port at different time points comprises: calculating a first difference value between the median value of the interactive traffic of the interactive port at a current time point and the median value of the interactive traffic of the interactive port at a previous time point, and a second difference value between the median value of the interactive traffic of the interactive port at the previous time point and the median value of the interactive traffic of the interactive port at a time point two units of time before the previous time point; comparing the first difference value with the second difference value; and determining that the interactive traffic between the current time point and the previous time point is abnormal when the first difference value is greater than the product of the second difference value and a preset limit value, and taking the time period between the current time point and the previous time point as the abnormal time period when the interactive traffic is abnormal.

[0053] (2) The traffic data processing module: based on different interactive traffic generated by each different port in real time, confirming the median value of the interactive traffic of the corresponding port, and based on the specific change of the median value at different time points, evaluating whether the traffic of the corresponding port is abnormal, and locking the abnormal time period. Specifically, the interactive traffic at different time points is inconsistent. As long as the interactive traffic exceeds two groups, the median value of the corresponding interactive traffic can be determined, and the specific evaluation method is:

[0054] For each different port, different interactive traffic generated at different time points is marked as Li, where i represents different time points. Based on the interactive traffic Li generated in real time, the corresponding median value Zz is confirmed. The sum of the value difference of the interactive traffic below the median value Zz and the value of the median value is confirmed as the lower value difference sum. The sum of the value difference of the interactive traffic above the median value Zz and the value of the median value is confirmed and marked as the upper value difference sum. The confirmed value difference is greater than 0, and the lower value difference sum and the upper value difference sum of the median value Zz at the corresponding time point are equal.

[0055] The corresponding median value Zz of the corresponding port at the corresponding time point is marked as Zz i-k , where i represents different time points, k represents different ports, and the median value Zz marked at the current time point is identified i-k whether abnormal:

[0056] The current time point is j and j∈k. If Zz i-j -Zz i-（j-1） > (Zz i-（j-1） -Zz i-（j-2） ) × C1, where C1 is a preset limit value, and Zz i-（j-1） is the median value corresponding to the time point one unit of time before the current time point, and Zz i-（j-2）The median value corresponding to the previous two unit time of the current time, the specific value is determined by the operator according to experience, and C1 is generally 3. The time period corresponding to the current time and the previous time is marked as an abnormal time period. If the abnormal time period continues to appear, integrate several continuously appearing abnormal time periods, re-mark the abnormal time period, and if Zz i-j -Zz i-（j-1） ≤(Zz i-（j-1） -Zz i-（j-2） )×C1, do not perform any marking. Then the port interaction data associated with this abnormal time period is transmitted to the data process identification end.

[0057] Specifically, different ports have corresponding interaction flows at different times. If the interaction flows appearing are 10, 12, and the median value of 10 and 12 is 11, and the next interaction flow appearing is 14, then the median value between 10, 12 and 14 is 12. The median value changes with the subsequent real-time interaction flow. The median value can better show the overall numerical characteristics of several interaction flows. When the adjacent median values change, it can be determined whether the flow data changes abnormally. Based on the specific determination result, comprehensive evaluation is performed, and based on the subsequent specific comprehensive evaluation result, the subsequent corresponding abnormal time period can be locked. There is interaction data in such an abnormal time period. When the flow is abnormal, it is caused by such interaction data. Therefore, in order to analyze whether such interaction data has security risks, the interaction data appearing in this time period can be directly analyzed and managed for security.

[0058] Preferably, the data process identification module is configured to identify process data corresponding to the interaction data in the abnormal time period and transmit the process data to the allocation processing module, and the data process identification module is configured to identify data containing a process identifier in the interaction data in the abnormal time period as corresponding process data according to the process identifier, and transmit the process data to the allocation processing module.

[0059] (3) Data process identification module: receive the determined interaction data, and identify the process data inside the interaction data through the set process identifier. The identified process data is transmitted to the allocation processing center. Specifically, the data process is the process that needs to be associated with the process data. The process data has a related data identifier, and the data identifier is generally: ……exe. The related data with "……exe" is marked as corresponding process data.

[0060] Preferably, the allocation processing module is configured to determine whether there is an abnormal process according to the process data, and transmit the abnormal process to the abnormal process processing module when it is determined that there is an abnormal process, and the allocation processing module is configured to identify data capacities of the process data, and obtain data capacity ratios between the process data according to the data capacities; obtain an unoccupied rate of the CPU at a current time, divide the unoccupied rate according to the data capacity ratios, allocate corresponding process data to each process data for data processing, and record processing rates corresponding to each time in the data processing process of each process data; for each process data, calculate an average of the processing rates corresponding to each time in the data processing process of the process data to obtain a corresponding average processing rate; and determine whether the process corresponding to each process data is an abnormal process according to the average processing rate, and transmit the abnormal process to the abnormal process processing module when it is determined that there is an abnormal process.

[0061] Preferably, the determination of whether the process corresponding to each process data is an abnormal process according to the average processing rate comprises: performing standard deviation processing on the average processing rates corresponding to all process data to obtain a standard deviation parameter; comparing the standard deviation parameter with a preset value; when the standard deviation parameter is greater than the preset value, removing the largest average processing rate from the average processing rates corresponding to all process data, and performing standard deviation processing on the remaining average processing rates after the removal to obtain a new standard deviation parameter, and then continuing to compare the new standard deviation parameter with the preset value until the standard deviation parameter is not greater than the preset value, and regarding the process corresponding to the removed average processing rate as an abnormal process.

[0062] (4) The allocation processing module: based on the identified process data and the unoccupied rate of the CPU, the computing resource of the CPU is divided, and based on the division result, the processing rate of each group of process data is analyzed and processed to determine whether there is an abnormal process, and the determined abnormal process is transmitted to the abnormal process processing center, and the specific way of determination is:

[0063] The data capacities of the identified process data are denoted as Rq, where q represents different process data, and the data capacities of different process data are processed by ratio to determine a capacity ratio sequence, for example: it is assumed that there are three groups of process data, and the data capacities of each group of process data are 20, 25 and 30 respectively; then the ratio of the data capacities of the three groups is 20:25:30=4:5:6, and the capacity ratio sequence is 4:5:6.

[0064] Identify the current time CPU unoccupied rate YL, the unoccupied rate YL according to the capacity ratio sequence is divided, lock each different process data associated with the allocation of the occupancy rate Zq, and based on the occupancy rate Zq reasonable allocation of CPU internal computing power resources to process the relevant process data (each different process data processing process is a process), and the processing rate of its real-time processing process (that is, a processing process, the first time processing rate V1, the second time processing rate V2, then the real-time processing rate and the processing rate of the previous occurrence of the mean processing rate, determine the corresponding processing rate Vq.

[0065] The different Vq in different processing processes is processed by standard deviation, and the standard deviation parameter Fc is determined, and the variance processing method is: determine the mean of several Vq at the current time and mark it as Vj, and q=1, 2, …, n, determine the corresponding standard deviation parameter Fc, and compare the determined standard deviation parameter Fc with the preset related value Y1: if Fc>Y1, remove a group, wherein Y1 is a preset value, its specific value is determined by the operator according to experience, remove a group of maximum processing rate Vq, and then identify whether the variance parameter Fc of the remaining several processing rates satisfies Fc≤Y1, if it still does not satisfy, remove a group of minimum processing rate, and so on, if it still does not satisfy, remove the maximum or minimum processing rate in turn, until it satisfies, if Fc≤Y1, continue to monitor, if Fc>Y1 does not appear all the time, it represents that the interactive data is normal data.

[0066] The process data associated with the removed processing process is marked as an abnormal process, and the marked abnormal process is transmitted to the abnormal process processing center.

[0067] Specifically, if there are three sets of process data, A, B and C, respectively, with RA=20M, RB=25M and RC=30M, each different process data corresponds to a different data capacity, and the CPU unoccupied rate is 75%, 20% of the computing resource is allocated to A process data, 25% of the computing resource is allocated to B process data, and 30% of the computing resource is allocated to B process data. Since different process data belongs to the same type of interactive data, the computing resource allocation is relatively balanced, so the process data processing rate is almost the same, and the standard deviation generated by the processing rate is small, so numerical evaluation can be performed. If the standard deviation is large, it means that the numerical value of the process rate is large or other conditions exist, which means that there is an abnormal process, that is, there is a related hidden process in the corresponding process data, which may be virus data. When such process data is completely registered, it is started again. Therefore, the processing rate of such process data is faster than other numerical values during processing. Because part of the process is hidden, it still occupies relevant data capacity, so the computing resource is more than other process data, so the processing rate is faster. This processing method can be used to lock abnormal processes.

[0068] Preferably, the abnormal process processing module is further configured to, when the number of the signature items is consistent with the number of the registered items, acquire a first start sequence associated with the signature items and a second start sequence associated with the registered items, compare the first start sequence with the second start sequence, and determine that the interactive data corresponding to the abnormal process is normal data when the first start sequence is consistent with the second start sequence, and determine that the interactive data corresponding to the abnormal process is abnormal data when the first start sequence is inconsistent with the second start sequence.

[0069] Preferably, the abnormal process processing module is further configured to, when it is determined that the interactive data corresponding to the abnormal process is abnormal data, generate a corresponding data abnormality prompt.

[0070] (5) Abnormal process processing module: please refer to Figure 2 , the abnormal process processing module of the data abnormality evaluation process schematic diagram, based on the determined abnormal process, whether the number of the specified signature item and the actual registered item in the abnormal process is consistent, if consistent, the start item sorting in the specified signature item and the corresponding registered item is analyzed to determine whether it is abnormal, if not consistent, directly determine the abnormality, and the abnormal signal is displayed through the corresponding data display end, wherein the specific way of identification is:

[0071] The abnormal process is preliminarily processed, the signature item recognized by the platform is determined (the platform receives the data, and based on the corresponding data protocol, the data is recognized to be signed, so that the data is problem-free), and the number of signature items GS1 is recorded. The abnormal process is pre-registered, and the registration item generated by the abnormal process is identified and the number of registration items GS2 is recorded (the related data will generate a registration item in the platform when the registration process is performed, and some hidden data will generate a registration item in the registration process. Such data has related problems), if GS1 = GS2, subsequent analysis is performed, if GS1 ≠ GS2, a data exception signal is generated, and the data exception signal and the abnormal process are displayed through the data display end for external personnel to view.

[0072] The specific way of subsequent analysis is:

[0073] The signature item and the corresponding registration item are selected, the startup sequence associated in the signature item is locked, the startup sequence associated in the registration item is identified, whether the two groups of startup sequences are consistent is identified, if consistent, the abnormal process is normal and does not need to be processed, if inconsistent, a self-starting item (that is, a related starting item not approved by the platform) exists in the registration item, and a data exception signal is directly generated.

[0074] Preferably, it further comprises a data display module; the data display module is used for visualizing and displaying the abnormal data and the abnormal process when it is determined that the interaction data corresponding to the abnormal process is abnormal data.

[0075] (6) Data display module: when it is determined that the interaction data corresponding to the abnormal process is abnormal data, the abnormal data and the abnormal process are visualized and displayed.

[0076] As can be seen, the present application provides an electric power network abnormal data monitoring system. The present application monitors the network flow data of the corresponding port, locks the corresponding median based on the specific results of real-time monitoring, evaluates whether the median is abnormal based on the associated changes of the median, locks the abnormal data based on the specific evaluation results, and preliminarily processes the abnormal process associated in the abnormal data. It is determined whether the processing rate of the abnormal data in the actual processing process is abnormal based on the specific identification result, and whether the corresponding processing rate is discrete abnormality based on the specific identification result. The abnormal process can be accurately identified, and the identification rate of the abnormal process is simultaneously ensured.

[0077] Subsequently, for the determined abnormal process, the registry and signature in the process are compared to determine whether the number of items is consistent. For the consistent number, the startup items are analyzed again to determine whether the startup sequence is consistent, thereby comprehensively determining whether the abnormal process has abnormal data, making the overall determination of the abnormal process more accurate and comprehensive, and achieving better evaluation processing effect.

[0078] The above specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the protection scope of the present application. It is particularly pointed out that any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A power network anomaly data monitoring system, characterized in that, include: Port traffic monitoring module, traffic data processing module, data process identification module, allocation processing module, and abnormal process handling module; The port traffic monitoring module is used to monitor the interaction traffic of each interaction port in real time and transmit the interaction traffic and interaction data of each interaction port to the traffic data processing module. The traffic data processing module is used to determine whether the interaction traffic of each interaction port is abnormal. When it is determined that the interaction traffic of an interaction port is abnormal, the abnormal time period when the interaction traffic is abnormal is determined, and the interaction data within the abnormal time period is transmitted to the data process identification module. The data process identification module is used to identify the process data corresponding to the interaction data during the abnormal period and transmit the process data to the allocation processing module. The allocation processing module is used to determine whether there is an abnormal process based on the process data, and when it is determined that there is an abnormal process, it transmits the abnormal process to the abnormal process processing module. The abnormal process processing module is used to obtain the signature items recognized by the power network abnormal monitoring system for the abnormal process and the number of the signature items, and to perform pre-registration processing on the abnormal process according to the signature items to obtain the registration items of the abnormal process and the number of the registration items. Then, the number of signature items is compared with the number of registration items. When the number of signature items is inconsistent with the number of registration items, the interaction data corresponding to the abnormal process is determined to be abnormal data. The abnormal process handling module is further configured to, when the number of signature items is consistent with the number of registration items, obtain the first startup order associated with the signature item and the second startup order associated with the registration item, compare the first startup order with the second startup order, and determine that the interaction data corresponding to the abnormal process is normal data when the first startup order is consistent with the second startup order; and determine that the interaction data corresponding to the abnormal process is abnormal data when the first startup order is inconsistent with the second startup order.

2. The power network abnormal data monitoring system as described in claim 1, characterized in that, The abnormal process handling module is also used to generate a corresponding data abnormality prompt when it is determined that the interactive data corresponding to the abnormal process is abnormal data.

3. The power network abnormal data monitoring system as described in claim 1, characterized in that, Also includes: Data display module; The data display module is used to visualize the abnormal data and the abnormal process when the interaction data corresponding to the abnormal process is determined to be abnormal data.

4. The power network abnormal data monitoring system as described in claim 1, characterized in that, The traffic data processing module is used to determine whether the interaction traffic of each interaction port is abnormal. When it is determined that the interaction traffic of an interaction port is abnormal, the module determines the abnormal time period when the abnormal interaction traffic occurs and transmits the interaction data within the abnormal time period to the data process identification module, including: The traffic data processing module is used to determine the median of the interaction traffic of each interaction port at each time point based on the interaction traffic of the interaction port. Based on the change in the median of the interaction traffic at different time units before and after the interaction port, it is determined whether the interaction traffic of the interaction port is abnormal. When it is determined that the interaction traffic of an interaction port is abnormal, the abnormal time period when the interaction traffic is abnormal is determined, and the interaction data within the abnormal time period is transmitted to the data process identification module.

5. The power network abnormal data monitoring system as described in claim 4, characterized in that, The method of determining whether the interaction traffic of an interaction port is abnormal based on the change in the median of the interaction traffic at different times before and after the change, and when it is determined that the interaction traffic of an interaction port is abnormal, determining the abnormal time period when the interaction traffic is abnormal, including: Calculate the first difference between the median interaction traffic at the current moment and the median interaction traffic at the previous unit moment, and the second difference between the median interaction traffic at the previous unit moment and the median interaction traffic at the previous two units moment. Compare the first difference with the second difference. When the first difference is greater than the product of the second difference and a preset limit value, it is determined that the interaction traffic between the current moment and the previous unit moment is abnormal, and the time period between the current moment and the previous unit moment is taken as the abnormal time period when the interaction traffic is abnormal.

6. The power network abnormal data monitoring system as described in claim 1, characterized in that, The data process identification module is used to identify the process data corresponding to the interaction data during the abnormal period and transmit the process data to the allocation processing module, including: The data process identification module is used to identify data containing the process identifier within the abnormal time period as the corresponding process data based on the preset process identifier, and then transmit the process data to the allocation processing module.

7. The power network abnormal data monitoring system as described in claim 1, characterized in that, The allocation processing module is used to determine whether there is an abnormal process based on the process data, and when an abnormal process is determined to exist, to transmit the abnormal process to the abnormal process processing module, including: The allocation processing module is used to identify the data capacity of each process and obtain the data capacity ratio between the data of each process based on the data capacity. Obtain the CPU's unutilized rate at the current moment, divide the unutilized rate equally according to the data capacity ratio, allocate corresponding process data to each process data for data processing, and record the processing rate of each process data at each moment during the data processing process; For each process data, calculate the average processing rate at each moment during the data processing process to obtain the corresponding average processing rate. Based on the average processing rate, determine whether the process corresponding to each process data is an abnormal process. When an abnormal process is determined to exist, the abnormal process is transmitted to the abnormal process processing module.

8. The power network abnormal data monitoring system as described in claim 7, characterized in that, The step of determining whether a process corresponding to each process data is an abnormal process based on the average processing rate includes: The average processing rate of all process data is processed by standard deviation to obtain a standard deviation parameter. The standard deviation parameter is compared with a preset value. When the standard deviation parameter is greater than the preset value, the average processing rate with the largest processing rate among all process data is removed. After removal, the standard deviation of the remaining average processing rates is reprocessed to obtain a new standard deviation parameter. The new standard deviation parameter is then compared with the preset value until the standard deviation parameter is not greater than the preset value. The process corresponding to the removed average processing rate is then identified as an abnormal process.

Images