Power dispatching boundary data behavior anomaly detection method and system based on Markov chain

Abstract

The invention discloses a Markov chain-based power dispatching boundary data behavior anomaly detection method and system. The method comprises the following steps: monitoring historical data of each information object of network boundary equipment of a power dispatching system in an IEC104 protocol, and extracting each dispatching service according to a time interval of a remote control instruction data packet of the information object; constructing a state transition matrix based on all historical remote control instructions for each information object based on a Markov chain algorithm, wherein the state transition matrix records all possible transitions among states and probability distribution thereof; when a new scheduling service is received, calculating the probability that the scheduling service belongs to a normal behavior by using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, determining that the scheduling service has an abnormal behavior; and updating the corresponding state transition matrix according to the abnormal behavior detection result. According to the scheme, the anomaly detection capability of the power dispatching control system is remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of power dispatching behavior detection, and in particular relates to a method and system for detecting power dispatching boundary data behavior anomaly based on a Markov chain. Background Art

[0002] In order to ensure the safe and stable operation of the increasingly large-scale power network, the global economic optimization dispatch, the coordinated handling of major accidents, and the effective consumption of renewable energy, the power dispatch control system is gradually developing towards intelligence. The traditional power dispatch mode adopts a "top-down" one-way control method, which may lead to misoperation and false data injection attacks (False Data Injection Attacks, FDIA) hidden dangers. FDIA refers to the highly concealed power industrial control system network security threat in which the attacker injects carefully forged remote control commands into the control channel of the power system in an attempt to interfere with or destroy the normal operation of power facilities.

[0003] There are currently two main detection methods for FDIA threats: one is based on collecting data traffic from real businesses and converting it into numerical form (vectorization), and then using these vectorized data sets to train machine learning classifiers. Once the model training is completed, it can be used to monitor real-time data streams to identify potential FDIA behaviors. Another method is to use a sliding window method to collect historical data to build a standard operating baseline. Subsequently, during actual operation, the real-time data features are obtained in the same sliding window method and compared with the standard baseline. If it is within the acceptable range, it is considered that there is no attack. If it exceeds the warning range, it is judged that the system is being attacked by false data injection.

[0004] However, traditional methods usually train machine learning models based on normal business traffic in specific scenarios as positive samples. The power dispatching system varies due to its large scale and complex and changeable situations. For example, the traffic characteristics of different substations or the same substation in different time periods may be very different. Therefore, the models trained in this way often have weak generalization ability and are prone to high false alarm rates. Due to the constraints of hardware resources, traditional algorithms tend to use smaller time windows for data analysis, and the models can only capture data patterns in the short term. For power dispatching systems that need to understand long-term periodic changes (such as daily power consumption peaks and valleys, seasonal load adjustments, etc.), traditional methods are difficult to build a baseline that can accurately reflect these long-term characteristics. In addition, traditional solutions mainly focus on establishing baselines based on measurement type data (such as continuous variables such as voltage and current). This type of data changes smoothly over time and is suitable for identifying anomalies using time series analysis methods. In contrast, remote control commands are discrete events, which represent specific control actions rather than continuous change processes. Therefore, it is difficult to establish an effective anomaly detection baseline for remote control commands by relying solely on time window methods, and it is difficult to discover potential security threats. Summary of the invention

[0005] In order to solve the deficiencies in the prior art, the present invention provides a method and system for detecting behavior anomalies in power dispatching boundary data based on a Markov chain, so as to solve the technical problem of detecting anomalies of different types of data.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0007] The present invention firstly discloses a method for detecting abnormal behavior of power dispatching boundary data based on a Markov chain, the method comprising the following steps:

[0008] Monitor the historical data of each information object of the network edge device of the power dispatching system in the IEC104 protocol, and extract each dispatching service according to the time interval of the remote control instruction data packet of the information object;

[0009] Based on the Markov chain algorithm, a state transition matrix based on all historical remote control instructions is constructed for each information object, and the state transition matrix records all possible transitions between states and their probability distributions; when a new dispatch service is received, the probability that the dispatch service belongs to normal behavior is calculated using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, it is determined that the dispatch service has abnormal behavior;

[0010] Update the corresponding state transition matrix according to the abnormal behavior detection results.

[0011] The present invention further includes the following preferred embodiments:

[0012] The monitoring of the historical data of each information object of the electric power dispatching system network boundary device in the IEC104 protocol, and extracting each dispatching service according to the time interval of the remote control instruction data packet of the information object, further comprises:

[0013] The source IP, destination IP and information object address are combined into a triplet, and a time threshold T is set. When the time interval between data packets with the same triplet is greater than T, a complete scheduling service is extracted.

[0014] Before constructing a state transition matrix based on all historical remote control commands for each information object based on the Markov chain algorithm, it also includes:

[0015] Each remote control command data packet in the IEC 104 protocol is regarded as a node, and the information used to represent the status of each node is filtered out, including the command number, transmission reason, command, output duration, and whether it is executed.

[0016] The calculating the probability that the remote control instruction belongs to normal behavior by using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, determining that the remote control instruction has abnormal behavior, further includes:

[0017] Assuming that the current remote control command consists of n data packets, calculate the transfer probability of any two adjacent data packets A to B

[0018] Count(A|B) indicates the number of packets A when the previous packet is B, and Count(A) indicates the total number of packets A.

[0019] Calculate the probability p that the initial packet of the scheduling service is A A :

[0020]

[0021] Use the pre-established state transition matrix P to calculate the probability that the current business is normal:

[0022]

[0023] Among them, i represents the i-th scheduling service; C i ={O1, O2, O3, ..., O n}, C i is a set of triples, C i ={{e}|e∈E k}; E k To remote control traffic;

[0024] An abnormality threshold θ is set, and when the calculated probability is less than the abnormality threshold θ, it is determined that the current remote control instruction is abnormal.

[0025] The present invention also discloses a Markov chain-based power dispatching boundary data behavior anomaly detection system using the aforementioned Markov chain-based power dispatching boundary data behavior anomaly detection method, comprising:

[0026] A monitoring module, used to monitor the historical data of each information object of the power dispatching system network boundary device in the IEC104 protocol, and extract each dispatching service according to the time interval of the remote control instruction data packet of the information object;

[0027] An anomaly detection module is used to construct a state transition matrix based on all historical remote control instructions for each information object based on the Markov chain algorithm, and the state transition matrix records all possible transitions between states and their probability distribution; when a new scheduling service is received, the probability that the scheduling service belongs to normal behavior is calculated using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, it is determined that the scheduling service has abnormal behavior;

[0028] The updating module is used to update the corresponding state transition matrix according to the abnormal behavior detection results.

[0029] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0030] The storage medium is used to store instructions;

[0031] The processor is used to operate according to the instructions to execute the steps of the aforementioned power dispatch boundary data behavior anomaly detection method based on Markov chain.

[0032] Correspondingly, the present application also discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method for detecting abnormal behavior of power dispatching boundary data based on a Markov chain.

[0033] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a method and system for detecting anomaly behavior of boundary data of power dispatching based on Markov chain, which effectively alleviates the problem of limited coverage of business scenarios and easy false alarm caused by manually collecting business traffic to establish a baseline; avoids the lack of long-term data correlation caused by time window limitations in traditional methods, solves the defect that traditional methods can only model continuous numerical measurements, and enhances the ability to detect anomalies of different types of data; by retrieving the probability transfer matrix, finds the situation in which the node is most likely to appear in the historical record, provides higher explainability for the anomaly detection results, and helps operation and maintenance personnel better understand and analyze the causes of the anomaly. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of the method for detecting abnormal behavior of power dispatching boundary data based on Markov chain in the present invention.

[0035] Figure 2 It is a schematic diagram of the state transition of the remote control instruction data packet in the present invention.

[0036] Figure 3 It is a schematic diagram of the boundary data scheduling architecture in the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0038] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0039] In view of the shortcomings of the prior art, the present invention proposes a method and system for detecting abnormal behavior of power dispatching boundary data based on Markov chain. By continuously monitoring the historical data of each information object of the network boundary device of the power dispatching system in the IEC104 protocol, a special historical baseline is established for the business traffic in different scenarios. Once the real-time data deviates significantly from the established baseline, it is determined to be an abnormal situation and the baseline is updated at the same time to reflect the normal behavior mode in each specific scenario, thereby improving the universal applicability of the model and reducing the false alarm rate. Based on the Markov chain, a state transition matrix based on all its historical remote control instructions is constructed for each information object, recording all possible transitions from one state to another and their probability distribution. When a new remote control instruction is received, the existing state transition matrix is ​​used to calculate the probability that the instruction belongs to normal behavior. If the calculated probability is lower than the preset safety threshold, the instruction is identified as a potential abnormal behavior. In addition, whenever a new instruction arrives, the corresponding state transition matrix will be updated immediately to ensure that the model can always be analyzed based on the latest complete historical data to maintain its timeliness and accuracy.

[0040] See also Figure 1 As shown, the power dispatching boundary data behavior anomaly detection method based on Markov chain disclosed in the present invention includes the following steps:

[0041] Step 1: Monitor the historical data of each information object of the power dispatching system network edge device in the IEC104 protocol, and extract each dispatching service according to the time interval of the remote control instruction data packet of the information object.

[0042] Specifically, the boundary data of the power dispatching system is obtained, such as Figure 3 As shown, the system of the present invention is deployed in the network edge device of the power dispatching system to obtain the original power data packet set E. The historical data of each information object of the network edge device of the power dispatching system in the IEC104 protocol is continuously monitored, and the remote control flow E is identified according to the type. k , E k ∈E, the source IP, destination IP and information object address are combined into a triplet, and the information object for which a baseline needs to be established is determined based on the triplet, and the historical data packet set C of the information object is extracted i ={{e}|e∈E k} to ensure accurate monitoring of specific business information objects. Figure 3 As shown, the triple "1.1.1.1-2.2.2.2-2" can uniquely locate the information object of the remote terminal unit.

[0043] Set the time threshold T, when the triple set C i When the time interval between two adjacent data packets is greater than T, it is considered that a scheduling service is completed and C i Re-dividing is done based on a complete dispatching service, and testing and updating the baseline are done based on a complete dispatching service. i ={O1, O2, O3, ..., O n}. i Represents the i-th scheduling service:

[0044] O i ={e1, e2, ..., e n |Time(e i )<Time(e j ), i<j}

[0045] Time(O j1 )-Time(O in )>T, j>i establishes a special historical baseline for business traffic in different scenarios. Once the real-time data deviates significantly from the established baseline, it is considered an abnormal situation. Time() means obtaining the timestamp.

[0046] Step 2: Based on the Markov chain algorithm, a state transition matrix based on all historical remote control instructions is constructed for each information object. The state transition matrix records all possible transitions between states and their probability distributions. When a new scheduling service is received, the state transition matrix is ​​used to calculate the probability that the scheduling service is a normal behavior. If the calculated probability is lower than the preset safety threshold, it is determined that the scheduling service has abnormal behavior.

[0047] Specifically, a baseline is established based on Markov chain theory, assuming that the state of each node depends only on the state of the previous node. Figure 2 As shown, each remote control command data packet in the IEC 104 protocol is regarded as a node, and the following key information is filtered out to represent the status of each node, including command number, transmission reason, command, output duration, and execution status. Figure 2 In the IEC 104 protocol, TYPE is the type identifier of the IEC 104 protocol, and common ones are single command, dual command, step adjustment command, etc. COT is the transmission reason of the IEC 104 protocol, and common ones are activation, activation confirmation, activation termination, etc. SCS (DCS / RCS) is the single command status (dual command status / step adjustment command status). QU is the duration, and SE is whether to execute.

[0048] Calculate the transition probability of any two adjacent packets A to B

[0049] Count(A|B) indicates the number of packets A when the previous packet is B, and Count(A) indicates the total number of packets A.

[0050] Calculate the probability p that the initial packet of the scheduling service is A A :

[0051]

[0052] The pre-established state transition matrix P is used to calculate the probability that the current service is normal.

[0053]

[0054] Assume that the current service consists of n packets, calculate the current service O i Normal probability:

[0055]

[0056] An abnormality threshold θ is set, and when the calculated probability is less than the abnormality threshold θ, it is determined that the current remote control instruction is abnormal.

[0057] Step 3: Update the corresponding state transition matrix according to the abnormal behavior detection results.

[0058] Every time a complete instruction is received, the corresponding state transition matrix is ​​updated immediately, that is, the new state transition matrix is ​​recalculated based on the historical data using the newly added data to ensure that the model is always analyzed based on the latest complete historical data to maintain the timeliness and accuracy of the model and adapt to the ever-changing business environment.

[0059] In an optional embodiment, in addition to the Markov chain, a machine learning algorithm that establishes a baseline and identifies anomalies can also be used as an alternative. For example, clustering algorithms (such as K-means, DBSCAN) and discriminant algorithms (such as support vector machine SVM, random forest Random Forest), etc., can all be used for anomaly detection.

[0060] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a method and system for detecting abnormal behavior of power dispatch boundary data based on Markov chain, which collects business traffic in various scenarios by monitoring the historical data of each information object in the IEC 104 protocol, and establishes a special historical baseline for the business data of each scenario. When the real-time data deviates significantly from the established baseline, it is determined to be an abnormal situation, which effectively alleviates the problem of limited coverage of business scenarios and easy false alarms caused by manually collecting business traffic to establish a baseline; based on the Markov chain, a state transition matrix of all historical remote control instructions is established for each information object, and the matrix records all possible transitions from one state to another and their probability distribution. When a new remote control instruction is received, the probability that the instruction belongs to normal behavior is calculated using the existing state transition matrix. If the calculated probability is lower than the preset safety threshold, the instruction is identified as a potential abnormal behavior. Each time a new remote control instruction is received, the corresponding state transition matrix will be updated immediately to ensure that the model is always analyzed based on the latest complete historical data; the state transition matrix is ​​constructed using all historical data, and the long-term data correlation loss problem caused by time window restrictions in traditional methods is avoided through a real-time update mechanism. At the same time, based on the characteristics of Markov chains, the state of each node depends only on the state of the previous node, so that the model can effectively characterize discrete remote control instructions, thereby solving the defect that the traditional method can only model continuous numerical measurements, and enhancing the ability to detect anomalies in different types of data; the Markov chain-based algorithm can not only identify abnormal nodes, but also find out the most likely situation of the node in the historical records by retrieving the probability transfer matrix. This mechanism provides higher interpretability for anomaly detection results, helping operation and maintenance personnel better understand and analyze the causes of anomalies.

[0061] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a Markov chain-based power dispatching boundary data behavior anomaly detection system based on the aforementioned Markov chain-based power dispatching boundary data behavior anomaly detection method, comprising:

[0062] A monitoring module, used to monitor the historical data of each information object of the power dispatching system network boundary device in the IEC104 protocol, and extract each dispatching service according to the time interval of the remote control instruction data packet of the information object;

[0063] An anomaly detection module is used to construct a state transition matrix based on all historical remote control instructions for each information object based on the Markov chain algorithm, and the state transition matrix records all possible transitions between states and their probability distribution; when a new scheduling service is received, the probability that the scheduling service belongs to normal behavior is calculated using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, it is determined that the scheduling service has abnormal behavior;

[0064] The updating module is used to update the corresponding state transition matrix according to the abnormal behavior detection results.

[0065] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned power dispatch boundary data behavior anomaly detection method based on Markov chain. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned power dispatch boundary data behavior anomaly detection method based on Markov chain.

[0066] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0067] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0068] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting abnormal behavior of power dispatching boundary data based on Markov chain, characterized in that: The following steps are involved: Monitor the historical data of each information object of the network edge device of the power dispatching system in the IEC104 protocol, and extract each dispatching service according to the time interval of the remote control instruction data packet of the information object; Based on the Markov chain algorithm, a state transition matrix based on all historical remote control instructions is constructed for each information object, and the state transition matrix records all possible transitions between states and their probability distribution; when a new dispatch service is received, the probability that the dispatch service belongs to normal behavior is calculated using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, it is determined that the dispatch service has abnormal behavior; Update the corresponding state transition matrix according to the abnormal behavior detection results.

2. The method for detecting abnormal behavior of power dispatching boundary data based on Markov chain according to claim 1 is characterized in that: The monitoring of the historical data of each information object of the electric power dispatching system network boundary device in the IEC104 protocol, and extracting each dispatching service according to the time interval of the remote control instruction data packet of the information object, further comprises: The source IP, destination IP and information object address are combined into a triplet, and a time threshold T is set. When the time interval between data packets with the same triplet is greater than T, a complete scheduling service is extracted.

3. The method for detecting abnormal behavior of power dispatching boundary data based on Markov chain according to claim 2 is characterized in that: Before constructing a state transition matrix based on all historical remote control commands for each information object based on the Markov chain algorithm, it also includes: Each remote control command data packet in the IEC 104 protocol is regarded as a node, and the information used to represent the status of each node is filtered out, including the command number, transmission reason, command, output duration, and whether it is executed.

4. The method for detecting abnormal behavior of power dispatching boundary data based on Markov chain according to claim 3 is characterized in that: The calculating the probability that the remote control instruction belongs to normal behavior by using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, determining that the remote control instruction has abnormal behavior, further includes: Assuming that the current remote control command consists of n data packets, calculate the transfer probability of any two adjacent data packets A to B Count(A|B) indicates the number of packets A when the previous packet is B, and Count(A) indicates the total number of packets A. Calculate the probability p that the initial packet of the scheduling service is A A : Use the pre-established state transition matrix P to calculate the probability that the current business is normal: Among them, i represents the i-th scheduling service; C i ={O1, O2, O3, ..., O n }, C i is a set of triples, C i ={{e}|e∈E k }; E k To remote control traffic; An abnormality threshold θ is set, and when the calculated probability is less than the abnormality threshold θ, it is determined that the current remote control instruction is abnormal.

5. A power dispatching boundary data behavior anomaly detection system based on Markov chain, characterized in that: include: A monitoring module, used to monitor the historical data of each information object of the power dispatching system network boundary device in the IEC104 protocol, and extract each dispatching service according to the time interval of the remote control instruction data packet of the information object; An anomaly detection module is used to construct a state transition matrix based on all historical remote control instructions for each information object based on the Markov chain algorithm, and the state transition matrix records all possible transitions between states and their probability distribution; when a new scheduling service is received, the probability that the scheduling service belongs to normal behavior is calculated using the state transition matrix, and if the calculated probability is lower than a preset safety threshold, it is determined that the scheduling service has abnormal behavior; The updating module is used to update the corresponding state transition matrix according to the abnormal behavior detection results.

6. The power dispatching boundary data behavior anomaly detection system based on Markov chain according to claim 5 is characterized in that: The monitoring module is further used for: The source IP, destination IP and information object address are combined into a triplet, and a time threshold T is set. When the time interval between data packets with the same triplet is greater than T, a complete scheduling service is extracted.

7. The power dispatching boundary data behavior anomaly detection system based on Markov chain according to claim 6 is characterized in that: The monitoring module is further used for: Each remote control instruction data packet in the IEC104 protocol is regarded as a node, and the information used to represent the status of each node is filtered out, including instruction number, transmission reason, command, output duration, and whether it is executed.

8. The power dispatching boundary data behavior anomaly detection system based on Markov chain according to claim 7 is characterized in that: The anomaly detection module is further used to: Assuming that the current remote control command consists of n data packets, calculate the transfer probability of any two adjacent data packets A to B Count(A|B) indicates the number of packets A when the previous packet is B, and Count(A) indicates the total number of packets A. Calculate the probability p that the initial packet of the scheduling service is A A : Use the pre-established state transition matrix P to calculate the probability that the current business is normal: Among them, i represents the i-th scheduling service; C i ={O1, O2, O3, ..., O n }, C i is a set of triples, C i ={{e}|e∈E k }; E k To remote control traffic; An abnormality threshold θ is set, and when the calculated probability is less than the abnormality threshold θ, it is determined that the current remote control instruction is abnormal.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the power dispatching boundary data behavior anomaly detection method based on Markov chain according to any one of claims 1-4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for detecting abnormal behavior of power dispatching boundary data based on a Markov chain as described in any one of claims 1 to 4 are implemented.

Images