Terminal safety behavior monitoring system based on distribution automation master station architecture

Abstract

The invention provides a terminal safety behavior monitoring system based on a power distribution automation master station architecture. The terminal safety behavior monitoring system comprises the following steps: firstly, acquiring equipment information and behavior information of a power distribution automation terminal; determining current state information of the power distribution automation terminal according to the equipment data, the behavior information and a first neural network; wherein the current state information comprises equipment abnormity, communication abnormity and behavior abnormity; and finally, according to the current state information, the behavior information and the second neural network, determining a behavior safety monitoring result of the distribution automation terminal. According to the method, the influence of the equipment state on safety monitoring is considered, the two-stage neural network is set, the current state of the equipment is identified firstly, then safety monitoring is completed through the corresponding second neural network, and the monitoring accuracy is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of power system safety, and in particular relates to a terminal safety behavior monitoring system based on a distribution automation master station architecture. Background Art

[0002] In the distribution automation master station architecture, terminal security behavior monitoring is crucial. At present, the power distribution network faces many security risks, especially in embedded systems. On the one hand, the complexity of system tailoring, application customization, online upgrade difficulties and proprietary communication protocols have caused a large number of security risks and vulnerabilities in most distribution network equipment. This is because different tailoring and customization may lead to incomplete security protection, while the difficulty of upgrading makes it difficult to repair vulnerabilities in time, and proprietary communication protocols may also pose security risks due to the lack of extensive review. On the other hand, due to the limited software and hardware computing resources of distribution network equipment, in order to ensure real-time and availability in the early stage of design, information security needs are often not fully considered. This has led to most of the distribution network terminals in service and on sale being in an unguarded state, prone to problems such as counterfeit replacement, illegal access, illegal access, and intrusion attacks.

[0003] Compared with the distribution master station, the distribution terminal has a harsh operating environment and weak physical protection, making it more likely to become a target of cyber attacks. There is a risk that criminals use the distribution terminal as a springboard for group control attacks. At the same time, the interconnection between distributed energy access, terminal and user-side energy storage and electric vehicles also brings unknown and uncontrollable security risks to the distribution terminal. In this case, it is particularly important to monitor the terminal security behavior through the distribution automation master station architecture. The terminal access status and access behavior can be monitored in real time, illegal access and illegal access can be discovered in time, the terminal operation status can be analyzed, and whether there are signs of intrusion attacks can be determined, so as to take corresponding protective measures to ensure the safe and stable operation of the power distribution network.

[0004] Therefore, the terminal security of the distribution automation master station architecture in the prior art needs to be improved. Summary of the invention

[0005] In view of this, the present invention provides a terminal security behavior monitoring system based on a distribution automation master station architecture, aiming to solve the problem that the terminal security of the distribution automation master station architecture in the prior art needs to be improved.

[0006] A first aspect of an embodiment of the present invention provides a terminal safety behavior monitoring system based on a distribution automation master station architecture, comprising:

[0007] Obtain equipment information and behavior information of distribution automation terminals;

[0008] Determine the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality and behavior abnormality;

[0009] According to the current state information, behavior information and the second neural network, the behavior safety monitoring result of the distribution automation terminal is determined.

[0010] In a possible implementation, determining the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network includes:

[0011] Inputting device data and behavior information into the first neural network to obtain state characteristics of the distribution automation terminal;

[0012] According to the status characteristics, the current status information of the distribution automation terminal is determined; wherein the current status information includes equipment abnormality, communication abnormality, behavior abnormality, and association abnormality.

[0013] In a possible implementation, determining the current state information of the distribution automation terminal according to the state characteristics includes:

[0014] The similarity between the state feature and each standard feature in the standard feature library is calculated, and the label information of the standard feature whose similarity is greater than a first preset value is used as the current state information.

[0015] In a possible implementation, determining the behavior safety monitoring result of the distribution automation terminal according to the current state information, the behavior information and the second neural network includes:

[0016] selecting a second neural network from a plurality of pre-established neural networks based on the current state information;

[0017] Determine at least one behavior feature vector according to the current state information and the behavior information;

[0018] Each behavior feature vector is input into the second neural network to determine the behavior safety monitoring result of the distribution automation terminal.

[0019] In a possible implementation, determining at least one behavior feature vector according to current state information and behavior information includes:

[0020] Determine at least one feature extraction criterion according to each tag information in the current state information;

[0021] At least one behavior feature vector is determined from the behavior information according to at least one feature extraction criterion.

[0022] In a possible implementation, each behavior feature vector is input into a second neural network to determine a behavior safety monitoring result of a distribution automation terminal, including:

[0023] Inputting each behavior feature vector into a second neural network to determine the risk type, risk degree and confidence level of each behavior feature vector;

[0024] Determine the behavioral safety monitoring results of distribution automation terminals based on risk type, risk level and confidence level.

[0025] In one possible implementation, the device information includes: device type, device operation log, and device maintenance record;

[0026] Behavior information includes the current operation data and communication data of the device.

[0027] A second aspect of an embodiment of the present invention provides a terminal safety behavior monitoring device based on a distribution automation master station architecture, comprising:

[0028] Data acquisition module, used to obtain equipment information and behavior information of distribution automation terminals;

[0029] A state determination module, used to determine the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality and behavior abnormality;

[0030] The safety monitoring module is used to determine the behavior safety monitoring results of the distribution automation terminal based on the current state information, behavior information and the second neural network.

[0031] A third aspect of an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the terminal safety behavior monitoring system based on the distribution automation master station architecture of the first aspect are implemented.

[0032] The fourth aspect of an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the terminal safety behavior monitoring system based on the distribution automation master station architecture as described in the first aspect above.

[0033] The terminal safety behavior monitoring system based on the distribution automation master station architecture provided by the embodiment of the present invention first obtains the device information and behavior information of the distribution automation terminal; then determines the current state information of the distribution automation terminal based on the device data, behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality, and behavior abnormality; finally, determines the behavior safety monitoring result of the distribution automation terminal based on the current state information, behavior information and the second neural network. The present invention sets a two-level neural network by considering the impact of the device status on safety monitoring, first identifies the current state of the device, and then completes safety monitoring through the corresponding second neural network, effectively improving the monitoring accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0035] Figure 1 It is a flow chart for implementing a terminal safety behavior monitoring system based on a distribution automation master station architecture provided by an embodiment of the present invention;

[0036] Figure 2 It is a structural schematic diagram of a terminal safety behavior monitoring device based on a distribution automation master station architecture provided by an embodiment of the present invention;

[0037] Figure 3 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present invention. However, it should be clear to those skilled in the art that the present invention may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present invention.

[0039] Figure 1 1 is a flow chart of the implementation of the terminal security behavior monitoring system based on the distribution automation master station architecture provided by the embodiment of the present invention. Figure 1 As shown, in some embodiments, a terminal security behavior monitoring system based on a distribution automation master station architecture includes:

[0040] S110, obtaining device information and behavior information of the distribution automation terminal;

[0041] S120, determining the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality and behavior abnormality;

[0042] S130, determining a behavior safety monitoring result of the distribution automation terminal according to the current state information, the behavior information and the second neural network.

[0043] In some embodiments, the device information includes: device type, device operation log, and device maintenance record; the behavior information includes the device's current operation data and communication data.

[0044] In an embodiment of the present invention, device information can be obtained from a configuration file. Information related to the device type is usually stored in a local storage medium of the device, such as a flash memory or a hard disk. These files contain detailed parameter settings and function definitions of the device. For a distribution automation terminal, the configuration file may contain information such as the communication protocol type (such as IEC 61850, DNP3, etc.), the input and output interface configuration of the device (the number of analog input channels, the number of digital output channels, etc.), etc.

[0045] Distribution automation terminals are usually equipped with their own log storage system to record various events during the operation of the equipment. These events include the start and stop time of the equipment, software upgrade records, execution of operation commands, and various abnormal events (such as communication interruption, data collection errors, etc.). When reading the log storage system, you need to understand its storage structure and data format. For example, some terminals may store logs in the form of text files, with each line recording an event, including the timestamp of the event, event type, related parameters, and other information. You can use the log query tool provided by the terminal or log in to the terminal through a remote connection (such as SSH or Telnet protocol) and execute specific commands to obtain the log content.

[0046] The maintenance management system of the distribution master station centrally manages the maintenance records of multiple distribution automation terminals. The maintenance management system can interact with the terminal to automatically obtain relevant equipment identification, fault code and other information during equipment maintenance, and provide an interface for maintenance personnel to enter detailed maintenance information. When obtaining maintenance records from the maintenance management system, identity authentication and permission management are required to ensure that only authorized personnel can access relevant records. Usually, the maintenance records of a specific terminal can be obtained through database query statements or special maintenance management system interface operations.

[0047] In an embodiment of the present invention, the current operation data of the device can be acquired through sensors. Various sensors are usually set on the distribution automation terminal to monitor the operation status of the device. For example, the current sensor is used to measure the current in the circuit, the voltage sensor is used to monitor the voltage value, and the temperature sensor is used to detect the temperature inside the device. The raw data obtained from the sensor may contain noise or errors and need to be processed. For example, a filtering algorithm is used to remove noise interference and improve the accuracy of the data.

[0048] Device communication data can be obtained through network monitoring tools. Network monitoring tools can monitor the communication network of distribution automation terminals. These tools can capture communication data packets between terminals and other devices (such as master station systems and other terminal devices). For example, using network analysis software such as Wireshark, you can capture and analyze the communication data of terminals on Ethernet. Communication data includes information such as the source address and destination address of the data packet, protocol type, and data content. By analyzing the communication data, you can determine whether the communication between devices is normal and whether there is a communication failure (such as data packet loss, communication delay, etc.).

[0049] In some embodiments, the current status information of the distribution automation terminal is determined based on the device data, behavior information and the first neural network, including: inputting the device data and behavior information into the first neural network to obtain the status characteristics of the distribution automation terminal; determining the current status information of the distribution automation terminal based on the status characteristics; wherein the current status information includes device abnormality, communication abnormality, behavior abnormality, and association abnormality.

[0050] In the embodiment of the present invention, the attacker may cause the device to malfunction through illegal instructions, and the attacker may illegally use or destroy the intelligent terminal without authorization, thereby reducing the security of the distribution network. In addition, the distribution network equipment is usually deployed in an unattended or unsafe environment, which makes it easy for the attacker to directly contact the device to carry out physical damage, or to clone the device to achieve forgery, or to achieve information theft, software tampering and remote control through various means such as short-range or long-range attacks. Hardware failure of the device: may include circuit board damage, chip failure, sensor failure, etc. For example, when the measurement sensor of the terminal fails, it may cause the collected electrical parameters to be inaccurate, affecting the judgment of the state of the distribution system. Therefore, after the present invention identifies the state characteristics of the distribution automation terminal, it is classified into equipment abnormality, communication abnormality, behavior abnormality, and association abnormality, and then it is judged whether it is a regular fault or an attack after classification. Equipment abnormality may include conventional faults such as circuit board damage, chip failure, sensor failure, etc., and may also include faults caused by attack behaviors such as illegal physical damage. Communication abnormality may include signal interference, communication line failure, etc. Behavior abnormality may include the operation behavior of the terminal not conforming to the normal working mode. For example, frequent malfunctions, unexplained resets, etc. This may be caused by software failures, logic errors, or external interference. The collected data does not match the expected value, or the data change trend is abnormal. The terminal's response time to the command is too long or too short.

[0051] In addition, in the distribution automation system, there is a certain relationship between the terminals and between the terminals and the master station. If there is a problem with the relationship between a terminal and other devices, it may affect the operation of the entire system. For example, when the communication between a terminal and the adjacent terminal is interrupted, it may lead to inaccurate fault location and isolation in the area.

[0052] In the embodiment of the present invention, the first neural network may be a convolutional neural network, a recurrent neural network, etc., which is not limited here.

[0053] In some embodiments, the current state information of the distribution automation terminal is determined based on the state characteristics, including: calculating the similarity between the state characteristics and each standard feature in the standard feature library, and taking the label information of the standard feature whose similarity is greater than a first preset value as the current state information.

[0054] In an embodiment of the present invention, the standard feature library stores standard features in various states, and each standard feature has corresponding label information. These standard features are obtained by analyzing and summarizing the equipment data and behavior information of a large number of distribution automation terminals in known states. The similarity can be calculated using a variety of methods, such as cosine similarity, Euclidean distance, etc. By calculating the similarity, the degree of closeness between the state feature and each standard feature can be measured. The first preset value is a pre-set threshold value used to determine whether the similarity between the state feature and the standard feature is high enough. If the similarity is greater than the first preset value, it means that the current state feature is close to the standard feature, and it can be considered that the distribution automation terminal is in the state corresponding to the standard feature.

[0055] In some embodiments, the behavioral safety monitoring result of the distribution automation terminal is determined based on the current state information, the behavior information and the second neural network, including: selecting a second neural network from a plurality of pre-established neural networks based on the current state information; determining at least one behavior feature vector based on the current state information and the behavior information; and inputting each behavior feature vector into the second neural network to determine the behavioral safety monitoring result of the distribution automation terminal.

[0056] In some embodiments, at least one behavior feature vector is determined based on current state information and behavior information, including: determining at least one feature extraction criterion based on each tag information in the current state information; and determining at least one behavior feature vector from the behavior information based on the at least one feature extraction criterion.

[0057] In the embodiment of the present invention, there are various types of distribution network terminals, and the failures that may occur in various devices are more complicated. Therefore, the present invention pre-stores behavior extraction standards under various states for each state of the device. After obtaining the current state information, the corresponding behavior extraction standard is queried to extract the behavior feature vector from the behavior information. Each element in the behavior feature vector represents a feature value in the current operating data and communication data under this state. The feature value is used to reflect whether there is an abnormality and the degree of abnormality.

[0058] In some embodiments, each behavioral feature vector is input into a second neural network to determine the behavioral safety monitoring result of the distribution automation terminal, including: inputting each behavioral feature vector into a second neural network to determine the risk type, risk level and confidence level of each behavioral feature vector; determining the behavioral safety monitoring result of the distribution automation terminal according to the risk type, risk level and confidence level.

[0059] In an embodiment of the present invention, the risk level and confidence level are both percentages. The risk level and confidence level are weighted and summed to obtain a first value. If the first value is greater than a second preset value, the behavior feature vector is abnormal, and the risk type, risk level, and confidence level are written into the behavior safety monitoring results.

[0060] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0061] Figure 2 Schematic diagram of the structure of the terminal security behavior monitoring system device based on the distribution automation master station architecture provided by the embodiment of the present invention. Figure 2 As shown, in some embodiments, a terminal safety behavior monitoring system device 2 based on a distribution automation master station architecture includes:

[0062] The data acquisition module 210 is used to acquire the equipment information and behavior information of the distribution automation terminal;

[0063] The state determination module 220 is used to determine the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality and behavior abnormality;

[0064] The safety monitoring module 230 is used to determine the behavior safety monitoring result of the distribution automation terminal according to the current state information, behavior information and the second neural network.

[0065] Optionally, the state determination module 220 is used to: input device data and behavior information into the first neural network to obtain state characteristics of the distribution automation terminal; determine the current state information of the distribution automation terminal based on the state characteristics; wherein the current state information includes device abnormality, communication abnormality, behavior abnormality, and association abnormality.

[0066] Optionally, the state determination module 220 is used to calculate the similarity between the state feature and each standard feature in the standard feature library, and use the label information of the standard feature with a similarity greater than a first preset value as the current state information.

[0067] Optionally, the safety monitoring module 230 is used to: select a second neural network from multiple pre-established neural networks based on current state information; determine at least one behavior feature vector based on current state information and behavior information; input each behavior feature vector into the second neural network to determine the behavior safety monitoring result of the distribution automation terminal.

[0068] Optionally, the security monitoring module 230 is used to: determine at least one feature extraction standard according to each tag information in the current state information; and determine at least one behavior feature vector from the behavior information according to the at least one feature extraction standard.

[0069] Optionally, the safety monitoring module 230 is used to: input each behavior feature vector into the second neural network to determine the risk type, risk level and confidence level of each behavior feature vector; and determine the behavior safety monitoring result of the distribution automation terminal based on the risk type, risk level and confidence level.

[0070] Optionally, the device information includes: device type, device operation log and device maintenance record; the behavior information includes the device's current operation data and communication data.

[0071] The terminal safety behavior monitoring system device based on the distribution automation master station architecture provided in this embodiment can be used to execute the above method embodiments. Its implementation principles and technical effects are similar, and this embodiment will not be repeated here.

[0072] Figure 3 Schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, an electronic device 3 provided by an embodiment of the present invention includes: a processor 30, a memory 31, and a computer program 32 stored in the memory 31 and executable on the processor 30. When the processor 30 executes the computer program 32, the steps in the above-mentioned output voltage calibration method based on LLC are implemented, for example Figure 2 Alternatively, when the processor 30 executes the computer program 32, the functions of each module / unit in the above-mentioned system embodiments are implemented, for example Figure 3 The functions of each module are shown.

[0073] Exemplarily, the computer program 32 may be divided into one or more modules / units, one or more modules / units are stored in the memory 31, and are executed by the processor 30 to implement the present invention. One or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the computer program 32 in the electronic device 3.

[0074] The electronic device 3 may be a mobile phone, MCU, ECU, industrial computer, etc., which is not limited here. The electronic device 3 may include, but is not limited to, a processor 30 and a memory 31. Those skilled in the art will understand that Figure 3It is only an example of the electronic device 3 and does not constitute a limitation of the electronic device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0075] The processor 30 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0076] The memory 31 may be an internal storage unit of the electronic device 3, such as a hard disk or memory of the electronic device 3. The memory 31 may also be an external storage device of the electronic device 3, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 3. Further, the memory 31 may also include both an internal storage unit of the electronic device 3 and an external storage device. The memory 31 is used to store computer programs and other programs and data required by the electronic device. The memory 31 may also be used to temporarily store data that has been output or is to be output.

[0077] An embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned LLC-based output voltage calibration method embodiment are implemented.

[0078] The computer readable storage medium stores a computer program 32, which includes program instructions. When the program instructions are executed by the processor 30, all or part of the processes in the above-mentioned embodiment method are implemented. The computer program 32 can also be used to instruct related hardware to complete. The computer program 32 can be stored in a computer readable storage medium. When the computer program 32 is executed by the processor 30, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program 32 includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer readable medium may include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium.

[0079] The computer-readable storage medium may be an internal storage unit of the electronic device of any of the aforementioned embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the computer-readable storage medium may also include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store computer programs and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0080] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0081] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0082] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0083] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0084] In the embodiments provided by the present invention, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0085] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0086] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0087] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. Computer-readable media may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0088] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A terminal safety behavior monitoring system based on distribution automation master station architecture, characterized in that: include: Data acquisition module, used to obtain equipment information and behavior information of distribution automation terminals; A state determination module, used to determine the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality and behavior abnormality; The safety monitoring module is used to determine the behavior safety monitoring result of the distribution automation terminal according to the current state information, the behavior information and the second neural network.

2. The terminal safety behavior monitoring system based on the distribution automation master station architecture according to claim 1 is characterized in that: A state determination module for: Inputting the device data and the behavior information into a first neural network to obtain state characteristics of the distribution automation terminal; According to the state characteristics, the current state information of the distribution automation terminal is determined; wherein the current state information includes equipment abnormality, communication abnormality, behavior abnormality, and association abnormality.

3. The terminal safety behavior monitoring system based on the distribution automation master station architecture according to claim 2 is characterized in that: A state determination module for: The similarity between the state feature and each standard feature in the standard feature library is calculated, and the label information of the standard feature whose similarity is greater than a first preset value is used as the current state information.

4. The terminal safety behavior monitoring system based on the distribution automation master station architecture according to claim 3 is characterized in that: Safety monitoring module for: selecting a second neural network from a plurality of pre-established neural networks according to the current state information; Determining at least one behavior feature vector according to the current state information and the behavior information; Each behavior feature vector is input into the second neural network to determine the behavior safety monitoring result of the distribution automation terminal.

5. The terminal safety behavior monitoring system based on the distribution automation master station architecture according to claim 4 is characterized in that: Safety monitoring module for: Determining at least one feature extraction criterion according to each tag information in the current state information; At least one behavior feature vector is determined from the behavior information according to the at least one feature extraction criterion.

6. The terminal safety behavior monitoring system based on the distribution automation master station architecture according to claim 5 is characterized in that: Safety monitoring module for: Inputting each behavior feature vector into the second neural network to determine the risk type, risk level and confidence level of each behavior feature vector; The behavior safety monitoring result of the distribution automation terminal is determined according to the risk type, risk degree and confidence level.

7. The terminal safety behavior monitoring system based on the distribution automation master station architecture according to claim 2 is characterized in that: The equipment information includes: equipment type, equipment operation log and equipment maintenance record; The behavior information includes current operation data and communication data of the device.

8. A terminal security behavior monitoring method based on distribution automation master station architecture, characterized in that: include: Obtain equipment information and behavior information of distribution automation terminals; Determine the current state information of the distribution automation terminal according to the device data, the behavior information and the first neural network; wherein the current state information includes device abnormality, communication abnormality and behavior abnormality; A behavior safety monitoring result of the distribution automation terminal is determined according to the current state information, the behavior information and the second neural network.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the terminal security behavior monitoring method based on the distribution automation master station architecture as described in claim 8 above are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the terminal safety behavior monitoring system based on the distribution automation master station architecture as described in claim 8 above are implemented.

Images