Defect elimination checking method and system for substation terminal network equipment based on deep learning

Abstract

The invention provides a substation terminal network equipment defect elimination checking method and system based on deep learning, and the method comprises the following steps: constructing an equipment configuration heterogeneous graph network by a substation client through combining an equipment configuration file, an equipment operation log and equipment network flow data, all the transformer substation clients utilize a heterogeneous graph network to train a local model, the federated learning server updates a shared learning model by combining local training parameters of all the clients, and the clients needing to be checked continue to update the model according to updating parameters of the server; and identifying a configuration mode of local network equipment through the updated model and obtaining a configuration parameter mapping table, generating an equipment checking strategy in combination with the configuration mode and the configuration parameter mapping table, and finishing checking work of all the network equipment through the equipment checking strategy. According to the invention, the transformer substation can accurately complete network equipment checking.

Description

Technical Field

[0001] The present invention belongs to the technical field of equipment network configuration, and specifically relates to a method and system for eliminating faults and verifying network equipment at a substation end based on deep learning. Background Art

[0002] As a basic industry, the power system shoulders the important responsibility of the stable operation of all walks of life. Its communication network adopts a dedicated special communication network. This communication network plays an important role in coordinating the joint operation of the power system's generation, transmission, transformation, distribution and power consumption, and ensuring the safe, economical, stable and reliable operation of the power grid. Various network devices in the power communication network (such as switches, routers, firewalls, isolation devices and encryption devices, etc.) are the basic infrastructure for the normal operation of the network. The network topology, subnet division and IP access blacklist and whitelist are usually designed by professional network communication engineers. These network devices and various configuration items in the devices are the specific manifestations of realizing network design.

[0003] In the traditional substation management mode, the configuration and verification of substation network equipment mainly rely on manual operation and regular inspection. This method is not only inefficient, but also prone to human errors, and it is difficult to detect and deal with potential problems in a timely manner. With the expansion of substation scale and the increase in the number of network devices, this management mode has been unable to meet the needs of modern power grids. Therefore, the industry has begun to explore the use of artificial intelligence and big data technologies to realize the intelligent management of substation network equipment. Some centralized intelligent management platforms have begun to appear. These platforms can centralize the configuration data of multiple substation network devices to the cloud for analysis and processing. However, the data generated by substation network equipment has a strong correlation, and there are complex interdependencies between different substation network devices. These relationships have an important impact on equipment fault diagnosis, troubleshooting, and verification. On the other hand, as a key node in the power system, the operation data of the substation is highly sensitive. Direct transmission and centralized storage of this data will face huge data security risks. Therefore, how to achieve efficient and accurate network equipment troubleshooting and verification under the premise of protecting data privacy has become an urgent problem to be solved. Summary of the invention

[0004] The present invention provides a substation-side network equipment fault elimination and verification method and system based on deep learning, so as to solve the problem of how to achieve efficient and accurate network equipment fault elimination and verification under the premise of protecting data privacy, which has become an urgent problem to be solved.

[0005] In the first aspect, the present invention provides a method for eliminating faults and checking network equipment at a substation end based on deep learning, which is applied to a substation federated learning system in a target area, wherein the substation federated learning system comprises a plurality of substation clients and a federated learning server deployed in the target area, wherein all of the substation clients are communicatively connected to the federated learning server, the federated learning server is pre-constructed with a shared learning model, and all of the substation clients are pre-deployed with a client learning model whose initial configuration is the same as that of the shared learning model, and all of the client learning models are from the federated learning server, and both the shared learning model and the client learning model are GNN models; the plurality of substation clients respectively belong to a plurality of substations in the target area, and each of the substations has one and only one substation client, and for any of the substations, the substation client in the substation is communicatively connected to all network devices in the substation based on a pre-configured substation intranet connection;

[0006] The method comprises the following steps:

[0007] When any one or more target substation clients among all the substation clients trigger a preset device verification rule, for any of the substation clients, the substation client obtains device data of all the network devices through the substation intranet, and the device data includes device configuration files, device operation logs and device network traffic data;

[0008] The substation client uses Granger causality test analysis method and mutual information analysis method to extract the correlation relationship characteristics between the device configuration file, the device operation log and the device network traffic data;

[0009] The substation client constructs a device configuration heterogeneous graph network based on the association relationship characteristics and in combination with the device configuration file, the device operation log and the device network traffic data;

[0010] The substation client simplifies the device configuration heterogeneous graph network to a basic heterogeneous graph network through graph simplification technology, extracts simplified topology features from the basic heterogeneous graph network, and uploads the simplified topology features to the federated learning server;

[0011] The substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters of the client learning model, and uploads the updated client model parameters to the federated learning server;

[0012] After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results;

[0013] The federated learning server trains the shared learning model in combination with all the client model parameters and the corresponding client weights, updates the shared model parameters of the shared learning model, and sends the updated shared model parameters to all the substation clients;

[0014] For any of the target substation clients, the target substation client updates the shared model parameters to the local client learning model, inputs the device configuration heterogeneous graph network into the client learning model after parameter update, and outputs the configuration mode and configuration parameter mapping table of all the network devices through the client learning model after parameter update;

[0015] The target substation client generates a device verification strategy in combination with the configuration mode and the configuration parameter mapping table, and completes the verification work of all the network devices through the device verification strategy.

[0016] Optionally, the substation client extracts the correlation relationship characteristics among the device configuration file, the device operation log and the device network traffic data by using the Granger causality test analysis method and the mutual information analysis method, including the following steps:

[0017] The substation client converts the device configuration file, the device operation log and the device network flow data into time series feature data, and processes all the time series feature data in a standardized manner;

[0018] The substation client determines the optimal lag order of the Granger causality test analysis method based on the time series characteristic data and using the AIC information criterion;

[0019] The substation client performs a multivariate Granger causality test analysis on all the time series feature data according to the optimal lag order, and generates a linear correlation feature between the device configuration file, the device operation log and the device network traffic data according to the analysis result of the Granger causality test analysis;

[0020] The substation client converts all the time series characteristic data into discrete characteristic data;

[0021] The substation client extracts nonlinear correlation features among the device configuration file, the device operation log and the device network traffic data from the discrete feature data using a mutual information analysis method;

[0022] The substation client integrates the linear association feature and the nonlinear association feature into an association relationship feature among the device configuration file, the device operation log and the device network traffic data.

[0023] Optionally, the substation client extracts the nonlinear correlation features among the device configuration file, the device operation log and the device network traffic data from the discrete feature data using the mutual information analysis method, including the following steps:

[0024] The substation client uses a mutual information calculation formula to respectively calculate a first joint information entropy between the device configuration file and the device operation log, a second joint information entropy between the device configuration file and the device network traffic data, and a third joint information entropy between the device configuration file, the device operation log, and the device network traffic data;

[0025] The substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy;

[0026] The substation client determines the nonlinear correlation characteristics among the device configuration file, the device operation log and the device network traffic data according to the total mutual information.

[0027] Optionally, the total mutual information calculation formula is as follows:

[0028] t(X;Y;Z)=H(X;Y)+W(Y;Z)H(X;Y;Z)

[0029] Wherein: I(X; Y; Z) represents the total mutual information, H(X; Y) represents the first joint information entropy, H(Y; Z) represents the second joint information entropy, and H(X; Y; Z) represents the third joint information entropy.

[0030] Optionally, after the substation client simplifies the device configuration heterogeneous graph network into a basic heterogeneous graph network by using a graph simplification technology, extracting simplified topological features from the basic heterogeneous graph network, and uploading the simplified topological features to the federated learning server comprises the following steps:

[0031] The substation client performs node clustering and edge pruning processing on the device configuration heterogeneous graph network according to the association relationship characteristics to obtain a simplified heterogeneous graph network;

[0032] The substation client extracts a heterogeneous graph network skeleton from the simplified heterogeneous graph network using a minimum spanning tree algorithm;

[0033] The substation client calculates the node centrality index in the simplified heterogeneous graph network, and selects the key nodes in the simplified heterogeneous graph network according to the node centrality index;

[0034] The substation client reconstructs the device configuration heterogeneous graph network into a basic heterogeneous graph network in combination with the heterogeneous graph network skeleton and the key nodes;

[0035] Simplified topological features are extracted from the basic heterogeneous graph network, and the simplified topological features are uploaded to the federated learning server.

[0036] Optionally, the simplified topological feature is a feature vector composed of graph global features, node-level features, edge-level features, subgraph features and spectral features.

[0037] Optionally, after receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results, including the following steps:

[0038] After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server calculates the feature similarity between each pair of the substation clients based on the simplified topology features and using a similarity measurement method, and constructs a feature similarity matrix of the substation clients according to all the feature similarities;

[0039] The federated learning server divides all the substation clients into multiple client groups based on the simplified topological features and by using a K-means clustering algorithm, and determines the client centrality of each of the substation clients according to the distance between the substation client and the group center of the client group;

[0040] The federated learning server assigns client weights to all the substation clients in combination with the feature similarity matrix and the client centrality.

[0041] In the second aspect, the present invention also provides a substation-side network equipment fault elimination and verification system based on deep learning, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements the substation-side network equipment fault elimination and verification method based on deep learning as described in the first aspect.

[0042] In a third aspect, the present invention further provides a substation-side network equipment fault elimination and verification platform based on deep learning, comprising:

[0043] The substation-side network equipment fault elimination and verification system according to the second aspect; and

[0044] A substation federated learning system, the substation federated learning system comprising a plurality of substation clients and a federated learning server deployed in the target area, all of the substation clients are in communication connection with the federated learning server, the federated learning server has a shared learning model pre-built, all of the substation clients are pre-deployed with a client learning model with an initial configuration identical to the shared learning model, and all of the client learning models are from the federated learning server, the shared learning model and the client learning model are both GNN models; the plurality of substation clients respectively belong to a plurality of substations in the target area, and each of the substations has only one substation client, and for any of the substations, the substation client in the substation is in communication connection with all network devices in the substation based on a pre-configured substation intranet connection.

[0045] In a fourth aspect, the present invention further provides a computer-readable storage medium having instructions stored thereon, which, when executed by a processor, configures the processor to execute the substation-side network equipment fault elimination and verification method based on deep learning as described in the first aspect.

[0046] The beneficial effects of the present invention are:

[0047] The present invention effectively solves the contradiction between data privacy protection and collaborative learning by introducing a federated learning framework. Each substation client only needs to share model parameters and simplify topological features, without transmitting original sensitive data, which greatly reduces the risk of data leakage and can make full use of global data resources in distributed systems. This not only improves the security of the system, but also makes cross-regional and cross-organizational collaboration possible, laying the foundation for the intelligent management of large-scale substation networks. Secondly, the graph neural network (GNN) model is used as the core learning algorithm, which greatly improves the system's modeling ability for complex network structures. By constructing a heterogeneous graph network of device configuration, the present invention can better capture and represent the complex association relationship between substation network devices, thereby improving the accuracy and interpretability of the model. This is crucial for accurately identifying and processing the configuration problems of substation network devices, and helps to improve the efficiency and accuracy of equipment management and fault diagnosis. The present invention extracts the association relationship characteristics between device data through Granger causality test analysis and mutual information analysis, further enhancing the model's ability to understand the intrinsic structure of the data, which is conducive to discovering potential causal relationships and interdependencies, thereby providing a more reliable decision-making basis for equipment configuration and optimization.

[0048] The complex equipment configuration heterogeneous graph network is simplified into a basic heterogeneous graph network through graph simplification technology, which not only reduces the computational complexity, but also helps to extract key topological features, so that the model can better focus on important information. This simplification and feature extraction process not only improves the efficiency of the model, but also enhances its robustness and generalization ability. At the same time, the federated learning server realizes adaptive learning of different substation characteristics by performing similarity analysis on simplified topological features and assigning client weights, which not only ensures the personalization of the model, but also makes full use of global information. This method of balancing local characteristics and global optimization enables the system to better adapt to the operating environment and equipment configuration differences of different substations. By generating equipment verification strategies and completing the verification of network equipment, the present invention realizes a closed loop from data analysis to actual operation, and provides a comprehensive solution for the intelligent management of substation network equipment. In general, this substation-side network equipment elimination and verification method based on deep learning, by integrating advanced technologies such as federated learning, graph neural network, and causal analysis, realizes the collaborative learning and intelligent optimization of distributed systems while protecting data privacy, greatly improves the efficiency, accuracy and adaptability of substation network equipment management, and provides strong technical support for the development of smart grids. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a system structure diagram of a federated learning system for a substation in one of the implementation modes of the present application.

[0050] Figure 2 This is a flow chart of a method for troubleshooting and verifying network equipment at a substation based on deep learning in one of the implementation modes of the present application.

[0051] Figure 3 A schematic diagram of constructing a heterogeneous graph network configured with devices in one embodiment of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0053] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0054] The substation-side network equipment fault elimination and verification method based on deep learning aims to improve the efficiency and accuracy of the substation federated learning system. The core of this method is to use federated learning and graph neural network (GNN) technology to achieve collaborative learning among multiple substations while protecting data privacy. Figure 1 , the system architecture includes clients distributed in various substations in the target area and a central federated learning server. Each substation is equipped with a dedicated client, which establishes a communication connection with all network devices in the station through a pre-configured intranet. This design ensures the local processing of data and lays the foundation for improving the overall performance of the system. As the core of the entire system, the federated learning server pre-builds a shared learning model and distributes its initial configuration to all substation clients. This unified starting point ensures the consistency of the system and provides the possibility for subsequent personalized optimization.

[0055] A stable communication connection is established between the federated learning server and each substation client, which provides the necessary technical support for model updating and knowledge sharing. Both the shared learning model and the client learning model adopt the GNN structure. The GNN model can effectively capture the complex topological relationships and mutual influences between substation network devices, thereby performing well in tasks such as equipment status analysis and fault prediction. In actual applications, each substation client trains and optimizes its GNN model based on local data. This process not only considers the individual characteristics of the equipment, but also includes the correlation information between the equipment. In this way, the system can fully understand and analyze the operating status of the equipment inside the substation, providing a more accurate basis for fault elimination and verification.

[0056] The operating mechanism of the system embodies the perfect combination of distributed learning and centralized coordination. Each substation client performs data processing and model training locally, and regularly transmits model update information to the federated learning server. The server aggregates the update information from each client, optimizes the global model, and then redistributes the optimized model parameters to each client. This cyclic iterative process continuously improves the performance of the entire system while maintaining the privacy of the data. This method allows each substation to make local adjustments to the model according to its own characteristics and needs, thereby achieving a personalized equipment calibration strategy while maintaining the overall consistency of the system. In this way, the system can adapt to the special needs of different substations, while improving the efficiency and accuracy of substation equipment calibration in the target area as a whole.

[0057] Figure 2 FIG. 1 is a flow chart of a method for verifying faults of network equipment at a substation based on deep learning in one embodiment. It should be understood that although Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 At least part of the steps in the above method may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps. Figure 2 As shown, a method for verifying faults of substation network equipment based on deep learning disclosed in the present invention specifically includes the following steps:

[0058] S101. When any one or more target substation clients among all substation clients trigger a preset device verification rule, for any substation client, the substation client obtains device data of all network devices through the substation intranet.

[0059] Among them, when any one or more target substation clients trigger the preset equipment verification rules, each substation client will obtain the equipment data of all network devices through the substation intranet. These data include equipment configuration files, equipment operation logs and equipment network traffic data. Equipment configuration files usually contain various parameter settings of network equipment, such as IP address, subnet mask, routing table, security policy, etc. Equipment operation logs record important events such as equipment operation status, error information, warning information, etc. Equipment network traffic data reflects the communication between network devices, including the source address, destination address, protocol type, data volume and other information of the data packet.

[0060] The process of obtaining this data involves a variety of network protocols and technologies. SNMP (Simple Network Management Protocol) can be used to obtain configuration information and operating status from network devices. Through SNMP, the substation client can send requests to network devices to obtain various object values ​​defined in the MIB (Management Information Base). For device operation logs, the Syslog protocol needs to be used to allow network devices to send log information to a designated log server. The substation client can act as a Syslog server to receive and store these log information. Obtaining network flow data requires the use of network mirroring or flow collection technologies such as NetFlow or sFlow. These technologies allow network devices to send flow statistics to designated collectors, and the substation client can act as such a collector.

[0061] A specific way to implement this step is as follows: The substation client is configured as an SNMP manager, which sends SNMPGET requests to all network devices at regular intervals (such as every 5 minutes) to obtain device configuration information. At the same time, the substation client is configured as a Syslog server to receive log information from all network devices. For network traffic data, NetFlow can be configured on the core switch to send traffic statistics to the substation client at regular intervals (such as 1 minute). When the preset device verification rule is triggered (for example, when a network device is detected to have completed fault elimination or a new device is added), the substation client immediately starts the data collection program and integrates all data from the recent period to form a complete device data set. By simultaneously obtaining device configuration, operation logs, and network traffic data, the operating status of network devices can be understood from multiple dimensions. This comprehensive data collection method helps to discover potential problems and anomalies, especially those that may not be easily detected in a single data source. For example, a configuration change of a device may cause a change in the network traffic pattern, which may not be directly reflected in the log. By comprehensively analyzing these three types of data, the health status and potential risks of network devices can be more accurately judged.

[0062] S102. The substation client uses Granger causality test analysis and mutual information analysis to extract the correlation characteristics between device configuration files, device operation logs and device network traffic data.

[0063] Among them, the purpose of this step is to discover the potential causal relationships and interdependencies between these three types of data, and provide a basis for the subsequent construction of heterogeneous graph networks. Granger causality test is a statistical method used to determine whether one time series helps predict another time series. In this scenario, changes in device configuration files, events in device operation logs, and changes in network traffic data can be regarded as different time series. For example, it is possible to test whether changes in device configuration can predict changes in network traffic, or whether certain types of log events can predict changes in device configuration.

[0064] In specific implementation, the Granger causality test can be performed according to the following steps:

[0065] Convert the data into a time series format, such as counting the number of configuration changes, log events, and network traffic per minute. Perform a stationary test on the time series, and perform difference processing if it is non-stationary. Select an appropriate lag order, and use the AIC or BIC criteria. Construct unrestricted and restricted models, and perform F tests or Wald tests. Determine the existence and direction of causal relationships based on the test results.

[0066] For example, suppose we want to test whether a device configuration change (X) has a Granger causal effect on network traffic (Y). We can use the following model:

[0067]

[0068] Where p is the lag order, α i and β j is the coefficient, ∈ t is the error term. If β j If it is significantly different from zero, it means that X has a Granger causal relationship with Y.

[0069] Mutual information analysis is used to measure the mutual dependence between two random variables. It can capture nonlinear relationships and is therefore a powerful supplement to Granger causality testing. The calculation formula for mutual information is as follows:

[0070]

[0071] Where p(x,y) is the joint probability distribution of X and Y, and p(x) and p(y) are the marginal probability distributions of X and Y respectively.

[0072] In practical applications, device configuration, log events, and network traffic data can be discretized, and then the mutual information between them can be calculated. For example, network traffic can be discretized into three levels: high, medium, and low, log events can be discretized by type, and configuration changes can be discretized by impact range. Then the mutual information between these discretized variables can be calculated to discover the dependencies between them.

[0073] The effect of this step is to obtain a correlation matrix, in which each element represents the strength of the correlation between two variables. For example, it may be found that a certain type of configuration change is highly correlated with a specific type of log event, or that some log events are strongly correlated with sudden changes in network traffic. These findings provide an important basis for the subsequent construction of heterogeneous graph networks, which can help determine the connection relationship between nodes in the graph and the weight of the edges.

[0074] S103. The substation client constructs a device configuration heterogeneous graph network based on the association relationship characteristics and in combination with the device configuration file, the device operation log and the device network traffic data.

[0075] Among them, based on the association relationship features extracted in the previous step, combined with device configuration files, device operation logs and device network traffic data, a device configuration heterogeneous graph network is constructed. The purpose of this step is to integrate different types of data into a unified graph structure to better represent and analyze the complex relationships between devices. A heterogeneous graph network is a graph structure that contains multiple types of nodes and edges. In this scenario, the following types of nodes can be defined:

[0076] 1. Device node: represents each network device; 2. Configuration item node: represents each configuration item in the device configuration file; 3. Log event node: represents different types of log events; 4. Traffic feature node: represents different characteristics of network traffic.

[0077] The edge types may include: 1. Device-configuration item edge: connecting the device node and its corresponding configuration item node; 2. Device-log event edge: connecting the device node and the log event node it generates; 3. Device-traffic feature edge: connecting the device node and the traffic feature node related to it; 4. Configuration item-log event edge: representing the association between configuration item changes and log events; 5. Configuration item-traffic feature edge: representing the association between configuration items and traffic features; 6. Log event-traffic feature edge: representing the association between log events and traffic features.

[0078] A specific implementation method of constructing such a heterogeneous graph network is as follows:

[0079] 1. Create nodes: Create a device node for each network device, traverse the device configuration file, create a configuration item node for each key configuration item, analyze the log file, create a log event node for each type of log event, and create traffic feature nodes for important traffic features (such as total traffic, specific protocol traffic, etc.) based on the traffic data.

[0080] 2. Create edges: Create edges between the device node and its corresponding configuration item node based on the device configuration file; create edges between the device node and the log event node it generates based on the log data; create edges between the device node and the related traffic feature nodes based on the traffic data; use the association relationship features obtained in step S102 to create edges between the configuration item, log event, and traffic feature nodes; the weight of the edge can be determined based on the significance of the Granger causality test or the mutual information value.

[0081] 3. Edge weight setting: For device-configuration item edges, weights can be set according to the importance of the configuration items. For device-log event edges, weights can be set according to the frequency or severity of log events. For device-traffic feature edges, weights can be set according to the significance of traffic features. For other types of edges, the mutual information value calculated in step S2 or the F statistic of the Granger causality test can be used as weights.

[0082] For example, suppose there is a router device with an IP address of 192.168.1.1. Recently, multiple "link down" log events have occurred, and an abnormal increase in ICMP traffic has been observed. In a heterogeneous graph network, this can be represented as: a device node representing the router; a configuration item node representing the IP address configuration, connected to the device node; a log event node representing the "link down" event, connected to the device node; a traffic feature node representing ICMP traffic, connected to the device node; and possibly an edge connecting the "link down" event node and the ICMP traffic node to represent the association between them. This heterogeneous graph network construction method can capture the complex relationship between devices, configurations, logs, and traffic. By integrating different types of data into a unified graph structure, the status and behavior of network devices can be fully represented. By analyzing the abnormal structure or weight changes in the graph, potential problems or abnormal situations can be more easily discovered. When a failure occurs, the root cause of the problem can be quickly located by tracing the associated path in the graph. Based on the characteristics of the graph structure, more advanced prediction models can be developed to predict possible problems or performance bottlenecks.

[0083] S104. After the substation client simplifies the equipment configuration heterogeneous graph network into a basic heterogeneous graph network through graph simplification technology, it extracts simplified topological features from the basic heterogeneous graph network and uploads the simplified topological features to the federated learning server.

[0084] Among them, the device configuration heterogeneous graph network is simplified to a basic heterogeneous graph network, and simplified topological features are extracted from it. The purpose of this step is to reduce the complexity of the graph network and extract the most critical topological features to facilitate the subsequent federated learning process. Graph simplification technology is a method to reduce the size and complexity of the graph while retaining its key structure and characteristics. In this scenario, the following graph simplification technologies can be used:

[0085] 1. Node clustering: Aggregate similar or closely related nodes into a supernode. For example, for configuration item nodes, clustering can be performed based on the type of configuration (such as network configuration, security configuration, performance configuration, etc.). For log event nodes, clustering can be performed based on the severity or type of the event. For traffic feature nodes, clustering can be performed based on protocol type or traffic pattern.

[0086] 2. Edge pruning: Remove edges with weights below a certain threshold and keep only the most important relationships. Specifically, you can calculate the weight distribution of all edges, set a threshold (such as the first 80% of the weight distribution), and remove edges with weights below the threshold.

[0087] 3. Graph systematization: retain the skeleton structure of the graph and remove redundant connections. Specifically, the minimum spanning tree algorithm (such as Kruskal algorithm or Prim algorithm) can be used to retain the skeleton structure of the graph. On the basis of the minimum spanning tree, some important non-tree edges are added to retain the key cycle structure.

[0088] 4. Feature selection: Based on the importance index of nodes or edges, only the most critical features are retained. Specifically, the centrality index of the nodes can be calculated, such as degree centrality, betweenness centrality, or eigenvector centrality, and then the nodes with the highest centrality index ranking are selected as key nodes.

[0089] 5. Build a basic heterogeneous graph network: Reconstruct a simplified graph network using the selected key nodes and edges.

[0090] Extracting topological features from the simplified underlying heterogeneous graph network is the next key step. The topological features that can be extracted include: 1. Global features of the graph: number of nodes, number of edges, average degree, density of the graph, clustering coefficient, diameter (length of the longest and shortest path).

[0091] 2. Node-level features: degree, local clustering coefficient, betweenness centrality, closeness centrality, PageRank value.

[0092] 3. Edge-level features: edge weight and edge betweenness centrality.

[0093] 4. Subgraph features: number of triangles, number of other specific patterns (such as star structures). The number of triangles can be calculated using the following formula:

[0094]

[0095] Where A is the adjacency matrix of the graph.

[0096] 5. Spectral features: eigenvalues ​​of the Laplacian matrix, eigenvectors of the adjacency matrix.

[0097] Combining all the above features into a feature vector is to simplify the topological features. For example, the feature vector can be as follows:

[0098] [100,500,10,0.101,0.3,6,15.5,0.4,0.6,0.2,1000,0.8,0.1,3.5,λ1,λ2,...,λk]

[0099] Among them, these values ​​represent the number of nodes, number of edges, average degree, graph density, global clustering coefficient, diameter, average node degree, average local clustering coefficient, average betweenness centrality, average closeness centrality, number of triangles, edge weight mean, edge weight variance, edge weight skewness, and the first k non-zero eigenvalues ​​of the Laplacian matrix.

[0100] This approach to simplification and feature extraction has the following advantages:

[0101] 1. Reduce computational complexity: By reducing the number of nodes and edges, the computational complexity of subsequent analysis is greatly reduced.

[0102] 2. Highlight key information: The most important structures and relationships in the graph are retained, which helps to identify key patterns and anomalies.

[0103] 3. Standardized representation: Convert graph networks of different sizes and structures into feature vectors of fixed length to facilitate subsequent machine learning processing.

[0104] 4. Privacy protection: By only extracting statistical features instead of the original node and edge information, the privacy of the original data is protected to a certain extent.

[0105] 5. Adaptability: This method can be applied to networks of different sizes and types and has good scalability and versatility.

[0106] The last step in this process is to upload the extracted simplified topological features to the federated learning server. This provides important input for the subsequent federated learning process, allowing the server to perform further analysis and model training based on these features without accessing the original detailed graph structure, thereby achieving efficient distributed learning while protecting privacy.

[0107] S105. The substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters of the client learning model, and uploads the updated client model parameters to the federated learning server.

[0108] Among them, the substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters. The purpose of this step is to use local data to train the model while protecting data privacy, in preparation for the subsequent federated learning process. The choice of client learning model is crucial for this task. Considering that graph structured data is processed, a suitable choice is the graph neural network (GNN) model. Specifically, a graph convolutional network (GCN) or a graph attention network (GAT) can be used as the basic model. Here, GCN is used as an example to illustrate the training process.

[0109] The basic principle of GCN is to propagate and aggregate node features through the adjacency relationship of the graph. The calculation formula of the GCN layer is as follows:

[0110]

[0111] in, is the adjacency matrix with self-loops added, yes The degree matrix, H (l) is the node feature matrix of the lth layer, W (l) is a learnable weight matrix, and σ is an activation function. The GCN model architecture includes an input layer, multiple GCN layers, a fully connected layer, and an output layer. The specific training process is as follows:

[0112] 1. Data preparation: Convert the device configuration heterogeneous graph network into a format suitable for GCN processing, including the adjacency matrix A and the node feature matrix X. Assign a label Y to each node (for example, normal / abnormal, or a specific configuration category). Divide the dataset into training, validation, and test sets.

[0113] 2. Model definition: Build a model with multiple GCN layers, for example:

[0114] InputLayer->GCNLayer(64units)->ReLU->Dropout(0.5)->GCNLayer(32units)->ReLU->Dropout(0.5)->DenseLayer(num_classes)->Softmax

[0115] 3. Loss function and optimizer: For multi-classification problems, use the cross entropy loss function. Choose an appropriate optimizer, such as the Adam optimizer.

[0116] 4. Training loop: Pass input data to the model and get predictions. Compare predictions to true labels and calculate loss. Calculate gradients. Use optimizers to update model parameters. Evaluate model performance on validation set and save the best model.

[0117] 5. Parameter extraction:

[0118] After training is completed, the model parameters are extracted as client model parameters.

[0119] In step S105, the model can learn valuable patterns and features from the local heterogeneous graph network of device configuration. Since the training process is performed completely locally, the original data will not leave the substation client, protecting data privacy. Each substation client can train a personalized model based on its own data characteristics. Graph neural networks can effectively utilize graph structure information and are more suitable for processing complex relational data such as network device configuration than traditional machine learning methods. By analyzing model parameters and node embeddings, some interpretable insights about network configuration can be obtained. Finally, the updated client model parameters are uploaded to the federated learning server. These parameters will be aggregated with the parameters of other clients on the server side to form a global model. This method not only protects the data privacy of each substation, but also can use the knowledge of all substations to improve the overall performance of the model.

[0120] S106. After receiving the simplified topology features and client model parameters of all substation clients, the federated learning server performs feature similarity analysis on all simplified topology features, and assigns client weights to all substation clients according to the feature similarity analysis results.

[0121] Among them, the federated learning server receives the simplified topology features and client model parameters of all substation clients, then performs feature similarity analysis on the simplified topology features and assigns weights to each client based on the analysis results. The purpose of this step is to evaluate the similarity and representativeness of each client data so as to give a more reasonable weight allocation in the subsequent model aggregation. Feature similarity analysis is a key process that can help understand the degree of similarity between different substations and the uniqueness of each substation data. The specific process is as follows:

[0122] First, the simplified topological features uploaded by each client need to be standardized to eliminate the scale differences between different features. Commonly used standardization methods include: Z-score standardization: Min-Max Scaling:

[0123] Then select an appropriate similarity measure to calculate the similarity between clients. Common similarity measures include: Euclidean distance, cosine similarity, Pearson correlation coefficient, etc. Based on the selected similarity measure, calculate the similarity between each pair of clients and construct a similarity matrix S. For N clients, S will be an NxN matrix. Use a clustering algorithm (such as K-means or hierarchical clustering) to group the clients to identify similar client groups. Evaluate the representativeness of each client in the group to which it belongs. This can be achieved by calculating the distance between the client and the center of its group. Based on the results of the similarity and representativeness analysis, assign weights to each client. Clients with strong representativeness receive higher weights, and clients with high uniqueness (low similarity to other clients) should also receive certain weights to retain their unique information.

[0124] Through similarity analysis, clients that may have data quality issues (for example, clients that are very different from all other clients) can be identified. Cluster analysis helps identify substation groups with similar characteristics, which may reflect certain common operational characteristics or environmental factors. The weight distribution mechanism takes into account the representativeness of client data while retaining unique information, which helps to improve the fairness and efficiency of federated learning. By assigning different weights to different clients, the final aggregated model can better adapt to a variety of different substation environments. Similarity analysis can also help identify abnormal substation configurations, which is very valuable for preventing potential failures and optimizing system configuration. There may be opportunities for knowledge transfer between clients with high similarity, which provides direction for subsequent model optimization. Finally, the server saves the calculated weight distribution results for subsequent model aggregation. This intelligent weight distribution mechanism based on data characteristics can significantly improve the performance and adaptability of federated learning in heterogeneous environments.

[0125] S107. The federated learning server trains the shared learning model in combination with all client model parameters and corresponding client weights, updates the shared model parameters of the shared learning model, and sends the updated shared model parameters to all substation clients.

[0126] Among them, the federated learning server performs weighted averaging of the model parameters of all clients according to the assigned weights, thereby updating the global model. This step is the core of federated learning, which integrates the local knowledge of each client to form a unified global model while taking into account the representativeness and uniqueness of each client's data. The specific implementation process is as follows:

[0127] For each parameter in the global model, a weighted average method is used for aggregation. Assuming there are N clients, the weight of the i-th client is w_i, and its model parameter is θ_i, then the update formula for the global model parameter θ_global is: The weight w_i has been calculated in step S106 and satisfies Before performing parameter aggregation, it is necessary to ensure that the model structures of all clients are consistent. Specifically, before federated learning begins, the server defines and distributes a standard model structure. During the aggregation process, it checks whether the parameters uploaded by each client conform to the predefined structure. If there are slight differences in the models between clients (for example, due to different random initializations), some compatibility processing is required: For missing parameters, the current value of the global model or zero value can be used to fill in. For redundant parameters, you can choose to ignore them.

[0128] During the aggregation process, possible anomalies also need to be detected and handled. If the parameter value of a client is obviously abnormal (for example, it contains NaN or infinity), you can choose to exclude the client or use the average value of other clients instead. If the parameter update direction of a client is significantly different from that of most clients, its weight needs to be adjusted or specially handled. After completing the parameter aggregation, use the aggregation results to update the global model. Specifically, replace the current parameters of the global model with the aggregated parameters, update the version number or round count of the global model, and record the updated timestamp and related performance indicators.

[0129] By using the weights calculated in S106, the model aggregation process takes into account the representativeness and uniqueness of each client's data. It not only retains the common characteristics of mainstream clients, but also retains the unique information of niche clients to a certain extent. Even if the model of an individual client is abnormal, its impact will be limited to a controllable range due to the existence of weights. The weights can be adjusted dynamically so that the model can adapt to changes in the quality of client data in different periods. Weighted averaging is a computationally efficient aggregation method suitable for large-scale federated learning scenarios. The entire process only involves the exchange of model parameters, and there is no need to access the original data, which protects the client's data privacy. Through this weighted averaging method, the knowledge of multiple substations can be effectively integrated into a unified global model, thereby improving the generalization ability and applicability of the model. This global model will be distributed to each client in the next round of federated learning for further local training and optimization.

[0130] S108. For any target substation client, the target substation client updates the shared model parameters to the local client learning model, inputs the device configuration heterogeneous graph network into the client learning model after parameter update, and outputs the configuration mode and configuration parameter mapping table of all network devices through the client learning model after parameter update.

[0131] Among them, after the target substation client receives the updated shared model parameters sent by the federated learning server, these parameters are first updated to the local client learning model. This process usually involves replacing the weights and bias values ​​in the model, and also includes updating statistical information such as the mean and variance of the BatchNorm layer. After the update is completed, the target substation client will pass the previously built device configuration heterogeneous graph network as input data into the updated client learning model. The updated client learning model uses the graph neural network (GNN) technology when processing this input. The output of the model includes two key parts: configuration mode and configuration parameter mapping table. The configuration mode is a classification result that indicates which type or mode the current network device configuration belongs to (such as standard configuration, high security configuration, high performance configuration, etc.). This can be achieved through a softmax function, for example:

[0132]

[0133] Among them, y i is the probability of the ith configuration mode, z i is the raw score output by the model, and K is the total number of configuration patterns.

[0134] The configuration parameter mapping table is a more complex structure that provides a recommended value or a range of possible values ​​for each device and each configuration item. This can be achieved through a regression task. For each configuration parameter p, the model outputs a predicted value and an uncertainty estimate σ:

[0135]

[0136] where f θ and g θ are different parts of the model, x is the input graph data, and θ is the model parameters.

[0137] This output method not only provides recommended configuration values, but also gives the confidence of this recommendation, which is very valuable for the subsequent device verification strategy formulation. For example, for the ACL configuration of a router, the model may output: "It is recommended to use extended ACL, with a confidence of 80%; it is recommended to apply it on the inbound interface, with a confidence of 95%; the specific rules should include the following IP addresses and ports (list), and the confidence varies depending on the rule (60%-90%)." In this way, the client learning model is able to provide customized configuration recommendations for each device based on the global information of the entire substation network. These recommendations take into account not only the characteristics of a single device, but also the role of the device in the entire network and its interaction with other devices.

[0138] S109. The target substation client generates a device verification strategy based on the configuration mode and the configuration parameter mapping table, and completes the verification of all network devices through the device verification strategy.

[0139] Among them, after obtaining the configuration mode and configuration parameter mapping table, the target substation client begins to generate the equipment verification strategy. This process involves converting the abstract suggestions output by the model into specific and executable verification steps. The process of generating the strategy can be divided into several sub-steps: 1. Configuration mode analysis: First, according to the configuration mode output by the model, determine the overall verification direction. For example, if the configuration mode is identified as "high security configuration", the verification strategy will pay more attention to security-related configuration items, such as firewall rules, encryption settings, etc. 2. Parameter mapping table analysis: For each device and configuration item, analyze the recommended values ​​and uncertainty estimates given by the model. A threshold can be set, for example, only considering suggestions with a confidence level of more than 70%. 3. Rule generation: Based on the above analysis, a series of specific verification rules are generated for each device. These rules include:

[0140] Configuration item check: Verify whether a configuration item is within the recommended range.

[0141] Consistency check: Ensure that the configurations of related devices are consistent, such as VLAN configuration, routing protocol parameters, etc.

[0142] Security check: Verify whether security policies are met, such as password complexity, access control lists, etc.

[0143] Performance optimization check: Checks whether recommended performance optimization settings, such as QoS configuration, buffer size, etc., are adopted.

[0144] 4. Prioritization: Prioritize the verification rules according to the importance and uncertainty of the configuration items.

[0145] 5. Execution plan formulation: According to the sorting results, formulate an execution plan for the verification rules. This includes determining the execution order, estimating the time required for each verification, and considering the potential impact on network operation.

[0146] An example of a generated device calibration strategy is as follows:

[0147] 1. Check the VLAN configuration of the core switch (priority: high, estimated time: 10 minutes)

[0148] 2. Verify OSPF area settings for all routers (Priority: High, Estimated time: 15 minutes)

[0149] 3. Review the firewall's access control list (Priority: Medium, Estimated time: 30 minutes)

[0150] 4. Check the NTP synchronization status of all devices (priority: low, estimated time: 5 minutes)

[0151] Based on this strategy, the target substation client can start to perform the actual verification work. The verification work is as follows: For checks that can be performed by scripts or automated tools, the system automatically performs and records the results. For example, you can use SNMP or SSH to connect to the device, retrieve configuration information and compare it with the recommended value. For items that require a certain degree of manual judgment, the system will provide guidance and auxiliary information, but the final decision may require operator confirmation. For complex or high-risk inspection items, the system will generate detailed inspection guides for manual execution by professionals. The results of each verification are recorded in detail, including whether it meets expectations, specific differences, possible impacts, etc. The system may use natural language processing technology to generate easy-to-understand summary reports. For non-conformities found, the system will give correction suggestions, which may include specific configuration commands or operation steps. For potential high-risk issues, the system will immediately issue an alarm. The verification results will be used to further optimize the local model, such as adjusting the model parameters through reinforcement learning methods to make it perform better in the next verification.

[0152] In this way, the configuration verification of the substation network becomes more intelligent, efficient and comprehensive. It can not only detect and correct configuration errors in a timely manner, but also actively optimize network performance and security, greatly improving the reliability and operation efficiency of the substation network. At the same time, this machine learning-based method is also highly adaptable and can continuously improve itself as the network environment changes, providing strong support for the long-term stable operation of the substation.

[0153] In one implementation manner, the substation client uses the Granger causality test analysis method and the mutual information analysis method to extract the correlation relationship characteristics between the device configuration file, the device operation log, and the device network traffic data, including the following steps:

[0154] The substation client converts the equipment configuration files, equipment operation logs and equipment network traffic data into time series feature data, and processes all the time series feature data in a standardized manner;

[0155] The substation client determines the optimal lag order of the Granger causality test analysis method based on the time series characteristic data and using the AIC information criterion;

[0156] The substation client performs a multivariate Granger causality test analysis on all time series feature data according to the optimal lag order, and generates linear correlation characteristics between device configuration files, device operation logs, and device network traffic data based on the analysis results of the Granger causality test analysis;

[0157] The substation client converts all time series characteristic data into discrete characteristic data;

[0158] The substation client uses mutual information analysis to extract nonlinear correlation features between device configuration files, device operation logs, and device network traffic data from discrete feature data;

[0159] The substation client integrates linear association features and nonlinear association features into association relationship features among equipment configuration files, equipment operation logs, and equipment network traffic data.

[0160] In this embodiment, refer to Figure 3, the substation client first converts the device configuration file, device operation log, and device network traffic data into time series feature data. This process involves unifying data in different formats into the form of time series. For the device configuration file, it is necessary to extract the timestamp of the configuration change and use the various configuration parameters as features; for the device operation log, the timestamp of the log can be directly used, and the various indicators in the log can be used as features; for the device network traffic data, the traffic features such as the number of packets, the number of bytes, the distribution of protocol types, etc. can be counted at fixed time intervals (such as every minute or every hour). For example, suppose there is a configuration file for a router, which contains information such as IP address, subnet mask, routing table, etc. This information can be converted into time series data as shown below:

[0161] Timestamp, IP address change, subnet mask change, number of routing table entries

[0162] 2023-01-0100:00:00,192.168.1.1,255.255.255.0,10

[0163] 2023-01-0212:30:00,192.168.1.2,255.255.255.0,12 ...

[0165] For the device operation log, there will be the following time series data:

[0166] Timestamp, CPU usage, memory usage, number of active connections

[0167] 2023-01-01 00:01:00,35%,60%,1000

[0168] 2023-01-01 00:02:00,40%,62%,1050 ...

[0170] Network traffic data is converted into:

[0171] Timestamp, Inbound traffic (Mbps), Outbound traffic (Mbps), TCP connections, UDP packets

[0172] 2023-01-0100:00:00,50,30,500,1000

[0173] 2023-01-0100:01:00,55,35,520,1100 ...

[0175] After the conversion is completed, the substation client standardizes all time series feature data. The purpose of standardization is to adjust features of different scales to the same scale for subsequent analysis. Common standardization methods include Z-score standardization and Min-Max scaling. Taking CPU usage as an example, assume that the original data is [35%, 40%, 38%, 45%, 42%], the average is 40%, and the standard deviation is about 3.54%. After Z-score standardization, the data becomes [-1.41, 0, -0.56, 1.41, 0.56]. The standardized data is more suitable for subsequent analysis because it eliminates the dimensional differences between different features, making the weights of each feature more balanced in the analysis. This is especially important for subsequent Granger causality test and mutual information analysis, because these methods are sensitive to the scale of the data.

[0176] In this step, the substation client uses AIC (Akaike Information Criterion) to determine the optimal lag order for the Granger causality test analysis method. This process is to find the best balance between model complexity and goodness of fit, thereby improving the accuracy and reliability of subsequent Granger causality tests. The basic form of AIC is:

[0177] AIC=2k-2ln(L)

[0178] Where k is the number of parameters in the model and L is the maximum likelihood estimate of the model.

[0179] In time series analysis, an AIC value is calculated for each possible lag order p. The optimal lag order is the p value that minimizes the AIC value. Specifically, for the vector autoregression (VAR) model, AIC can be expressed as:

[0180]

[0181] Among them, |Σ p | is the determinant of the residual covariance matrix of the p-order VAR model, n is the number of time series variables, and T is the sample size. The implementation process is as follows: First, determine a maximum lag order pmax, which can be set to 10% of the sample size, for example. For each possible lag order p (from 1 to pmax), fit a VAR(p) model. Calculate the AIC value of each model. Select p with the smallest AIC value as the optimal lag order. For example, assume there are three time series variables: CPU usage, memory usage, and network traffic. The sample size is 1000, and pmax is set to 10. The calculation results are as follows:

[0182] p=1, AIC=-15200; p=2, AIC=-15500; p=3, AIC=-15800; p=4, AIC=-15900; p=5, AIC=-15850; p=6, AIC=-15800; p=7, AIC=-15750

[0183] In this example, the AIC value is minimum when p=4, so the optimal lag order is 4.

[0184] Using AIC to select the optimal lag order can balance model complexity and goodness of fit. AIC penalizes overly complex models to prevent overfitting. Moreover, AIC is applicable to multivariate time series and can capture complex interactions between variables. Through this step, the substation client determines the optimal lag order for each set of time series data that needs to be Granger causality tested. After determining the optimal lag order, the substation client begins to perform multivariate Granger causality test analysis on all time series feature data. Granger causality test is a statistical hypothesis test used to determine whether one time series has predictive power for the future values ​​of another time series. The basic idea of ​​multivariate Granger causality test is that if the model including all variables has significantly better predictive power than the model excluding a certain variable, then the excluded variable is considered to be the Granger cause of other variables. The specific implementation process is as follows:

[0185] Build a complete model: a vector autoregression (VAR) model that includes all variables. For n variables, a p-order VAR model can be expressed as:

[0186] Y t =c+A1Y t-1 +A2Y t-2 +...+A p Y t-p +e t

[0187] Among them, Y t is an n×1 vector, c is a constant term, A i is an n×n coefficient matrix, e t is the error term.

[0188] Then build a constrained model. For each variable, build a model that excludes the variable. Next, perform an F test, which specifically compares the residual sum of squares of the complete model and the constrained model. The F statistic calculation formula is:

[0189]

[0190] Where RSS_R is the residual sum of squares for the constrained model, RSS_U is the residual sum of squares for the full model, q is the number of constraints, T is the sample size, and k is the number of parameters for the full model.

[0191] Next, the p-value is calculated based on the F statistic and the degrees of freedom. If the p-value is less than the significance level (usually 0.05), Granger causality is considered to exist.

[0192] Based on the results of the Granger causality test, the substation client can generate linear correlation features between device configuration files, device operation logs, and device network traffic data. These features include:

[0193] Direction of causality: which variables influence other variables.

[0194] The strength of the causal relationship can be expressed by the size of the F statistic or the p value.

[0195] Lag effect: The optimal lag order reflects the time scale of the causal relationship.

[0196] These linear correlation features provide important information for understanding the mutual influence between equipment operating states. For example, changes in equipment configuration will affect network traffic after 2 time units, or changes in CPU usage will immediately affect memory usage. This information is of great value for predicting equipment behavior, optimizing configuration, and detecting potential problems early. Through this step, the substation client not only identifies the causal relationship between various equipment data, but also quantifies the strength and time characteristics of these relationships, providing a solid data foundation for subsequent equipment management and optimization.

[0197] In the next step, the substation client converts all time series feature data into discrete feature data. This process is to prepare for the subsequent mutual information analysis, because mutual information analysis usually requires the input data to be discrete. Discretizing continuous time series data can simplify calculations, reduce the impact of noise, and help capture nonlinear relationships in the data. There are many discretization methods, and the commonly used ones include:

[0198] Equal-width binning: Divide the data range into n equal intervals.

[0199] Equal-frequency binning: Divide the data into n groups of equal size, each group contains the same number of samples.

[0200] K-means clustering: Use the K-means algorithm to cluster the data, with each cluster as a discrete category.

[0201] Quantile-based binning: Use quantiles (such as quartiles) to divide the data.

[0202] Taking equal-width binning as an example, the specific implementation process is as follows: Determine the maximum and minimum values ​​of each feature. Select the appropriate number of bins, usually using the Sturges formula: Where n is the number of samples and k is the recommended number of bins. Calculate the width of each bin: Assign each data point to the corresponding bin. For example: Assume there is time series data of CPU usage ranging from 0% to 100%. The number of samples is 1000, and the number of bins calculated using the Sturges formula is 11. The width of the bin = (100%-0%) / 11≈9.09%. So we can get the following bins: 0: [0%, 9.09%); 1: [9.09%, 18.18%); 2: [18.18%, 27.27%)... 10: [90.91%, 100%). For each CPU usage data point, convert it to the corresponding bin number. For example: 5%->0; 15%->1; 95%->10.

[0203] Similar discretization is performed for other features, such as memory usage, network traffic, etc. Special processing may be required for the data in the device configuration file. For example, IP addresses can be classified according to subnets instead of simply binning by numerical range. For event data in the device operation log, discretization can be performed according to the severity or frequency of the event. For network traffic data, it may be necessary to consider the difference between normal traffic and abnormal traffic and retain this distinction during discretization. Discretization can reduce the complexity of the data, map continuous values ​​to a limited number of discrete categories, and simplify the data structure. It can also reduce the impact of noise, and small fluctuations will be classified into the same box, which helps to highlight the main data patterns. Discretized data is easier to capture nonlinear relationships, which is particularly useful for subsequent mutual information analysis. Mutual information is a method to measure the mutual dependence between two random variables. It can capture nonlinear relationships between variables, which is something that linear correlation coefficients cannot do.

[0204] In this embodiment, the specific implementation process is as follows: For each discretized feature, the frequency of occurrence of each category is calculated. For example, for CPU usage, the number of data points in each box is calculated and divided by the total number of data points. For each pair of features, their joint frequency of occurrence is calculated. For example, the number of data points with CPU usage in box i and memory usage in box j is calculated and divided by the total number of data points. The mutual information between each pair of features is calculated using the mutual information calculation formula. In order to make the mutual information between different feature pairs comparable, standardization is usually performed. A commonly used standardization method is to calculate the standardized mutual information (NMI):

[0205]

[0206] Where H(X) and H(Y) are the entropies of X and Y respectively.

[0207] The mutual information value directly reflects the strength of the nonlinear association between features. By setting a threshold, a correlation network can be constructed to show which features have significant nonlinear associations. By calculating the average mutual information between each feature and all other features, the overall importance of the feature can be evaluated. If two features have high mutual information with a third feature, it may indicate that the two features contain redundant information. In this embodiment, there may be a nonlinear association between device configuration parameters and network traffic patterns, indicating how configuration changes affect network behavior. Certain events in the device operation log may have a strong nonlinear association with CPU or memory usage, indicating potential performance issues. Certain features of network traffic may have a strong association with multiple device parameters, indicating key network status indicators. Through this step, the substation client is able to capture complex relationships that may be overlooked by linear analysis, providing richer information for a comprehensive understanding of the equipment operation status. Detailed description of step S6:

[0208] Next, the substation client integrates the linear correlation features and nonlinear correlation features obtained in the previous steps to form a comprehensive set of correlation relationship features. This integration process is not just a simple merger, but it takes into account the complementarity of the two features and how to most effectively represent and use this information. The specific integration process may include the following aspects:

[0209] For each pair of variables, there are two indicators: the linear association strength obtained by the Granger causality test and the nonlinear association strength obtained by the mutual information analysis. The linear and nonlinear scores can be fused as two components of a two-dimensional vector. Based on the fused scores, a comprehensive association network can be constructed. In this network, nodes represent different features (such as CPU usage, specific configuration parameters, network traffic indicators, etc.), the weights of the edges represent the fused association strength, and the direction of the edges can be based on the results of the Granger causality test. Considering the linear and nonlinear associations comprehensively, the features are ranked in importance. Next, through association pattern recognition, special association patterns between features are found. For example, strong linear and weak nonlinear associations can represent simple dependencies, weak linear and strong nonlinear associations indicate complex interactions, and double high associations represent key mutual influencing factors.

[0210] By analyzing the strong correlation pairs and potential impact chains in the correlation network, it is possible to predict device failure or performance degradation. For example, if the correlation between configuration parameter P2 and network traffic N is found to suddenly increase, it may indicate that network equipment is about to have problems. The system can issue a warning in advance and arrange maintenance personnel to check the relevant equipment. When an anomaly occurs, the correlation network can help quickly locate the root cause of the problem. For example, if the CPU usage suddenly soars, by tracing the correlation chain, it may be found that this is related to a specific configuration parameter change. This analysis can significantly shorten the troubleshooting time. According to the feature importance sorting, monitoring and resource allocation can be optimized. For example, if network traffic (N) is identified as the most critical indicator, the monitoring frequency of network devices can be increased, or the network infrastructure can be upgraded first. By analyzing the correlation between configuration parameters (such as P1, P2) and other operating indicators, device configuration can be optimized. For example, if P2 is found to have a strong correlation with both network traffic and CPU usage, P2 can be adjusted to optimize overall system performance. By comparing the current correlation pattern with the historical pattern, abnormal changes in system behavior can be detected. For example, if the correlation between P1 and M suddenly weakens, this may indicate that some subsystems are no longer working as expected and require further investigation. By analyzing the strength of associations between different devices, highly coupled groups of devices can be identified. This information can be used to optimize load balancing strategies to ensure that high-load tasks are not performed simultaneously on devices that have a large impact on each other. Correlation signatures can be used to detect potential security threats. For example, if certain network traffic signatures suddenly show strong correlations with system parameters that are not usually correlated, this may indicate an abnormal data access pattern that requires a security review.

[0211] In one implementation manner, the substation client uses the mutual information analysis method to extract nonlinear correlation features between device configuration files, device operation logs, and device network traffic data from discrete feature data, including the following steps:

[0212] The substation client uses the mutual information calculation formula to respectively calculate the first joint information entropy between the device configuration file and the device operation log, the second joint information entropy between the device configuration file and the device network traffic data, and the third joint information entropy between the device configuration file, the device operation log and the device network traffic data;

[0213] The substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy;

[0214] The substation client determines the nonlinear correlation characteristics among device configuration files, device operation logs, and device network traffic data based on the total mutual information.

[0215] In this embodiment, in order to calculate the first joint information entropy, the device configuration file is regarded as a random variable X, and the device operation log is regarded as a random variable Y. Then, the joint occurrence frequency of X and Y is counted, p(x, y), p(x) and p(y) are estimated, and the mutual information calculation formula is substituted to calculate the mutual information. Similarly, to calculate the second joint information entropy, the device configuration file is taken as X and the network traffic data is taken as Y. The network traffic data may require feature extraction, such as calculating the number of data packets or traffic size per minute. The third joint information entropy involves three variables, and its calculation formula is expanded to:

[0216] I(X;Y;Z)=I(X;Y)+I(X;Z|Y)=H(X)+H(Y)+H(Z)-H(X,Y)-H(Y,Z)-H(X,Z)+H(X,Y,Z)

[0217] Where H represents entropy and H(X,Y,Z) is the joint entropy of the three variables. The effect of implementing this step is to quantify the information dependencies between different data sources. High mutual information values ​​indicate strong correlation, while low values ​​indicate weak correlation or independence. This lays the foundation for subsequent nonlinear association analysis and helps to identify hidden data patterns and dependencies, thereby more fully understanding the dynamic characteristics of the substation system.

[0218] Next, the substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy.

[0219] In this step, the three joint information entropies calculated in the previous step need to be integrated to obtain a comprehensive total mutual information index. This total mutual information will reflect the overall nonlinear correlation between device configuration files, operation logs, and network traffic data. The total mutual information calculation formula is as follows:

[0220] I(X;Y;Z)=H(X;Y)+H(Y;Z)H(X;Y;Z)

[0221] Among them: I(X; Y; Z) represents the total mutual information, H(X; Y) represents the first joint information entropy, H(Y; Z) represents the second joint information entropy, and H(X; Y; Z) represents the third joint information entropy.

[0222] This approach takes into account the conditional dependencies between variables and can more accurately capture the information redundancy and complementarity between the three. In actual implementation, the time dependency of the data may also need to be considered. For example, time lags can be introduced to calculate the mutual information between different time points to form a time-dependent total mutual information. This can capture the dynamic correlation in the system. The effect of calculating the total mutual information is to obtain a comprehensive indicator that reflects the overall nonlinear correlation between the three data sources. A high total mutual information value indicates that there is a strong interdependence between these data sources, which may mean that there is a close interaction between system components. A low total mutual information value may indicate that the data sources are relatively independent, or there is a potential system isolation problem.

[0223] Based on the total mutual information calculated previously, the substation client needs to further analyze and determine the specific nonlinear correlation characteristics. First, a threshold θ can be set. When the total mutual information exceeds this threshold, it is considered that there is a significant nonlinear correlation. The selection of the threshold can be based on historical data analysis or expert experience. For example, the 95% quantile of the total mutual information distribution can be selected as the threshold. Next, for the significant associations identified, feature extraction and pattern recognition are required. One method is to use nonlinear time series analysis techniques, such as the reconstructed phase space method. This method first embeds the time series into a high-dimensional space:

[0224] Y(t)=[X(t),X(t+τ),...,X(t+(m-1)τ)]

[0225] where m is the embedding dimension and τ is the time delay. Attractor structures can then be identified in this reconstructed phase space, which reflect the nonlinear dynamical characteristics of the system.

[0226] Another approach is to use kernel methods for nonlinear feature extraction. For example, kernel principal component analysis (KernelPCA) can be used to extract nonlinear principal components:

[0227] K(xi,xj)=exp(-||xi-xj|| 2 / (2σ 2 ))

[0228] Where K is the Gaussian kernel function, xi and xj are data points, and σ is the kernel width parameter. By solving the eigenvalue problem, nonlinear principal components can be obtained, which reflect the nonlinear structure in the data.

[0229] The nonlinear correlation features identified by these methods include threshold effects between configuration parameters and system performance, periodic correlations between network traffic patterns and device states, and bursty system behaviors caused by multiple parameter combinations.

[0230] In one embodiment, after the substation client simplifies the device configuration heterogeneous graph network into a basic heterogeneous graph network through graph simplification technology, it extracts simplified topological features from the basic heterogeneous graph network, and uploads the simplified topological features to the federated learning server, including the following steps:

[0231] The substation client performs node clustering and edge pruning on the equipment configuration heterogeneous graph network according to the association relationship characteristics to obtain a simplified heterogeneous graph network.

[0232] The substation client uses the minimum spanning tree algorithm to extract the heterogeneous graph network skeleton from the simplified heterogeneous graph network;

[0233] The substation client calculates the node centrality index in the simplified heterogeneous graph network and selects the key nodes in the simplified heterogeneous graph network according to the node centrality index;

[0234] The substation client reconstructs the equipment configuration heterogeneous graph network into a basic heterogeneous graph network by combining the heterogeneous graph network skeleton and key nodes;

[0235] Simplified topological features are extracted from the underlying heterogeneous graph network and uploaded to the federated learning server.

[0236] In this embodiment, the purpose of node clustering is to group similar nodes together to reduce the complexity of the network. A commonly used clustering method is the spectral clustering algorithm. The algorithm first constructs a similarity matrix S, where Sij represents the similarity between nodes i and j. Then calculate the graph Laplacian matrix L=DS, where D is the degree matrix. Then solve the generalized eigenvalue problem Lv=λDv, select the eigenvectors corresponding to the k smallest non-zero eigenvalues, and form a matrix V. Finally, perform k-means clustering on the row vectors of V to obtain the clustering results of the nodes. For example, suppose there are n nodes and they are to be clustered into k categories. First, calculate the n×n similarity matrix S, and the similarity can be calculated based on node attributes or topological structures. Then solve the n×k eigenvector matrix V, perform k-means clustering on each row of V, and obtain the category label of each node.

[0237] Edge pruning aims to remove unimportant connections in the network and retain key edges. One method is to prune based on edge weights. A threshold θ can be set. When the weight of an edge is less than θ, it is deleted. The weight of an edge can be determined based on the previously calculated association relationship characteristics. Another method is to prune based on a centrality indicator. For example, the betweenness centrality of an edge can be calculated to retain edges with high centrality. The formula for calculating the betweenness centrality of an edge is:

[0238] CB(e)=Σs≠t≠vσst(e) / σst

[0239] where σst is the number of shortest paths between nodes s and t, and σst(e) is the number of shortest paths through edge e.

[0240] Through node clustering and edge pruning, a simplified heterogeneous graph network can be obtained. This simplified network retains the main structural features of the original network while greatly reducing the number of nodes and edges. For example, a network that originally may have thousands of nodes and tens of thousands of edges may only have a few hundred nodes and more than a thousand edges after simplification. The effect of implementing this step is to significantly reduce the complexity of the network, making subsequent analysis and calculation more efficient. At the same time, through clustering and pruning, the key structures and important associations in the network are highlighted, which helps to better understand the core components and key dependencies of the substation system.

[0241] Next, the substation client uses the minimum spanning tree algorithm to extract the heterogeneous graph network skeleton from the simplified heterogeneous graph network. In this step, the goal is to extract a most basic connection structure, namely the network skeleton, from the simplified heterogeneous graph network. The minimum spanning tree (MST) algorithm is an effective way to achieve this goal. MST is a loop-free connected subgraph that contains all nodes in the graph and has the smallest sum of edge weights. The two most commonly used MST algorithms are the Kruskal algorithm and the Prim algorithm. Taking the Kruskal algorithm as an example, its implementation steps are as follows: Sort all edges in the graph from small to large according to weight. Create a forest F, where each node is an independent tree at the beginning. Traverse the sorted edge list: If the two nodes connected by the current edge are not in the same tree, add this edge to F and merge the two trees. If the two nodes connected by the current edge are already in the same tree, skip this edge. When there is only one tree left in F, the algorithm ends, and this tree is the minimum spanning tree. When applying the MST algorithm in a heterogeneous graph network, special attention should be paid to the definition of edge weights. Since heterogeneous graphs contain different types of nodes and edges, the weight of the edge can be defined based on the previously calculated association relationship features. For example, the inverse of the mutual information can be used as the weight of the edge, so that the edge with higher mutual information has smaller weight and is more likely to be selected into the MST. Example of weight calculation formula: w(e) = 1 / (ε+I(X; Y)). Where I(X; Y) is the mutual information between the two nodes X and Y connected by edge e, and ε is a small positive number used to avoid division by zero errors.

[0242] The effect of extracting the network skeleton of a heterogeneous graph is to obtain an extremely concise subgraph that reflects the main structure of the entire network. For example, the originally simplified heterogeneous graph may have 500 nodes and 1500 edges. After being processed by the MST algorithm, the obtained network skeleton may only retain 499 edges (for a graph with n nodes, its MST has exactly n-1 edges). This network skeleton retains the most important edges connecting all nodes, reflecting the most basic and critical associations in the substation network equipment. At the same time, since the number of edges is greatly reduced, the computational complexity of subsequent analysis is also greatly reduced. This provides an efficient analysis basis for the optimization and risk assessment of substation systems.

[0243] Next, the substation client calculates the node centrality index in the simplified heterogeneous graph network and selects the key nodes in the simplified heterogeneous graph network based on the node centrality index. In this step, node centrality is an indicator used to measure the importance of nodes in the graph. In a heterogeneous graph network, nodes with high centrality usually represent key components or parameters in the system. Commonly used centrality indicators include degree centrality, betweenness centrality, closeness centrality, and eigenvector centrality.

[0244] Degree Centrality: The simplest centrality indicator, which indicates the number of edges directly connected to a node. In a directed graph, it can be divided into in-degree and out-degree. Calculation formula: CD(v) = deg(v) / (N-1), where deg(v) is the degree of node v and N is the total number of nodes in the graph.

[0245] Betweenness Centrality: Measures the number of times a node is an intermediate node in the shortest path between other pairs of nodes in the network. Calculation formula:

[0246] CB(v)=Σs≠v≠t(σst(v) / σst)

[0247] where σst is the number of shortest paths between nodes s and t, and σst(v) is the number of shortest paths through node v.

[0248] Closeness Centrality: It measures the inverse of the average distance from a node to all other nodes in the graph. Calculation formula:

[0249] CC(v)=(N-1) / Σud(v,u)

[0250] where d(v,u) is the shortest path length from node v to u.

[0251] Eigenvector Centrality: Considers the importance of a node not only by the number of its connections, but also by the importance of the nodes it is connected to. The calculation involves solving the characteristic equation Ax=λx, where A is the adjacency matrix, x is the eigenvector, and λ is the largest eigenvalue. In heterogeneous graph networks, these centrality metrics need to be appropriately modified to account for the heterogeneity of nodes and edges. For example, different weights can be given to different types of edges when calculating degree centrality. After calculating the node centrality, the next step is to select key nodes. A simple method is to set a threshold and select nodes with a centrality index higher than the threshold as key nodes. Another method is to use a sorting method to select nodes with the top N% centrality ranking. Clustering methods, such as the k-means algorithm, can also be used to cluster nodes based on multiple centrality metrics and select nodes in high centrality clusters.

[0252] Next, the substation client reconstructs the device configuration heterogeneous graph network into a basic heterogeneous graph network by combining the heterogeneous graph network skeleton and key nodes. In this step, the goal is to integrate the heterogeneous graph network skeleton and key node information obtained in the previous step to build a basic heterogeneous graph network that retains the core structure of the network and highlights the important nodes. This reconstruction process needs to comprehensively consider the topological structure of the network and the importance of the nodes. One implementation method of the reconstruction process is as follows: First, the heterogeneous graph network skeleton is used as the basic structure. This skeleton is obtained by the minimum spanning tree algorithm, which ensures the basic connectivity of the network. The identified key nodes are added to the skeleton. If some key nodes are already in the skeleton, no additional operation is required; for key nodes that are not in the skeleton, they need to be added. For the added key nodes, it is necessary to consider how to connect them to the existing skeleton structure. One method is to find the k nodes that are most relevant to the key node in the original simplified heterogeneous graph (k can be set according to requirements, such as k=3), and then connect the key node to these k nodes. The correlation can be based on the mutual information or other correlation relationship indicators calculated previously. In order to maintain the sparsity and importance of the network, certain rules can be applied when adding new connections. For example, a maximum degree limit can be set, and when the degree of a node reaches this limit, no new connections are added to it. For connections between key nodes, consider retaining direct connections that exist in the original network, even if these connections are not in the minimum spanning tree. This helps to preserve important relationships between key nodes. When adding new connections, the heterogeneous nature of the graph needs to be maintained. For example, ensure that connections between different types of nodes follow the original rules or constraints. Weights can be assigned to edges in the reconstructed network, and the weights can be determined based on the strength of the association in the original network or the importance during the reconstruction process.

[0253] Next, simplified topological features are extracted from the underlying heterogeneous graph network and uploaded to the federated learning server. In this step, the goal is to extract simplified topological features that can accurately describe the network structure and characteristics from the reconstructed underlying heterogeneous graph network. These features should be able to fully reflect the global structure, local characteristics, and properties of nodes and edges of the network. Simplified topological features include graph global features, node-level features, edge-level features, subgraph features, and spectral features. Specifically, graph global features include the number of nodes and the number of edges; graph density: 2|E| / (|V|(|V|-1)), where |E| is the number of edges and |V| is the number of nodes; average degree: 2|E| / |V|; clustering coefficient: calculate the average local clustering coefficient of the entire graph; diameter: the longest shortest path length in the network; average path length: the average value of the shortest paths between all pairs of nodes.

[0254] Node-level features include degree distribution: calculating the distribution of the number of nodes with different degree values; centrality indicators: including statistical information of degree centrality, betweenness centrality, closeness centrality and eigenvector centrality (such as mean, median, maximum, minimum, etc.); local clustering coefficient distribution: calculating the local clustering coefficient of each node and then obtaining its distribution characteristics.

[0255] Edge-level features include edge weight distribution: if the edge has a weight, calculate the statistical characteristics of the weight; edge betweenness centrality distribution: calculate the betweenness centrality of each edge to obtain its distribution characteristics; edge connection mode: count the number and proportion of edges connecting different types of nodes.

[0256] Subgraph features include the number of triangles: the number of triangular subgraphs in the network; the number of other important subgraph patterns (such as star structures, ring structures, etc.); community structure: using community detection algorithms (such as the Louvain method) to identify communities, calculate the number of communities, average community size, etc.

[0257] The spectral features include the eigenvalue distribution of the Laplacian matrix: the eigenvalues ​​of the graph Laplacian matrix are calculated and its statistical characteristics (such as the maximum eigenvalue, the skewness and kurtosis of the eigenvalue distribution, etc.) are extracted; the eigenvalue distribution of the adjacency matrix: similarly, the eigenvalue distribution characteristics of the adjacency matrix are calculated.

[0258] These features can be combined into a feature vector. For example, a feature vector containing 100 elements can be constructed, where the first 20 elements represent global features of the graph, the next 30 elements represent node-level features, 20 elements represent edge-level features, 20 elements represent subgraph features, and the last 10 elements represent spectral features.

[0259] The process of uploading these features to the federated learning server can be done by following the steps below: Standardize the extracted features to ensure that the features of different substations are on the same scale. Encrypt the feature vectors using techniques such as homomorphic encryption to protect the privacy of the original data. Use a secure communication protocol (such as HTTPS) to transmit the encrypted feature vectors to the federated learning server. Implement a verification mechanism on the server side to ensure that the source of the received data is credible and complete. In this way, the substation client can provide valuable network feature information to the federated learning server without revealing the original network structure.

[0260] In one implementation manner, after receiving the simplified topology features and client model parameters of all substation clients, the federated learning server performs feature similarity analysis on all simplified topology features, and assigns client weights to all substation clients according to the feature similarity analysis results, including the following steps:

[0261] After receiving the simplified topological features and client model parameters of all substation clients, the federated learning server calculates the feature similarity between each pair of substation clients based on the simplified topological features and using a similarity measurement method, and constructs a feature similarity matrix of substation clients based on all feature similarities;

[0262] The federated learning server divides all substation clients into multiple client groups based on simplified topological features and through the K-means clustering algorithm, and determines the client centrality of each substation client according to the distance between the substation client and the group center of the client group;

[0263] The federated learning server assigns client weights to all substation clients by combining the feature similarity matrix and client centrality.

[0264] In this embodiment, for each pair of substation clients, their simplified topological feature vectors need to be compared. Assume that there are n substation clients, and the feature vector of each client contains m elements. Cosine similarity can be used as a similarity measurement method. This method calculates the cosine value of the angle between two vectors, ranging from -1 to 1, 1 means complete similarity, -1 means complete opposite, and 0 means irrelevant. The calculation formula of cosine similarity is: cos(θ) = (A·B) / (||A||||B||), where A and B are two feature vectors, · represents the dot product, and ||A|| represents the modulus length of vector A. For example, suppose there are two substation clients, and their simplified topological feature vectors are A = [0.5, 0.8, 0.3] and B = [0.6, 0.7, 0.4], respectively. Then the cosine similarity between them is:

[0265] (0.5*0.6+0.8*0.7+0.3*0.4) / (sqrt(0.5^2+0.8^2+0.3^2)*sqrt(0.6^2+0.7^2+0.4^2))≈0.9962

[0266] After calculating the similarity between all substation client pairs, an n×n feature similarity matrix can be constructed. Each element (i, j) in the matrix represents the similarity between the i-th and j-th substation clients. This matrix is ​​symmetrical, and the elements on the diagonal are all 1 (indicating that the similarity between each client and itself is 1). The feature similarity matrix can reflect the similarity between different substation clients, which helps to better utilize the information of similar clients in the federated learning process and improve the performance and generalization ability of the model.

[0267] K-means algorithm is an iterative clustering method, and its basic steps are as follows: 1. Randomly select K points as the initial cluster center; 2. Assign each data point to the nearest cluster center; 3. Recalculate the center point of each cluster; 4. Repeat steps 2 and 3 until the cluster center no longer changes significantly or the maximum number of iterations is reached. In this embodiment, each data point represents a simplified topological feature vector of a substation client. The selection of K can determine the optimal number of clusters by methods such as the elbow rule or the silhouette coefficient. For example, assuming that K=3 is finally determined, it means that all substation clients are divided into 3 groups. After clustering is completed, the Euclidean distance from each substation client to the center of its group is calculated to measure the client centrality. The calculation formula of the Euclidean distance is: d=sqrt(Σ(xi-yi)^2), where xi and yi are the i-th elements of the client feature vector and the group center vector, respectively. The smaller the distance, the closer the client is to the group center and the higher the centrality. The distance can be converted to centrality, for example, using the formula: centrality=1 / (1+d), so that the smaller the distance, the closer the centrality is to 1. The calculation of client centrality provides an important basis for model aggregation and weight allocation, which reflects the representativeness of each substation client in the group to which it belongs. Clients with high centrality may contain more universal features and can be given higher weights when the model is updated, which helps to improve the overall performance and adaptability of the federated learning model.

[0268] For each substation client, its average similarity with all other clients can be calculated based on the feature similarity matrix. The average similarity reflects the degree of relevance of the client to the whole, and the calculation formula is: avg_sim_i = (Σsim_ij) / (n-1), where sim_ij is the similarity between the i-th client and the j-th client, and n is the total number of clients. Then, the average similarity is combined with the client centrality to obtain a comprehensive score. The combination is as follows: score_i = w1*avg_sim_i+w2*centrality_i, where w1 and w2 are weight factors that can be adjusted according to actual needs, and centrality_i is the centrality of the i-th client. Finally, the comprehensive score is normalized to obtain the final client weight: weight_i = score_i / (Σscore_j). For example, suppose there are three substation clients, their average similarities are 0.8, 0.7, and 0.9, and their centralities are 0.6, 0.8, and 0.5, respectively. Let w1 = 0.6 and w2 = 0.4, then the comprehensive scores are: 0.72, 0.74, and 0.74, and the normalized weights are approximately 0.327, 0.336, and 0.336. This weight distribution method takes into account the similarity and representativeness of the clients, which helps to better utilize the characteristics of each client in the federated learning process. Clients with high similarity may have similar data distributions, and assigning higher weights is conducive to rapid model convergence; clients with high centrality may contain more common features, which helps to improve the generalization ability of the model. The client weights assigned in this way can play an important role in the subsequent model aggregation process and improve the efficiency and effectiveness of federated learning.

[0269] The present invention also discloses a substation-side network equipment fault elimination and verification system based on deep learning, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the substation-side network equipment fault elimination and verification method based on deep learning as described in any one of the above-mentioned embodiments.

[0270] Among them, the processor can adopt a central processing unit (CPU). Of course, according to actual usage, other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. can also be adopted. The general-purpose processor can adopt a microprocessor or any conventional processor, etc., and this application does not impose any restrictions on this.

[0271] Among them, the memory can be an internal storage unit of a computer device, such as a hard disk or memory of a computer device, or an external storage device of a computer device, such as a plug-in hard disk, a smart memory card (SMC), a secure digital card (SD) or a flash memory card (FC) equipped on the computer device, etc., and the memory can also be a combination of an internal storage unit and an external storage device of a computer device. The memory is used to store computer programs and other programs and data required by the computer device. The memory can also be used to temporarily store data that has been output or is to be output, and this application does not impose any restrictions on this.

[0272] The present invention also discloses a substation-side network equipment fault elimination and verification platform based on deep learning, including the substation-side network equipment fault elimination and verification system described in the above-mentioned embodiment and the substation federated learning system. The substation federated learning system includes multiple substation clients and a federated learning server deployed in the target area, all substation clients are connected to the federated learning server in communication, the federated learning server is pre-built with a shared learning model, all substation clients are pre-deployed with a client learning model with the same initial configuration as the shared learning model, and all client learning models are from the federated learning server, and the shared learning model and the client learning model are both GNN models; multiple substation clients belong to multiple substations in the target area respectively, and each substation has and only has one substation client, and for any substation, the substation client in the substation is connected to all network devices in the substation in communication based on the pre-configured substation intranet connection.

[0273] The present invention also discloses a computer-readable storage medium, which stores instructions. When the instructions are executed by a processor, the processor is configured to execute the substation-side network equipment fault elimination and verification method based on deep learning described in any of the above-mentioned embodiments.

[0274] Among them, the computer program can be stored in a machine-readable medium, the computer program includes computer program code, the computer program code can be in the form of source code, object code, executable file or certain middleware, etc. The machine-readable medium includes any entity or device that can carry the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the machine-readable medium includes but is not limited to the above-mentioned components.

[0275] Among them, through this computer-readable storage medium, the comprehensive fault detection method for transmission lines in the above embodiment is stored in a computer-readable storage medium, and is loaded and executed on a processor to facilitate the storage and application of the above method.

[0276] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of protection of the present application is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as above, which are not provided in detail for the sake of simplicity.

[0277] One or more embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the present application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application should be included in the protection scope of the present application.

Claims

1. A method for eliminating faults and checking network equipment at a substation based on deep learning, characterized in that: A substation federated learning system applied to a target area, the substation federated learning system comprising a plurality of substation clients and a federated learning server deployed in the target area, all of the substation clients are in communication connection with the federated learning server, the federated learning server is pre-constructed with a shared learning model, all of the substation clients are pre-deployed with a client learning model with an initial configuration identical to the shared learning model, and all of the client learning models are from the federated learning server, the shared learning model and the client learning model are both GNN models; the plurality of substation clients belong to a plurality of substations in the target area respectively, and each of the substations has and has only one substation client, and for any of the substations, the substation client in the substation is in communication connection with all network devices in the substation based on a pre-configured substation intranet connection; The method comprises the following steps: When any one or more target substation clients among all the substation clients trigger a preset device verification rule, for any of the substation clients, the substation client obtains device data of all the network devices through the substation intranet, and the device data includes device configuration files, device operation logs and device network traffic data; The substation client uses Granger causality test analysis method and mutual information analysis method to extract the correlation relationship characteristics between the device configuration file, the device operation log and the device network traffic data; The substation client constructs a device configuration heterogeneous graph network based on the association relationship characteristics and in combination with the device configuration file, the device operation log and the device network traffic data; The substation client simplifies the device configuration heterogeneous graph network to a basic heterogeneous graph network through graph simplification technology, extracts simplified topology features from the basic heterogeneous graph network, and uploads the simplified topology features to the federated learning server; The substation client uses the device configuration heterogeneous graph network to train the local client learning model and update the client model parameters of the client learning model, and uploads the updated client model parameters to the federated learning server; After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results; The federated learning server trains the shared learning model in combination with all the client model parameters and the corresponding client weights, updates the shared model parameters of the shared learning model, and sends the updated shared model parameters to all the substation clients; For any of the target substation clients, the target substation client updates the shared model parameters to the local client learning model, inputs the device configuration heterogeneous graph network into the client learning model after parameter update, and outputs the configuration mode and configuration parameter mapping table of all the network devices through the client learning model after parameter update; The target substation client generates a device verification strategy in combination with the configuration mode and the configuration parameter mapping table, and completes the verification work of all the network devices through the device verification strategy.

2. According to the deep learning-based substation terminal network equipment fault elimination and verification method according to claim 1, it is characterized in that: The substation client extracts the correlation relationship features between the device configuration file, the device operation log and the device network traffic data by using the Granger causality test analysis method and the mutual information analysis method, including the following steps: The substation client converts the device configuration file, the device operation log and the device network flow data into time series feature data, and processes all the time series feature data in a standardized manner; The substation client determines the optimal lag order of the Granger causality test analysis method based on the time series characteristic data and using the AIC information criterion; The substation client performs a multivariate Granger causality test analysis on all the time series feature data according to the optimal lag order, and generates a linear correlation feature between the device configuration file, the device operation log and the device network traffic data according to the analysis result of the Granger causality test analysis; The substation client converts all the time series characteristic data into discrete characteristic data; The substation client extracts nonlinear correlation features among the device configuration file, the device operation log and the device network traffic data from the discrete feature data using a mutual information analysis method; The substation client integrates the linear association feature and the nonlinear association feature into an association relationship feature among the device configuration file, the device operation log and the device network traffic data.

3. The method for eliminating faults and checking network equipment at a substation end based on deep learning according to claim 2 is characterized in that: The substation client extracts the nonlinear correlation features among the device configuration file, the device operation log and the device network traffic data from the discrete feature data by using the mutual information analysis method, including the following steps: The substation client uses a mutual information calculation formula to respectively calculate a first joint information entropy between the device configuration file and the device operation log, a second joint information entropy between the device configuration file and the device network traffic data, and a third joint information entropy between the device configuration file, the device operation log, and the device network traffic data; The substation client calculates the total mutual information by combining the first joint information entropy, the second joint information entropy and the third joint information entropy; The substation client determines the nonlinear correlation characteristics among the device configuration file, the device operation log and the device network traffic data according to the total mutual information.

4. The method for eliminating faults and checking network equipment at a substation based on deep learning according to claim 3 is characterized in that: The total mutual information calculation formula is as follows: I(X;Y;Z)=H(X;Y)+H(Y;Z)H(X;Y;Z) Wherein: I(X; Y; Z) represents the total mutual information, H(X; Y) represents the first joint information entropy, H(Y; Z) represents the second joint information entropy, and H(X; Y; Z) represents the third joint information entropy.

5. The method for eliminating faults and checking network equipment at a substation based on deep learning according to claim 1 is characterized in that: After the substation client simplifies the device configuration heterogeneous graph network to a basic heterogeneous graph network through graph simplification technology, extracting simplified topological features from the basic heterogeneous graph network, and uploading the simplified topological features to the federated learning server includes the following steps: The substation client performs node clustering and edge pruning on the device configuration heterogeneous graph network according to the association relationship characteristics to obtain a simplified heterogeneous graph network; The substation client extracts a heterogeneous graph network skeleton from the simplified heterogeneous graph network using a minimum spanning tree algorithm; The substation client calculates the node centrality index in the simplified heterogeneous graph network, and selects the key nodes in the simplified heterogeneous graph network according to the node centrality index; The substation client reconstructs the device configuration heterogeneous graph network into a basic heterogeneous graph network in combination with the heterogeneous graph network skeleton and the key nodes; Simplified topological features are extracted from the basic heterogeneous graph network, and the simplified topological features are uploaded to the federated learning server.

6. The method for eliminating faults and checking network equipment at a substation based on deep learning according to claim 5 is characterized in that: The simplified topological feature is a feature vector composed of graph global features, node-level features, edge-level features, subgraph features and spectrum features.

7. The method for eliminating faults and checking network equipment at a substation based on deep learning according to claim 6 is characterized in that: After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server performs feature similarity analysis on all the simplified topology features, and assigns client weights to all the substation clients according to the feature similarity analysis results, including the following steps: After receiving the simplified topology features and the client model parameters of all the substation clients, the federated learning server calculates the feature similarity between each pair of the substation clients based on the simplified topology features and using a similarity measurement method, and constructs a feature similarity matrix of the substation clients according to all the feature similarities; The federated learning server divides all the substation clients into multiple client groups based on the simplified topological features and by using a K-means clustering algorithm, and determines the client centrality of each of the substation clients according to the distance between the substation client and the group center of the client group; The federated learning server assigns client weights to all the substation clients in combination with the feature similarity matrix and the client centrality.

8. A substation network equipment fault elimination and verification system based on deep learning, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the substation-side network equipment fault elimination and verification method based on deep learning as described in any one of claims 1 to 7.

9. A substation network equipment fault elimination and verification platform based on deep learning, characterized in that: include: The substation terminal network equipment fault elimination and verification system according to claim 8; as well as A substation federated learning system, the substation federated learning system comprising a plurality of substation clients and a federated learning server deployed in the target area, all of the substation clients are in communication connection with the federated learning server, the federated learning server has a shared learning model pre-built, all of the substation clients are pre-deployed with a client learning model with an initial configuration identical to the shared learning model, and all of the client learning models are from the federated learning server, the shared learning model and the client learning model are both GNN models; the plurality of substation clients respectively belong to a plurality of substations in the target area, and each of the substations has only one substation client, and for any of the substations, the substation client in the substation is in communication connection with all network devices in the substation based on a pre-configured substation intranet connection.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor is configured to execute the substation-side network equipment fault elimination and verification method based on deep learning according to any one of claims 1 to 7.

Images