Monitoring system and method for network security protection equipment of intermediate dispatching master station

Abstract

The invention discloses a monitoring system and method for network security protection equipment of a central dispatching master station, and relates to the field of power dispatching control, and the method comprises the steps that a security protection equipment data acquisition module inputs collected data into a security protection intelligent control module; a fault judgment module in the security intelligent control module performs fault judgment based on the text data, and sends fault information to an alarm indication module if a fault exists; a fault pre-judgment module in the security intelligent control module performs fault pre-judgment based on the historical log file, and if a fault exists, a predicted alarm date is calibrated and sent to an alarm indication module; and a network attack detection module in the security intelligent control module performs attack prediction based on the network flow information, and sends abnormal information to an alarm indication module if the abnormal information exists. According to the system, operation monitoring personnel are helped to organize and carry out emergency disposal work leisurely, the influence of equipment faults on a service system is greatly reduced, safe and stable operation of a large power grid is further guaranteed, and the influence of the equipment faults on the service system is effectively reduced from the source.

Description

Technical Field

[0001] The present invention relates to the field of electric power dispatching control, and in particular to a central dispatching master station network security protection equipment monitoring system and method. Background Art

[0002] At present, the power monitoring system deployed at the central dispatching main station covers a large number of related network security protection devices. They are often deployed in a serial manner on the network communication channel. Once the equipment fails, it will lead to the interruption of network communication of systems such as dispatching automation, metering automation, dispatching orders, OMS, etc., directly affecting the power grid dispatching operation control and management, as well as marketing metering, power grid online monitoring and other power grid production and marketing businesses.

[0003] At present, monitoring the operating status of network security equipment such as vertical encryption, firewalls, and intrusion detection relies on regular inspections by personnel, which is too long to detect problems in time, delaying the opportunity for troubleshooting and handling; second, when equipment fails, after dispatching automation and other services are interrupted, the business department will notify the inspection and find the problem, which is in an extremely serious and passive situation. Both methods prolong the time for equipment failure detection and emergency handling, which in turn affects the production, operation and management of power grids.

[0004] The purpose of the invention is to provide a central dispatching master station network security protection equipment monitoring system and method, which can quickly discover border security equipment failure problems and reduce the impact of equipment failures on business systems. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the problems to be solved by the present invention are: first, relying on regular inspections by personnel, the cycle is too long to discover problems in time, which delays the opportunity for troubleshooting and handling; second, when equipment fails, after the dispatching automation and other services are interrupted, the business department notifies for investigation and finds the problem, which is in an extremely serious and passive situation.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: a central dispatching master station network security protection equipment monitoring system, which includes a security equipment data acquisition module, a security intelligent control module and an alarm indication module; the security equipment data acquisition module is used to collect data and specifically includes a hardware data acquisition module, a performance data acquisition module, an audio and video processing module and an infrared sensor unit; the security intelligent control module is used to diagnose network security faults and specifically includes a fault judgment module, a fault prediction module and a network attack detection module; the alarm indication module is used to alarm faults and specifically includes an emergency alarm module and an abnormal alarm module.

[0008] To solve the above technical problems, the present invention provides the following technical solutions: a method for centrally adjusting the network security protection equipment monitoring system of the main station, which comprises: the security equipment data acquisition module inputs the collected data into the security intelligent control module; the fault judgment module in the security intelligent control module performs fault judgment based on text data, and if a fault exists, the fault information is sent to the alarm indication module; the fault prediction module in the security intelligent control module performs fault prediction based on historical log files, and if a fault exists, the expected alarm date is calibrated and sent to the alarm indication module; the network attack detection module in the security intelligent control module performs attack prediction based on network traffic information, and if there is abnormal information, the abnormal information is sent to the alarm indication module.

[0009] As a preferred solution of the method of a central adjustment master station network security protection equipment monitoring system described in the present invention, wherein: the hardware data acquisition module in the security equipment data acquisition module is used to collect and transmit the temperature, humidity and power-on status data of the security equipment in real time; the performance data acquisition module in the security equipment data acquisition module is used to monitor and transmit the rule configuration status, system status, network status, traffic data, log function, detection status and communication status data of the security equipment in real time; the audio and video processing module in the security equipment data acquisition module is used to monitor and record the working status of the maintenance workers, and when the maintenance workers trigger the infrared sensor unit, the audio and video processing module is started to record the work, and the audio and video processing module and the infrared sensor unit are arranged in each network security protection equipment area unit.

[0010] As a preferred solution of the method for monitoring the network security protection equipment of a central dispatching main station described in the present invention, wherein: the fault judgment module performs fault judgment based on text data, including using an improved regular expression matching algorithm to perform fault judgment, including defining a regular expression pattern according to the characteristics and rules of network security protection failures, and using a regular expression library function to compile the defined regular expression; obtaining the network data related to the central dispatching main station one by one, traversing the text data to be matched, and performing a matching operation on each piece of text data; obtaining a matching result after a successful match, analyzing the matching result to determine whether there is a network security protection failure; recording the matching result and the judgment conclusion, and sending information about the existence of a network security protection failure to the alarm indication module.

[0011] As a preferred solution of the method for centrally adjusting the network security protection equipment monitoring system of the main station described in the present invention, wherein: the fault prediction module performs fault prediction based on historical log files, including, based on the log files of each network security protection device, collecting candidate alarm logs from the historical log files and receiving the scoring results of the current type of logs, iteratively updating the initial log model according to the scoring results to obtain the alarm log model, collecting and retrieving the target alarm log from the target log model, and backing up the retrieved target alarm log in the data storage module and outputting it to the alarm indication module at the same time.

[0012] As a preferred solution of the method for monitoring the network security protection equipment of the central adjustment master station described in the present invention, wherein: the fault prediction module performs fault prediction based on the historical log file and also includes setting a threshold value according to the historical environmental data and historical service life of the equipment, and issuing an alarm when it is detected that the equipment environmental data and the historical environmental data range do not meet the historical service life threshold; the equipment environmental data and the historical environmental data are data collected by the hardware data acquisition module.

[0013] As a preferred solution of the method for centrally adjusting the network security protection equipment monitoring system of the main station described in the present invention, wherein: the network attack detection module performs attack prediction based on network traffic information, and the network attack detection module uses an improved anomaly detection algorithm to perform attack detection, specifically including: dividing the data into normal category data and abnormal category data, and normalizing each type of data; extracting network features as a front network; comprehensively detecting the abnormal situation of the current network operation and obtaining abnormal information of the network traffic through machine learning; analyzing the unknown aggressiveness of the traffic information and using machine learning methods to obtain the observation vector X from the network traffic information; based on the conversion method of the abnormal information data, converting the data in the training set into a mapping function representing the abnormal state of the network traffic; inputting the observation vector X into the mapping function, evaluating the obtained traffic abnormality information and sending it to the alarm indication module.

[0014] As a preferred solution of the method for centrally adjusting the network security protection equipment monitoring system of the master station described in the present invention, the alarm indication module includes an emergency alarm module and an abnormal alarm module;

[0015] The emergency alarm module is used to receive the transmission data of the fault judgment module in the security intelligent control module, and contact the corresponding maintenance personnel for maintenance according to the fault situation; the abnormal alarm module is used to receive the transmission data of the fault prediction module and the network attack detection module in the security intelligent control module, and contact the corresponding maintenance personnel for maintenance according to the abnormal alarm situation.

[0016] As a preferred solution of the method of a central dispatching master station network security protection equipment monitoring system described in the present invention, wherein: the alarm indication module transmits the alarm information to the user display interface, and the user display interface implants each monitored network security protection device into the geographic information system through visualization processing and presents it in a visual form, and the areas where conventional monitoring equipment, emergency alarm equipment and abnormal alarm equipment are located are presented in the form of different symbols, and the user display interface is also provided with an identity authentication unit.

[0017] As a preferred solution of the method for centrally adjusting the main station network security protection equipment monitoring system described in the present invention, the user display interface is connected to each module via a 5G communication transmission method; and redundant backup is performed on the serially connected network security protection equipment.

[0018] The beneficial effects of the present invention are: 1. The fault judgment module of the security intelligent control module of the present invention can promptly and quickly detect emergency faults and notify maintenance through the system, which can efficiently solve emergency fault events and thus ensure the safe and stable operation of the large power grid.

[0019] 2. Since the events generated by the fault prediction module and network attack detection module of the security intelligent control module of the present invention are not very urgent, the fault judgment module can provide different mode alarms to alleviate the data calculation pressure, provide more accurate judgments, eliminate possible risks, reduce emergency failures, and provide double insurance for the network security of the central dispatching main station.

[0020] 3. The present invention sets up redundant backup for serially connected network security protection devices, thereby avoiding network paralysis due to equipment failure. The operating status of each network security protection device in the central dispatching master station can be intuitively understood through the visual user display interface, so as to make timely scheduling and adjustment decisions. Setting up this system on the basis of the original equipment can also reduce implementation costs.

[0021] 4. The system of the present invention helps operation monitoring personnel to calmly organize and carry out emergency response work, greatly reducing the impact of equipment failures on business systems, thereby ensuring the safe and stable operation of large power grids, and effectively reducing the impact of equipment failures on business systems from the source. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0023] Figure 1 This is a module structure diagram of a central control master station network security protection equipment monitoring system in Example 1.

[0024] Figure 2 This is a flow chart of a method for monitoring network security protection equipment of a central control master station in Example 2.

[0025] Figure 3 This is a flowchart of the steps for implementing a fault judgment module of a method for monitoring network security protection equipment of a central control master station in Example 2.

[0026] Figure 4 This is a flowchart of the steps for implementing a network attack detection module in a method for monitoring network security protection equipment of a central control master station in Example 3. DETAILED DESCRIPTION

[0027] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0028] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0029] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and this embodiment provides a central dispatching master station network security protection equipment monitoring system including a security equipment data acquisition module 100, a security intelligent control module 200 and an alarm indication module 300; the security equipment data acquisition module 100 is used to collect data and specifically includes a hardware data acquisition module, a performance data acquisition module, an audio and video processing module and an infrared sensor unit; the security intelligent control module 200 is used to diagnose network security faults and specifically includes a fault judgment module, a fault prediction module and a network attack detection module; the alarm indication module 300 is used to alarm faults and specifically includes an emergency alarm module and an abnormal alarm module.

[0030] Example 2, reference Figure 2 and Figure 3 , which is the second embodiment of the present invention, and which is different from the first embodiment in that: a method for adjusting the network security protection equipment monitoring system of the master station includes: Figure 1 As shown:

[0031] S1. The security equipment data acquisition module 100 inputs the collected data into the security intelligent control module 200.

[0032] The hardware data acquisition module in the security equipment data acquisition module 100 is used to collect and transmit the temperature, humidity and power supply status data of the security equipment in real time.

[0033] The performance data acquisition module in the security equipment data acquisition module 100 is used to monitor and transmit in real time the rule configuration status, system status, network status, flow data, log function, detection status and communication status data of the security equipment.

[0034] The audio and video processing module in the security equipment data acquisition module 100 is used to monitor and record the working status of the maintenance workers. When the maintenance workers trigger the infrared sensor unit, the audio and video processing module starts recording. The audio and video processing module and the infrared sensor unit are set in each network security protection equipment area unit.

[0035] S2. The fault judgment module in the security intelligent control module 200 performs fault judgment based on the text data, and if a fault exists, sends the fault information to the alarm indication module 300.

[0036] like Figure 2 As shown in the figure, the fault judgment using the improved regular expression matching algorithm includes:

[0037] S201. Define a regular expression pattern according to the characteristics and rules of network security protection failures, and use a regular expression library function to compile the defined regular expression.

[0038] S202, obtaining network data related to the central adjustment main station one by one, traversing the text data to be matched, and performing a matching operation on each piece of text data.

[0039] S203: After the match is successful, a matching result is obtained, and an analysis is performed based on the matching result to determine whether there is a network security protection failure.

[0040] S204: Record the matching results and judgment conclusions, and send information about network security protection failures to an alarm indication module.

[0041] Specifically, the regular expression pattern is carefully designed according to the characteristics and rules of network security protection failures. For example, to match a specific IP address, such as 192.168.1.1, the pattern can be defined as ^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$. Here, ^ represents the beginning of the matching string, $ represents the end of the matching string, \d represents a number, {1,3} represents that the preceding number appears 1 to 3 times, and \. represents a dot; in the code, the regular expression library function provided by the corresponding programming language is used to compile the defined regular expression to generate an executable matching object. This step can be expressed by the formula: CompiledRegex=Compile(RegexPattern), where RegexPattern is the defined regular expression pattern, Compile is the compilation function, and CompiledRegex is the executable object obtained after compilation.

[0042] Obtain network data related to the central dispatching main station one by one, such as log information, data packet content, etc. The text data to be traversed is designed to be TextData, and the text data fragments are processed one by one through loops and other methods. For each piece of text data, use the compiled matching object to match; in this process, according to the rules of regular expressions, try to match step by step from the beginning of the text; during the matching process, check whether each character meets the requirements of the regular expression. If it does, continue to move backward until the entire regular expression matches successfully or is determined to be unmatched.

[0043] If the match is successful, the specific location of the match, the matched substring and other information can be obtained, and these results can be obtained through specific functions or attributes. According to the matching results, analysis is performed to determine whether there is a network security protection failure. If a specific malicious code pattern or abnormal behavior pattern is matched, it can be determined that a corresponding failure exists.

[0044] The matching results and judgment conclusions are recorded for subsequent analysis and tracing. At the same time, corresponding protective measures or alarm actions are executed according to the judgment results.

[0045] It is also possible to use the historical data collected in the security equipment data acquisition module to understand the triggering mechanism of faulty network security protection equipment, combine it with expert systems, various diagnostic methods and fault knowledge graphs, and further adjust the regular expression pattern and perform calibration.

[0046] S3. The fault prediction module in the security intelligent control module 200 performs fault prediction based on the historical log file. If a fault exists, the expected alarm date is calibrated and sent to the alarm indication module 300.

[0047] Specifically, when retrieving the alarm log through the log analysis software, the initial log model in the log analysis software is called to capture the alarm log from the log file; the log capture rules are the set rules of the log analysis software; the alarm features in the initial log model specifically refer to the keywords in the alarm log, and the key fields identify the specific information of the alarm log, such as error, bug, etc.; it can also be the keywords customized by the system maintenance personnel in the central dispatching main station.

[0048] The historical log text is obtained through the security equipment data acquisition module, and the candidate alarm logs are collected according to the above rules and characteristics; the candidate alarm logs are displayed and the scoring results of the candidate alarm logs obtained based on the displayed results are received. For example, the device for retrieving the alarm log pushes the candidate alarm logs to the maintenance personnel of the system in the central dispatching main station, and the maintenance personnel view and score the candidate alarm logs according to the accuracy of the candidate alarm logs, and the log analysis software receives the scoring results.

[0049] According to the scoring results, the initial log model is iteratively updated until the accuracy of the iterative log model in searching the alarm log reaches the preset conditions to obtain the alarm log model. The alarm log model is a log model whose accuracy in searching the alarm log reaches the preset conditions. The log model is compared with the keywords in the target log file to retrieve the target alarm log, thereby improving the retrieval efficiency.

[0050] Furthermore, the fault prediction module sets a threshold value based on the historical environmental data and historical service life of the equipment, and issues an alarm when it is detected that the equipment environmental data does not match the historical environmental data range and exceeds the historical service life threshold.

[0051] Equipment environment data and historical environment data are data collected by the hardware data acquisition module.

[0052] Specifically, among the influences of equipment failure, temperature, humidity and power supply have a greater impact on the equipment. When powered on, excessive humidity can easily cause a short circuit in the equipment, and excessive temperature can affect the life of equipment components. In order to reduce this impact, this plan is specially set up to provide important reference opinions for troubleshooting and repairing.

[0053] Regarding service life, each component has a life limit. Components that are about to reach their service life or have exceeded their historical service life but are still working normally can be classified as fragile equipment and require increased maintenance frequency. If there is any abnormality, they must be replaced immediately. Regarding historical service life, statistics are collected based on components and equipment of the same type and model that have been replaced in the previous period to obtain the average service life as the threshold of the historical service life.

[0054] S4. The network attack detection module in the security intelligent control module 200 predicts attacks based on network traffic information, and sends abnormal information to the alarm indication module 300 if there is any abnormal information.

[0055] Example 3, reference Figure 4 , which is the third embodiment of the present invention, and which is different from the first two embodiments in that: a method for adjusting the network security protection equipment monitoring system of the master station also includes: Figure 4 As shown:

[0056] The network attack detection module uses an improved anomaly detection algorithm to detect attacks, including:

[0057] S401, classify the data into normal category data and abnormal category data, and normalize each category of data.

[0058] S402: extract network features as a front network.

[0059] S403. Detect the abnormal situation of the current network operation in an all-round way through machine learning and obtain abnormal information of network traffic.

[0060] S404: Analyze the unknown aggressiveness of the traffic information and obtain an observation vector X from the network traffic information using a machine learning method.

[0061] S405: Based on the conversion method of abnormal information data, the data in the training set is converted into a mapping function representing the abnormal state of network traffic.

[0062] S406: Input the observation vector X into the mapping function, evaluate and obtain the traffic anomaly information, and send it to the alarm indication module.

[0063] Specifically: Data is classified into two categories: normal (marked as 01) and abnormal (marked as 10). The data range in network operation intrusion data varies greatly, so it is necessary to use normalization to normalize the intrusion data of the same sequence to between (0, 1). The formula is:

[0064]

[0065] Among them, X represents any column of data value in the initial data set, x max Indicates the maximum value in the data value, x min Indicates the minimum value in the data value, x * Represents the data value after normalization of the network intrusion data set, thereby obtaining the data value suitable for the design of this system and reducing the dimension of the data, extracting the network features as the front network, the formula is:

[0066] y=σ(x′)=σ(F(x * ))

[0067] Where x′ represents the vector with high-level features of intrusion data output by the feature extraction network; x * Represents the data value after normalization of the network intrusion data set; σ represents the feature extraction network activation function. The feature vector composition of the network intrusion data is obtained, and the observation vector X is obtained from the network traffic information using the machine learning algorithm; secondly, based on the conversion method of abnormal information data, the data in the training set is converted into a mapping function representing the abnormal state of network traffic; finally, the observation vector X is input into the mapping function, and the evaluation result of the mapping function is improved through performance evaluation, and finally the abnormal information of network traffic is obtained.

[0068] Embodiment 4 is the third embodiment of the present invention, which is different from the first three embodiments in that: a method for centrally adjusting a master station network security protection equipment monitoring system also includes that an alarm indication module includes an emergency alarm module and an abnormal alarm module.

[0069] Among them, the emergency alarm module is used to receive the transmission data from the fault judgment module in the security intelligent control module, and contact the corresponding maintenance personnel for repair according to the fault situation.

[0070] The abnormal alarm module is used to receive the transmission data from the fault prediction module and the network attack detection module in the security intelligent control module, and contact the corresponding maintenance personnel for maintenance according to the abnormal alarm situation.

[0071] Specifically, the above is a classification based on the urgency of the detection situation, which can reduce the calculation process of a single module to improve the efficiency and accuracy of system data processing. For matters handled by the emergency alarm module, when a fault is discovered, the maintenance personnel should be notified in time to deal with it as soon as possible. For matters handled by the abnormal alarm module, maintenance and repair can be arranged in a time period according to the severity of the equipment corresponding to the abnormal alarm situation. Compared with the urgency of matters in the emergency alarm module, the above method can also alleviate the situation when the maintenance personnel are short of manpower.

[0072] The central dispatching master station carries out the dispatching operation control and management, dispatching command and metering automation, etc. It plays a vital role in the safe and stable operation of the power grid, and network security protection equipment is also crucial in the central dispatching master station; the audio and video processing module includes a camera unit, a sound collection unit, a storage unit and a wireless communication unit. If the equipment is damaged by human beings, the operation of the central dispatching master station will be damaged. Therefore, in order to prevent malicious damage by others and improve maintenance records, this solution is specially set up. When necessary, the historical audio and video processing data is retrieved through the storage unit to achieve the effect of restoring the scene. When the maintenance personnel enter the network security protection equipment area unit, the infrared sensor unit is triggered to turn on the audio and video processing module. If necessary, if the maintenance personnel need to contact the commander, they can also contact and communicate in real time through the audio and video processing module.

[0073] Furthermore, it includes a user display interface, which implants each monitored network security protection device into the geographic information system through visualization processing and presents it in a visual form. The areas where conventional monitoring equipment, emergency alarm equipment and abnormal alarm equipment are located are presented in the form of different symbols. The user display interface is also provided with an identity authentication unit.

[0074] Specifically, the user display interface needs to be displayed through a specific device. The specific implementation steps for implanting each monitored network security protection device into the geographic information system are:

[0075] 1. Clarify the specific goals and requirements of network security protection, determine the key data and access control strategies that need to be protected, and select appropriate firewalls, intrusion detection systems, encryption devices, etc. according to needs.

[0076] 2. Fully understand the architecture, data storage methods, interfaces, etc. of the geographic information system in order to better integrate and develop interfaces between network security protection equipment and the geographic information system to ensure that the two can communicate and work together effectively.

[0077] 3. Set up specific security policies for the GIS system in the network security protection equipment, such as access permission control, data encryption rules, etc.; physically install the network security protection equipment in a suitable location and connect it to the GIS.

[0078] 4. Carry out comprehensive testing on the implanted system, including functional testing, safety performance testing, etc., and promptly debug and optimize any problems found; establish a continuous monitoring mechanism, regularly check the operating status and protection effect of network security protection equipment, and perform maintenance and updates in a timely manner.

[0079] Different user display interfaces are provided for different personnel identities according to the identity authentication unit. For example, after identity authentication, maintenance personnel only display historical maintenance items and current maintenance items, and the maintenance items contain real-time monitoring information of corresponding equipment; after identity authentication, management personnel can realize the real-time and historical data of the global equipment unit status of the central adjustment master station, which can be retrieved according to needs. The specific implementation steps of setting management permissions in this system are as follows:

[0080] 1. Clarify different levels of management authority, such as super administrator, ordinary administrator, etc., as well as the specific scope of authority corresponding to each level; build a detailed authority model to define the correspondence between various operations and resources and authority levels.

[0081] 2. Establish a reliable user identity authentication mechanism, such as user name and password, digital certificate, etc., to ensure that only legitimate users can perform permission setting operations; create corresponding user accounts for personnel who need management authority, and assign certain permission levels to each user account.

[0082] 3. Formulate specific access rules for various resources in the system (such as data, functional modules, etc.), clarify which operations can be performed at which permission levels; develop an intuitive and easy-to-use permission configuration interface to facilitate administrators to adjust and manage permissions.

[0083] 4. Embed a permission verification module in the system to check in real time whether the user's permissions match when performing an operation; conduct a comprehensive test on the permission setting and verification mechanism, and optimize and adjust in a timely manner when problems are found; regularly review the allocation of permissions, and update the permission settings in a timely manner according to personnel changes and changes in business needs.

[0084] Furthermore, each module is connected to the user display interface via wireless transmission, preferably 5G communication transmission.

[0085] Specifically, the communication transmission method can be determined according to the design scale of the central control master station. If the scale is small and the transmission distance requirement is not high, ZigBee transmission, Wi-Fi transmission or radio waves can be used. If the scale is large, 5G communication transmission can be used. In view of the relatively large scale of domestic central control master stations, 5G communication transmission is preferred as the data transmission method for each module and user display interface in this system.

[0086] Furthermore, redundant backup is performed on the serially connected network security protection devices, preferably dual-machine hot standby.

[0087] Specifically, for the setting of single-line connected network security protection equipment, the network will often be paralyzed due to the damage of one of the components. Even if the problem is discovered and dealt with in time, it will take a lot of time to go to the repair and in the repair process. This time is likely to have a large negative impact on the scheduling of the central dispatching master station. Based on this situation, redundant backup is set for serially connected network security protection equipment. For redundant backup, dual serial interface redundancy, master-slave device redundancy, multi-path serial redundancy and serial communication link redundancy can be selected for different components. However, in order to quickly replace the spare equipment when the equipment is damaged, dual-machine hot standby is preferred.

[0088] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A central dispatching master station network security protection equipment monitoring system, characterized by: It comprises a security equipment data acquisition module (100), a security intelligent control module (200) and an alarm indication module (300); The security equipment data acquisition module (100) is used to collect data and specifically comprises a hardware data acquisition module, a performance data acquisition module, an audio and video processing module and an infrared sensor unit; The security intelligent control module (200) is used to diagnose network security faults and specifically comprises a fault judgment module, a fault prediction module and a network attack detection module; The alarm indication module (300) is used to warn of faults and specifically comprises an emergency alarm module and an abnormal alarm module.

2. A method using a central control master station network security protection equipment monitoring system as claimed in claim 1, characterized in that: include, The security equipment data acquisition module (100) inputs the collected data into the security intelligent control module (200); The fault judgment module in the security intelligent control module (200) performs fault judgment based on the text data, and if a fault exists, sends the fault information to the alarm indication module (300); The fault prediction module in the security intelligent control module (200) performs fault prediction based on the historical log file, and if a fault exists, the expected alarm date is calibrated and sent to the alarm indication module (300); The network attack detection module in the security intelligent control module (200) performs attack prediction based on network traffic information, and if abnormal information exists, sends the abnormal information to the alarm indication module (300).

3. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 2, characterized in that: The hardware data acquisition module in the security equipment data acquisition module (100) is used to collect and transmit in real time the temperature, humidity and power supply status data of the security equipment; The performance data acquisition module in the security equipment data acquisition module (100) is used to monitor and transmit in real time the rule configuration status, system status, network status, flow data, log function, detection status and communication status data of the security equipment; The audio and video processing module in the security equipment data acquisition module (100) is used to monitor and record the working status of the maintenance worker. When the maintenance worker triggers the infrared sensor unit, the audio and video processing module starts recording. The audio and video processing module and the infrared sensor unit are arranged in each network security protection equipment area unit.

4. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 3, characterized in that: The fault judgment module performs fault judgment based on text data, including using an improved regular expression matching algorithm to perform fault judgment, including defining a regular expression pattern according to the characteristics and rules of network security protection faults, and using a regular expression library function to compile the defined regular expression; Obtain the network data related to the central dispatching main station one by one, traverse the text data to be matched, and perform matching operations on each piece of text data; If the match is successful, the matching result is obtained, and the matching result is analyzed to determine whether there is a network security protection failure; The matching results and judgment conclusions are recorded, and information about network security protection failures is sent to the alarm indication module.

5. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 4, characterized in that: The fault prediction module performs fault prediction based on historical log files, including collecting candidate alarm logs from historical log files based on the log files of each network security protection device and receiving the scoring results of the current type of logs, iteratively updating the initial log model according to the scoring results to obtain the alarm log model, collecting and retrieving the target alarm log from the target log model, and backing up the retrieved target alarm log in the data storage module and outputting it to the alarm indication module at the same time.

6. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 5, characterized in that: The fault prediction module performs fault prediction based on the historical log file, and further includes setting a threshold value according to the historical environmental data and the historical service life of the equipment, and issuing an alarm when it is detected that the equipment environmental data does not match the historical environmental data range and exceeds the historical service life threshold value; The equipment environment data and historical environment data are data collected by the hardware data acquisition module.

7. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 6, characterized in that: The network attack detection module performs attack prediction based on network traffic information, including: the network attack detection module uses an improved anomaly detection algorithm to perform attack detection, specifically including: Divide the data into normal category data and abnormal category data, and normalize each category of data; Extract network features as the front network; Through machine learning, it can comprehensively detect abnormal conditions in the current network operation and obtain abnormal information of network traffic; Analyze the unknown aggressiveness of traffic information and use machine learning methods to obtain observation vector X from network traffic information; Based on the conversion method of abnormal information data, the data in the training set is converted into a mapping function representing the abnormal state of network traffic; The observation vector X is input into the mapping function, and the traffic anomaly information obtained by evaluation is sent to the alarm indication module.

8. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 7, characterized in that: The alarm indication module (300) comprises an emergency alarm module and an abnormal alarm module; The emergency alarm module is used to receive the transmission data of the fault judgment module in the security intelligent control module, and contact the corresponding maintenance personnel for maintenance according to the fault situation; The abnormal alarm module is used to receive the transmission data of the fault prediction module and the network attack detection module in the security intelligent control module, and contact the corresponding maintenance personnel for maintenance according to the abnormal alarm situation.

9. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 8, characterized in that: The alarm indication module (300) transmits the alarm information to a user display interface. The user display interface implants each monitored network security protection device into a geographic information system through visual processing and presents it in a visual form. The areas where conventional monitoring equipment, emergency alarm equipment and abnormal alarm equipment are located are presented in the form of different symbols. The user display interface is also provided with an identity authentication unit.

10. A method for adjusting the network security protection equipment monitoring system of a master station as claimed in claim 9, characterized in that: The user display interface is connected to each module via 5G communication transmission; Provides redundant backup for serially connected network security protection devices.

Images