Power system asset monitoring blind spot analysis method, device, electronic equipment and storage medium

Abstract

The present application discloses a method, device, equipment and storage medium for analyzing blind spots in power system asset monitoring. The method includes the following steps: S1, collecting power system asset information to generate all asset feature vectors in the system ledger to construct a graph neural network; S2, based on the constructed graph neural network and subgraph matching technology, searching and matching the power system assets in the system ledger through graph convolutional neural network and graph query; S3, in the search and matching results, marking the power system assets that can be matched in the system ledger to indicate that they have been included in the monitoring scope. After searching all detected power system assets, checking all power system assets in the system ledger, determining the power system assets that cannot be matched as the asset monitoring blind spot range, and analyzing the reasons for the failure to monitor. The asset information covered by this application is relatively comprehensive, the matching accuracy and efficiency are high, and the characteristics of different assets can be better identified, thereby maintaining the effectiveness of the system.

Description

Technical Field

[0001] The present application relates to the field of power monitoring technology, and in particular, to a method, device, equipment and storage medium for blind spot analysis of power system asset monitoring. Background Art

[0002] Power system asset monitoring blind spots refer to areas or equipment that are not effectively covered or monitored during power system monitoring and management. These areas are often unable to be monitored in real time, data collected, or necessary actions performed due to technical, resource, or other limitations. Monitoring blind spots can lead to overlooking potential issues in the power system, increasing system operational risks.

[0003] Possible reasons for the existence of monitoring blind spots in power system assets include the inability of existing sensors to cover the entire power system, the inability of monitoring equipment and the monitoring system to communicate effectively, the failure to transmit data from equipment or areas to the monitoring system in a timely manner, and the potential existence of monitoring blind spots at the locations where equipment is deployed. Some researchers have proposed a terminal status monitoring method for distributed power grid big data systems. By establishing a set of registered monitoring terminal host IP addresses, MAC addresses, and communication ports, the status of the monitoring terminal host is judged from three dimensions: IP address, MAC address, and communication port. When the retrieved IP address, MAC address, and communication port of the monitoring terminal host are inconsistent with the IP address, MAC address, and communication port registered on the power transmission and transformation equipment status monitoring master station platform, an alarm is issued. This overcomes the passive situation of manually troubleshooting the monitoring terminal host, which is cumbersome and passive, and detects unregistered equipment.

[0004] Existing power system monitoring technology has flaws. First, it fails to account for blind spots in power system asset monitoring. The lack of a comparable system ledger prevents all power assets from being monitored. In large-scale power grids, this limitation can lead to problems occurring outside the monitoring range going undetected, resulting in monitoring blind spots. Second, verifying the identity of monitoring terminal hosts by matching them against registered monitoring terminal hosts' IP addresses, MAC addresses, and communication port numbers is prone to the massive size of registered data, resulting in slow and inefficient retrieval. Furthermore, matching methods that only utilize information from three dimensions—IP addresses, MAC addresses, and communication ports—result in limited asset features and inaccurate matching. Considering the current lack of stable and reliable technical means for analyzing blind spots in power asset monitoring and the analysis of data from previous network security field inspections showing that over 30% of network-related assets are not included in network security monitoring, the sheer volume of industrial control network ledger data makes existing matching algorithms inefficient. Summary of the Invention

[0005] On the one hand, the present application provides a method for analyzing blind spots in power system asset monitoring to solve the technical problems that the existing power system asset monitoring blind spot monitoring technology still has monitoring blind spots, inaccurate matching and low matching algorithm efficiency.

[0006] This application is implemented through the following scheme:

[0007] A method for analyzing blind spots in power system asset monitoring, comprising the steps of:

[0008] S1. Collect power system asset information to generate all asset feature vectors in the system ledger and construct a graph neural network. The power system asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and a combination of various power system asset information. The system ledger is used to archive, manage, and maintain power assets;

[0009] S2. Based on the constructed graph neural network and subgraph matching technology, the power system assets in the system ledger are retrieved and matched through graph convolutional neural network and graph query;

[0010] S3. In the search and matching results, the power system assets that can be matched in the system ledger are marked to indicate that they have been included in the monitoring scope. After all the detected power system assets have been searched, all the power system assets in the system ledger are checked, and the power system assets that cannot be matched are identified as the asset monitoring blind area, and the reasons for the failure to monitor are analyzed.

[0011] Furthermore, the step S1 specifically includes the steps of:

[0012] S11. Collect power system asset information and extract information features to generate asset feature vectors;

[0013] S12. Standardize and pre-process the N power system asset information recorded in the power system ledger to obtain feature vectors for the N power system assets, and establish a ledger asset information table. The data columns of the ledger asset information table include the power system asset information used to generate the asset feature vectors and the final generated asset feature vectors. The power system asset information in the table is consistent with the data in the ledger.

[0014] S13. Establish a corresponding graph structure model based on the relationships between power system assets, and clarify nodes, edges, and edge attributes, wherein the nodes are power system assets, each power system asset carries its attribute information, the edges represent physical connections or functional relationships between power system assets, and are established by the network topology of the power system and the interconnections between power system assets; the edge attributes define the strength or nature of the relationships between power system assets, and are set based on the topology and physical characteristics of the power system;

[0015] S14. Build a graph neural network model and use U-KNN for node classification. First, based on multi-type convolution, extract information from 1-hop, 2-hop, and kNN networks. Then, adaptively learn and fuse the feature representations of the neighbor graphs of the three networks. During the neighbor aggregation process, introduce differentiated neighbor graph contribution calculations to enable the model to focus on fusing neighbor graphs to achieve node classification, and support situations where the contribution of neighbor nodes to the center point is not predetermined.

[0016] Furthermore, in step S11, the method of generating an asset feature vector from an IP address and a MAC address includes: converting each part of the address into binary and then combining them, and mapping them into a binary vector of fixed length using a hash function; the method of generating an asset feature vector from a device name includes: using word embedding and text embedding methods; the method of generating an asset feature vector from a device type, device model, manufacturer, and device operating system includes: using one-hot encoding to clarify the number of values ​​of each attribute, setting the value of the corresponding position according to the value of each attribute of the specific asset, and finally merging all attributes into a feature vector.

[0017] Furthermore, in step S14, based on multi-type convolution, information is extracted from 1-hop, 2-hop and kNN networks, including the following steps:

[0018] S141, introduce a multi-type convolution mechanism based on three neighbor graphs, using 1-hop, 2-hop and kNN networks for direct information propagation, specifically including: defining the original input network 1-hop as G D =(A D ,X), define the 2-hop network as G R =(A R ,X), the KNN network is defined as G F =(A F ,X), where X is the node feature matrix, A D , A R , A F For the adjacency matrix, for a 1-hop network, information is directly propagated to the original input network; for a 2-hop network, it is stipulated that when setting edges, each node must select nodes connected by at least two different paths to construct the adjacency matrix A. R For the kNN network, we obtain the kNN of each node based on the Jaccard similarity, calculate the similarity matrix between n nodes, and then select the top-k similar node pairs for each node to set edges to obtain the adjacency matrix AF. The node similarity calculation uses the Jaccard distance to describe the similarity between two nodes:

[0019]

[0020] Among them, v i and v j are two nodes in the graph, d j For node v i and v j Similarity value of

[0021] S142. When performing message propagation, a two-layer GCN is used to learn node embeddings that capture specific information from neighbors. The embedding matrix is:

[0022]

[0023] Where I is the identity matrix, for The diagonal matrix, W t (l) is the weight matrix, and σ is the nonlinear activation function.

[0024] Furthermore, in step S14, the adaptive learning and fusion of the feature representations of the neighbor graphs of the three networks introduces differentiated neighbor graph contribution calculations during the aggregation process, so that the model can focus on fusion of neighbor graphs to achieve node classification and support situations where the contribution of neighbor nodes to the center point is not predetermined. Specifically, the steps include:

[0025] S143. After multi-type convolution, in the neighbor aggregation and model update stage, the self-attention mechanism is used for discriminative aggregation to automatically learn the contribution of three network neighbors according to the given learning goal;

[0026] S144. After obtaining the contribution of each network neighbor, the contribution is normalized using the softmax function to obtain the final weight:

[0027]

[0028] Among them, β t is the contribution of different neighbor graphs;

[0029] S145. Use cross entropy to define the loss function:

[0030]

[0031] Among them, y L is the set of node indices, Y is the label indicator matrix, and F is the dimension of the output embedding.

[0032] Furthermore, in step S143, the contribution of the three network neighbors is specifically calculated as follows:

[0033] For a 1-hop network, the contribution is calculated as:

[0034]

[0035] Among them, E s is the number of edges with the same node type at both ends, E a is the total number of edges;

[0036] For a 2-hop network, the contribution is calculated as:

[0037]

[0038] Among them, N i is the total number of neighbors of the node, N ci is the number of neighbors of each label type, N v is the number of nodes with edges in the graph data;

[0039] For the kNN network, the contribution is calculated as:

[0040]

[0041] According to β R The positive or negative value of increases or decreases the k-nearest neighbor weights.

[0042] Furthermore, the step S2 specifically includes the steps of:

[0043] S21. Generate an embedding vector for the node, where the embedding vector includes the original attributes of the node, the relative position of the node in the graph, and the topological structure;

[0044] S22. Establish an index for node embedding. Based on the embedding vector of each node, use efficient retrieval algorithms such as approximate nearest neighbor ANN and local sensitive hashing (LSH) to establish an index structure for node features.

[0045] S23. Combine graph structure and node feature vector and use graph embedding technology for node retrieval.

[0046] On the other hand, the present application also provides a power system asset monitoring blind spot analysis device, which is characterized by comprising:

[0047] A graph neural network construction module is used to collect power system asset information to generate all asset feature vectors in the system ledger for graph neural network construction. The power system asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and a combination of various power system asset information. The system ledger is used to archive, manage, and maintain power assets;

[0048] The power system asset retrieval and matching module is used to retrieve and match power system assets in the system ledger through graph convolutional neural networks and graph queries based on the constructed graph neural network and subgraph matching technology;

[0049] The monitoring blind spot determination and analysis module is used to mark the power system assets that can be matched in the system ledger in the retrieval and matching results to indicate that they have been included in the monitoring scope. After all the detected power system assets have been retrieved, all the power system assets in the system ledger are checked, and the power system assets that cannot be matched are determined as the asset monitoring blind spot range, and the reasons for the failure to monitor are analyzed.

[0050] On the other hand, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the power system asset monitoring blind spot analysis method when executing the computer program.

[0051] On the other hand, the present application further provides a storage medium, which includes a stored program, and when the program is run, controls the device where the storage medium is located to execute the steps of the power system asset monitoring blind spot analysis method.

[0052] Compared with the existing technology, this application has the following beneficial effects:

[0053] The present application provides a method, device, electronic device and storage medium for analyzing blind spots in power system asset monitoring. The method fully considers the characteristics of diverse protocols and complicated brands of power-specific equipment, generates asset feature vectors by selecting asset information, establishes a graph structure, and classifies large-scale ledger data into nodes. Each node in the graph stores the asset feature vector. By establishing a graph structure and a graph index, the number of searches is reduced, the speed and efficiency of searches are improved, and power assets in the ledger are quickly retrieved and matched, so as to realize the instant discovery of blind spots in industrial control system monitoring. On the one hand, the asset information used in this application includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, etc. , can be freely selected according to the different characteristics of the system. Compared with the method of matching only using information in three dimensions of IP address, MAC address, and communication port, which has the problem of low matching accuracy, this application covers asset information more comprehensively, has high matching accuracy, can better identify the characteristics of different assets, and maintains the effectiveness of the system; on the other hand, compared with the current power grid security monitoring technology, this application fully considers the problem of blind spots in power system asset monitoring. By comparing the system ledger, it finds assets that are not within the monitoring range and issues alarms, thereby expanding the scope of security monitoring and ensuring that the abnormal conditions of the power grid can be fully monitored, thereby improving the effectiveness, coverage and depth of the power monitoring system's security monitoring system.

[0054] In addition to the above-described purposes, features and advantages, the present application also has other purposes, features and advantages. The present application will be further described in detail below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The drawings that constitute a part of this application are used to provide further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute improper limitations on this application.

[0056] Figure 1 It is a flow chart of the blind spot analysis method for power system asset monitoring according to the preferred embodiment of the present application.

[0057] Figure 2 It is a schematic flow chart of the sub-steps of step S2 of the preferred embodiment of the present application.

[0058] Figure 3 It is a schematic diagram of the module of the power system asset monitoring blind spot analysis device of the preferred embodiment of the present application.

[0059] Figure 4 This is a schematic block diagram of an electronic device entity according to a preferred embodiment of the present application.

[0060] Figure 5 It is a diagram of the internal structure of a computer device according to a preferred embodiment of the present application. DETAILED DESCRIPTION

[0061] The embodiments of the present application are described in detail below with reference to the accompanying drawings, but the present application can be implemented in a variety of different ways defined and covered below.

[0062] like Figure 1 As shown, the preferred embodiment of the present application provides a method for analyzing blind spots in power system asset monitoring, comprising the steps of:

[0063] S1. Collect power system asset information to generate all asset feature vectors in the system ledger and construct a graph neural network. The power system asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and a combination of various power system asset information. The system ledger is used to file, manage, and maintain power assets;

[0064] S2. Based on the constructed graph neural network and subgraph matching technology, the power system assets in the system ledger are retrieved and matched through graph convolutional neural network and graph query;

[0065] S3. In the search and matching results, the power system assets that can be matched in the system ledger are marked to indicate that they have been included in the monitoring scope. After all the detected power system assets have been searched, all the power system assets in the system ledger are checked, and the power system assets that cannot be matched are identified as the asset monitoring blind area, and the reasons for the failure to monitor are analyzed.

[0066] This embodiment provides a method for analyzing blind spots in asset monitoring of power systems. This method fully considers the characteristics of diverse protocols and complicated brands of power-specific equipment. By selecting asset information to generate asset feature vectors, a graph structure is established, and large-scale ledger data is classified into nodes. Each node in the graph stores an asset feature vector. By establishing a graph structure and a graph index, the number of searches is reduced, the speed and efficiency of searches are improved, and power assets in the ledger are quickly retrieved and matched, so that the blind spots of industrial control system monitoring can be discovered immediately. On the one hand, the asset information used in this embodiment includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, etc., which can be found according to the system Compared with the method of matching using only the three dimensions of information of IP address, MAC address and communication port, which has the problem of low matching accuracy, this embodiment covers asset information more comprehensively, has high matching accuracy, can better identify the characteristics of different assets, and maintains the effectiveness of the system; on the other hand, compared with the current power grid security monitoring technology, this application fully considers the problem of blind spots in power system asset monitoring. By comparing the system ledger, it finds assets that are not within the monitoring range and issues alarms, thereby expanding the scope of security monitoring, ensuring that the abnormal conditions of the power grid can be fully monitored, and improving the effectiveness, coverage and depth of the power monitoring system security monitoring system.

[0067] Preferably, the step S1 specifically includes the steps of:

[0068] S11. Collect power system asset information and extract information features to generate asset feature vectors. The extracted asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, etc., and establish an asset feature vector X = (x1, x2, x3, x4, x5, x6, x7, ...), where X represents a certain asset feature vector, x1 represents the IP address information of the asset, x2 represents the MAC address information of the asset, x3 represents the device name information of the asset, x4 represents the device type information of the asset, x5 represents the device model information of the asset, x6 represents the manufacturer information of the asset, and x7 represents the device operating system information of the asset. The asset information represented in the above feature vectors is all data that has undergone some kind of conversion. If an asset information item is empty, the length of the data item is padded with 0. The selection of which asset information to extract features and generate feature vectors needs to be considered according to the actual situation, including but not limited to the above-mentioned IP address, MAC address, device name, device type, device model, manufacturer, device operating system, etc., or a combination of any several types of information;

[0069] In addition, methods for generating asset feature vectors from IP addresses and MAC addresses include: converting each part of the address into binary, recombining them, and mapping them into a fixed-length binary vector using a hash function; methods for generating asset feature vectors from device names include: using word embedding and text embedding methods; methods for generating asset feature vectors from device types, device models, manufacturers, and device operating systems include: using one-hot encoding to specify the number of values ​​for each attribute, setting the value of the corresponding position based on the value of each attribute for the specific asset, and finally merging all attributes into a feature vector. The converted asset IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and other data are merged to form the final complete asset feature vector. The method selected for converting asset information into a vector should be considered based on actual conditions, and no examples are given here.

[0070] S12: Perform standardization preprocessing on the N power system asset information recorded in the power system ledger to obtain the feature vector X of the N power system assets. 1 , X 2 ,…X N , and establish a ledger asset information table, as shown in Table 1, wherein the data columns of the ledger asset information table include the power system asset information used to generate the asset feature vector and the final generated asset feature vector. The power system asset information in the table is consistent with the data in the ledger.

[0071] Table 1 Ledger asset information table

[0072]

[0073] S13. Based on the relationship between power system assets, establish a corresponding graph structure model, clarify the nodes, edges, and edge attributes, where:

[0074] The nodes are power system assets, and each power system asset carries its attribute information. The attributes of power assets include IP address, MAC address, device name, device type, device model, manufacturer, device operating system, etc. These attributes of power assets will be used as node feature inputs of the graph neural network when constructing the graph neural network, helping the graph neural network model to understand the basic information of each device.

[0075] Edges represent physical connections or functional relationships between power system assets, established by the power system's network topology and the interconnectedness between power system assets. Specifically, the connection between adjacent devices (such as power transformers, switches, and transmission lines) forms a physical connection. In this case, an edge represents a direct connection between the devices, and the edge weight can be weighted based on the current or voltage of the connection. Edge weights can be based not only on the electrical parameters between the devices (such as resistance, conductance, and load capacity), but also on the distance between the devices (such as the physical distance between the two devices or communication latency). Furthermore, the functional relationship between devices is an important basis for edge establishment, such as the relationship between a transformer and a transmission line, or between a generator and the grid. If the output of one device directly affects the operating status of another, this functional connection is represented by an edge. Finally, if the relationship between devices is unidirectional (such as current flowing from a generator to a transformer), the edge has directionality, reflecting this unidirectional nature.

[0076] Edge attributes define the strength or nature of relationships between power system assets. Based on the topology and physical characteristics of the power system, edge attributes include similarity, distance metrics, and power flow intensity, which are used to measure the strength of the relationship between two devices. For edge attribute settings, the similarity between devices is measured by the similarity of voltage and current, the distance is calculated by the actual distance between devices or the length of the transmission line, and the power flow intensity is used to measure the intensity of power transmission between devices.

[0077] S14. Build a graph neural network model and use U-KNN for node classification. First, based on multi-type convolution, extract information from 1-hop, 2-hop, and kNN networks. Then, adaptively learn and fuse the feature representations of the neighbor graphs of the three networks. During the neighbor aggregation process, introduce differentiated neighbor graph contribution calculations to enable the model to focus on fusing neighbor graphs to achieve node classification, and support situations where the contribution of neighbor nodes to the center point is not predetermined.

[0078] Preferably, in step S14, extracting information from 1-hop, 2-hop and kNN networks based on multi-type convolution specifically includes the steps of:

[0079] S141. Since networks with different properties and structures require different propagation mechanisms, a multi-type convolution mechanism based on three neighbor graphs is introduced, using 1-hop, 2-hop and kNN networks for direct information propagation respectively. Specifically, the original input network 1-hop is defined as G D =(A D ,X), define the 2-hop network as G R =(A R ,X), the KNN network is defined as G F =(A F ,X), where X is the node feature matrix, A D , A R , A F For the adjacency matrix, for a 1-hop network, information is directly propagated to the original input network; for a 2-hop network, it is stipulated that when setting edges, each node must select nodes connected by at least two different paths to construct the adjacency matrix A. R For the kNN network, we obtain the kNN of each node based on the Jaccard similarity, calculate the similarity matrix between n nodes, and then select the top-k similar node pairs for each node to set edges to obtain the adjacency matrix AF. The node similarity calculation uses the Jaccard distance to describe the similarity between two nodes:

[0080]

[0081] Among them, v i and v j are two nodes in the graph, d j For node v i and v j Similarity value of

[0082] S142. When performing message propagation, a two-layer GCN is used to learn node embeddings that capture specific information from neighbors. The embedding matrix is:

[0083]

[0084] Where I is the identity matrix, for The diagonal matrix, W t (l) is the weight matrix, and σ is the nonlinear activation function.

[0085] Preferably, in step S14, the adaptive learning and fusion of the feature representations of the neighbor graphs of the three networks introduces differentiated neighbor graph contribution calculations during the aggregation process, so that the model can focus on fusion of neighbor graphs to achieve node classification and support the situation where the contribution of neighbor nodes to the center point is not predetermined, specifically including the steps of:

[0086] S143. After multi-type convolution, in the neighbor aggregation and model update stage, the self-attention mechanism is used for discriminant aggregation, and the contribution of three types of network neighbors is automatically learned according to the given learning objectives, where:

[0087] For a 1-hop network, the contribution is calculated as:

[0088]

[0089] Among them, E s is the number of edges with the same node type at both ends, E a is the total number of edges;

[0090] For a 2-hop network, the contribution is calculated as:

[0091]

[0092] Among them, N i is the total number of neighbors of the node, N ci is the number of neighbors of each label type, N v is the number of nodes with edges in the graph data;

[0093] For the kNN network, its contribution is calculated as:

[0094]

[0095] According to β R The positive or negative value of increases or decreases the k-nearest neighbor weights.

[0096] S144. After obtaining the contribution of each network neighbor, the contribution is normalized using the softmax function to obtain the final weight:

[0097]

[0098] Among them, β t is the contribution of different neighbor graphs, and its specific calculation method is shown in the calculation formula of the contribution of the three neighbor graphs in step S143 above;

[0099] S145. Use cross entropy to define the loss function:

[0100]

[0101] Among them, y L is the set of node indices, Y is the label indicator matrix, and F is the dimension of the output embedding.

[0102] Preferably, if Figure 2 As shown, the step S2 specifically includes the following steps:

[0103] S21. Generate an embedding vector for the node, where the embedding vector includes the original attributes of the node, the relative position of the node in the graph, and the topological structure. When GNN is used to embed the nodes in the graph in the aforementioned step, the feature vector of the node includes the node's own attributes, and at the same time integrates the feature information of the surrounding neighboring nodes and the structural information of the graph. At this time, the embedding vector not only reflects the original attributes of the node, but also its relative position and topological structure in the graph.

[0104] S22. Build a node embedding index. Based on each node's embedding vector, use efficient retrieval algorithms such as approximate nearest neighbor ANN and locality-sensitive hashing (LSH) to create an index structure for node features. Because the embedding vectors for power nodes are relatively low-dimensional, LSH technology is used to map similar vectors to the same hash bucket, accelerating similarity calculations. By establishing an efficient index structure, the amount of computation required for queries is significantly reduced, transforming retrieval from brute-force search to efficient approximate query.

[0105] S23. Combine the graph structure and node feature vectors and use graph embedding technology to perform node retrieval. In order to ensure the accuracy and relevance of the retrieval results, combine the graph structure information and node feature information to further optimize the node matching results. Simply relying on the feature vector of the node for retrieval cannot fully consider the structural information of the graph, so the retrieval results are adjusted by the similarity of the graph structure. Use graph embedding technology (such as DeepWalk or node2vec) to encode the topological information of the graph into the embedding vector of the node, which not only relies on the attribute characteristics of the node, but also fully considers the connection relationship between the nodes. In addition, combining the structural information of the graph with the feature information of the node, calculate the structural similarity between nodes (such as graph isomorphism or graph edit distance), and consider it together with the feature similarity to ensure that the found nodes are highly similar to the query node in both topological structure and attribute characteristics.

[0106] In summary, the power system asset monitoring blind spot analysis method provided by the above embodiment has the following characteristics:

[0107] 1. Accurately identify blind spots in industrial control system monitoring. Current industrial control network security risk monitoring suffers from the problem of inability to identify assets in real time, resulting in blind spots in monitoring. There is a lack of technical means for blind spot analysis of power asset monitoring, making it difficult for security management departments to understand how many assets in power plants and substations under their jurisdiction need to be included in network security monitoring. This application focuses on the blind spot analysis technology for industrial control asset detection for new power systems, matching detected assets with system ledger data to achieve instant discovery of blind spots in industrial control system monitoring and efficient matching of ledger data. This technology can adapt to the update of industrial control network asset information and comprehensively improve the effectiveness, coverage, and depth of the power monitoring system's security monitoring system.

[0108] 2. Comprehensive asset information coverage can effectively identify different assets. The asset information used in this application includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, etc., which can be freely selected according to the different characteristics of the system. Compared with the matching method that only uses information in three dimensions of IP address, MAC address, and communication port, this application covers more comprehensive asset information and has high matching accuracy. It can better identify the characteristics of different assets and maintain the effectiveness of the system.

[0109] 3. This application uses graph convolutional neural network technology and graph query technology to greatly improve the speed and efficiency of asset retrieval and matching. The industrial control network ledger data is huge, covering a wide range of equipment and system information, forming a large and complex network equipment list. By establishing a graph structure and graph index, the number of searches is reduced and the speed and efficiency of searches are improved.

[0110] 4. In the process of node classification, the main features are selected in a differentiated manner. In the process of node classification, a differentiated neighbor graph contribution calculation method is introduced into the graph attention mechanism to strengthen the feature representation of the main neighbor graph, weaken the interference information of the secondary neighbor graph, improve the model accuracy, and enhance the accuracy of node classification.

[0111] like Figure 3 As shown, another preferred embodiment of the present application further provides a power system asset monitoring blind spot analysis device, comprising:

[0112] A graph neural network construction module is used to collect power system asset information to generate all asset feature vectors in the system ledger for graph neural network construction. The power system asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and a combination of various power system asset information. The system ledger is used to archive, manage, and maintain power assets;

[0113] The power system asset retrieval and matching module is used to retrieve and match power system assets in the system ledger through graph convolutional neural networks and graph queries based on the constructed graph neural network and subgraph matching technology;

[0114] The monitoring blind spot determination and analysis module is used to mark the power system assets that can be matched in the system ledger in the retrieval and matching results to indicate that they have been included in the monitoring scope. After all the detected power system assets have been retrieved, all the power system assets in the system ledger are checked, and the power system assets that cannot be matched are determined as the asset monitoring blind spot range, and the reasons for the failure to monitor are analyzed.

[0115] The purpose of this embodiment is to study blind spot analysis technology for industrial control asset monitoring for new power systems. Through graph neural networks and subgraph matching technology, the detected assets are matched with system ledger data, and a mapping from matching paths to asset feature vectors is established. This enables the immediate discovery of blind spots in industrial control system monitoring and efficient matching of ledger data. It can adapt to the update of industrial control network asset information and can comprehensively improve the effectiveness, coverage, and depth of the power monitoring system's safety monitoring system.

[0116] like Figure 4 As shown, a preferred embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the power system asset monitoring blind spot analysis method in the above embodiment when executing the computer program.

[0117] like Figure 5 As shown, the preferred embodiment of the present application further provides a computer device, which can be a terminal or a liveness detection server, and its internal structure diagram can be as shown in FIG. Figure 5 As shown. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with other external computer devices via a network connection. When the computer program is executed by the processor, the steps of the above-mentioned power system asset monitoring blind spot analysis method are implemented.

[0118] Those skilled in the art will understand that Figure 5The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0119] A preferred embodiment of the present application further provides a storage medium, which includes a stored program. When the program is executed, the device where the storage medium is located is controlled to execute the steps of the power system asset monitoring blind spot analysis method in the above embodiment.

[0120] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0121] If the functions described in the method of this embodiment are implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a storage medium readable by one or more computing devices. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computing device (which can be a personal computer, server, mobile computing device or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0122] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal translation scripting language JavaScript, etc.

[0123] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0125] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0126] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0127] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for analyzing blind spots in power system asset monitoring, characterized in that: Including steps: S1. Collect power system asset information to generate all asset feature vectors in the system ledger and construct a graph neural network. The power system asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and a combination of various power system asset information. The system ledger is used to archive, manage, and maintain power assets; S2. Based on the constructed graph neural network and subgraph matching technology, the power system assets in the system ledger are retrieved and matched through graph convolutional neural network and graph query; S3. In the search and matching results, the power system assets that can be matched in the system ledger are marked to indicate that they have been included in the monitoring scope. After all the detected power system assets are searched, all the power system assets in the system ledger are checked, and the power system assets that cannot be matched are determined as the asset monitoring blind area, and the reasons for the failure to monitor are analyzed. The step S1 specifically includes the following steps: S11. Collect power system asset information and extract information features to generate asset feature vectors; S12. Standardize and pre-process the N power system asset information recorded in the power system ledger to obtain feature vectors for the N power system assets, and establish a ledger asset information table. The data columns of the ledger asset information table include the power system asset information used to generate the asset feature vectors and the final generated asset feature vectors. The power system asset information in the table is consistent with the data in the ledger. S13. Establish a corresponding graph structure model based on the relationships between power system assets, and clarify nodes, edges, and edge attributes, wherein the nodes are power system assets, each power system asset carries its attribute information, the edges represent physical connections or functional relationships between power system assets, and are established by the network topology of the power system and the interconnections between power system assets; the edge attributes define the strength or nature of the relationships between power system assets, and are set based on the topology and physical characteristics of the power system; S14. Build a graph neural network model and use U-KNN for node classification. First, based on multi-type convolution, extract information from 1-hop, 2-hop, and kNN networks. Then, adaptively learn and fuse the feature representations of the neighbor graphs of the three networks. During the neighbor aggregation process, introduce differentiated neighbor graph contribution calculations to enable the model to focus on fusing neighbor graphs to achieve node classification, and support situations where the contribution of neighbor nodes to the center point is not predetermined.

2. The power system asset monitoring blind area analysis method according to claim 1, characterized in that: In step S11, the method of generating an asset feature vector from an IP address and a MAC address includes: converting each part of the address into binary and then combining them, and mapping them into a binary vector of fixed length using a hash function; the method of generating an asset feature vector from a device name includes: using word embedding and text embedding methods; the method of generating an asset feature vector from a device type, device model, manufacturer, and device operating system includes: using one-hot encoding to clarify the number of values ​​for each attribute, setting the value of the corresponding position according to the value of each attribute of the specific asset, and finally merging all attributes into a feature vector.

3. The power system asset monitoring blind area analysis method according to claim 1, characterized in that: In step S14, information is extracted from 1-hop, 2-hop and kNN networks based on multi-type convolution, including the following steps: S141, introduce a multi-type convolution mechanism based on three neighbor graphs, using 1-hop, 2-hop and kNN networks for direct information propagation, specifically including: defining the original input network 1-hop as G D =(A D ,X), define the 2-hop network as G R =(A R ,X), the KNN network is defined as G F =(A F ,X), where X is the node feature matrix, A D , A R , A F For the adjacency matrix, for a 1-hop network, information is directly propagated to the original input network; for a 2-hop network, it is stipulated that when setting edges, each node must select nodes connected by at least two different paths to construct the adjacency matrix A. R For the kNN network, we obtain the kNN of each node based on the Jaccard similarity, calculate the similarity matrix between n nodes, and then select the top-k similar node pairs for each node to set edges to obtain the adjacency matrix AF. The node similarity calculation uses the Jaccard distance to describe the similarity between two nodes: Among them, v i and v j are two nodes in the graph, d j For node v i and v j Similarity value of S142. When performing message propagation, a two-layer GCN is used to learn node embeddings that capture specific information from neighbors. The embedding matrix is: Where I is the identity matrix, for The diagonal matrix, W t (l) is the weight matrix, and σ is the nonlinear activation function.

4. The power system asset monitoring blind area analysis method according to claim 1, characterized in that: In step S14, the adaptive learning and fusion of the feature representations of the neighbor graphs of the three networks introduces differentiated neighbor graph contribution calculations during the aggregation process, so that the model can focus on fusion of neighbor graphs to achieve node classification and support the situation where the contribution of neighbor nodes to the center point is not predetermined. Specifically, the steps include: S143. After multi-type convolution, in the neighbor aggregation and model update stage, the self-attention mechanism is used for discriminative aggregation to automatically learn the contribution of three network neighbors according to the given learning goal; S144. After obtaining the contribution of each network neighbor, the contribution is normalized using the softmax function to obtain the final weight: Among them, β t is the contribution of different neighbor graphs; S145. Use cross entropy to define the loss function: Among them, y L is the set of node indices, Y is the label indicator matrix, and F is the dimension of the output embedding.

5. The power system asset monitoring blind area analysis method according to claim 4, characterized in that: In step S143, the contribution of the three network neighbors is specifically calculated as follows: For a 1-hop network, the contribution is calculated as: Among them, E s is the number of edges with the same node type at both ends, E a is the total number of edges; For a 2-hop network, the contribution is calculated as: Among them, N i is the total number of neighbors of the node, N ci is the number of neighbors of each label type, N v is the number of nodes with edges in the graph data; For the kNN network, the contribution is calculated as: According to β R The positive or negative value of increases or decreases the k-nearest neighbor weights.

6. The power system asset monitoring blind area analysis method according to claim 1, characterized in that: The step S2 specifically includes the following steps: S21. Generate an embedding vector for the node, where the embedding vector includes the original attributes of the node, the relative position of the node in the graph, and the topological structure; S22. Establish an index for node embedding. Based on the embedding vector of each node, use efficient retrieval algorithms such as approximate nearest neighbor ANN and local sensitive hashing (LSH) to establish an index structure for node features. S23. Combine graph structure and node feature vector and use graph embedding technology for node retrieval.

7. A power system asset monitoring blind spot analysis device, characterized in that: include: The graph neural network construction module is used to collect power system asset information to generate all asset feature vectors in the system ledger for graph neural network construction. The power system asset information includes IP address, MAC address, device name, device type, device model, manufacturer, device operating system, and a combination of various power system asset information. The system ledger is used to archive, manage, and maintain power assets. Specifically, it is used to: Collect power system asset information and extract information features to generate asset feature vectors; Standardization preprocessing is performed on N power system asset information recorded in the power system ledger to obtain feature vectors of the N power system assets, and a ledger asset information table is established, wherein the data columns of the ledger asset information table include the power system asset information used to generate the asset feature vector and the final generated asset feature vector, and the power system asset information in the table is consistent with the data in the ledger; Based on the relationships between power system assets, a corresponding graph structure model is established to clarify nodes, edges, and edge attributes, where the nodes are power system assets, each of which carries its attribute information; the edges represent the physical connections or functional relationships between power system assets, which are established by the network topology of the power system and the interconnections between power system assets; the edge attributes define the strength or nature of the relationships between power system assets, which are set based on the topology and physical characteristics of the power system; A graph neural network model was established, using U-KNN for node classification. First, based on multi-type convolution, information was extracted from 1-hop, 2-hop, and kNN networks. The feature representations of the neighborhood graphs of the three networks were then adaptively learned and fused. During the neighborhood aggregation process, differentiated neighborhood graph contribution calculations were introduced, enabling the model to prioritize node classification by integrating neighborhood graphs. This also supports situations where the contribution of neighbor nodes to the central node is not predetermined. The power system asset retrieval and matching module is used to retrieve and match power system assets in the system ledger through graph convolutional neural networks and graph queries based on the constructed graph neural network and subgraph matching technology; The monitoring blind spot determination and analysis module is used to mark the power system assets that can be matched in the system ledger in the retrieval and matching results to indicate that they have been included in the monitoring scope. After all the detected power system assets have been retrieved, all the power system assets in the system ledger are checked, and the power system assets that cannot be matched are determined as the asset monitoring blind spot range, and the reasons for the failure to monitor are analyzed.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the power system asset monitoring blind spot analysis method according to any one of claims 1 to 6 are implemented.

9. A storage medium comprising a stored program, which controls a device where the storage medium is located to execute the steps of the blind spot analysis method for power system asset monitoring according to any one of claims 1 to 6 when the program is executed.

Images