Management and control application side data risk monitoring system based on artificial intelligence

Abstract

The invention discloses a management and control application side data risk monitoring system based on artificial intelligence, which relates to the field of data monitoring and comprises an application side acquisition module, a hardware side acquisition module, an information transmission acquisition module, a safety protection acquisition module, a data processing module and an information sending module. The application side acquisition module is used for acquiring and controlling application side data; the hardware side acquisition module is used for acquiring hardware related information of hardware used by a management and control application side of a power supply company; the information transmission and acquisition module is used for acquiring information transmission related information; the safety protection acquisition module is used for acquiring safety protection related information; and the data processing module is used for processing the management and control application side data to generate application side data risk warning information, and processing hardware related information of hardware used by the management and control application side of the power supply company to generate hardware risk warning information. According to the invention, more comprehensive management and control of application side data risk monitoring can be carried out.

Description

Technical Field

[0001] The present invention relates to the field of data monitoring, and in particular to an artificial intelligence-based management and control application-side data risk monitoring system. Background Art

[0002] As the business scale of power supply companies continues to expand and their level of informatization deepens, their management and control applications are facing unprecedentedly complex data environments and multiple risk challenges, which has prompted the emergence of artificial intelligence-based management and control application-side data risk monitoring systems.

[0003] In today's digital age, the operation of power supply companies is highly dependent on various management and control applications. From power dispatching, equipment operation and maintenance to power marketing, customer service and other links, massive amounts of data are transmitted interactively between different systems. On the one hand, the amount of data is growing explosively, and the sources are becoming more and more extensive, including equipment operation data collected by various sensors, user electricity consumption data, market transaction data, etc., making it increasingly difficult to manage data integrity, consistency and volatility. Therefore, it is necessary to use the data risk monitoring system on the management and control application side to conduct risk monitoring.

[0004] The existing risk monitoring system for control and management application side data has the problem of single monitoring content and failure to timely discover abnormal data on the control and management application side of the power company, which has a certain impact on the use of the risk monitoring system for control and management application side data. Therefore, a risk monitoring system for control and management application side data based on artificial intelligence is proposed. Summary of the invention

[0005] The technical problem to be solved by the present invention is: how to solve the problem that some control application side data risk monitoring systems have a single monitoring content and cannot timely discover the abnormal data on the control application side of the power company, which has a certain impact on the use of the control application side data risk monitoring system. A control application side data risk monitoring system based on artificial intelligence is provided.

[0006] The present invention solves the above technical problems through the following technical solutions, which include an application side acquisition module, a hardware side acquisition module, an information transmission acquisition module, a security protection acquisition module, a data processing module and an information sending module; The application side acquisition module is used to collect and control application side data; The hardware side acquisition module is used to collect hardware related information of the hardware used by the power supply company's management and control application side; The information transmission collection module is used to collect information related to information transmission; The safety protection collection module is used to collect safety protection related information; The data processing module is used to process the control application side data to generate application side data risk warning information, process the hardware related information of the hardware used on the control application side of the power supply company to generate hardware risk warning information, process the information transmission related information to generate information transmission risk warning information, and process the security protection related information to obtain security protection warning information; The information sending module is used to send the application side data risk warning information, hardware risk warning information, information transmission risk warning information and security protection warning information to a preset receiving terminal after the above information is generated.

[0007] Furthermore, the specific process of obtaining the application-side data risk warning information is as follows: Extract the control application side data, which includes the data collected by the application side acquisition module, including data integrity, data consistency and data volatility; Determine data integrity, data consistency, and data volatility; When any one of the data integrity judgment, data consistency judgment and data volatility judgment is abnormal, application-side data risk warning information is generated.

[0008] Furthermore, the specific process of determining the data integrity is as follows: Perform integrity check on the collected control application side data. Suppose the number of preset data items that the original data should contain is , the number of complete key data items actually collected is ; By calculating the data integrity ratio to measure data integrity risk; The calculation formula is: ; Set integrity risk threshold ,when When the data is detected, it is judged to be abnormal and the corresponding application-side data risk warning information is generated; The specific process of data consistency risk determination is as follows: For the data values ​​collected from the same data object at different times or from different data sources, suppose there are n sets of comparison data, each set of data contains two comparison values and ; By formula , calculate the data consistency deviation value ; Setting consistency risk thresholds ,like , that is, it is judged to be abnormal and application-side data risk warning information is generated.

[0009] The specific process of determining the risk of abnormal data fluctuation is as follows: Select the management application side data with time series characteristics, set the time series length to m, and the data value sequence to ; First use the moving average method to calculate the smoothed series , where k is the moving average window size, and the calculation formula is: ; Then calculate the residual sequence , , By formula , calculate the standard deviation of the residual sequence ,in is the mean of the residual sequence; Set the abnormal fluctuation threshold multiple r. If the absolute value of the residual is greater than If the situation occurs, it is judged as abnormal and application-side data risk warning information is generated.

[0010] Furthermore, the specific process of obtaining the hardware risk warning information is as follows: Extract the hardware related information of the hardware used by the power supply company's management and control application side, where the hardware related information includes the hardware's historical fault data and the hardware's key performance indicators; Process the historical failure data of the hardware to obtain the probability of hardware failure; Process the key performance indicators of the hardware to obtain comprehensive indicators of performance bottlenecks; When any one of the hardware failure probability and performance bottleneck comprehensive indicators is abnormal, a hardware risk warning message is generated.

[0011] Furthermore, the specific process of obtaining the hardware failure probability is as follows: Extract the historical fault data of the hardware, and extract the total running time of the hardware in the past The cumulative time of failure is , through the formula , calculate the probability of hardware failure ; Also, consider the hardware's current operating environment factors, including temperature and humidity; Establish environmental impact factor function through experimental or empirical data ; By formula , get the corrected hardware failure risk probability ; Setting hardware failure risk thresholds (e.g. 10%, depending on the hardware type and importance), when When it is detected, it indicates that there is an abnormality and a hardware risk warning message is generated; The process of obtaining comprehensive performance bottleneck indicators is as follows: Key performance indicators of hardware include CPU utilization , memory usage , Disk I / O rate ; Assume that the upper limits of the performance indicators when the hardware is operating normally are , , ; By formula , comprehensive indicators of computing performance bottlenecks ; Set performance bottleneck risk threshold ; when , it indicates that there is an abnormality and generates a hardware risk warning message.

[0012] Furthermore, the specific process of obtaining the information transmission risk warning information is as follows: Extracting the collected information transmission related information, the information transmission related information includes the bandwidth usage of the information transmission link and the encryption algorithm used for transmitting the information; Process the bandwidth usage of the transmission link to obtain the bandwidth utilization rate; The encryption algorithm used for transmitting information is processed to obtain an encryption strength score; When either the bandwidth utilization rate or the encryption strength score is abnormal, an information transmission risk warning message is generated.

[0013] Furthermore, the process of obtaining the bandwidth utilization is as follows: The actual occupied bandwidth of the transmission link at the current moment is collected from the bandwidth usage of the information transmission link. The bandwidth usage of the information transmission link and the total bandwidth of the link are ; By formula , calculate the bandwidth utilization ; Set appropriate bandwidth utilization risk thresholds ; when When the current information transmission is judged to be at risk due to insufficient bandwidth, it indicates that there is an abnormality and generates information transmission risk warning information; The encryption strength score is obtained as follows: Identify and evaluate the encryption algorithm used for transmitted information. Different encryption algorithms are assigned a basic security score based on their security and encryption key length factors. ; Considering the update frequency of encryption keys, the key update cycle is set to , in days, set an ideal key update cycle threshold based on business security requirements , calculate the key update delay penalty , the formula is: ; Then through the formula , get the final encryption strength comprehensive score ; Set the encryption strength risk threshold. If the value is less than the encryption strength risk threshold, it indicates that an abnormality exists and an information transmission risk warning message is generated.

[0014] Furthermore, the process of obtaining the safety protection warning information is as follows: Extract the acquired security protection related information, which includes the intrusion detection risk ratio and the vulnerability risk comprehensive score; When any of the intrusion detection risk ratio and the vulnerability risk comprehensive score is abnormal, a security protection warning message is generated.

[0015] Furthermore, the process of obtaining the intrusion detection risk ratio is as follows: Use intrusion detection system to monitor network traffic in real time; Assume that the number of suspected intrusion behaviors detected by the intrusion detection system within the preset time is , the total number of network connections is ; By formula , calculate the intrusion detection risk ratio ; Set the intrusion detection risk threshold. Exceeding the intrusion detection risk threshold indicates an abnormality and generates a security protection warning message; The process of obtaining the comprehensive vulnerability risk score is as follows: Regularly scan the vulnerabilities of the control applications and related hardware systems. Set the number of high-risk vulnerabilities found as H1, the number of medium-risk vulnerabilities as H2, and the number of low-risk vulnerabilities as H3, and assign weights m1, m2, and m3 respectively; Calculate the comprehensive vulnerability risk score Hh through the formula H1*m1+H2*m2+H3*m3=Hh; Set a vulnerability risk threshold. When the vulnerability risk comprehensive score Hh is greater than the vulnerability risk threshold, it means that there is an abnormality and a security protection warning message is generated.

[0016] Compared with the prior art, the present invention has the following advantages: the data risk monitoring system for the management and control application side based on artificial intelligence can ensure the reliability of power supply, and through hardware-side risk monitoring, it can grasp the operating status of the hardware equipment that the power supply company's management and control applications rely on in real time. It can accurately predict the probability of hardware failure, discover performance bottlenecks in advance, and arrange maintenance and upgrades in a timely manner to avoid shutdown of key applications such as the power dispatching system and the billing system due to hardware failure, ensure continuous and stable power supply, and reduce the impact of power outages on residents and enterprises.

[0017] Information transmission risk monitoring ensures the real-time and accurate transmission of power data between different departments, substations and dispatching centers. It avoids the untimely issuance of power instructions and data synchronization errors caused by transmission delays or packet loss, allowing accurate monitoring of the power grid operation status, and operation and maintenance personnel can respond quickly based on accurate information to maintain the normal operation rhythm of the power system.

[0018] The quality of power data has been improved. Data risk monitoring on the application side controls the quality of power data from multiple aspects, including integrity, consistency, and abnormal fluctuations. It ensures that data such as power statistics, load forecasting, and equipment status monitoring are accurate and complete, providing a reliable basis for the production and operation decisions of power supply companies. For example, accurate power data helps to ensure fair and reasonable electricity bill settlement, and reliable load forecasting guides the scientific formulation of power generation plans, avoiding economic disputes and resource waste caused by data problems.

[0019] Security protection warning information can timely detect and respond to data security threats, prevent hackers from tampering with power data, ensure data authenticity and integrity, maintain the authority of power supply companies' operating data, and ensure that data such as power market transactions and user electricity consumption information are reliable and available.

[0020] The efficiency of operation and maintenance management has been optimized. The real-time warning of the system enables the operation and maintenance team of the power supply company to quickly know various risks and locate the root cause of the fault. At the embryonic stage of hardware failure, the initial stage of information transmission abnormality, and the initial emergence of data risks, warnings are received and measures are taken, changing the previous passive operation and maintenance mode to active prevention, greatly shortening the fault repair time and reducing operation and maintenance costs.

[0021] The comprehensive information provided by multi-dimensional risk monitoring helps operation and maintenance personnel formulate a comprehensive operation and maintenance plan. Based on the risk assessment results of each dimension, hardware inspection, software upgrade, network optimization and other tasks can be reasonably arranged to avoid duplication of work, improve the efficiency of operation and maintenance resource utilization, and make the system more worthy of promotion and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0023] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiment.

[0024] like Figure 1 As shown, this embodiment provides a technical solution: an artificial intelligence-based management and control application-side data risk monitoring system, including an application-side acquisition module, a hardware-side acquisition module, an information transmission acquisition module, a security protection acquisition module, a data processing module and an information sending module; The application side acquisition module is used to collect and control application side data; The hardware side acquisition module is used to collect hardware related information of the hardware used by the power supply company's management and control application side; The information transmission collection module is used to collect information related to information transmission; The safety protection collection module is used to collect safety protection related information; The data processing module is used to process the control application side data to generate application side data risk warning information, process the hardware related information of the hardware used on the control application side of the power supply company to generate hardware risk warning information, process the information transmission related information to generate information transmission risk warning information, and process the security protection related information to obtain security protection warning information; The information sending module is used to send the application side data risk warning information, hardware risk warning information, information transmission risk warning information and security protection warning information to a preset receiving terminal after the above information is generated.

[0025] Furthermore, the specific process of obtaining the application-side data risk warning information is as follows: Extract the control application side data, which includes the data collected by the application side acquisition module, including data integrity, data consistency and data volatility; Determine data integrity, data consistency, and data volatility; When any one of the data integrity judgment, data consistency judgment and data volatility judgment is abnormal, application-side data risk warning information is generated.

[0026] The specific process of determining the data integrity is as follows: Perform integrity check on the collected control application side data. Suppose the number of preset data items that the original data should contain is , the number of complete key data items actually collected is ; By calculating the data integrity ratio to measure data integrity risk; The calculation formula is: ; Set integrity risk threshold ,when When the data is detected, it is judged to be abnormal and the corresponding application-side data risk warning information is generated; The specific process of data consistency risk determination is as follows: For the data values ​​collected from the same data object at different times or from different data sources, suppose there are n sets of comparison data, each set of data contains two comparison values and ; By formula , calculate the data consistency deviation value ; Setting consistency risk thresholds , (determined according to the data type and business requirements, such as for some precise data, the threshold is set to 0.5). , indicating that the data consistency risk is high, that is, it is judged to be abnormal, triggering the data risk warning information on the application side.

[0027] The specific process of determining the risk of abnormal data fluctuation is as follows: Select the management application side data with time series characteristics, set the time series length to m, and the data value sequence to ; First use the moving average method to calculate the smoothed series , where k is the moving average window size, and the calculation formula is: ; Then calculate the residual sequence , , By formula , calculate the standard deviation of the residual sequence ,in is the mean of the residual sequence; Set abnormal fluctuation threshold multiples (As in 3), if there is a residual with an absolute value greater than If there is a situation, it is judged to be abnormal and an application-side data risk warning information is generated;

[0028] Through the above process, the reliability of power supply is guaranteed. In the power dispatching link, accurate data integrity is crucial. For example, real-time monitoring of the power grid operation status relies on a large amount of data support, such as the voltage and current of substation equipment. If there is a problem with data integrity and the data of key periods or key nodes is missing, the dispatcher will not be able to accurately judge the operation status of the power grid, and may make wrong decisions, causing power outages. The data risk warning information on the application side captures data integrity anomalies in a timely manner, ensuring that the dispatcher issues instructions based on complete and accurate data to maintain a reliable power supply.

[0029] Data consistency plays a key role in load forecasting. Power supply companies need to combine historical load data, real-time meteorological data, and electricity consumption trends in different regions to make forecasts. If these data deviate in consistency, such as large differences in the historical peak electricity consumption in the same area recorded by different data sources, the load forecasting model will fail, the power generation plan will be unbalanced, and there may be insufficient or excessive power supply. Through data consistency risk assessment, deviations can be corrected in advance to ensure accurate load forecasting and lay the foundation for stable power supply.

[0030] Abnormal data fluctuation risk monitoring helps power supply companies cope with sudden changes in electricity demand. For example, during the hot summer period, residents' air conditioning power consumption surges, and power consumption data shows abnormal fluctuations. If such fluctuations are not detected and analyzed in time, it will be difficult for power supply companies to allocate power generation resources in time, which may lead to unstable voltage or even power outages in local areas. With the help of application-side data risk warning information, abnormal fluctuations can be quickly identified, emergency plans can be launched in advance, and stable power supply can be ensured.

[0031] In terms of electricity statistics, data integrity is the cornerstone of fair billing. Power supply companies charge users based on the electricity data collected by their meters. Once the data is missing or wrong, it will directly affect the fairness of electricity bill settlement. Application-side data risk warning information ensures that electricity data is collected completely and accurately, avoids user complaints and economic disputes caused by data problems, and maintains the reputation of power supply companies.

[0032] In the field of equipment status monitoring, data consistency and accuracy are closely linked. By comparing the operating parameters of the same power equipment fed back by different monitoring devices at different times, such as transformer oil temperature, if there is a problem with consistency, it may conceal potential equipment failures. Timely discovery and correction of data consistency deviations can provide a reliable basis for equipment operation and maintenance, extend equipment service life, and improve power system stability.

[0033] Accurate load forecasting is inseparable from high-quality data, and the risk assessment of abnormal data fluctuations can effectively eliminate the interference of abnormal data. For example, due to the impact of temporary large-scale activities, the power load in some areas has increased sharply in a short period of time. If such abnormal fluctuation data is included in the load forecasting model, the forecast results will be seriously distorted. By filtering abnormal data through risk warning information, load forecasting can be more accurate, providing strong support for the rational allocation of power resources.

[0034] In daily inspections, maintenance personnel face massive amounts of power data and find it difficult to manually identify data problems. Application-side data risk warning information automatically completes the screening of data integrity, consistency, and abnormal fluctuations, and quickly locates the source of problematic data. For example, if a data acquisition terminal frequently has data integrity anomalies, maintenance personnel can specifically check device connections or software configurations, greatly shortening troubleshooting time and improving maintenance efficiency.

[0035] Based on data risk warning information, the operation and maintenance team can arrange resources reasonably. When consistency risk warnings frequently appear in the power data of a certain area, it indicates that there may be systemic problems in the data collection or transmission links in the area. The operation and maintenance team can prioritize the allocation of manpower and material resources to conduct in-depth investigation and optimization of the area, avoid blind inspections, improve the utilization efficiency of operation and maintenance resources, and make the operation and maintenance work of the power supply company more scientific and efficient.

[0036] The specific process of obtaining the hardware risk warning information is as follows: Extract the hardware related information of the hardware used by the power supply company's management and control application side, where the hardware related information includes the hardware's historical fault data and the hardware's key performance indicators; Process the historical failure data of the hardware to obtain the probability of hardware failure; Process the key performance indicators of the hardware to obtain comprehensive indicators of performance bottlenecks; When any one of the hardware failure probability and performance bottleneck comprehensive indicators is abnormal, a hardware risk warning message is generated.

[0037] The specific process of obtaining the hardware failure probability is as follows: Extract the historical fault data of the hardware, and extract the total running time of the hardware in the past The cumulative time of failure is , through the formula , calculate the probability of hardware failure ; Also, consider the hardware's current operating environment factors, including temperature and humidity; Establish environmental impact factor function through experimental or empirical data (For example, in high temperature and high humidity environments, As the value increases, hardware aging accelerates and the probability of failure increases); By formula , get the corrected hardware failure risk probability ; Setting hardware failure risk thresholds (e.g. 10%, depending on the hardware type and importance), when When it is detected, it indicates that there is an abnormality and a hardware risk warning message is generated; The process of obtaining comprehensive performance bottleneck indicators is as follows: Key performance indicators of hardware include CPU utilization , memory usage , Disk I / O rate ; Assume that the upper limits of the performance indicators when the hardware is operating normally are , , ; By formula , comprehensive indicators of computing performance bottlenecks ; Set performance bottleneck risk threshold (For example, 1.5 means that multiple performance indicators are close to or exceed the upper limit, and there is a risk of performance bottleneck); when When it is detected, it indicates that there is an abnormality and a hardware risk warning message is generated; In the substation operation scenario, hardware failure probability monitoring is crucial. Once a sudden failure occurs in the core hardware equipment in the substation, such as transformers and circuit breakers, the power transmission link will be directly cut off, causing a large-scale power outage. Through in-depth mining of historical hardware failure data and comprehensive consideration of current real-time environmental factors (such as temperature and humidity), the hardware failure risk probability can be accurately calculated. For example, in the hot and humid summer, the environment's erosion of electrical equipment intensifies. If the corrected failure probability of a key transformer is calculated based on historical data and environmental impact factor functions to exceed the set threshold of 10%, the operation and maintenance personnel will be able to receive an early warning, conduct a comprehensive inspection, maintenance, or even replace key components of the transformer in a timely manner, prevent problems before they occur, ensure the continuous and stable transmission of electricity, and ensure that residents and businesses have no worries about electricity.

[0038] As the "brain" of the power grid operation, the power dispatch center always relies on hardware devices such as servers and switches to process massive amounts of power data at high speed and stability to ensure that dispatch instructions are issued immediately. When the CPU utilization rate, memory utilization rate or disk I / O rate of these devices approaches or exceeds the set performance bottleneck risk threshold (such as 1.5), system freezes and delays are inevitable, power dispatch instructions are blocked, and the power grid operation rhythm is disrupted. With the help of the hardware risk warning information system, the comprehensive indicators of performance bottlenecks are monitored in real time. Once an abnormality occurs, the operation and maintenance personnel can respond quickly and take measures such as optimizing program algorithms, expanding memory, and upgrading storage devices to ensure that the hardware equipment of the dispatch center returns to an efficient operating state and maintain smooth and reliable power supply.

[0039] In the past, the operation and maintenance team's maintenance of various hardware equipment of power supply companies mostly followed a fixed-cycle inspection mode, which lacked pertinence, consumed a lot of manpower and material resources, and easily missed equipment with real high-risk hidden dangers. Today, based on the precise calculation and dynamic monitoring of the probability of hardware failure, operation and maintenance personnel can tailor differentiated maintenance plans according to the level of failure risk of each device. For key equipment with a high probability of failure, such as the core circuit breaker of the hub substation, the inspection frequency is increased and in-depth detection projects are strengthened; and for relatively stable equipment with a low probability of failure, the inspection interval is appropriately extended. In this way, operation and maintenance resources can be optimally allocated, operation and maintenance efficiency is greatly improved, and operation and maintenance costs are significantly reduced.

[0040] When the comprehensive index of hardware performance bottleneck lights up red, operation and maintenance personnel no longer blindly conduct a carpet check of the entire system. With the help of detailed performance indicator data feedback (such as clarifying whether it is CPU overload, memory emergency or disk I / O congestion), it is possible to directly hit the crux of the problem and implement precise policies. For example, if it is found that the memory usage of a server exceeds the threshold due to long-term operation, the operation and maintenance personnel can quickly shut down unnecessary background programs, optimize memory allocation strategies or directly expand memory capacity, so that the server can resume normal operation in a short time, greatly shorten the fault repair time, and make the operation and maintenance work of the power supply company more orderly and efficient.

[0041] The service life of hardware equipment is closely related to the operating environment. Harsh environmental conditions such as high temperature and high humidity are important causes of hardware aging and frequent failures. By introducing the environmental impact factor function when calculating the probability of hardware failure, the power supply company can intuitively quantify the potential damage of environmental factors to the hardware. This prompted it to take a series of environmental improvement measures, such as equipping computer rooms that are susceptible to high temperatures with professional precision air conditioners to accurately control indoor temperature; installing high-efficiency dehumidification equipment in distribution rooms in humid areas to strictly control humidity levels. These measures reduce the probability of hardware failures caused by environmental degradation from the source, extend the average service life of hardware equipment, and reduce the high cost expenditure caused by frequent hardware replacement.

[0042] Timely capture of hardware performance bottlenecks and resolution of them can effectively prevent the hardware from being in a "sub-healthy" state of overload operation for a long time. Taking the disk I / O rate as an example, continuous high-load read and write operations will not only accelerate disk wear and shorten disk life, but may also increase the risk of data loss. Once the hardware risk warning information system detects that the disk I / O rate is close to or exceeds the upper limit, the operation and maintenance personnel will intervene in time to reduce the disk pressure through data migration, optimization of storage structure and other means, so that the hardware can run smoothly under a reasonable workload, delay the aging process of the hardware, and ensure that it can serve the power supply company's business stably and reliably in the long term.

[0043] The specific process of obtaining the information transmission risk warning information is as follows: Extracting the collected information transmission related information, the information transmission related information includes the bandwidth usage of the information transmission link and the encryption algorithm used for transmitting the information; Process the bandwidth usage of the transmission link to obtain the bandwidth utilization rate; The encryption algorithm used for transmitting information is processed to obtain an encryption strength score; When either the bandwidth utilization rate or the encryption strength score is abnormal, an information transmission risk warning message is generated.

[0044] The process of obtaining the bandwidth utilization is as follows: The actual occupied bandwidth of the transmission link at the current moment is collected from the bandwidth usage of the information transmission link. The bandwidth usage of the information transmission link and the total bandwidth of the link are ; By formula , calculate the bandwidth utilization .

[0045] Set corresponding bandwidth utilization risk thresholds for different business scenarios For example, for daily office data transmission scenarios, since data traffic is relatively stable, the threshold can be set at 70%; while for scenarios such as video conferencing that have extremely high requirements for real-time and smoothness, the threshold can be set to 85% (these thresholds can be flexibly adjusted based on past experience, network performance testing and business needs).

[0046] when When the information transmission is judged to be at risk due to insufficient bandwidth, it indicates that there is an abnormality, and generates information transmission risk warning information to remind relevant operation and maintenance personnel that they may need to expand bandwidth or limit non-critical business traffic to ensure smooth information transmission; The encryption strength score is obtained as follows: Identify and evaluate the encryption algorithm used for transmitted information. Different encryption algorithms are assigned a basic security score based on their security and encryption key length factors. For example, the basic security score of the common AES-128 encryption algorithm is set to 60 points, and the basic security score of the AES-256 encryption algorithm is set to 80 points (the score setting refers to the industry encryption standards and security assessment system).

[0047] Considering the update frequency of encryption keys, the key update cycle is set to , in days, set an ideal key update cycle threshold based on business security requirements , such as for highly sensitive data transmission, Set to 30 days. Calculate the penalty for delayed key update , the formula is: ; Then through the formula , get the final encryption strength comprehensive score .

[0048] Set the encryption strength risk threshold. Less than the encryption strength risk threshold, such as 70 points. When it is less than 70 points, it indicates that there is a risk of insufficient encryption strength in information transmission, which means that there is an abnormality and generates information transmission risk warning information, prompting managers to upgrade the encryption algorithm or adjust the key update strategy in time to improve the security of transmitted information.

[0049] In the power grid dispatching automation system, a large amount of key power data involving power grid operation status, equipment control instructions, etc. needs to be transmitted in real time and accurately. By monitoring the encryption strength score of the transmitted information, it can be ensured that these sensitive data are not stolen or tampered with during the transmission process. For example, when the system uses the AES-128 encryption algorithm to transmit important power dispatching instructions, if the comprehensive encryption strength score is lower than the set threshold of 70 points, the warning information is triggered in time, prompting managers to upgrade to the more secure AES-256 encryption algorithm, effectively resist hacker attacks, maintain the security and stability of power grid operation, and avoid the risk of power system failure or malicious manipulation caused by data leakage.

[0050] Encryption strength monitoring is also crucial for data interaction between power supply companies and external partners and regulatory authorities, such as power market transaction data and enterprise operation reports. Once the encryption strength is found to be insufficient, the key update strategy should be adjusted in a timely manner to ensure the confidentiality of data transmission, maintain the commercial reputation of power supply companies, and prevent economic disputes and market trust crises caused by information leakage.

[0051] In the daily power office network environment, employees handle various office affairs such as documents, reports and emails, and the data flow is relatively stable. When the bandwidth utilization risk warning information indicates that the bandwidth is close to or exceeds the 70% threshold, the operation and maintenance personnel can accurately locate the problem and limit the flow of non-critical business traffic, giving priority to ensuring the smooth operation of core business applications such as power production management systems and equipment fault repair platforms, avoiding low office efficiency due to network congestion, and ensuring the orderly advancement of daily power business.

[0052] In the power emergency command scenario, if a large-scale power outage occurs, a video conference needs to be held quickly to coordinate emergency repair resources and issue emergency repair instructions, which places extremely high demands on the real-time and smoothness of information transmission. At this time, if the bandwidth utilization rate exceeds the 85% threshold, the operation and maintenance personnel can respond immediately, and through temporary bandwidth expansion and other means, ensure that the video conference picture is clear and the instructions are transmitted in time, speed up the emergency repair progress, shorten the power outage time, and improve the emergency response capabilities of the power supply company.

[0053] The process of obtaining the safety protection warning information is as follows: Extract the acquired security protection related information, which includes the intrusion detection risk ratio and the vulnerability risk comprehensive score; When any of the intrusion detection risk ratio and the vulnerability risk comprehensive score is abnormal, a security protection warning message is generated.

[0054] The process of obtaining the intrusion detection risk ratio is as follows: Use intrusion detection system to monitor network traffic in real time; Assume that the number of suspected intrusion behaviors detected by the intrusion detection system within the preset time is , the total number of network connections is ; By formula , calculate the intrusion detection risk ratio ; Set the intrusion detection risk threshold. When the intrusion detection risk threshold (such as 0.1%, depending on the network security level requirements) is exceeded, it is determined that there is a high intrusion risk, which means that there is an abnormality and a security protection warning message is generated; The process of obtaining the comprehensive vulnerability risk score is as follows: Regularly scan the vulnerabilities of the control applications and related hardware systems. Let the number of high-risk vulnerabilities found be H1, the number of medium-risk vulnerabilities be H2, and the number of low-risk vulnerabilities be H3. They are assigned weights m1 (such as 0.5), m2 (such as 0.3), and m3 (such as 0.2) respectively. m1+m2+m3=1, m1>m2>m3; Calculate the comprehensive vulnerability risk score Hh through the formula H1*m1+H2*m2+H3*m3=Hh; Set a vulnerability risk threshold. When the vulnerability risk comprehensive score Hh is greater than the vulnerability risk threshold, it indicates that the system has a high vulnerability risk, that is, it indicates that there is an abnormality and generates a security protection warning message; In the power grid dispatching network, real-time intrusion detection risk ratio monitoring plays a key role. Once a hacker attempts to invade, the continuous scanning of network traffic by the intrusion detection system (IDS) can quickly capture suspected intrusion behaviors. For example, when the calculated intrusion detection risk ratio exceeds the threshold of 0.1%, a warning message is immediately generated, and the operation and maintenance personnel can cut off the suspicious connection in time to prevent further infiltration by hackers, prevent malicious manipulation of power equipment, tampering with power grid operation parameters and other catastrophic consequences, ensure the accuracy and reliability of power grid dispatching, and maintain the normal operation order of the power system.

[0055] For various management and control application systems of power supply companies, such as power marketing systems and electricity bill settlement systems, monitoring of comprehensive vulnerability risk scores is crucial. Regular vulnerability scanning finds high-risk vulnerabilities, and a high comprehensive score is calculated based on the corresponding high weight. If the threshold is exceeded, operation and maintenance personnel can prioritize the repair of high-risk vulnerabilities, such as timely updating software patches, to avoid security incidents such as user information leakage and electricity bill data tampering due to vulnerability exploitation, maintain the trust relationship between power supply companies and users, and ensure the normal development of power business.

[0056] In the past, when faced with network security threats, operation and maintenance personnel often found it difficult to detect them in time and only responded hastily when problems appeared. Now, based on the abnormal warning of intrusion detection risk ratio, the operation and maintenance team can act quickly when intrusion behavior first appears, quickly identify the source of intrusion, and initiate emergency defense plans, such as adjusting firewall policies and isolating affected areas, which greatly shortens the response time of security incidents and reduces potential losses.

[0057] When the vulnerability risk comprehensive score warning lights up red, the operation and maintenance personnel will organize the repair work in an orderly manner based on the detailed vulnerability level information. Prioritize high-risk vulnerabilities, allocate resources to focus on tackling key issues, avoid blind and unfocused inspections, efficiently respond to system security risks, and ensure the stability of the power supply company's overall network protection system.

[0058] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0059] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0060] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. An artificial intelligence-based management and control application-side data risk monitoring system, characterized in that: It includes application side acquisition module, hardware side acquisition module, information transmission acquisition module, security protection acquisition module, data processing module and information sending module; The application side acquisition module is used to collect and control application side data; The hardware side acquisition module is used to collect hardware related information of the hardware used by the power supply company's management and control application side; The information transmission collection module is used to collect information related to information transmission; The safety protection collection module is used to collect safety protection related information; The data processing module is used to process the control application side data to generate application side data risk warning information, process the hardware related information of the hardware used on the control application side of the power supply company to generate hardware risk warning information, process the information transmission related information to generate information transmission risk warning information, and process the security protection related information to obtain security protection warning information; The information sending module is used to send the application side data risk warning information, hardware risk warning information, information transmission risk warning information and security protection warning information to a preset receiving terminal after the above information is generated.

2. According to claim 1, an artificial intelligence-based management and control application-side data risk monitoring system is characterized by: The specific process of obtaining the application-side data risk warning information is as follows: Extract the control application side data, which includes the data collected by the application side acquisition module, including data integrity, data consistency and data volatility; Determine data integrity, data consistency, and data volatility; When any one of the data integrity judgment, data consistency judgment and data volatility judgment is abnormal, application-side data risk warning information is generated.

3. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 2 is characterized in that: The specific process of determining the data integrity is as follows: Perform integrity check on the collected control application side data. Suppose the number of preset data items that the original data should contain is , the number of complete key data items actually collected is ; By calculating the data integrity ratio to measure data integrity risk; The calculation formula is: ; Set integrity risk threshold ,when When an abnormality occurs, the application-side data risk warning information is generated. The specific process of data consistency risk determination is as follows: For the data values ​​collected from the same data object at different times or from different data sources, suppose there are n sets of comparison data, each set of data contains two comparison values and ; By formula , calculate the data consistency deviation value ; Setting consistency risk thresholds ,like , that is, to determine that it is abnormal and generate application-side data risk warning information; The specific process of determining the risk of abnormal data fluctuation is as follows: Select the management application side data with time series characteristics, set the time series length to m, and the data value sequence to ; First use the moving average method to calculate the smoothed series , where k is the moving average window size, and the calculation formula is: ; Then calculate the residual sequence , , By formula , calculate the standard deviation of the residual sequence ,in is the mean of the residual sequence; Set the abnormal fluctuation threshold multiple r. If the absolute value of the residual is greater than If the situation occurs, it is judged as abnormal and application-side data risk warning information is generated.

4. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 1 is characterized in that: The specific process of obtaining the hardware risk warning information is as follows: Extract the hardware related information of the hardware used by the power supply company's management and control application side, where the hardware related information includes the hardware's historical fault data and the hardware's key performance indicators; Process the historical failure data of the hardware to obtain the probability of hardware failure; Process the key performance indicators of the hardware to obtain comprehensive indicators of performance bottlenecks; When any one of the hardware failure probability and performance bottleneck comprehensive indicators is abnormal, a hardware risk warning message is generated.

5. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 4 is characterized in that: The specific process of obtaining the hardware failure probability is as follows: Extract the historical fault data of the hardware, and extract the total running time of the hardware in the past The cumulative time of failure is , through the formula , calculate the probability of hardware failure ; Also, consider the hardware's current operating environment factors, including temperature and humidity; Establish environmental impact factor function through experimental or empirical data ; By formula , get the corrected hardware failure risk probability ; Setting hardware failure risk thresholds ,when When it is detected, it indicates that there is an abnormality and a hardware risk warning message is generated; The process of obtaining comprehensive performance bottleneck indicators is as follows: Key performance indicators of hardware include CPU utilization , memory usage , Disk I / O rate ; Assume that the upper limits of the performance indicators when the hardware is operating normally are , , ; By formula , comprehensive indicators of computing performance bottlenecks ; Set performance bottleneck risk threshold ; when , it indicates that there is an abnormality and generates a hardware risk warning message.

6. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 1, characterized in that: The specific process of obtaining the information transmission risk warning information is as follows: Extracting the collected information transmission related information, the information transmission related information includes the bandwidth usage of the information transmission link and the encryption algorithm used for transmitting the information; Process the bandwidth usage of the transmission link to obtain the bandwidth utilization rate; Process the encryption algorithm used for transmitting information to obtain an encryption strength score; When either the bandwidth utilization rate or the encryption strength score is abnormal, an information transmission risk warning message is generated.

7. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 6 is characterized by: The process of obtaining the bandwidth utilization is as follows: The actual occupied bandwidth of the transmission link at the current moment is collected from the bandwidth usage of the information transmission link. The bandwidth usage of the information transmission link and the total bandwidth of the link are ; By formula , calculate the bandwidth utilization ; Set appropriate bandwidth utilization risk thresholds ; when When the information transmission is judged to be at risk due to insufficient bandwidth, it indicates that there is an abnormality and generates information transmission risk warning information; The encryption strength score is obtained as follows: Identify and evaluate the encryption algorithm used for transmitted information. Different encryption algorithms are assigned a basic security score based on their security and encryption key length factors. ; Considering the update frequency of encryption keys, the key update cycle is set to , in days, set an ideal key update cycle threshold based on business security requirements , calculate the key update delay penalty , the formula is: ; Then through the formula , get the final encryption strength comprehensive score ; Set the encryption strength risk threshold. If the value is less than the encryption strength risk threshold, it indicates that an abnormality exists and an information transmission risk warning message is generated.

8. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 1, characterized in that: The process of obtaining the safety protection warning information is as follows: Extract the acquired security protection related information, which includes the intrusion detection risk ratio and the vulnerability risk comprehensive score; When any of the intrusion detection risk ratio and the vulnerability risk comprehensive score is abnormal, a security protection warning message is generated.

9. The artificial intelligence-based management and control application-side data risk monitoring system according to claim 8, characterized in that: The process of obtaining the intrusion detection risk ratio is as follows: Use intrusion detection system to monitor network traffic in real time; Assume that the number of suspected intrusion behaviors detected by the intrusion detection system within the preset time is , the total number of network connections is ; By formula , calculate the intrusion detection risk ratio ; Set the intrusion detection risk threshold. Exceeding the intrusion detection risk threshold indicates an abnormality and generates a security protection warning message; The process of obtaining the comprehensive vulnerability risk score is as follows: Regularly scan the vulnerabilities of the control applications and related hardware systems. Set the number of high-risk vulnerabilities found as H1, the number of medium-risk vulnerabilities as H2, and the number of low-risk vulnerabilities as H3, and assign weights m1, m2, and m3 respectively; Calculate the comprehensive vulnerability risk score Hh through the formula H1*m1+H2*m2+H3*m3=Hh; Set a vulnerability risk threshold. When the vulnerability risk comprehensive score Hh is greater than the vulnerability risk threshold, it means that there is an abnormality and a security protection warning message is generated.

Images