Safety protection system for power distribution terminal

Abstract

The invention provides a safety protection system for a power distribution terminal, and belongs to the technical field of safety protection, and the system comprises a data monitoring module which is used for obtaining a monitoring mechanism for each monitoring target according to the target type and target coverage of the monitoring target of the power distribution terminal, and carrying out the monitoring to obtain initial data; the log acquisition module is used for acquiring a communication log between the power distribution terminal and the monitoring target; the anomaly analysis module is used for analyzing the initial data and the communication log, determining the abnormal action of the power distribution terminal and the external abnormal action, performing logic visualization on the abnormal action of the power distribution terminal and the external abnormal action, and setting a security event for the power distribution terminal; and the time sequence analysis module is used for performing time sequence analysis on all the safety events to determine a jump time sequence point, and performing safety protection on the power distribution terminal according to the jump type of the jump time sequence point. Safe operation of the power distribution terminal is ensured, and monitoring efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of safety protection technology, and in particular to a safety protection system for a power distribution terminal. Background Art

[0002] The distribution terminal is a general term for various remote monitoring and control units installed in the distribution network. It collects information such as electrical quantities (such as voltage, current), switch status, etc. on site, analyzes and processes them, and controls the distribution network equipment according to the predetermined control strategy or the command received from the master station. It is common now that the distribution terminal provides safety protection for each device in the distribution network, but it is rare to provide its own safety protection. Conventional protection of the distribution terminal's own safety is achieved through regular inspections by maintenance personnel. In this process, if the distribution terminal is abnormal, it will not be able to monitor the equipment in the distribution network in a timely and effective manner. There is no doubt that there will be a situation where the distribution network is faulty but not aware of it, which reduces the monitoring efficiency.

[0003] Therefore, the present invention proposes a safety protection system for a power distribution terminal. Summary of the invention

[0004] The present invention provides a safety protection system for a power distribution terminal, which is used to ensure the effective acquisition of data by setting a monitoring mechanism for the monitoring target of the power distribution terminal, and to determine the abnormality of the power distribution terminal in combination with the communication log, and then to determine the jump type of the power distribution terminal itself by performing a timing analysis on the event, thereby ensuring the safe operation of the power distribution terminal and improving the monitoring efficiency.

[0005] The present invention provides a safety protection system for a power distribution terminal, comprising: A data monitoring module, used to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage of the monitoring target of the power distribution terminal, and to monitor the operation of the corresponding monitoring target according to the monitoring mechanism to obtain initial data; A log acquisition module, used to acquire the communication log between the power distribution terminal and the monitoring target during the monitoring process of the corresponding monitoring target; An abnormality analysis module, used to analyze the initial data and the communication log, determine the abnormal actions of the power distribution terminal itself and the external abnormal actions, and perform logical visualization of the abnormal actions of the power distribution terminal itself and the external abnormal actions, and set a security event for the power distribution terminal; The timing analysis module is used to perform timing analysis on all safety events to determine the jump timing points, and to perform safety protection on the power distribution terminal according to the jump types of the jump timing points.

[0006] Preferably, the data monitoring module includes: A set establishment unit, used to establish a coverage device sequence for each target coverage range, and then disassemble the coverage device sequence according to the operation attribute of each coverage device to establish an attribute device vector set; a priority determination unit, used to respectively determine the operation priority of each attribute device vector in the attribute device vector set, and match a monitoring period matching the operation priority from a priority-period comparison table; ;

[0007] in, Indicates the target weight of the corresponding monitoring target; Indicates the attribute weight of the i1 attribute device vector corresponding to the monitoring target; Indicates the number of attribute devices involved in the i1th attribute device vector under the corresponding monitoring target; Indicates the basic working time of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; It represents the average of basic working time involved in all target coverages; It represents the interaction value of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Represents the average value of the interaction values ​​involved under all target coverage; Respectively represent the standardized coefficients for basic working time and interaction value; Indicates the device weight of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Indicates the operation priority of i1 attribute device vector under the corresponding monitoring target; Conventional cycle determination unit, used to determine the A regular cycle is set for the monitoring target, wherein: Indicates the monitoring period corresponding to the i1th attribute device vector under the corresponding monitoring target; Indicates all The variance of Indicates setting threshold; Indicates all The average period of the probability of satisfying the normal distribution; Indicates all The number of monitoring periods that do not satisfy the normal distribution probability; Quantity determination unit for Determine the number of alternating intervals between the normal cycle and the maximum cycle, where: They respectively represent obtaining the maximum cycle and minimum cycle from all monitoring cycles under the corresponding monitoring target. Indicates the regular cycle of the corresponding monitoring target; Indicates the rounding up symbol; The mechanism construction unit is used to construct a monitoring mechanism corresponding to the monitoring target according to the regular cycle, the maximum cycle and the number of alternating intervals.

[0008] Preferably, the mechanism construction unit includes: A comparison subunit, configured to obtain an initial mechanism from a type-construction comparison table according to a target type of the monitoring target; The application subunit is used to apply the normal cycle, the maximum cycle and the number of alternating intervals corresponding to the monitoring target to the initial mechanism to obtain the monitoring mechanism.

[0009] Preferably, the log acquisition module includes: A first capturing unit, used to capture a first working log of a first communication interface corresponding to a monitoring target; A second capturing unit, used for capturing a second working log of a second communication interface in which the power distribution terminal is communicatively connected with a corresponding monitoring target; A third capturing unit, used to capture a third work log between the transmission channel of the power distribution terminal and the corresponding monitoring target; Among them, the first work log, the second work log and the third work log are regarded as communication logs.

[0010] Preferably, the abnormality analysis module includes: An array construction unit, used to extract monitoring sub-arrays at each time point from the initial data, wherein the monitoring sub-arrays include voltages and currents of different monitoring devices involved in the corresponding monitoring target; A log extraction unit, configured to extract a sub-log between a first time point and a second time point from the communication log according to a first time point at which the monitoring sub-array corresponding to the monitoring target at each time point starts to be transmitted from the first communication interface and a second time point at which the monitoring sub-array is transmitted to the second communication interface; The difference analysis unit is used to perform correlation difference analysis on the monitoring sub-array at the corresponding time point according to the sub-log, and perform standard difference analysis on the monitoring sub-array at the same time point according to the target mode of the corresponding monitoring target at the corresponding time point, lock the abnormal time point and the abnormal type at the corresponding abnormal time point, and construct an impact vector ,in, represents the impact value of the corresponding second communication interface at the tth time point; Indicates the total number of time points; Indicates the abnormal type of the corresponding second communication interface at time point t; A vector construction unit, configured to determine the communication value of the second communication interface at each time point according to the communication log, and construct the communication vector of the power distribution terminal ,in, Indicates the communication value of the corresponding second communication interface at time point t. When the communication is normal, the value is 1, and when the communication is abnormal, the value is 0; A vector analysis unit is used to analyze the influence vector and the communication vector , input into the vector analysis model, and obtain the abnormal actions of the distribution terminal itself and the external abnormal actions.

[0011] Preferably, the abnormality analysis module further includes: An action comparison unit is used to compare and analyze the abnormal actions of the self and the external abnormal actions with the action-logic database, and extract the first logic for each abnormal action of the self and the second logic for each abnormal action of the external; The event integration unit is used to integrate all logics and time points involved in each abnormal action, and the logical hazard level involved in the corresponding abnormal action, into a safety event based on each time point of the distribution terminal.

[0012] Preferably, the timing analysis module includes: An event set statistics unit, used to count the security events between the power distribution terminal and different monitoring targets at the same time point in chronological order to obtain an event set at each time point; A jump type determination unit, used for inputting the event set into an event analysis model consistent with the power distribution terminal to obtain a jump coefficient of a corresponding time point; when the jump coefficient is greater than a preset coefficient, the corresponding time point is regarded as a jump timing point; and depending on the occurrence frequency of each safety event involved in the event set of the jump timing point and the influence coefficient on the power distribution terminal, a first event less than a safety threshold is determined, and the event type of the first event is combined as the jump type of the corresponding jump timing point; The protection mode acquisition unit is used to obtain the protection mode for each jump timing point based on the type-mode database and perform security protection.

[0013] Preferably, the jump type determination unit includes: Determine the safety factor of each safety event in the event set corresponding to the jump timing point ; ; in, Indicates the impact coefficient of the corresponding security event on the power distribution terminal; Indicates the occurrence frequency of the corresponding security event in all event sets; Indicates the total number of events involved in all event sets.

[0014] Compared with the prior art, the present invention has the following beneficial effects: By setting up a monitoring mechanism for the monitoring target of the distribution terminal to ensure the effective acquisition of data, and combining the communication log to determine the abnormality of the distribution terminal, and then determining the jump type of the distribution terminal itself through timing analysis of the events, the safe operation of the distribution terminal is ensured, thereby improving the monitoring efficiency.

[0015] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0016] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 The structure diagram of a safety protection system for a power distribution terminal in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0019] The present invention provides a safety protection system for a power distribution terminal, such as Figure 1 As shown, including: A data monitoring module, used to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage of the monitoring target of the power distribution terminal, and to monitor the operation of the corresponding monitoring target according to the monitoring mechanism to obtain initial data; A log acquisition module, used to acquire the communication log between the power distribution terminal and the monitoring target during the monitoring process of the corresponding monitoring target; An abnormality analysis module, used to analyze the initial data and the communication log, determine the abnormal actions of the power distribution terminal itself and the external abnormal actions, and perform logical visualization of the abnormal actions of the power distribution terminal itself and the external abnormal actions, and set a security event for the power distribution terminal; The timing analysis module is used to perform timing analysis on all safety events to determine the jump timing points, and to perform safety protection on the power distribution terminal according to the jump types of the jump timing points.

[0020] In this embodiment, the monitoring target refers to several devices in different areas of the distribution network, and the monitoring mechanism refers to periodic monitoring of the monitoring target. The periodicity involved in different monitoring targets is different, and the purpose of periodic monitoring is to ensure the rationality of monitoring and to ensure the comprehensiveness of monitoring as much as possible.

[0021] In this embodiment, the initial data refers to information such as voltage and current of different devices involved in the monitoring target.

[0022] In this embodiment, the communication log refers to the log generated by the communication channel constructed by the monitoring target and the distribution terminal during the monitoring process, as well as the log generated by the communication interface of the monitoring target and the distribution terminal, and the log is captured by a pre-set log capture tool.

[0023] In this embodiment, the analysis of the initial data and the communication log is mainly to determine whether there is external interference that causes the initial data to be abnormal during the transmission process, or whether the data will be abnormal due to problems with the interface when it starts to be transmitted or when it is transmitted to the distribution terminal, so as to obtain abnormal actions of itself and external factors. The abnormal action of itself refers to abnormal behavior of the interface of the distribution terminal, and the external abnormal action refers to external interference (virus invasion, etc.) that causes abnormal data transmitted to the distribution terminal, and whether the virus will have a further impact on the distribution terminal.

[0024] In this embodiment, logic visualization is achieved by obtaining logic related to abnormal actions and integrating the logic to obtain safety events. Safety events are used to configure dangerous conditions existing in the power distribution terminal to facilitate subsequent determination of the jump timing points.

[0025] In this embodiment, the jump timing point refers to the event point at which safety protection is required for the power distribution terminal.

[0026] In this embodiment, the jump type can be any one or more combinations of tripping type, closed type, and permission control type. Since there is at least one monitoring target related to the distribution terminal, there will be a combination of types, thereby realizing more comprehensive protection of the terminal.

[0027] The beneficial effects of the above technical solution are: by setting a monitoring mechanism for the monitoring target of the distribution terminal to ensure the effective acquisition of data, and combining the communication log to determine the abnormality of the distribution terminal, and then determining the jump type of the distribution terminal itself by performing a timing analysis of the event, thereby ensuring the safe operation of the distribution terminal and improving the monitoring efficiency.

[0028] The present invention provides a safety protection system for a power distribution terminal, wherein the data monitoring module comprises: A set establishment unit, used to establish a coverage device sequence for each target coverage range, and then disassemble the coverage device sequence according to the operation attribute of each coverage device to establish an attribute device vector set; a priority determination unit, used to respectively determine the operation priority of each attribute device vector in the attribute device vector set, and match a monitoring period matching the operation priority from a priority-period comparison table; ; in, Indicates the target weight of the corresponding monitoring target; Indicates the attribute weight of the i1 attribute device vector corresponding to the monitoring target; Indicates the number of attribute devices involved in the i1th attribute device vector under the corresponding monitoring target; Indicates the basic working time of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; It represents the average of basic working time involved in all target coverages; It represents the interaction value of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Represents the average value of the interaction values ​​involved under all target coverage; Respectively represent the standardized coefficients for basic working time and interaction value; Indicates the device weight of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Indicates the operation priority of i1 attribute device vector under the corresponding monitoring target; Conventional cycle determination unit, used to determine the A regular cycle is set for the monitoring target, wherein: Indicates the monitoring period corresponding to the i1th attribute device vector under the corresponding monitoring target; Indicates all The variance of Indicates setting threshold; Indicates all The average period of the probability of satisfying the normal distribution; Indicates all The number of monitoring periods that do not satisfy the normal distribution probability; Quantity determination unit for Determine the number of alternating intervals between the normal cycle and the maximum cycle, where: They respectively represent obtaining the maximum cycle and minimum cycle from all monitoring cycles under the corresponding monitoring target. Indicates the regular cycle of the corresponding monitoring target; Indicates the rounding up symbol; The mechanism construction unit is used to construct a monitoring mechanism corresponding to the monitoring target according to the regular cycle, the maximum cycle and the number of alternating intervals.

[0029] In this embodiment, the coverage device sequence is the device serial number included in the corresponding target coverage range, for example: {area A1 corresponding to the target coverage range includes device 1, device 2, device 3, device 4, device 5}, and the operation attribute refers to the function of the corresponding device. For example, device 1 and device 3 are for power generation, and device 2, device 4, and device 5 are for power transmission. At this time, they can be disassembled to obtain the attribute device vector set: {{device 1, device 3}, {device 2, device 4, device 5}}.

[0030] In this embodiment, the priority-period comparison table includes different operating priorities and monitoring periods matching the priorities, which are pre-set and can be directly matched.

[0031] In this embodiment, the sum of the target weights of all monitoring targets involved in the power distribution terminal is 1, and the target weight of each monitoring target and the attribute weight of the equipment involved in each monitoring target are all known.

[0032] In this embodiment, the basic working time refers to the set operating time of the corresponding equipment under normal working conditions.

[0033] In this embodiment, the interaction value ranges from 0 to 1, and the interaction value is the degree of interaction between the device and other devices.

[0034] In this embodiment, the threshold value is set to 0.1.

[0035] In this embodiment, the value of the normal distribution probability is 0.8, that is, to obtain all After normal distribution, the position where it falls is within the value corresponding to the probability of 0.8 and the average is processed to obtain the average period.

[0036] In this embodiment, the normal cycle is: The calculation results for both cases.

[0037] In this embodiment, the number of alternating intervals refers to the number between the normal cycle and the maximum cycle. For example, the number of alternating intervals is 2. At this time, the monitoring mechanism is obtained according to: normal cycle, normal cycle, maximum cycle, normal cycle, normal cycle, maximum cycle, etc.

[0038] For example, T02 is used as a cycle for monitoring. After the monitoring is completed, there is an interval of 10 seconds and T02 is continued to be used as a cycle for monitoring. At this time, after T02 is used for monitoring twice, there is an interval of 10 seconds and a maximum cycle T03 is used for monitoring. And so on.

[0039] The beneficial effects of the above technical solution are: the sequence is split according to the attributes to obtain the operating priority of the equipment with different attributes and then the monitoring cycle, and the regular cycle is determined by subsequent calculation and analysis of the monitoring cycle. Compared with all-day online monitoring, it can save monitoring resources, and by replacing the regular cycle with the minimum cycle, it can ensure the comprehensiveness of data monitoring, thereby improving the monitoring efficiency and providing a basis for subsequent analysis of abnormalities.

[0040] The present invention provides a safety protection system for a power distribution terminal, wherein the mechanism construction unit comprises: A comparison subunit, configured to obtain an initial mechanism from a type-construction comparison table according to a target type of the monitoring target; The application subunit is used to apply the normal cycle, the maximum cycle and the number of alternating intervals corresponding to the monitoring target to the initial mechanism to obtain the monitoring mechanism.

[0041] In this embodiment, the type-construction comparison table includes different target types and initial mechanisms that match the types, and the initial mechanism is mainly used to determine whether the regular cycle is in the first start cycle or the maximum cycle is in the first start cycle, and the length of the interval pause time between cycles, for example, the interval pause time length is 10 seconds, etc.

[0042] In this embodiment, the target type is the main function of the monitored target, such as thermal power generation type, wind power generation type, etc.

[0043] In this embodiment, the number of alternating intervals is mainly for the regular period, that is, the corresponding regular period will have a number that is consistent with the number of alternating intervals appearing continuously.

[0044] The beneficial effects of the above technical solution are: obtaining the initial mechanism according to the type facilitates the construction of the monitoring mechanism, and by applying the regular cycle, the maximum cycle and the number of alternating intervals, the pertinence of the mechanism is ensured.

[0045] The present invention provides a safety protection system for a power distribution terminal, wherein the log acquisition module comprises: A first capturing unit, used to capture a first working log of a first communication interface corresponding to a monitoring target; A second capturing unit, used for capturing a second working log of a second communication interface in which the power distribution terminal is communicatively connected with a corresponding monitoring target; A third capturing unit, used to capture a third work log between the transmission channel of the power distribution terminal and the corresponding monitoring target; Among them, the first work log, the second work log and the third work log are regarded as communication logs.

[0046] In this embodiment, the first work log, the second work log and the third work log are captured based on corresponding tools, and are mainly for communication parameters generated by interfaces and channels and parameters affecting transmission. Among them, the parameters affecting transmission may be virus data that affects the transmission data, resulting in data loss or mutation, etc.

[0047] In this embodiment, the communication log includes: the first communication log+the second communication log+the third communication log.

[0048] The beneficial effect of the above technical solution is: starting from the interface and channel to capture the work log, obtain the communication log, and provide an analysis basis for the subsequent analysis of abnormal actions.

[0049] The present invention provides a safety protection system for a power distribution terminal, wherein the abnormality analysis module comprises: An array construction unit, used to extract monitoring sub-arrays at each time point from the initial data, wherein the monitoring sub-arrays include voltages and currents of different monitoring devices involved in the corresponding monitoring target; A log extraction unit, configured to extract a sub-log between a first time point and a second time point from the communication log according to a first time point at which the monitoring sub-array corresponding to the monitoring target at each time point starts to be transmitted from the first communication interface and a second time point at which the monitoring sub-array is transmitted to the second communication interface; The difference analysis unit is used to perform correlation difference analysis on the monitoring sub-array at the corresponding time point according to the sub-log, and perform standard difference analysis on the monitoring sub-array at the same time point according to the target mode of the corresponding monitoring target at the corresponding time point, lock the abnormal time point and the abnormal type at the corresponding abnormal time point, and construct an impact vector ,in, represents the impact value of the corresponding second communication interface at the tth time point; Indicates the total number of time points; Indicates the abnormal type of the corresponding second communication interface at time point t; A vector construction unit, configured to determine the communication value of the second communication interface at each time point according to the communication log, and construct the communication vector of the power distribution terminal ,in, Indicates the communication value of the corresponding second communication interface at time point t. When the communication is normal, the value is 1, and when the communication is abnormal, the value is 0; A vector analysis unit is used to analyze the influence vector and the communication vector , input into the vector analysis model, and obtain the abnormal actions of the distribution terminal itself and the external abnormal actions.

[0050] In this embodiment, the initial data includes voltages and currents of the monitoring devices involved at several different time points, wherein the time point refers to the time point at which the corresponding monitoring mechanism is used for monitoring.

[0051] In this embodiment, for example, the first time point is Dt1, and the second time point is Dt2. At this time, the logs between Dt1 and Dt2 are extracted from the communication logs and regarded as sub-logs, so that there is a more complete impact analysis basis when analyzing the time points.

[0052] In this embodiment, the correlation difference analysis is specifically as follows: Extract the influencing factors that affect the monitoring sub-array from the sub-logs, such as viruses, external intrusions, etc.

[0053] The possible impact of each influencing factor on the data is extracted from the factor-data impact comparison table as the result of the associated difference analysis, such as missing data, changes in data values, etc.

[0054] In this embodiment, the target mode refers to the working mode of the corresponding monitoring target, which is pre-set. For example, the mode at the corresponding time point is the mode of generating electricity using device 1, and then the standard operating data of the monitoring target in mode 09 is obtained according to the target-mode-operation database, which is pre-set, and then the standard difference analysis is realized by comparing and analyzing with the monitoring sub-array.

[0055] In this embodiment, the abnormal time point can be first determined based on the standard difference analysis result, that is, the absolute value of the actual voltage and actual current at the corresponding time point subtracted from the standard voltage and standard current is not within the set difference range. At this time, the corresponding time point is regarded as an abnormal time point. Then, the correlation difference analysis result is used to analyze whether the existing factors will affect the actual voltage and actual current at the abnormal time point. If so, the corresponding factors are retained, and if not, the corresponding factors are eliminated. That is, Does not exist.

[0056] In this embodiment, the communication value of the second communication interface is obtained by analyzing whether the communication parameters of the interface are normal or not. If normal, the communication value is 1, otherwise, it is 0.

[0057] In this embodiment, the vector analysis model is obtained by training the neural network model based on samples of different communication impact vectors, the communication vector of the distribution terminal and the abnormal analysis results of the combination of these two vectors by experts. Therefore, the abnormal actions of itself and the external abnormal actions can be directly obtained.

[0058] The beneficial effect of the above technical solution is: by extracting the time points of the initial data and the communication log to perform correlation difference analysis, and combining the pattern to perform standard difference analysis to construct the influence vector, and then input the communication vector constructed in combination with the communication value into the model, to achieve reasonable and reliable acquisition of abnormal actions of the distribution terminal, ensure timely resolution of the distribution terminal anomalies, and indirectly improve monitoring efficiency.

[0059] The present invention provides a safety protection system for a power distribution terminal, wherein the abnormality analysis module further comprises: An action comparison unit is used to compare and analyze the abnormal actions of the self and the external abnormal actions with the action-logic database, and extract the first logic for each abnormal action of the self and the second logic for each abnormal action of the external; The event integration unit is used to integrate all logics and time points involved in each abnormal action, and the logical hazard level involved in the corresponding abnormal action, into a safety event based on each time point of the distribution terminal.

[0060] In this embodiment, the action-logic database includes different abnormal actions and logics matching the actions, and the logic is mainly aimed at the implementation reasons of the abnormal actions, that is, the corresponding abnormal actions are generated by executing the corresponding logic, which is set in advance.

[0061] In this embodiment, since the same abnormal action may occur at multiple time points, it is necessary to combine all logics and time points involved in each abnormal action and combine the logical risk level to form a security event, that is: security event = all logics and time points of abnormal action + logical risk level.

[0062] In this embodiment, the logical risk level is obtained by matching from an abnormality-level comparison table, which contains logical risk levels corresponding to different abnormal actions and is preset.

[0063] The beneficial effects of the above technical solution are: by comparing and analyzing abnormal actions with the database, it is easy to obtain logic, and by determining the logic and time points involved in the same action and combining the levels to form a security event, it provides a basis for protecting the safety of distribution terminals.

[0064] The present invention provides a safety protection system for a power distribution terminal, wherein the timing analysis module comprises: An event set statistics unit, used to count the security events between the power distribution terminal and different monitoring targets at the same time point in chronological order to obtain an event set at each time point; A jump type determination unit, used for inputting the event set into an event analysis model consistent with the power distribution terminal to obtain a jump coefficient of a corresponding time point; when the jump coefficient is greater than a preset coefficient, the corresponding time point is regarded as a jump timing point; and depending on the occurrence frequency of each safety event involved in the event set of the jump timing point and the influence coefficient on the power distribution terminal, a first event less than a safety threshold is determined, and the event type of the first event is combined as the jump type of the corresponding jump timing point; The protection mode acquisition unit is used to obtain the protection mode for each jump timing point based on the type-mode database and perform security protection.

[0065] Preferably, the jump type determination unit includes: Determine the safety factor of each safety event in the event set corresponding to the jump timing point ; ; in, Indicates the impact coefficient of the corresponding security event on the power distribution terminal; Indicates the occurrence frequency of the corresponding security event in all event sets; Indicates the total number of events involved in all event sets.

[0066] In this embodiment, event set = {all security events involved at the same time point}.

[0067] In this embodiment, the event analysis model includes security events of different combinations and the evaluation coefficients of experts on security events of different combinations. The results are obtained by training the neural network model with samples. Therefore, after determining the event set, the jump coefficient can be directly obtained through the model, and the value of the jump coefficient is 0 to 1.

[0068] In this embodiment, the preset coefficient is set to 0.5.

[0069] In this embodiment, the value of the safety threshold is 0.6.

[0070] In this embodiment, the transition type is a combination of event types of the first event involved at the corresponding transition timing point.

[0071] In this embodiment, the type-mode database includes different jump types and the protection modes matched therewith, and the protection mode is a combination of one or more of a tripping protection mode, a closed isolation protection mode, a control protection mode, and the like.

[0072] In this embodiment, the influence coefficient ranges from 0 to 1.

[0073] In this embodiment, for example, the distribution terminal is powered on again after tripping protection to achieve re-monitoring, or the part of the distribution terminal that monitors the target U1 is closed and isolated, and the rest of the part is monitored normally, and the closed and isolated part is maintained and adjusted, or a code upgrade instruction is sent to the distribution terminal to achieve a security upgrade.

[0074] The beneficial effect of the above technical solution is: the jump coefficient is obtained by counting the event sets at different time points, and then the first event and the jump type are determined by comparing the coefficient sizes, thereby achieving reasonable protection of the distribution terminal and improving monitoring efficiency.

[0075] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A safety protection system for a power distribution terminal, characterized in that: include: A data monitoring module, used to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage of the monitoring target of the power distribution terminal, and to monitor the operation of the corresponding monitoring target according to the monitoring mechanism to obtain initial data; A log acquisition module, used to acquire the communication log between the power distribution terminal and the monitoring target during the monitoring process of the corresponding monitoring target; An abnormality analysis module, used to analyze the initial data and the communication log, determine the abnormal actions of the power distribution terminal itself and the external abnormal actions, and perform logical visualization of the abnormal actions of the power distribution terminal itself and the external abnormal actions, and set a security event for the power distribution terminal; The timing analysis module is used to perform timing analysis on all safety events to determine the jump timing points, and to perform safety protection on the power distribution terminal according to the jump types of the jump timing points.

2. The safety protection system for power distribution terminals according to claim 1, characterized in that: The data monitoring module comprises: A set establishment unit, used to establish a coverage device sequence for each target coverage range, and then disassemble the coverage device sequence according to the operation attribute of each coverage device to establish an attribute device vector set; a priority determination unit, used to respectively determine the operation priority of each attribute device vector in the attribute device vector set, and match a monitoring period matching the operation priority from a priority-period comparison table; ； in, Indicates the target weight of the corresponding monitoring target; Indicates the attribute weight of the i1 attribute device vector corresponding to the monitoring target; Indicates the number of attribute devices involved in the i1th attribute device vector under the corresponding monitoring target; Indicates the basic working time of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; It represents the average of basic working time involved in all target coverages; It represents the interaction value of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Represents the average value of the interaction values ​​involved under all target coverage; Respectively represent the standardized coefficients for basic working time and interaction value; Indicates the device weight of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Indicates the operation priority of i1 attribute device vector under the corresponding monitoring target; Conventional cycle determination unit, used to determine the A regular cycle is set for the monitoring target, wherein: Indicates the monitoring period corresponding to the i1th attribute device vector under the corresponding monitoring target; Indicates all The variance of Indicates setting threshold; Indicates all The average period of the probability of satisfying the normal distribution; Indicates all The number of monitoring periods that do not satisfy the normal distribution probability; Quantity determination unit for Determine the number of alternating intervals between the normal cycle and the maximum cycle, where: They respectively represent obtaining the maximum cycle and minimum cycle from all monitoring cycles under the corresponding monitoring target. Indicates the regular cycle of the corresponding monitoring target; Indicates the rounding up symbol; The mechanism construction unit is used to construct a monitoring mechanism corresponding to the monitoring target according to the regular cycle, the maximum cycle and the number of alternating intervals.

3. The safety protection system for power distribution terminals according to claim 2, characterized in that: The mechanism building unit comprises: A comparison subunit, configured to obtain an initial mechanism from a type-construction comparison table according to a target type of the monitoring target; The application subunit is used to apply the normal cycle, the maximum cycle and the number of alternating intervals corresponding to the monitoring target to the initial mechanism to obtain the monitoring mechanism.

4. The safety protection system for power distribution terminals according to claim 1, characterized in that: The log acquisition module includes: A first capturing unit, used to capture a first working log of a first communication interface corresponding to a monitoring target; A second capturing unit, used for capturing a second working log of a second communication interface in which the power distribution terminal is communicatively connected with a corresponding monitoring target; A third capturing unit, used to capture a third work log between the transmission channel of the power distribution terminal and the corresponding monitoring target; Among them, the first work log, the second work log and the third work log are regarded as communication logs.

5. The safety protection system for power distribution terminals according to claim 1, characterized in that: The abnormality analysis module comprises: An array construction unit, used to extract monitoring sub-arrays at each time point from the initial data, wherein the monitoring sub-arrays include voltages and currents of different monitoring devices involved in the corresponding monitoring target; A log extraction unit, configured to extract a sub-log between a first time point and a second time point from the communication log according to a first time point at which the monitoring sub-array corresponding to the monitoring target at each time point starts to be transmitted from the first communication interface and a second time point at which the monitoring sub-array is transmitted to the second communication interface; The difference analysis unit is used to perform correlation difference analysis on the monitoring sub-array at the corresponding time point according to the sub-log, and perform standard difference analysis on the monitoring sub-array at the same time point according to the target mode of the corresponding monitoring target at the corresponding time point, lock the abnormal time point and the abnormal type at the corresponding abnormal time point, and construct an impact vector ,in, represents the impact value of the corresponding second communication interface at the tth time point; Indicates the total number of time points; Indicates the abnormal type of the corresponding second communication interface at time point t; A vector construction unit, configured to determine the communication value of the second communication interface at each time point according to the communication log, and construct the communication vector of the power distribution terminal ,in, Indicates the communication value of the corresponding second communication interface at time point t. When the communication is normal, the value is 1, and when the communication is abnormal, the value is 0; A vector analysis unit is used to analyze the influence vector and the communication vector , input into the vector analysis model, and obtain the abnormal actions of the distribution terminal itself and the external abnormal actions.

6. The safety protection system for power distribution terminals according to claim 5, characterized in that: The abnormality analysis module further includes: An action comparison unit is used to compare and analyze the abnormal actions of the self and the external abnormal actions with the action-logic database, and extract the first logic for each abnormal action of the self and the second logic for each abnormal action of the external; The event integration unit is used to integrate all logics and time points involved in each abnormal action, and the logical hazard level involved in the corresponding abnormal action, into a safety event based on each time point of the distribution terminal.

7. The safety protection system for power distribution terminals according to claim 1, characterized in that: The timing analysis module comprises: An event set statistics unit, used to count the security events between the power distribution terminal and different monitoring targets at the same time point in chronological order to obtain an event set at each time point; A jump type determination unit, used for inputting the event set into an event analysis model consistent with the power distribution terminal to obtain a jump coefficient of a corresponding time point; when the jump coefficient is greater than a preset coefficient, the corresponding time point is regarded as a jump timing point; and depending on the occurrence frequency of each safety event involved in the event set of the jump timing point and the influence coefficient on the power distribution terminal, a first event less than a safety threshold is determined, and the event type of the first event is combined as the jump type of the corresponding jump timing point; The protection mode acquisition unit is used to obtain the protection mode for each jump timing point based on the type-mode database and perform security protection.

8. The safety protection system for power distribution terminals according to claim 7, characterized in that: The jump type determination unit includes: Determine the safety factor of each safety event in the event set corresponding to the jump timing point ; ； in, Indicates the impact coefficient of the corresponding security event on the power distribution terminal; Indicates the occurrence frequency of the corresponding security event in all event sets; Indicates the total number of events involved in all event sets.

Images