A safety protection system for a distribution terminal

Abstract

The present invention provides a safety protection system for a distribution terminal, belonging to the technical field of safety protection, including: a data monitoring module, configured to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage range of the monitoring target of the distribution terminal, and perform monitoring to obtain initial data; a log acquisition module, configured to acquire the communication log between the distribution terminal and the monitoring target; an anomaly analysis module, configured to analyze the initial data and the communication log to determine the self-anomaly actions and external anomaly actions of the distribution terminal, and perform logical visualization on the self-anomaly actions and external anomaly actions, and set safety events for the distribution terminal; a timing analysis module, configured to perform timing analysis on all safety events to determine the jump timing points, and perform safety protection on the distribution terminal according to the jump types of the jump timing points. Ensure the safe operation of the distribution terminal, thereby improving the monitoring efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of safety protection, and particularly relates to a safety protection system for a distribution terminal. Background Art

[0002] A distribution terminal is a general term for various remote monitoring and control units installed in a distribution network. It collects on-site electrical quantities (such as voltage and current), switch states and other information, analyzes and processes them, and implements control over distribution network equipment according to a predetermined control strategy or receives commands from a master station. Currently, it is common for a distribution terminal to protect the safety of various devices in the distribution network, but there is little protection for its own safety. And the conventional protection for the safety of the distribution terminal itself is achieved through regular inspections by maintenance personnel. During this process, if the distribution terminal has an abnormality, it cannot effectively monitor the devices in the distribution network in a timely manner. Undoubtedly, there will be a situation where the distribution network has a fault but is unaware of it, reducing the monitoring efficiency.

[0003] Therefore, the present invention proposes a safety protection system for a distribution terminal. Summary of the Invention

[0004] The present invention provides a safety protection system for a distribution terminal, which is used to ensure the effective acquisition of data by setting a monitoring mechanism for the monitoring targets of the distribution terminal, and combine communication logs to determine the abnormality of the distribution terminal, and then determine the jump type of the distribution terminal itself through chronological analysis of events, ensure the safe operation of the distribution terminal, and thus improve the monitoring efficiency.

[0005] The present invention provides a safety protection system for a distribution terminal, including:

[0006] A data monitoring module, which is used to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage range of the monitoring targets of the distribution terminal, and monitor the operation status of the corresponding monitoring targets according to the monitoring mechanism to obtain initial data;

[0007] A log acquisition module, which is used to obtain the communication log between the distribution terminal and the monitoring target during the monitoring process of the corresponding monitoring target;

[0008] An abnormality analysis module, which is used to analyze the initial data and the communication log, determine the self-abnormal actions and external abnormal actions of the distribution terminal, and visualize the logic of the self-abnormal actions and external abnormal actions, and set safety events for the distribution terminal;

[0009] A chronological analysis module, which is used to perform chronological analysis on all safety events to determine the jump chronological points, and perform safety protection on the distribution terminal according to the jump types of the jump chronological points.

[0010] Preferably, the data monitoring module includes:

[0011] A set establishment unit, configured to establish a coverage device sequence for each target coverage range, and then disassemble the coverage device sequence according to the operating attributes of each coverage device to establish an attribute device vector set;

[0012] A priority determination unit, configured to determine the operating priority of each attribute device vector in the attribute device vector set respectively, and match the monitoring period matching the operating priority from a priority-cycle comparison table;

[0013] ;

[0014] Wherein, represents the target weight corresponding to the monitoring target; represents the attribute weight of i1 attribute device vectors under the corresponding monitoring target; represents the number of attribute devices involved in the i1-th attribute device vector under the corresponding monitoring target; represents the basic working time of the j1-th attribute device in the i1-th attribute device vector under the corresponding monitoring target; represents the average value of the basic working times involved in all target coverage ranges; represents the interaction value of the j1-th attribute device in the i1-th attribute device vector under the corresponding monitoring target; represents the average value of the interaction values involved in all target coverage ranges; respectively represent the normalization coefficients for the basic working time and the interaction value; represents the device weight of the j1-th attribute device in the i1-th attribute device vector under the corresponding monitoring target; represents the operating priority of the i1-th attribute device vector under the corresponding monitoring target;

[0015] A regular period determination unit, configured to set a regular period for the monitoring target according to where, represents the monitoring period corresponding to the i1-th attribute device vector under the corresponding monitoring target; represents all the variance of; represents a set threshold; represents all the average period satisfying the normal distribution probability in; represents all the number of monitoring periods not satisfying the normal distribution probability in;

[0016] A quantity determination unit, configured to determine according to Determine the number of alternating intervals between the regular period and the maximum period, where respectively represent obtaining the maximum period and the minimum period from all monitoring periods under the corresponding monitoring target, represents the regular period of the corresponding monitoring target; represents the ceiling symbol;

[0017] A mechanism construction unit is used to construct a monitoring mechanism for the corresponding monitoring target according to the regular period, the maximum period, and the number of alternating intervals.

[0018] Preferably, the mechanism construction unit includes:

[0019] A comparison subunit is used to obtain an initial mechanism from a type-construction comparison table according to the target type of the monitoring target;

[0020] An application subunit is used to apply the regular period, the maximum period, and the number of alternating intervals of the corresponding monitoring target to the initial mechanism to obtain a monitoring mechanism.

[0021] Preferably, the log acquisition module includes:

[0022] A first capture unit is used to capture the first working day log of the first communication interface of the corresponding monitoring target;

[0023] A second capture unit is used to capture the second working day log of the second communication interface through which the power distribution terminal is communicatively connected to the corresponding monitoring target;

[0024] A third capture unit is used to capture the third working day log between the transmission channel of the power distribution terminal and the corresponding monitoring target;

[0025] Among them, the first working day log, the second working day log, and the third working day log are regarded as communication logs.

[0026] Preferably, the anomaly analysis module includes:

[0027] An array construction unit is used to respectively extract monitoring sub-arrays at each time point from the initial data, where the monitoring sub-arrays include the voltages and currents of different monitoring devices involved in the corresponding monitoring target;

[0028] A log extraction unit is used to extract sub-logs between the first time point when the monitoring sub-array starts to be transmitted from the first communication interface and the second time point when the monitoring sub-array is transmitted to the second communication interface from the communication logs according to the monitoring sub-arrays at each time point of the corresponding monitoring target;

[0029] A difference analysis unit is configured to perform associated difference analysis on a monitored sub-array at a corresponding time point according to the sub-log, and perform standard difference analysis on the monitored sub-array at the same time point according to the target pattern of the corresponding monitoring target at the corresponding time point, lock the abnormal time point and the abnormal type at the corresponding abnormal time point, and construct an influence vector , where represents the influence value of the corresponding second communication interface at the t-th time point; represents the total number of time points; represents the abnormal type of the corresponding second communication interface at the t-th time point;

[0030] A vector construction unit is configured to judge the communication value of the second communication interface at each time point according to the communication log, and construct the communication vector of the power distribution terminal , where represents the communication value of the corresponding second communication interface at the t-th time point, taking the value of 1 when the communication is normal and 0 when the communication is abnormal;

[0031] A vector analysis unit is configured to input the influence vector and the communication vector into a vector analysis model to obtain the self-abnormal actions and external abnormal actions of the power distribution terminal.

[0032] Preferably, the abnormal analysis module further includes:

[0033] An action comparison unit is configured to respectively compare and analyze the self-abnormal actions and external abnormal actions with an action-logic database, and extract a first logic for each self-abnormal action and a second logic for each external abnormal action;

[0034] An event integration unit is configured to integrate all the logics involved in each abnormal action and the time points involved, and combine the logic danger levels involved in the corresponding abnormal actions into the security events of the power distribution terminal based on each time point.

[0035] Preferably, the timing analysis module includes:

[0036] An event set statistics unit is configured to statistically count the security events between the power distribution terminal and different monitoring targets at the same time point in chronological order to obtain an event set for each time point;

[0037] A jump type determination unit, configured to input the event set into an event analysis model consistent with the distribution terminal to obtain a jump coefficient at a corresponding time point. When the jump coefficient is greater than a preset coefficient, the corresponding time point is regarded as a jump time sequence point, and depending on the occurrence frequency of each security event involved in the event set at the jump time sequence point and the influence coefficient on the distribution terminal, a first event less than the security threshold is determined, and the event types of the first event are combined as the jump type corresponding to the jump time sequence point;

[0038] A protection method acquisition unit, configured to obtain a protection method for each jump time sequence point based on a type - method database and perform security protection.

[0039] Preferably, the jump type determination unit includes:

[0040] Determine the safety coefficient of each security event in the event set corresponding to the jump time sequence point ;

[0041] ;

[0042] wherein, represents the influence coefficient of the corresponding security event on the distribution terminal; represents the occurrence frequency of the corresponding security event in all event sets; represents the total number of events involved in all event sets.

[0043] Compared with the prior art, the beneficial effects of the present application are as follows:

[0044] By setting a monitoring mechanism for the monitoring target of the distribution terminal to ensure the effective acquisition of data, and combining communication logs to determine the abnormality of the distribution terminal, and then determining the jump type of the distribution terminal itself through timing analysis of events, the safe operation of the distribution terminal is ensured, thereby improving the monitoring efficiency.

[0045] Other features and advantages of the present invention will be described in the following specification, and, in part, will be obvious from the specification, or will be understood by implementing the present invention. The objectives and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in the written specification and the drawings.

[0046] The technical solutions of the present invention will be further described in detail below through the drawings and embodiments. Description of the Drawings

[0047] The drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the drawings:

[0048] Figure 1 This is the structural diagram of a safety protection system for a distribution terminal in an embodiment of the present invention. Specific embodiments

[0049] The following describes the preferred embodiments of the present invention in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only for explaining and illustrating the present invention, and are not used to limit the present invention.

[0050] The present invention provides a safety protection system for a distribution terminal, as Figure 1 shown, including:

[0051] A data monitoring module, configured to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage range of the monitoring target of the distribution terminal, and monitor the operation status of the corresponding monitoring target according to the monitoring mechanism to obtain initial data;

[0052] A log acquisition module, configured to acquire the communication log between the distribution terminal and the monitoring target during the monitoring of the corresponding monitoring target;

[0053] An anomaly analysis module, configured to analyze the initial data and the communication log, determine the self-anomaly actions and external anomaly actions of the distribution terminal, and perform logical visualization on the self-anomaly actions and external anomaly actions, and set safety events for the distribution terminal;

[0054] A timing analysis module, configured to perform timing analysis on all safety events to determine the jump timing points, and perform safety protection on the distribution terminal according to the jump types of the jump timing points.

[0055] In this embodiment, the monitoring target refers to several devices in different regions of the distribution network, and the monitoring mechanism refers to performing periodic monitoring on the monitoring target, and the periodicity involved in different monitoring targets is different, and the purpose of the periodic monitoring is to ensure the rationality of the monitoring and to ensure the comprehensiveness of the monitoring as much as possible.

[0056] In this embodiment, the initial data refers to information such as voltage and current of different devices involved in the monitoring target.

[0057] In this embodiment, the communication log refers to the log generated by the communication channel constructed by the monitoring target and the distribution terminal during the monitoring process, as well as the log generated by the communication interfaces of the monitoring target and the distribution terminal, etc., and the log is captured by a pre-set log capture tool.

[0058] In this embodiment, the analysis of the initial data and the communication log is mainly to determine whether there is external interference causing abnormalities in the transmission of the initial data, or whether the data will be abnormal due to problems such as interfaces when starting to be transmitted or transmitted to the power distribution terminal. Furthermore, for its own abnormal actions and external abnormal actions, the own abnormal action is the behavior of the interface of the power distribution terminal being abnormal, and the external abnormal action refers to external interference (such as virus intrusion) causing abnormalities in the data transmitted to the power distribution terminal, and then whether the virus will have an impact on the power distribution terminal again, etc.

[0059] In this embodiment, logical visualization is to obtain the logic related to abnormal actions, and integrate the logic to obtain security events. The security events are configured for the dangerous situations existing in the power distribution terminal to facilitate the subsequent determination of the jump timing points.

[0060] In this embodiment, the jump timing point refers to the event point that requires safety protection for the power distribution terminal.

[0061] In this embodiment, the jump type can be any one or a combination of multiple types such as the trip type, the closed type, and the allowable control type. Since there is at least one monitoring target related to the power distribution terminal, there will be a situation of type combination, and thus the protection of the terminal can be more comprehensively realized.

[0062] The beneficial effects of the above technical solution are: By setting a monitoring mechanism for the monitoring targets of the power distribution terminal to ensure the effective acquisition of data, and combining the communication log to determine the abnormalities of the power distribution terminal, and then determining the jump type of the power distribution terminal itself through the timing analysis of events, to ensure the safe operation of the power distribution terminal and improve the monitoring efficiency.

[0063] The present invention provides a safety protection system for a power distribution terminal. The data monitoring module includes:

[0064] A set building unit, used to build a coverage device sequence for each target coverage range, and then disassemble the coverage device sequence according to the operation attributes of each coverage device to build an attribute device vector set;

[0065] A priority determination unit, used to determine the operation priority of each attribute device vector in the attribute device vector set respectively, and match the monitoring period that matches the operation priority from the priority - period comparison table;

[0066] ;

[0067] Among them, represents the target weight corresponding to the monitoring target; represents the attribute weight of i1 attribute device vectors under the corresponding monitoring target; represents the number of attribute devices involved in the i1-th attribute device vector under the corresponding monitoring target; represents the basic working time of the j1-th attribute device in the i1-th attribute device vectors under the corresponding monitoring target; represents the average value of the basic working times involved under all target coverage ranges; represents the interaction value of the j1-th attribute device in the i1-th attribute device vectors under the corresponding monitoring target; represents the average value of the interaction values involved under all target coverage ranges; respectively represent the standardization coefficients for the basic working time and the interaction value; represents the device weight of the j1-th attribute device in the i1-th attribute device vectors under the corresponding monitoring target; represents the operation priority of the i1-th attribute device vectors under the corresponding monitoring target;

[0068] A regular cycle determination unit, configured to, according to set a regular cycle for the monitoring target, where represents the monitoring cycle corresponding to the i1-th attribute device vector under the corresponding monitoring target; represents all variance; represents a set threshold; represents all average cycle satisfying the normal distribution probability among represents all number of monitoring cycles not satisfying the normal distribution probability among

[0069] A quantity determination unit, configured to, according to determine the number of alternating intervals between the regular cycle and the maximum cycle, where respectively represent obtaining the maximum cycle and the minimum cycle from all the monitoring cycles under the corresponding monitoring target, represents the regular cycle of the corresponding monitoring target; represents the ceiling symbol;

[0070] A mechanism construction unit, configured to construct a monitoring mechanism corresponding to the monitoring target according to the regular cycle, the maximum cycle, and the number of alternating intervals.

[0071] In this embodiment, the coverage device sequence is the device serial numbers included in the corresponding target coverage area. For example, it is: {In area A1 corresponding to the target coverage area, devices 1, 2, 3, 4, and 5 are included}. The operating attribute refers to the function of the corresponding device. For example, devices 1 and 3 are for power generation, and devices 2, 4, and 5 are for power transmission. At this time, disassembly can be performed to obtain the attribute device vector set: {{devices 1, 3}, {devices 2, 4, 5}}.

[0072] In this embodiment, the priority - period comparison table includes different operating priorities and the monitoring periods matching these priorities, which are preset and can be directly matched.

[0073] In this embodiment, the sum of the target weights of all monitoring targets related to the distribution terminal is 1, and the target weights of each monitoring target and the attribute weights of the devices involved under each monitoring target are known.

[0074] In this embodiment, the basic working time refers to the set operating duration under the normal working state of the corresponding device.

[0075] In this embodiment, the value range of the interaction value is from 0 to 1, and the interaction value is the degree of interaction tightness between this device and other devices.

[0076] In this embodiment, the set threshold value is 0.1.

[0077] In this embodiment, the value of the normal distribution probability is 0.8, that is, all After obtaining the normal distribution, the values falling within the range corresponding to the 0.8 probability are averaged to obtain the average period.

[0078] In this embodiment, the regular period is: The calculation results in these two cases.

[0079] In this embodiment, the number of alternating intervals refers to the number between the regular period and the maximum period. For example, the number of alternating intervals is 2. At this time, according to: regular period, regular period, maximum period, regular period, regular period, maximum period, etc., the monitoring mechanism is obtained.

[0080] For example, T02 is used as a period for monitoring. After it ends, there is an interval of 10 seconds, and then T02 is used as a period for monitoring again. At this time, after T02 is monitored 2 times, there is an interval of 10 seconds again, and then the maximum period T03 is used for one - period monitoring, and so on.

[0081] The beneficial effects of the above technical solution are as follows: The sequence is split according to attributes to obtain the operation priorities of devices with different attributes, and then the monitoring period is obtained. Subsequently, the regular period is determined by calculating and analyzing the monitoring period. Compared with full-day online monitoring, monitoring resources can be saved. Moreover, through the replacement interval between the regular period and the minimum period, the comprehensiveness of data monitoring is ensured, thereby improving the monitoring efficiency and providing a basis for subsequent analysis of anomalies.

[0082] The present invention provides a safety protection system for a distribution terminal. The mechanism construction unit includes:

[0083] The comparison subunit is configured to obtain an initial mechanism from a type-construction comparison table according to the target type of the monitoring target;

[0084] The application subunit is configured to apply the regular period, the maximum period, and the number of alternating intervals corresponding to the monitoring target to the initial mechanism to obtain a monitoring mechanism.

[0085] In this embodiment, the type-construction comparison table includes different target types and the initial mechanisms matching the types. The initial mechanism is mainly used to determine whether the regular period is at the first start period or the maximum period is at the first start period, and the length of the interval pause time between the periods. For example, the length of the interval pause time is 10 seconds, etc.

[0086] In this embodiment, the target type is the main function of the monitoring target. For example, the thermal power generation type, the wind power generation type, etc.

[0087] In this embodiment, the number of alternating intervals is mainly for the regular period, that is, the corresponding regular period will continuously appear in the same number as the number of alternating intervals.

[0088] The beneficial effects of the above technical solution are as follows: Obtaining the initial mechanism according to the type provides convenience for constructing the monitoring mechanism, and by applying the regular period, the maximum period, and the number of alternating intervals, the pertinence of the mechanism is ensured.

[0089] The present invention provides a safety protection system for a distribution terminal. The log acquisition module includes:

[0090] The first capture unit is configured to capture the first working day log of the first communication interface corresponding to the monitoring target;

[0091] The second capture unit is configured to capture the second working day log of the second communication interface through which the distribution terminal is communicatively connected to the corresponding monitoring target;

[0092] The third capture unit is configured to capture the third working day log between the distribution terminal and the transmission channel of the corresponding monitoring target;

[0093] Among them, the first work log, the second work log, and the third work log are regarded as communication logs.

[0094] In this embodiment, the first work log, the second work log, and the third work log are captured based on corresponding tools, mainly for communication parameters generated by interfaces and channels and parameters affecting transmission. Among them, the parameters affecting transmission can be virus data such as virus affecting transmission data resulting in data loss or mutation.

[0095] In this embodiment, communication log = first communication log + second communication log + third communication log.

[0096] The beneficial effects of the above technical solution are: capturing work logs from two aspects of interfaces and channels to obtain communication logs, providing an analysis basis for subsequent analysis of abnormal actions.

[0097] The present invention provides a security protection system for a power distribution terminal. The anomaly analysis module includes:

[0098] An array construction unit for respectively extracting monitoring sub-arrays at each time point from the initial data, where the monitoring sub-arrays include voltages and currents of different monitoring devices involved in the corresponding monitoring target.

[0099] A log extraction unit for extracting sub-logs between the first time point when the monitoring sub-array starts to be transmitted from the first communication interface and the second time point when the monitoring sub-array is transmitted to the second communication interface according to the monitoring sub-arrays at each time point of the corresponding monitoring target from the communication log.

[0100] A difference analysis unit for performing associated difference analysis on the monitoring sub-arrays at the corresponding time points according to the sub-logs, and performing standard difference analysis on the monitoring sub-arrays at the same time point according to the target pattern of the corresponding monitoring target at the corresponding time point, locking the abnormal time points and the abnormal types at the corresponding abnormal time points, and constructing an influence vector , where represents the influence value of the corresponding second communication interface at the t-th time point; represents the total number of time points; represents the abnormal type of the corresponding second communication interface at the t-th time point;

[0101] A vector construction unit for judging the communication value of the second communication interface at each time point according to the communication log, and constructing the communication vector of the power distribution terminal , where represents the communication value of the corresponding second communication interface at the t-th time point, taking the value of 1 when the communication is normal and 0 when the communication is abnormal;

[0102] A vector analysis unit is used to analyze the influence vector and the communication vector , input into the vector analysis model, and obtain the abnormal actions of the distribution terminal itself and the external abnormal actions.

[0103] In this embodiment, the initial data includes voltages and currents of the monitoring devices involved at several different time points, wherein the time point refers to the time point at which the corresponding monitoring mechanism is used for monitoring.

[0104] In this embodiment, for example, the first time point is Dt1, and the second time point is Dt2. At this time, the logs between Dt1 and Dt2 are extracted from the communication logs and regarded as sub-logs, so that there is a more complete impact analysis basis when analyzing the time points.

[0105] In this embodiment, the correlation difference analysis is specifically as follows:

[0106] Extract the influencing factors that affect the monitoring sub-array from the sub-logs, such as viruses, external intrusions, etc.

[0107] The possible impact of each influencing factor on the data is extracted from the factor-data impact comparison table as the result of the associated difference analysis, such as missing data, changes in data values, etc.

[0108] In this embodiment, the target mode refers to the working mode of the corresponding monitoring target, which is pre-set. For example, the mode at the corresponding time point is the mode of generating electricity using device 1, and then the standard operating data of the monitoring target in mode 09 is obtained according to the target-mode-operation database, which is pre-set, and then the standard difference analysis is realized by comparing and analyzing with the monitoring sub-array.

[0109] In this embodiment, the abnormal time point can be first determined based on the standard difference analysis result, that is, the absolute value of the actual voltage and actual current at the corresponding time point subtracted from the standard voltage and standard current is not within the set difference range. At this time, the corresponding time point is regarded as an abnormal time point. Then, the correlation difference analysis result is used to analyze whether the existing factors will affect the actual voltage and actual current at the abnormal time point. If so, the corresponding factors are retained, and if not, the corresponding factors are eliminated. That is, Does not exist.

[0110] In this embodiment, the communication value of the second communication interface is obtained by analyzing whether the communication parameters of the interface are normal or not. If normal, the communication value is 1, otherwise, it is 0.

[0111] In this embodiment, the vector analysis model is obtained by training a neural network model with different communication impact vectors, communication vectors of distribution terminals, and the abnormal analysis results of experts on the combination of these two vectors as samples. Therefore, its own abnormal actions and external abnormal actions can be directly obtained.

[0112] The beneficial effects of the above technical solution are as follows: By extracting time points from the initial data and communication logs for correlation difference analysis, and combining patterns for standard difference analysis to construct impact vectors, and then inputting the communication vectors constructed in combination with communication values into the model, reasonable and reliable acquisition of abnormal actions of distribution terminals is achieved, ensuring the timely solution of abnormalities in distribution terminals and indirectly improving the monitoring efficiency.

[0113] The present invention provides a safety protection system for distribution terminals. The abnormal analysis module further includes:

[0114] An action comparison unit for respectively comparing and analyzing its own abnormal actions and external abnormal actions with the action-logic database, and extracting the first logic for each of its own abnormal actions and the second logic for each external abnormal action;

[0115] An event integration unit for integrating all the logics and time points involved in each abnormal action, and combining the logic danger levels involved in the corresponding abnormal actions into safety events of the distribution terminal based on each time point.

[0116] In this embodiment, the action-logic database includes different abnormal actions and the logics matched with the actions. The logics mainly refer to the reasons for the realization of abnormal actions, that is, the corresponding abnormal actions are generated by executing the corresponding logics, which are set in advance.

[0117] In this embodiment, since the same abnormal action may occur at multiple time points, it is necessary to combine all the logics and time points involved in each abnormal action, and combine the logic danger levels to form safety events, that is: Safety event = all logics and time points of abnormal actions + logic danger level.

[0118] In this embodiment, the logic danger level is obtained by matching from the abnormal-level comparison table, which includes the logic danger levels corresponding to different abnormal actions and is set in advance.

[0119] The beneficial effects of the above technical solution are as follows: By comparing and analyzing abnormal actions with the database, it is convenient to obtain logics. By determining the logics and time points involved in the same action and combining the levels to form safety events, it provides a basis for protecting the safety of distribution terminals.

[0120] The present invention provides a safety protection system for a distribution terminal. The timing analysis module includes:

[0121] An event set statistics unit for statistically analyzing safety events between the distribution terminal and different monitoring targets at the same time point in chronological order to obtain an event set for each time point;

[0122] A jump type determination unit for inputting the event set into an event analysis model consistent with the distribution terminal to obtain a jump coefficient for the corresponding time point. When the jump coefficient is greater than a preset coefficient, the corresponding time point is regarded as a jump timing point, and depending on the occurrence frequency of each safety event involved in the event set at the jump timing point and the influence coefficient on the distribution terminal, a first event with a value less than the safety threshold is determined, and the event types of the first event are combined as the jump type for the corresponding jump timing point;

[0123] A protection method acquisition unit for obtaining a protection method for each jump timing point based on a type - method database and performing safety protection.

[0124] Preferably, the jump type determination unit includes:

[0125] Determining the safety coefficient of each safety event in the event set corresponding to the jump timing point ;

[0126] ;

[0127] wherein, represents the influence coefficient of the corresponding safety event on the distribution terminal; represents the occurrence frequency of the corresponding safety event in all event sets; represents the total number of events involved in all event sets.

[0128] In this embodiment, the event set = {all safety events involved at the same time point}.

[0129] In this embodiment, the event analysis model is obtained by training a neural network model with different combinations of safety events and the evaluation coefficient results of experts for different combinations of safety events as samples. Therefore, after determining the event set, the jump coefficient can be directly obtained through this model, and the value of the jump coefficient ranges from 0 to 1.

[0130] In this embodiment, the value of the preset coefficient is 0.5.

[0131] In this embodiment, the value of the safety threshold is 0.6.

[0132] In this embodiment, the jump type is the combination of the event types of the first event involved at the corresponding jump timing point.

[0133] In this embodiment, the type-mode database includes different jump types and the matching protection modes, and the protection modes are a combination of one or more of the trip protection mode, the closed isolation protection mode, the control protection mode, etc.

[0134] In this embodiment, the value range of the influence coefficient is from 0 to 1.

[0135] In this embodiment, for example, after the trip protection of the distribution terminal, the power is restored to achieve re-monitoring, or a part of the monitoring target U1 in the distribution terminal is closed and isolated, and the rest is normally monitored, etc., and the closed and isolated part is maintained and adjusted, or a code upgrade instruction is sent to the distribution terminal to achieve security upgrade, etc.

[0136] The beneficial effects of the above technical solution are as follows: the jump coefficient is obtained by counting the event sets at different time points, and then the first event and the jump type are determined by comparing the magnitudes of the coefficients, so as to realize the reasonable protection of the distribution terminal and improve the monitoring efficiency.

[0137] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these changes and modifications.

Claims

1. A safety protection system for a power distribution terminal, characterized in that: include: A data monitoring module, used to obtain a monitoring mechanism for each monitoring target according to the target type and target coverage of the monitoring target of the power distribution terminal, and to monitor the operation of the corresponding monitoring target according to the monitoring mechanism to obtain initial data; A log acquisition module, used to acquire the communication log between the power distribution terminal and the monitoring target during the monitoring process of the corresponding monitoring target; An abnormality analysis module, used to analyze the initial data and the communication log, determine the abnormal actions of the power distribution terminal itself and the external abnormal actions, and perform logical visualization of the abnormal actions of the power distribution terminal itself and the external abnormal actions, and set a security event for the power distribution terminal; A timing analysis module, used to perform timing analysis on all safety events to determine the jump timing points, and to perform safety protection on the power distribution terminal according to the jump type of the jump timing points; The data monitoring module comprises: A set establishment unit, used to establish a coverage device sequence for each target coverage range, and then disassemble the coverage device sequence according to the operation attribute of each coverage device to establish an attribute device vector set; a priority determination unit, used to respectively determine the operation priority of each attribute device vector in the attribute device vector set, and match a monitoring period matching the operation priority from a priority-period comparison table; ； in, Indicates the target weight of the corresponding monitoring target; Indicates the attribute weight of the i1 attribute device vector corresponding to the monitoring target; Indicates the number of attribute devices involved in the i1th attribute device vector under the corresponding monitoring target; Indicates the basic working time of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; It represents the average of basic working time involved in all target coverages; It represents the interaction value of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Represents the average value of the interaction values ​​involved under all target coverage; Respectively represent the standardized coefficients for basic working time and interaction value; Indicates the device weight of the j1th attribute device in the i1th attribute device vector under the corresponding monitoring target; Indicates the operation priority of i1 attribute device vector under the corresponding monitoring target; Conventional cycle determination unit, used to determine the A regular cycle is set for the monitoring target, wherein: Indicates the monitoring period corresponding to the i1th attribute device vector under the corresponding monitoring target; Indicates all The variance of Indicates setting threshold; Indicates all The average period of the probability of satisfying the normal distribution; Indicates all The number of monitoring periods that do not satisfy the normal distribution probability; Quantity determination unit for Determine the number of alternating intervals between the normal cycle and the maximum cycle, where: They respectively represent obtaining the maximum cycle and minimum cycle from all monitoring cycles under the corresponding monitoring target. Indicates the regular cycle of the corresponding monitoring target; Indicates the rounding up symbol; The mechanism construction unit is used to construct a monitoring mechanism corresponding to the monitoring target according to the regular cycle, the maximum cycle and the number of alternating intervals.

2. The safety protection system for power distribution terminals according to claim 1, characterized in that: The mechanism building unit comprises: A comparison subunit, configured to obtain an initial mechanism from a type-construction comparison table according to a target type of the monitoring target; The application subunit is used to apply the normal cycle, the maximum cycle and the number of alternating intervals corresponding to the monitoring target to the initial mechanism to obtain the monitoring mechanism.

3. The safety protection system for power distribution terminals according to claim 1, characterized in that: The log acquisition module includes: A first capturing unit, used to capture a first working log of a first communication interface corresponding to a monitoring target; A second capturing unit, used for capturing a second working log of a second communication interface in which the power distribution terminal is communicatively connected with a corresponding monitoring target; A third capturing unit, used to capture a third work log between the transmission channel of the power distribution terminal and the corresponding monitoring target; Among them, the first work log, the second work log and the third work log are regarded as communication logs.

4. The safety protection system for power distribution terminals according to claim 1, characterized in that: The abnormality analysis module comprises: An array construction unit, used to extract monitoring sub-arrays at each time point from the initial data, wherein the monitoring sub-arrays include voltages and currents of different monitoring devices involved in the corresponding monitoring target; A log extraction unit, configured to extract a sub-log between a first time point and a second time point from the communication log according to a first time point at which the monitoring sub-array corresponding to the monitoring target at each time point starts to be transmitted from the first communication interface and a second time point at which the monitoring sub-array is transmitted to the second communication interface; The difference analysis unit is used to perform correlation difference analysis on the monitoring sub-array at the corresponding time point according to the sub-log, and perform standard difference analysis on the monitoring sub-array at the same time point according to the target mode of the corresponding monitoring target at the corresponding time point, lock the abnormal time point and the abnormal type at the corresponding abnormal time point, and construct an impact vector ,in, represents the impact value of the corresponding second communication interface at the tth time point; Indicates the total number of time points; Indicates the abnormal type of the corresponding second communication interface at time point t; A vector construction unit, configured to determine the communication value of the second communication interface at each time point according to the communication log, and construct the communication vector of the power distribution terminal ,in, Indicates the communication value of the corresponding second communication interface at time point t. When the communication is normal, the value is 1, and when the communication is abnormal, the value is 0; A vector analysis unit is used to analyze the influence vector and the communication vector , input into the vector analysis model, and obtain the abnormal actions of the distribution terminal itself and the external abnormal actions.

5. The safety protection system for power distribution terminals according to claim 4, characterized in that: The abnormality analysis module further includes: An action comparison unit is used to compare and analyze the abnormal actions of the self and the external abnormal actions with the action-logic database, and extract the first logic for each abnormal action of the self and the second logic for each abnormal action of the external; The event integration unit is used to integrate all logics and time points involved in each abnormal action, and the logical hazard level involved in the corresponding abnormal action, into a safety event based on each time point of the distribution terminal.

6. The safety protection system for power distribution terminals according to claim 1, characterized in that: The timing analysis module comprises: An event set statistics unit, used to count the security events between the power distribution terminal and different monitoring targets at the same time point in chronological order to obtain an event set at each time point; A jump type determination unit, used for inputting the event set into an event analysis model consistent with the power distribution terminal to obtain a jump coefficient of a corresponding time point; when the jump coefficient is greater than a preset coefficient, the corresponding time point is regarded as a jump timing point; and depending on the occurrence frequency of each safety event involved in the event set of the jump timing point and the influence coefficient on the power distribution terminal, a first event less than a safety threshold is determined, and the event type of the first event is combined as the jump type of the corresponding jump timing point; The protection mode acquisition unit is used to obtain the protection mode for each jump timing point based on the type-mode database and perform security protection.

7. The safety protection system for power distribution terminals according to claim 6, characterized in that: The jump type determination unit includes: Determine the safety factor of each safety event in the event set corresponding to the jump timing point ; ； in, Indicates the impact coefficient of the corresponding security event on the power distribution terminal; Indicates the occurrence frequency of the corresponding security event in all event sets; Indicates the total number of events involved in all event sets.

Images