Method and system for recording and storing multi-protocol communication messages of secondary equipment of transformer substation

Abstract

The invention discloses a transformer substation secondary equipment multi-protocol communication message recording and storing method and system, and relates to the technical field of power system communication, and the method comprises the steps: capturing network port and serial port communication messages in real time, automatically carrying out the preliminary recognition of the messages, carrying out the preprocessing of the messages, carrying out the real-time flow analysis, and carrying out the real-time flow analysis; identifying an abnormal flow mode and marking security threats, matching a message storage strategy by utilizing an analysis result, dynamically adjusting a message storage format and position according to message characteristics and access frequency, storing messages in each node in a scattered manner, analyzing the stored messages by utilizing a self-adaptive protocol analysis engine, and sending the analyzed messages to a server; and key information is extracted to construct an equipment operation state model, and equipment maintenance and fault diagnosis are carried out by using a mining result. The communication message processing efficiency and safety performance of the secondary equipment of the transformer substation are improved, the intelligent maintenance and fault diagnosis capabilities of the system are enhanced, and a powerful technical guarantee is provided for stable operation of a power system.

Description

Technical Field

[0001] The present invention relates to the technical field of power system communications, and in particular to a method and system for recording and storing multi-protocol communication messages of secondary equipment in a transformer substation. Background Art

[0002] As power systems continue to become more complex and automated, substation secondary equipment plays an increasingly prominent role in power system monitoring and communication. These devices exchange data using a variety of communication protocols to enable real-time monitoring and effective management of the power grid. However, existing technologies for recording and storing communication messages for substation secondary equipment face development bottlenecks. Traditional message recording and storage methods often rely on fixed storage formats and locations, lacking dynamic adaptability to message characteristics and access frequency, which limits system flexibility and efficiency.

[0003] Currently, although some technologies are capable of capturing and storing communication messages in real time, these technologies have shortcomings in message preprocessing, traffic analysis, storage policy adjustment, and protocol parsing. For example, existing technologies often cannot effectively distinguish between different types of messages, resulting in an inability to optimize message storage based on the characteristics and importance of the messages. In addition, there is a lack of efficient methods for identifying abnormal traffic patterns and marking security threats, which affects the security of message storage and the reliability of the system. At the same time, existing message parsing technologies are often unable to perform adaptive parsing in multi-protocol environments, resulting in an inability to fully utilize key information in messages during equipment maintenance and fault diagnosis. These shortcomings indicate that existing technologies need further improvement to adapt to the complex needs of substation secondary equipment in multi-protocol communication environments.

[0004] The method for recording and storing multi-protocol communication messages of substation secondary equipment proposed in this invention has emerged precisely under such a technical background. It aims to improve the intelligence level and efficiency of communication message processing of substation secondary equipment through innovative message capture, preprocessing, flow analysis, dynamic storage adjustment and adaptive protocol parsing technologies, thereby providing more solid technical support for the stable operation of the power system. Summary of the Invention

[0005] In view of the above existing problems, the present invention provides a method and system for recording and storing multi-protocol communication messages of substation secondary equipment, so as to solve the problems of low intelligence level and efficiency of substation secondary equipment communication message processing in the prior art.

[0006] In order to solve the above technical problems, a method for recording and storing multi-protocol communication messages of substation secondary equipment is proposed, including:

[0007] It captures network and serial port communication messages in real time, automatically performs preliminary identification on the messages, distinguishes different message types, and pre-processes the messages; performs real-time traffic analysis on the pre-processed messages, identifies abnormal traffic patterns and marks security threats, uses the analysis results to match the message storage strategy, dynamically adjusts the message storage format and location according to the message characteristics and access frequency, and stores the messages in various nodes in a dispersed manner; uses the adaptive protocol parsing engine to parse the stored messages, deeply mines the parsed message content, extracts key information to build a device operation status model, and uses the mining results to perform equipment maintenance and fault diagnosis.

[0008] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the real-time capture includes using network data packet capture technology to capture network port communication messages in real time, and capturing serial port communication messages in real time through a serial port communication interface, and automatically performing preliminary identification of the messages.

[0009] The preliminary identification includes using a deep learning model to classify the captured messages, distinguish between configuration messages, control messages and monitoring messages, and extract features from the messages; the extracted features include message length, protocol type and destination address.

[0010] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the preprocessing includes distinguishing different types of messages and performing data cleaning and data standardization on the messages.

[0011] The data cleaning formula is:

[0012] P clcan =g ( P i ,θ)

[0013] Among them, P clean is the cleaned message, g is the cleaning function, P i is the original message, and θ is the cleaning parameter.

[0014] The data normalization formula is:

[0015] P std =h(P clean ,φ)

[0016] Among them, P std is the standardized message, P clean is the cleaned message, h is the normalization function, and φ is the normalization parameter.

[0017] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the real-time traffic analysis includes performing real-time traffic analysis on pre-processed messages, identifying abnormal traffic patterns and marking security threats, and using the analysis results to match message storage strategies.

[0018] The real-time traffic analysis includes traffic statistics, abnormal traffic detection and security threat marking; the traffic statistics include traffic statistics of pre-processed messages, calculating the number of messages and traffic size within a specified time window; the abnormal traffic detection includes using an anomaly detection algorithm to identify abnormal traffic patterns and marking the detected abnormal traffic patterns.

[0019] The anomaly detection algorithm is:

[0020]

[0021] Among them, Z(P i ) is the abnormal detection value, P i is the original message, μ is the average value of normal traffic, σ is the standard deviation; set the anomaly detection threshold Z th , when Z(P i )>Z th When Z(P i )≤Z th When it is determined that there is no security threat, no marking is required.

[0022] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the matching message storage strategy includes extracting key information based on the content, size and type of the message, and counting the access frequency of each message to determine the priority, and dynamically adjusting the storage format and location based on the characteristics and access frequency of the message, and distributing the message storage in each node.

[0023] The dynamic adjustment of storage format and location includes analyzing the protocol type, content sensitivity, data size and priority tag of the message, and quantifying each feature through a weight factor to form a comprehensive feature score. When the feature score and access frequency of the message exceed the set threshold, different storage strategies will be matched.

[0024] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the message parsing includes parsing the stored messages using an adaptive protocol parsing engine and deeply mining the content of the parsed messages.

[0025] The adaptive protocol parsing includes starting the adaptive protocol parsing engine and initializing the engine, capturing and preprocessing stored messages in real time, and performing protocol identification on the preprocessed messages. Based on the identified protocol type and applying parsing rules, the fields and data in the messages are extracted.

[0026] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the construction of the equipment operation status model includes establishing a dynamic model of the equipment operation status based on the extracted key information, combined with time series analysis, cluster analysis and machine learning, and comparing it with actual operation data through cross-validation.

[0027] The equipment maintenance and fault diagnosis include predicting maintenance needs and time points based on the equipment operation status model, and formulating a preventive maintenance plan. When an abnormal pattern is detected, the system automatically triggers the fault diagnosis process, analyzes the cause of the fault, and provides repair suggestions. It also adjusts and optimizes the protocol parsing rules and mining algorithms through actual operation data and user feedback, and regularly updates the equipment operation status model.

[0028] As a preferred solution of the multi-protocol communication message recording and storage system for substation secondary equipment described in the present invention, it is characterized by including a message capture and preliminary identification module, a message preprocessing module, a real-time traffic analysis module, a dynamic storage adjustment module and an adaptive protocol parsing module.

[0029] The message capture and preliminary identification module is used to use network data packet capture technology and a serial communication interface to capture communication messages of the network port and the serial port in real time, and to perform preliminary identification on the messages.

[0030] The message preprocessing module is used to remove irrelevant information in the message and convert the cleaned message into a unified format.

[0031] The real-time traffic analysis module is used to calculate the number of messages and traffic volume within a specified time window, use anomaly detection algorithms to identify abnormal traffic patterns, and mark security threats.

[0032] The dynamic storage adjustment module is used to extract key information based on the content, size and type of the message, and to count the access frequency to determine the priority of the message. It is also used to dynamically adjust the storage format and location based on the feature score and access frequency of the message.

[0033] The adaptive protocol parsing module is used to parse the stored messages using the adaptive protocol parsing engine, identify the fields and data in the messages, perform in-depth analysis on the parsed message content, extract key information, build a device operation status model, and regularly maintain the equipment.

[0034] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, it implements the steps of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation.

[0035] A computer-readable storage medium stores a computer program thereon, wherein when the computer program is executed by a processor, the computer program implements the steps of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation.

[0036] Beneficial effects of the present invention: The present invention captures network port and serial port communication messages in real time and automatically performs preliminary identification and preprocessing, thereby ensuring comprehensive capture and rapid classification of messages, reducing false alarms and missed alarms, improving system response speed, and laying the foundation for in-depth analysis; performing real-time traffic analysis on preprocessed messages, effectively identifying abnormal traffic patterns and security threats, improving system security, reducing the risk of data loss and system interruption, and providing support for storage strategy optimization; dynamically adjusting storage format and location according to message characteristics and access frequency, realizing reasonable allocation and optimization of storage resources, improving the scalability and fault tolerance of the system, and facilitating rapid data recovery and backup; utilizing an adaptive protocol parsing engine to deeply mine stored messages, extract key information, and construct an equipment operation status model, thereby enhancing the accuracy of equipment status monitoring and providing data support for maintenance and fault diagnosis; predicting maintenance needs based on the equipment operation status model, formulating a preventive maintenance plan, and automatically triggering the fault diagnosis process, thereby realizing the predictability and initiative of equipment maintenance, extending equipment life, reducing maintenance costs, and further improving the stability and reliability of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive efforts. Among them:

[0038] Figure 1 The present invention provides an overall flow chart of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation according to an embodiment of the present invention.

[0039] Figure 2 A message storage diagram of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation provided by an embodiment of the present invention.

[0040] Figure 3A system solution flow chart of a multi-protocol communication message recording and storage system for substation secondary equipment provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0042] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0043] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it individually or selectively refer to an embodiment that is mutually exclusive of other embodiments.

[0044] The present invention is described in detail with reference to schematic diagrams. For ease of illustration, cross-sectional views of device structures may be partially enlarged and not to scale when describing embodiments of the present invention. Furthermore, the schematic diagrams are merely illustrative and should not limit the scope of the present invention. Furthermore, in actual production, the three-dimensional dimensions of length, width, and depth should be included.

[0045] In the description of the present invention, it should be noted that the terms "upper, lower, inner, and outer" and other references to orientations or positional relationships are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first, second, or third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0046] In this disclosure, unless otherwise specified or limited, the terms "mounted," "connected," and "connected" should be interpreted broadly. For example, they may refer to fixed, removable, or integral connections. They may also refer to mechanical, electrical, or direct connections, indirect connections through an intermediary, or internal communication between two components. Those skilled in the art will understand the specific meanings of these terms in this disclosure.

[0047] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, provides a method for recording and storing multi-protocol communication messages of a substation secondary device, comprising:

[0048] S1: Capture network and serial port communication messages in real time, automatically perform preliminary identification on the messages, distinguish different message types, and pre-process the messages.

[0049] The real-time capture includes capturing network port communication messages in real time using network data packet capture technology, capturing serial port communication messages in real time through a serial port communication interface, and automatically performing preliminary identification on the messages.

[0050] The preliminary identification includes using a deep learning model to classify the captured messages, distinguish between configuration messages, control messages and monitoring messages, and extract features from the messages; the extracted features include message length, protocol type and destination address.

[0051] The preprocessing includes distinguishing different types of messages and performing data cleaning and data standardization on the messages.

[0052] The data cleaning formula is:

[0053] P clcan =g ( P i ,θ)

[0054] Among them, P clean is the cleaned message, g is the cleaning function, P i is the original message, and θ is the cleaning parameter.

[0055] The data normalization formula is:

[0056] P std =h(P clean ,φ)

[0057] Among them, P std is the standardized message, P clean is the cleaned message, h is the normalization function, and φ is the normalization parameter.

[0058] S2: Performs real-time traffic analysis on pre-processed messages, identifies abnormal traffic patterns and marks security threats, uses the analysis results to match message storage policies, dynamically adjusts message storage format and location based on message characteristics and access frequency, and distributes message storage across nodes.

[0059] Furthermore, the real-time traffic analysis includes performing real-time traffic analysis on the pre-processed messages, identifying abnormal traffic patterns and marking security threats, and matching message storage policies using the analysis results.

[0060] The real-time traffic analysis includes traffic statistics, abnormal traffic detection and security threat marking; the traffic statistics include traffic statistics of pre-processed messages, calculating the number of messages and traffic size within a specified time window; the abnormal traffic detection includes using an anomaly detection algorithm to identify abnormal traffic patterns and marking the detected abnormal traffic patterns.

[0061] The anomaly detection algorithm is:

[0062]

[0063] Among them, Z(P i ) is the abnormal detection value, P i is the original message, μ is the average value of normal traffic, σ is the standard deviation; set the anomaly detection threshold Z th , when Z(P i )>Z th When Z(P i )≤Z th When it is determined that there is no security threat, no marking is required.

[0064] like Figure 2 ,The matching message storage strategy includes ,extracting key information based on the content, size and type of the message, ,and statistics on the access frequency of each message, determining the priority, ,and dynamically adjusting the storage format and location based on the ,characteristics and access frequency of the message, and distributing the ,messages in each node.

[0065] The dynamic adjustment of storage format and location includes analyzing the protocol type, content sensitivity, data size and priority tag of the message, and quantifying each feature through a weight factor to form a comprehensive feature score. When the feature score and access frequency of the message exceed the set threshold, different storage strategies will be matched.

[0066] The matching of different storage strategies includes matching the high-priority storage strategy when the message content is highly sensitive, the data is small, and the priority tag is high; matching the secure encryption storage strategy when the message content contains sensitive information; matching the large data volume storage strategy when the message data volume is large but high-speed access is not required; matching the frequency optimization storage strategy when the message access frequency is high but the data size and sensitivity are average; matching the archive storage strategy when the message content is not frequently accessed but needs to be stored for a long time; matching the distributed storage strategy when the message requires high availability and fault tolerance.

[0067] S3: Use the adaptive protocol parsing engine to parse the stored messages, conduct in-depth mining of the parsed message content, extract key information to build a device operation status model, and use the mining results to perform device maintenance and fault diagnosis.

[0068] Furthermore, the message parsing includes parsing the stored messages using an adaptive protocol parsing engine and deeply mining the content of the parsed messages.

[0069] The adaptive protocol parsing includes starting the adaptive protocol parsing engine and initializing the engine, capturing and preprocessing stored messages in real time, and performing protocol identification on the preprocessed messages. Based on the identified protocol type and applying parsing rules, the fields and data in the messages are extracted.

[0070] Furthermore, the construction of the equipment operation status model includes establishing a dynamic model of the equipment operation status based on the extracted key information, combining time series analysis, cluster analysis and machine learning, and comparing it with actual operation data through cross-validation.

[0071] The equipment maintenance and fault diagnosis include predicting maintenance needs and time points based on the equipment operation status model, and formulating a preventive maintenance plan. When an abnormal pattern is detected, the system automatically triggers the fault diagnosis process, analyzes the cause of the fault, and provides repair suggestions. It also adjusts and optimizes the protocol parsing rules and mining algorithms through actual operation data and user feedback, and regularly updates the equipment operation status model.

[0072] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0073] Example 2, reference Figure 3 , which is the second embodiment of the present invention, provides a multi-protocol communication message recording and storage system for substation secondary equipment, including a message capture and preliminary identification module 100, a message preprocessing module 200, a real-time traffic analysis module 300, a dynamic storage adjustment module 400 and an adaptive protocol parsing module 500.

[0074] The message capture and preliminary identification module 100 is used to use network data packet capture technology and a serial communication interface to capture communication messages of the network port and the serial port in real time, and to perform preliminary identification on the messages.

[0075] The message pre-processing module 200 is used to remove irrelevant information in the message and convert the cleaned message into a unified format.

[0076] The real-time traffic analysis module 300 is used to calculate the number of packets and the traffic volume within a specified time window, identify abnormal traffic patterns using an anomaly detection algorithm, and mark security threats.

[0077] The dynamic storage adjustment module 400 is used to extract key information based on the content, size and type of the message, and to count the access frequency to determine the priority of the message. It is also used to dynamically adjust the storage format and location based on the feature score and access frequency of the message.

[0078] The adaptive protocol parsing module 500 is used to parse the stored messages using the adaptive protocol parsing engine, identify the fields and data in the messages, perform in-depth analysis on the parsed message content, extract key information, build a device operation status model, and regularly maintain the device.

[0079] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0080] Embodiment 3, the third embodiment of the present invention, is different from the first two embodiments in that:

[0081] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0082] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0083] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0084] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

Claims

1. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation, characterized in that: include, Capture network and serial port communication messages in real time, automatically identify messages, distinguish different message types, and pre-process messages; Perform real-time traffic analysis on pre-processed messages, identify abnormal traffic patterns and mark security threats, use the analysis results to match message storage strategies, dynamically adjust message storage formats and locations based on message characteristics and access frequency, and store messages in dispersed locations on various nodes; The adaptive protocol parsing engine is used to parse the stored messages, deeply mine the parsed message content, extract key information to build a device operation status model, and use the mining results to perform equipment maintenance and fault diagnosis.

2. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation according to claim 1, characterized in that: The real-time capture includes using network data packet capture technology to capture network port communication messages in real time, and capturing serial port communication messages in real time through a serial port communication interface, and automatically performing preliminary identification on the messages; The preliminary identification includes using a deep learning model to classify the captured messages, distinguish between configuration messages, control messages and monitoring messages, and extract features from the messages; the extracted features include message length, protocol type and destination address.

3. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation according to claim 2, characterized in that: The preprocessing includes distinguishing different types of messages and performing data cleaning and data standardization on the messages; The data normalization formula is: P std =h(P clean ,φ) Among them, P std is the standardized message, P clean is the cleaned message, h is the normalization function, and φ is the normalization parameter.

4. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation as claimed in claim 3, characterized in that: The real-time traffic analysis includes performing real-time traffic analysis on the pre-processed messages, identifying abnormal traffic patterns and marking security threats, and matching the message storage strategy using the analysis results; The real-time traffic analysis includes traffic statistics, abnormal traffic detection and security threat marking; the traffic statistics include traffic statistics of pre-processed messages, calculating the number of messages and traffic size within a specified time window; the abnormal traffic detection includes using an abnormal detection algorithm to identify abnormal traffic patterns, and marking the detected abnormal traffic patterns; The anomaly detection algorithm is: Among them, Z(P i ) is the abnormal detection value, P i is the original message, μ is the average value of normal traffic, σ is the standard deviation; set the anomaly detection threshold Z th , when Z(P i )>Z th When a security threat is detected, it is determined to exist and a security threat mark is performed; When Z(P i )≤Z th When the device is detected, it is judged as no security threat and does not need to be marked.

5. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation as claimed in claim 4, characterized in that: The matching message storage strategy includes extracting key information according to the content, size and type of the message, counting the access frequency of each message, determining the priority, and dynamically adjusting the storage format and location according to the characteristics and access frequency of the message, and dispersing the message in each node; The dynamic adjustment of storage format and location includes analyzing the protocol type, content sensitivity, data size and priority label of the message, and quantifying each feature through a weight factor to form a comprehensive feature score. When the feature score and access frequency of the message exceed the set threshold, different storage strategies will be matched.

6. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation as claimed in claim 5, characterized in that: The message parsing includes parsing the stored messages using an adaptive protocol parsing engine and deeply mining the parsed message content; The adaptive protocol parsing includes starting the adaptive protocol parsing engine and initializing the engine, capturing and preprocessing the stored messages in real time, and performing protocol identification on the preprocessed messages, and extracting fields and data in the messages based on the identified protocol type and applying parsing rules.

7. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation as claimed in claim 6, characterized in that: The construction of the equipment operation status model includes, based on the extracted key information, combining time series analysis, cluster analysis and machine learning, establishing a dynamic model of the equipment operation status, and comparing it with actual operation data through cross-validation; The equipment maintenance and fault diagnosis include predicting maintenance needs and time points based on the equipment operation status model, and formulating a preventive maintenance plan. When an abnormal pattern is detected, the system automatically triggers the fault diagnosis process, analyzes the cause of the fault, and provides repair suggestions. Through actual operation data and user feedback, the protocol parsing rules and mining algorithms are adjusted and optimized, and the equipment operation status model is updated regularly.

8. A system using a method for recording and storing multi-protocol communication messages of a substation secondary device according to any one of claims 1 to 7, characterized in that: It includes a message capture and preliminary identification module, a message preprocessing module, a real-time traffic analysis module, a dynamic storage adjustment module, and an adaptive protocol analysis module; The message capture and preliminary identification module is used to use network data packet capture technology and serial communication interface to capture network port and serial port communication messages in real time and perform preliminary identification on the messages; The message preprocessing module is used to remove irrelevant information in the message and convert the cleaned message into a unified format; The real-time traffic analysis module is used to calculate the number of messages and traffic size within a specified time window, identify abnormal traffic patterns using anomaly detection algorithms, and mark security threats; The dynamic storage adjustment module is used to extract key information according to the content, size and type of the message, and count the access frequency to determine the priority of the message, and dynamically adjust the storage format and location according to the feature score and access frequency of the message; The adaptive protocol parsing module is used to parse the stored messages using the adaptive protocol parsing engine, identify the fields and data in the messages, perform in-depth analysis on the parsed message content, extract key information, build a device operation status model, and regularly maintain the device.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a method for recording and storing multi-protocol communication messages of a substation secondary device as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a method for recording and storing multi-protocol communication messages of a substation secondary device according to any one of claims 1 to 7 are implemented.

Images