A substation secondary equipment multi-protocol communication message recording and storing method and system

Abstract

The application discloses a kind of substation secondary equipment multi-protocol communication message recording storage method and system, it is related to power system communication technical field, including real-time capture network interface and serial port communication message, and automatically preliminary identification is carried out to message, and message is preprocessed, real-time flow analysis is carried out, abnormal flow mode is identified and marked security threat, utilize analysis result matching message storage strategy, according to message feature and access frequency, dynamically adjust message storage format and position, and message is dispersed and stored in each node, utilize adaptive protocol analysis engine to the message stored is parsed, extract key information and construct equipment operating state model, and utilize mining result and carry out equipment maintenance and fault diagnosis.The application improves the efficiency and safety performance of substation secondary equipment communication message processing, while enhancing the intelligent maintenance and fault diagnosis capability of system, provides strong technical guarantee for the stable operation of power system.

Description

Technical Field

[0001] The present invention relates to the technical field of power system communications, and in particular to a method and system for recording and storing multi-protocol communication messages of secondary equipment in a transformer substation. Background Art

[0002] As power systems continue to become more complex and automated, substation secondary equipment plays an increasingly prominent role in power system monitoring and communication. These devices exchange data using a variety of communication protocols to enable real-time monitoring and effective management of the power grid. However, existing technologies for recording and storing communication messages for substation secondary equipment face development bottlenecks. Traditional message recording and storage methods often rely on fixed storage formats and locations, lacking dynamic adaptability to message characteristics and access frequency, which limits system flexibility and efficiency.

[0003] Currently, although some technologies are capable of capturing and storing communication messages in real time, these technologies have shortcomings in message preprocessing, traffic analysis, storage policy adjustment, and protocol parsing. For example, existing technologies often cannot effectively distinguish between different types of messages, resulting in an inability to optimize message storage based on the characteristics and importance of the messages. In addition, there is a lack of efficient methods for identifying abnormal traffic patterns and marking security threats, which affects the security of message storage and the reliability of the system. At the same time, existing message parsing technologies are often unable to perform adaptive parsing in multi-protocol environments, resulting in an inability to fully utilize key information in messages during equipment maintenance and fault diagnosis. These shortcomings indicate that existing technologies need further improvement to adapt to the complex needs of substation secondary equipment in multi-protocol communication environments.

[0004] The method for recording and storing multi-protocol communication messages of substation secondary equipment proposed in this invention has emerged precisely under such a technical background. It aims to improve the intelligence level and efficiency of communication message processing of substation secondary equipment through innovative message capture, preprocessing, flow analysis, dynamic storage adjustment and adaptive protocol parsing technologies, thereby providing more solid technical support for the stable operation of the power system. Summary of the Invention

[0005] In view of the above existing problems, the present invention provides a method and system for recording and storing multi-protocol communication messages of substation secondary equipment, so as to solve the problems of low intelligence level and efficiency of substation secondary equipment communication message processing in the prior art.

[0006] In order to solve the above technical problems, a method for recording and storing multi-protocol communication messages of substation secondary equipment is proposed, including:

[0007] It captures network and serial port communication messages in real time, automatically performs preliminary identification on the messages, distinguishes different message types, and pre-processes the messages; performs real-time traffic analysis on the pre-processed messages, identifies abnormal traffic patterns and marks security threats, uses the analysis results to match the message storage strategy, dynamically adjusts the message storage format and location according to the message characteristics and access frequency, and stores the messages in various nodes in a dispersed manner; uses the adaptive protocol parsing engine to parse the stored messages, deeply mines the parsed message content, extracts key information to build a device operation status model, and uses the mining results to perform equipment maintenance and fault diagnosis.

[0008] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the real-time capture includes using network data packet capture technology to capture network port communication messages in real time, and capturing serial port communication messages in real time through a serial port communication interface, and automatically performing preliminary identification of the messages.

[0009] The preliminary identification includes using a deep learning model to classify the captured messages, distinguish between configuration messages, control messages and monitoring messages, and extract features from the messages; the extracted features include message length, protocol type and destination address.

[0010] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the preprocessing includes distinguishing different types of messages and performing data cleaning and data standardization on the messages.

[0011] The data cleaning formula is:

[0012] P clcan =g(P i ,θ)

[0013] Among them, P clean is the cleaned message, g is the cleaning function, P i is the original message, and θ is the cleaning parameter.

[0014] The data normalization formula is:

[0015] P std =h(P clean ,φ)

[0016] Among them, P std is the standardized message, P clean is the cleaned message, h is the normalization function, and φ is the normalization parameter.

[0017] As a preferred scheme of the substation secondary equipment multi-protocol communication message record storage method, the real-time traffic analysis comprises real-time traffic analysis on the preprocessed messages, identification of abnormal traffic patterns and marking of security threats, and matching of message storage strategies by using analysis results.

[0018] The real-time traffic analysis comprises traffic statistics, abnormal traffic detection and security threat marking; the traffic statistics comprises traffic statistics on the preprocessed messages, calculation of the number and size of messages within a specified time window; the abnormal traffic detection comprises identification of abnormal traffic patterns by using an abnormality detection algorithm, and marking of the detected abnormal traffic patterns.

[0019] The abnormality detection algorithm is as follows:

[0020]

[0021] wherein Z(P i ) is an abnormality detection value, P i is an original message, μ is an average value of normal traffic, and σ is a standard deviation; an abnormality detection threshold Z th is set; when Z(P i )>Z th , it is determined that there is a security threat, and security threat marking is performed; when Z(P i )≤Z th , it is determined that there is no security threat, and marking is not needed.

[0022] As a preferred scheme of the substation secondary equipment multi-protocol communication message record storage method, the matching of message storage strategies comprises extraction of key information according to the content, size and type of the messages, statistics of the access frequency of each message, determination of the priority, dynamic adjustment of the storage format and position according to the characteristics and access frequency of the messages, and dispersed storage of the messages in each node.

[0023] The dynamic adjustment of the storage format and position comprises analysis of the protocol type, content sensitivity, data size and priority label of the messages, quantification of each characteristic by using a weight factor to form a comprehensive characteristic score, and matching of different storage strategies when the characteristic score and access frequency of the messages exceed a set threshold.

[0024] As a preferred scheme of the substation secondary equipment multi-protocol communication message record storage method, the message analysis comprises analysis of the stored messages by using an adaptive protocol analysis engine, and deep mining of the contents of the analyzed messages.

[0025] The adaptive protocol parsing includes starting the adaptive protocol parsing engine and initializing the engine, capturing and preprocessing stored messages in real time, and performing protocol identification on the preprocessed messages. Based on the identified protocol type and applying parsing rules, the fields and data in the messages are extracted.

[0026] As a preferred solution of the method for recording and storing multi-protocol communication messages of substation secondary equipment described in the present invention, the construction of the equipment operation status model includes establishing a dynamic model of the equipment operation status based on the extracted key information, combined with time series analysis, cluster analysis and machine learning, and comparing it with actual operation data through cross-validation.

[0027] The equipment maintenance and fault diagnosis include predicting maintenance needs and time points based on the equipment operation status model, and formulating a preventive maintenance plan. When an abnormal pattern is detected, the system automatically triggers the fault diagnosis process, analyzes the cause of the fault, and provides repair suggestions. It also adjusts and optimizes the protocol parsing rules and mining algorithms through actual operation data and user feedback, and regularly updates the equipment operation status model.

[0028] As a preferred solution of the multi-protocol communication message recording and storage system for substation secondary equipment described in the present invention, it is characterized by including a message capture and preliminary identification module, a message preprocessing module, a real-time traffic analysis module, a dynamic storage adjustment module and an adaptive protocol parsing module.

[0029] The message capture and preliminary identification module is used to use network data packet capture technology and a serial communication interface to capture communication messages of the network port and the serial port in real time, and to perform preliminary identification on the messages.

[0030] The message preprocessing module is used to remove irrelevant information in the message and convert the cleaned message into a unified format.

[0031] The real-time traffic analysis module is used to calculate the number of messages and traffic volume within a specified time window, use anomaly detection algorithms to identify abnormal traffic patterns, and mark security threats.

[0032] The dynamic storage adjustment module is used to extract key information based on the content, size and type of the message, and to count the access frequency to determine the priority of the message. It is also used to dynamically adjust the storage format and location based on the feature score and access frequency of the message.

[0033] The adaptive protocol parsing module is used to parse the stored messages using the adaptive protocol parsing engine, identify the fields and data in the messages, perform in-depth analysis on the parsed message content, extract key information, build a device operation status model, and regularly maintain the equipment.

[0034] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, it implements the steps of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation.

[0035] A computer-readable storage medium stores a computer program thereon, wherein when the computer program is executed by a processor, the computer program implements the steps of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation.

[0036] Beneficial effects of the present invention: The present invention captures network port and serial port communication messages in real time and automatically performs preliminary identification and preprocessing, thereby ensuring comprehensive capture and rapid classification of messages, reducing false alarms and missed alarms, improving system response speed, and laying the foundation for in-depth analysis; performing real-time traffic analysis on preprocessed messages, effectively identifying abnormal traffic patterns and security threats, improving system security, reducing the risk of data loss and system interruption, and providing support for storage strategy optimization; dynamically adjusting storage format and location according to message characteristics and access frequency, realizing reasonable allocation and optimization of storage resources, improving the scalability and fault tolerance of the system, and facilitating rapid data recovery and backup; utilizing an adaptive protocol parsing engine to deeply mine stored messages, extract key information, and construct an equipment operation status model, thereby enhancing the accuracy of equipment status monitoring and providing data support for maintenance and fault diagnosis; predicting maintenance needs based on the equipment operation status model, formulating a preventive maintenance plan, and automatically triggering the fault diagnosis process, thereby realizing the predictability and initiative of equipment maintenance, extending equipment life, reducing maintenance costs, and further improving the stability and reliability of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive efforts. Among them:

[0038] Figure 1 The present invention provides an overall flow chart of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation according to an embodiment of the present invention.

[0039] Figure 2 A message storage diagram of a method for recording and storing multi-protocol communication messages of secondary equipment in a substation provided by an embodiment of the present invention.

[0040] Figure 3A system solution flow chart of a multi-protocol communication message recording and storage system for substation secondary equipment provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0042] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0043] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it individually or selectively refer to an embodiment that is mutually exclusive of other embodiments.

[0044] The present invention is described in detail with reference to schematic diagrams. For ease of illustration, cross-sectional views of device structures may be partially enlarged and not to scale when describing embodiments of the present invention. Furthermore, the schematic diagrams are merely illustrative and should not limit the scope of the present invention. Furthermore, in actual production, the three-dimensional dimensions of length, width, and depth should be included.

[0045] In the description of the present invention, it should be noted that the terms "upper, lower, inner, and outer" and other references to orientations or positional relationships are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first, second, or third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0046] In this disclosure, unless otherwise specified or limited, the terms "mounted," "connected," and "connected" should be interpreted broadly. For example, they may refer to fixed, removable, or integral connections. They may also refer to mechanical, electrical, or direct connections, indirect connections through an intermediary, or internal communication between two components. Those skilled in the art will understand the specific meanings of these terms in this disclosure.

[0047] Example 1, with reference to Figure 1 and Figure 2 , which is the first embodiment of the present invention, provides a method for recording and storing multi-protocol communication messages of a substation secondary device, comprising:

[0048] S1: Capture network and serial port communication messages in real time, automatically perform preliminary identification on the messages, distinguish different message types, and pre-process the messages.

[0049] The real-time capture includes capturing network port communication messages in real time using network data packet capture technology, capturing serial port communication messages in real time through a serial port communication interface, and automatically performing preliminary identification on the messages.

[0050] The preliminary identification includes using a deep learning model to classify the captured messages, distinguish between configuration messages, control messages and monitoring messages, and extract features from the messages; the extracted features include message length, protocol type and destination address.

[0051] The preprocessing includes distinguishing different types of messages and performing data cleaning and data standardization on the messages.

[0052] The data cleaning formula is:

[0053] P clcan =g(P i ,θ)

[0054] Among them, P clean is the cleaned message, g is the cleaning function, P i is the original message, and θ is the cleaning parameter.

[0055] The data normalization formula is:

[0056] P std =h(P clean ,φ)

[0057] Among them, P std is the standardized message, P clean is the cleaned message, h is the normalization function, and φ is the normalization parameter.

[0058] S2: Performs real-time traffic analysis on pre-processed messages, identifies abnormal traffic patterns and marks security threats, uses the analysis results to match message storage policies, dynamically adjusts message storage format and location based on message characteristics and access frequency, and distributes message storage across nodes.

[0059] Furthermore, the real-time traffic analysis includes performing real-time traffic analysis on the pre-processed messages, identifying abnormal traffic patterns and marking security threats, and matching message storage policies using the analysis results.

[0060] The real-time traffic analysis includes traffic statistics, abnormal traffic detection and security threat marking; the traffic statistics include traffic statistics of pre-processed messages, calculating the number of messages and traffic size within a specified time window; the abnormal traffic detection includes using an anomaly detection algorithm to identify abnormal traffic patterns and marking the detected abnormal traffic patterns.

[0061] The anomaly detection algorithm is:

[0062]

[0063] Among them, Z(P i ) is the abnormal detection value, P i is the original message, μ is the average value of normal traffic, σ is the standard deviation; set the anomaly detection threshold Z th , when Z(P i )>Z th When Z(P i )≤Z th When it is determined that there is no security threat, no marking is required.

[0064] like Figure 2 ,The matching message storage strategy includes ,extracting key information based on the content, size and type of the message, ,and statistics on the access frequency of each message, determining the priority, ,and dynamically adjusting the storage format and location based on the ,characteristics and access frequency of the message, and distributing the ,messages in each node.

[0065] The dynamic adjustment of storage format and location includes analyzing the protocol type, content sensitivity, data size and priority tag of the message, and quantifying each feature through a weight factor to form a comprehensive feature score. When the feature score and access frequency of the message exceed the set threshold, different storage strategies will be matched.

[0066] The matching of different storage strategies includes matching the high-priority storage strategy when the message content is highly sensitive, the data is small, and the priority tag is high; matching the secure encryption storage strategy when the message content contains sensitive information; matching the large data volume storage strategy when the message data volume is large but high-speed access is not required; matching the frequency optimization storage strategy when the message access frequency is high but the data size and sensitivity are average; matching the archive storage strategy when the message content is not frequently accessed but needs to be stored for a long time; matching the distributed storage strategy when the message requires high availability and fault tolerance.

[0067] S3: Utilizing the adaptive protocol analysis engine to parse the stored messages, deeply mining the parsed message content, extracting key information to construct a device operation state model, and using the mining results for device maintenance and fault diagnosis.

[0068] Further, the message parsing includes utilizing the adaptive protocol analysis engine to parse the stored messages, and deeply mining the parsed message content.

[0069] The adaptive protocol analysis includes starting the adaptive protocol analysis engine, initializing the engine, real-time capturing and preprocessing the stored messages, and performing protocol identification on the preprocessed messages, extracting fields and data in the messages according to the identified protocol type and applying the analysis rules.

[0070] Further, the construction of the device operation state model includes establishing a dynamic model of the device operation state based on the extracted key information, combining time series analysis, clustering analysis and machine learning, and comparing through cross-validation and actual operation data.

[0071] The device maintenance and fault diagnosis includes predicting maintenance requirements and time points according to the device operation state model, formulating a preventive maintenance plan, automatically triggering a fault diagnosis process when an abnormal pattern is monitored, analyzing the fault cause and providing repair suggestions, and adjusting and optimizing the protocol analysis rules and mining algorithms through actual operation data and user feedback, and regularly updating the device operation state model.

[0072] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and they should be covered in the scope of the claims of the present application.

[0073] Embodiment 2, refer to Figure 3 As a second embodiment of the present application, the embodiment provides a substation secondary equipment multi-protocol communication message recording and storage system, which includes a message capture and preliminary identification module 100, a message preprocessing module 200, a real-time traffic analysis module 300, a dynamic storage adjustment module 400 and an adaptive protocol analysis module 500.

[0074] The message capture and preliminary identification module 100 is used to capture the communication messages of network interfaces and serial ports in real time by using network packet capture technology and serial communication interfaces, and to perform preliminary identification on the messages.

[0075] The message preprocessing module 200 is used to remove irrelevant information in the messages, and to convert the cleaned messages into a unified format.

[0076] The real-time traffic analysis module 300 is used to calculate the number of packets and the traffic volume within a specified time window, identify abnormal traffic patterns using an anomaly detection algorithm, and mark security threats.

[0077] The dynamic storage adjustment module 400 is used to extract key information based on the content, size and type of the message, and to count the access frequency to determine the priority of the message. It is also used to dynamically adjust the storage format and location based on the feature score and access frequency of the message.

[0078] The adaptive protocol parsing module 500 is used to parse the stored messages using the adaptive protocol parsing engine, identify the fields and data in the messages, perform in-depth analysis on the parsed message content, extract key information, build a device operation status model, and regularly maintain the device.

[0079] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0080] Embodiment 3, the third embodiment of the present invention, is different from the first two embodiments in that:

[0081] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0082] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0083] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0084] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

Claims

1. A method for recording and storing multi-protocol communication messages of secondary equipment in a substation, characterized by: include, Capture network and serial port communication messages in real time, automatically perform preliminary identification on the messages, distinguish different message types, and pre-process the messages; Perform real-time traffic analysis on pre-processed packets to identify abnormal traffic patterns and flag security threats. The analysis results are used to match packet storage policies. Based on packet characteristics and access frequency, the packet storage format and location are dynamically adjusted, and packets are stored dispersedly across nodes. Utilizes an adaptive protocol parsing engine to parse stored messages, conducts in-depth mining of the parsed message content, extracts key information to build a device operating status model, and uses the mining results for device maintenance and fault diagnosis. The construction of the equipment operation status model includes establishing a dynamic model of the equipment operation status based on the extracted key information, combining time series analysis, cluster analysis and machine learning, and comparing it with actual operation data through cross-validation; The equipment maintenance and fault diagnosis include predicting maintenance needs and time points based on the equipment operation status model, and formulating a preventive maintenance plan. When an abnormal pattern is detected, the system automatically triggers the fault diagnosis process, analyzes the cause of the fault, and provides repair suggestions. It also adjusts and optimizes the protocol parsing rules and mining algorithms through actual operation data and user feedback, and regularly updates the equipment operation status model.

2. A method for recording and storing multi-protocol communication messages of a substation secondary device according to claim 1, characterized in that: The real-time capture includes using network data packet capture technology to capture network port communication messages in real time, and capturing serial port communication messages in real time through a serial port communication interface, and automatically performing preliminary identification on the messages; The preliminary identification includes using a deep learning model to classify the captured messages, distinguish between configuration messages, control messages and monitoring messages, and extract features from the messages; the extracted features include message length, protocol type and destination address.

3. A method for recording and storing multi-protocol communication messages of a substation secondary device according to claim 2, characterized in that: The pre-processing includes distinguishing different types of messages and performing data cleaning and data standardization on the messages; The data normalization formula is: P std =h(P clean ,φ) Among them, P std is the standardized message, P clean is the cleaned message, h is the normalization function, and φ is the normalization parameter.

4. A method for recording and storing multi-protocol communication messages of a substation secondary device according to claim 3, characterized in that: The real-time traffic analysis includes performing real-time traffic analysis on pre-processed messages, identifying abnormal traffic patterns and marking security threats, and using the analysis results to match message storage policies; The real-time traffic analysis includes traffic statistics, abnormal traffic detection and security threat marking; the traffic statistics include performing traffic statistics on pre-processed messages and calculating the number of messages and traffic volume within a specified time window; the abnormal traffic detection includes using an anomaly detection algorithm to identify abnormal traffic patterns and marking the detected abnormal traffic patterns; The anomaly detection algorithm is: Among them, Z(P i ) is the abnormal detection value, P i is the original message, μ is the average value of normal traffic, σ is the standard deviation; set the anomaly detection threshold Z th , when Z(P i )>Z th When a security threat occurs, it is determined to exist and a security threat mark is performed; When Z(P i )≤Z th When it is determined that there is no security threat, no marking is required.

5. A method for recording and storing multi-protocol communication messages of a substation secondary device according to claim 4, characterized in that: The matching message storage strategy includes extracting key information based on the content, size and type of the message, counting the access frequency of each message, determining the priority, and dynamically adjusting the storage format and location based on the characteristics and access frequency of the message, and distributing the message storage in each node; The dynamic adjustment of storage format and location includes analyzing the protocol type, content sensitivity, data size and priority tag of the message, and quantifying each feature through a weight factor to form a comprehensive feature score. When the feature score and access frequency of the message exceed the set threshold, different storage strategies will be matched.

6. A method for recording and storing multi-protocol communication messages of a substation secondary device according to claim 5, characterized in that: The message parsing includes parsing the stored messages using an adaptive protocol parsing engine and deeply mining the parsed message content; The adaptive protocol parsing includes starting the adaptive protocol parsing engine and initializing the engine, capturing and preprocessing stored messages in real time, and performing protocol identification on the preprocessed messages. Based on the identified protocol type and applying parsing rules, the fields and data in the messages are extracted.

7. A system using the method for recording and storing multi-protocol communication messages of substation secondary equipment according to any one of claims 1 to 6, characterized in that: It includes message capture and preliminary identification module, message preprocessing module, real-time traffic analysis module, dynamic storage adjustment module and adaptive protocol analysis module; The message capture and preliminary identification module is used to use network data packet capture technology and serial communication interface to capture network port and serial port communication messages in real time and perform preliminary identification on the messages; The message preprocessing module is used to remove irrelevant information in the message and convert the cleaned message into a unified format; The real-time traffic analysis module is used to calculate the number of messages and traffic volume within a specified time window, use anomaly detection algorithms to identify abnormal traffic patterns, and mark security threats; The dynamic storage adjustment module is used to extract key information based on the content, size and type of the message, and to count the access frequency to determine the priority of the message. The storage format and location are dynamically adjusted according to the feature score and access frequency of the message; The adaptive protocol parsing module is used to parse the stored messages using the adaptive protocol parsing engine, identify the fields and data in the messages, perform in-depth analysis on the parsed message content, extract key information, build a device operation status model, and regularly maintain the equipment.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for recording and storing multi-protocol communication messages of substation secondary equipment according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a method for recording and storing multi-protocol communication messages of a substation secondary device according to any one of claims 1 to 6 are implemented.

Images