Method, device and medium for identifying asset type and manufacturer in power system

Abstract

The present application discloses a method, device and storage medium for identifying asset types and manufacturers in power systems, including: obtaining device communication flow data, parsing and extracting the device communication flow data, and obtaining seven-tuple information of each message; obtaining the payload of the message by parsing the protocol content in the seven-tuple information of each message, pre-processing the acquired payload, and obtaining the first sample data of each message; using the device type and manufacturer preset mapping table to associate and map the first sample data of the message, and obtain the second sample data of the message; combining the second sample data of the message and using the BiLSTM algorithm to construct an identification model for the device type and manufacturer, and identifying the device type and manufacturer through the constructed identification model. Therefore, the present invention is not only more versatile; but also can adapt to different scenarios and achieve higher recognition coverage and accuracy.

Description

Technical Field

[0001] The present application relates to the technical field of network asset identification, and in particular to a method, device and medium for identifying asset types and manufacturers in a power system. Background Art

[0002] With the continuous development of big data and artificial intelligence technologies, as well as the diversification and intelligence level of power system business, the identification of device asset types and manufacturers has become increasingly important. As a key component of power system operations, asset management decisions directly affect key indicators such as dispatch decisions and power supply reliability. By obtaining asset parameter information, transmission system operators can solve two key problems: how to maximize the life cycle of assets, and how to reasonably arrange various asset management operations, especially assets that require shutdown operations.

[0003] At present, in the field of industrial control, asset identification methods are mainly divided into two types: active and passive:

[0004] 1) Active method: Obtain asset information and identify it by actively scanning the network system. Currently, the more mature active identification tools include Nmap, Nessus, OpenVAS, etc. Active fingerprint recognition technology aims to comprehensively collect asset fingerprint feature information, but it may cause network congestion, especially in large-scale power monitoring systems, which may overload devices such as PLCs, thereby affecting the response to normal requests. In addition, power system equipment usually has a long life cycle, and information on old equipment is often difficult to obtain through third parties. Moreover, asset management and maintenance may be performed by outsourced personnel, who may not be able to provide accurate information, or the information provided may be erroneous, thereby reducing the feasibility of implementation.

[0005] 2) Passive method: Minimize interference to the network and monitor the network to obtain information. At present, there are some mature passive identification tools, such as Ettercap, P0f, Satori and NetworkMiner. The passive method is based on the TCP / IP protocol stack and is identified by analyzing the session channel information. However, the information collected by this method is relatively limited, and it is difficult to obtain comprehensive asset fingerprints and detailed information, resulting in a low recognition rate. In addition, the existing method based on the DL / T1873 standard in smart substations combs through the device naming specifications in the protocol and matches them with specific strings in the flow data to identify the type of device assets, such as measurement and control devices and protection devices. In actual applications, many devices are not named strictly in accordance with the protocol, especially non-intelligent substation protocols are usually private protocols of each manufacturer, lacking unified and standardized research, resulting in low recognition coverage. Therefore, both the coverage and recognition rates are relatively low.

[0006] Whether based on active or passive detection methods, they are imperfect for power system applications and cannot meet the business needs of users. Therefore, technicians in this field are in urgent need of an asset type and manufacturer identification method, equipment and medium for power systems to solve the technical problem that the existing methods are highly dependent on protocols and private communication protocol standards provided by various equipment manufacturers, resulting in complex matching rules and low identification coverage. Summary of the invention

[0007] The purpose of this application is to provide a method, device and medium for identifying asset types and manufacturers in power systems, so as to solve the technical problems that the existing methods are highly dependent on specifications and private communication protocol standards provided by various equipment manufacturers, resulting in complex matching rules and low identification coverage.

[0008] To solve the above technical problems, the present application provides a method for identifying asset types and manufacturers in a power system, which includes:

[0009] Acquire device communication flow data, parse and extract the device communication flow data, and obtain seven-tuple information of each message; wherein the seven-tuple information includes source IP, source port, destination IP, destination port, source MAC, destination MAC, and protocol;

[0010] Obtaining the payload of the message by parsing the protocol content in the seven-tuple information of each message, and preprocessing the acquired payload to obtain first sample data of each message;

[0011] Using the device type and the manufacturer preset mapping table to associate and map the first sample data of the message to obtain the second sample data of the message;

[0012] The second sample data of the message is combined with the BiLSTM algorithm to construct an identification model for the device type and manufacturer, and the device type and manufacturer are identified in real time through the constructed identification model.

[0013] Preferably, the device communication network traffic data is obtained, and the device communication network traffic data is parsed and extracted to obtain the specific content of the seven-tuple information of each message:

[0014] Use bypass deployment to collect traffic data from the core switch ports of the plant or main station to obtain device communication data;

[0015] The acquired device communication data is subjected to deep message analysis, and the seven-tuple information of each message is extracted according to the principle of the same source IP to the same destination IP.

[0016] Preferably, the payload of the message is obtained by parsing the protocol content in the seven-tuple information of each message, and the obtained payload is preprocessed to obtain the specific content of the first sample data of each message:

[0017] Parse the protocol content in the seven-tuple information of each message and obtain the payload of the message;

[0018] Convert the payload of each obtained message into a hexadecimal string;

[0019] Mapping the numerical value in the hexadecimal string into letters using a coding rule so that the hexadecimal string is in letter form;

[0020] The character string is split according to the length L using space characters, and the first sample data of each message is output, wherein the first sample data includes the source IP, source port, destination IP, destination port, source MAC, destination MAC, protocol and a character string set of length L.

[0021] Preferably, the device type and the manufacturer preset mapping table are used to associate and map the first sample data of the message, and the specific content of the second sample data of the message is obtained as follows:

[0022] Combine the substation SCD file and asset ledger data to obtain the equipment type and manufacturer corresponding to each device in the production environment, and output the equipment type and manufacturer preset mapping table corresponding to each device;

[0023] Firstly, the first sample data of each message is associated with the device type and manufacturer preset mapping table corresponding to each device, and then the device type and manufacturer are mapped for the string set of length L in the first sample data of the message, so as to obtain the second sample data of each message.

[0024] Preferably, the specific content of combining the second sample data of the message and using the BiLSTM algorithm to construct an identification model for the device type and manufacturer is:

[0025] Dividing the second sample data of the message into a training set, a validation set and a test set according to a preset ratio;

[0026] The training set is input into the network structure built by BiLSTM to train the recognition model, and the recognition model performance is regularly evaluated on the validation set;

[0027] When the detection accuracy of the trained recognition model evaluated by the test set reaches a preset threshold, the recognition model training is completed and the current recognition model is output.

[0028] Preferably, the specific content of identifying the device type and manufacturer through the constructed recognition model is: preprocessing the real-time collected device communication traffic data to generate data in the same format as the first sample data; using the current recognition model to infer the data in the same format as the first sample data to identify the device type and manufacturer corresponding to the real-time collected device communication traffic data.

[0029] Preferably, the protocol in the seven-tuple information of each message is the MMS protocol or the 103 protocol.

[0030] Preferably, the method further includes acquiring second sample data of the new message at a preset specified time; optimizing the recognition model using the second sample data of the new message to obtain an optimized recognition model.

[0031] To solve the above technical problems, the present application also provides an asset type and manufacturer identification device for a power system, including:

[0032] Memory for storing computer programs;

[0033] A processor is used to implement the steps of the asset type and manufacturer identification method in the power system as described above when executing the computer program.

[0034] To solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the asset type and manufacturer identification method in the power system as described above are implemented.

[0035] The present application provides a method for identifying asset types and manufacturers in power systems, which includes: obtaining device communication flow data, parsing and extracting the device communication flow data, and obtaining seven-tuple information of each message; obtaining the payload of the message by parsing the protocol content in the seven-tuple information of each message, preprocessing the payload of the obtained message, and obtaining the first sample data of each message; using the device type and manufacturer preset mapping table to associate and map the first sample data of the message, and obtain the second sample data of each message; combining the second sample data of the message and using the BiLSTM algorithm to construct an identification model for the device type and manufacturer, and identifying the device type and manufacturer through the constructed identification model. This application can not only be used for the identification of intelligent stations, but also effectively support the identification of non-intelligent stations by parsing and extracting the device communication flow data, preprocessing the obtained message data, and combining the reuse of the same training algorithm model, so as to make it more versatile; and it can also provide comprehensive asset type data for algorithm learning, so that the model can adapt to different scenarios and achieve higher recognition coverage and accuracy.

[0036] The asset type and manufacturer identification device and computer-readable storage medium provided in this application for use in a power system correspond to the above method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 is a basic flow chart of the identification method of the present invention;

[0039] Figure 2 for Figure 1 A specific flow chart of step S200 described in;

[0040] Figure 3 for Figure 1 A specific flow chart of step S300 described in;

[0041] Figure 4 for Figure 1 A specific flow chart of part of the contents of step S400 described in;

[0042] Figure 5 for Figure 1 A specific flow chart of another part of the step S400;

[0043] Figure 6 A structural diagram of the identification device is provided for the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] The core of this application is to provide a method, device and medium for identifying asset types and manufacturers in a power system. In order to enable people in the technical field to better understand the application scheme, the application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0046] With the diversification and continuous improvement of the intelligence level of power system business, asset identification and classification in power systems have become particularly important. In the field of industrial control, active and passive methods are more common asset identification and classification methods. Specific brief description: (i) The active method is to collect information on asset fingerprint features as comprehensively as possible, but in actual applications, it may cause network congestion, especially in large-scale power systems, which may cause overload of devices such as PLCs, thereby affecting the response of normal requests. In addition, power grid equipment usually has a long life cycle, and the information of old equipment is difficult to be fully obtained by third parties. In addition, the personnel responsible for asset management and maintenance are often outsourced personnel, and the information they provide may be inaccurate or wrong. In addition, the heterogeneity of equipment and the existence of dedicated protocols make it difficult to fully develop active identification methods, thereby reducing its practicality. (ii) Passive methods, whether it is based on monitoring to obtain information based on the TCP / IP protocol stack, or by parsing the message content for key character matching, there is a problem of low recognition accuracy. For example: 1) When matching key characters based on message content parsing, the device naming in the actual production environment often does not fully follow the specifications, and the actual number of devices exceeds the specification definition, resulting in underreporting. In addition, if the device is not named according to the protocol, the matching result will not match the actual situation. 2) In the non-intelligent plant environment, each equipment manufacturer uses a private protocol, lacks a unified specification, and it is difficult to establish a comprehensive mapping rule. 3) Although network monitoring and analysis based on the TCP / IP protocol stack can collect session channel information, due to the TCP session characteristics caused by the long-term operation of the power monitoring system equipment, the collected information is relatively limited, and it is impossible to obtain comprehensive asset fingerprints and detailed information, which leads to low recognition rate and feasibility. Therefore, both active and passive detection methods are insufficient to meet the actual application needs of the power system.

[0047] Therefore, in order to solve the above problems, Figure 1 As shown, the present application provides a method for identifying asset types and manufacturers in a power system, including:

[0048] Step S100: Acquire device communication flow data, parse and extract the device communication flow data, and obtain seven-tuple information of each message, wherein the seven-tuple information includes source IP, source port, destination IP, destination port, source MAC, destination MAC, and protocol.

[0049] It should be noted that the specific contents of obtaining the device communication network traffic data, parsing and extracting the device communication network traffic data, and obtaining the seven-tuple information of each message are as follows: using a bypass deployment method to collect the traffic data of the core switch port of the plant station or the main station to obtain the device communication data; performing deep message parsing on the obtained device communication data, and extracting the seven-tuple information of each message according to the principle of the same source IP to the same destination IP.

[0050] Specifically, in the power monitoring system, a flow collection device is deployed in bypass mode to collect the communication network flow data of the core switching network port and capture the pcap / pcapng package. The pcap / pcapng flow packet header information is parsed to extract the seven-tuple (source IP, source port, destination IP, destination port, source MAC, destination MAC, protocol).

[0051] Step S200: Obtain the Payload of each message by parsing the protocol content in the seven-tuple information of each message, and pre-process the obtained Payload of each message to obtain the first sample data of each message.

[0052] It should be noted that in computer networks, "Payload" refers to the data portion of a packet that is actually transmitted. When data is sent over a network, it is usually divided into smaller units - packets, each of which contains a header, a trailer, and a payload in the middle. Payload: This is the actual content of the packet to be transmitted, that is, the data at the application layer. This part of the content is the actual information that the sender wants the receiver to receive, such as web page content, email text, part of a file, etc.

[0053] like Figure 2 As shown, in the embodiment of the present application, the Payload of the message is obtained by parsing the protocol content in the seven-tuple information of each message, and the Payload of the obtained message is preprocessed to obtain the specific content of the first sample data of each message:

[0054] Step S201: parse the protocol content in the seven-tuple information of each message and obtain the payload of the message.

[0055] In the embodiment of the present application, the protocol in the seven-tuple information of each message is the MMS protocol or the 103 protocol. Specifically, the protocol content is parsed to obtain the payload, specifically: 1) Intelligent station: parse the traffic based on the MMS protocol specification to extract the required message content and seven-tuple information. 2) Non-intelligent station: parse the traffic based on the 103 protocol specification defined by each manufacturer to extract the required message content and seven-tuple information.

[0056] Step S202: Convert the acquired Payload of each message into a string in hexadecimal format.

[0057] It should be noted that many devices in substations are not named strictly according to the regulations, especially non-intelligent station protocols are usually private protocols of each manufacturer, and there is a lack of unified specifications for research. Therefore, in order to ensure interoperability, this application converts the payload of each message into a hexadecimal string to facilitate the realization of a commonly recognized data representation.

[0058] Step S203: Encode the numerical value in the hexadecimal string using a coding rule so that the hexadecimal string is in letter form.

[0059] In an embodiment of the present application, the numerical value in the hexadecimal data is encoded by letters. The encoding rules or mapping rules can be used to convert the numbers into letters. For example, taking custom letter encoding as an example, see the following Table 1 for details.

[0060] Serial number Before processing the payload of the message After the payload of the message is processed (all letters) 1 030000ca02f080010001006181bc308169020 gjgbgifgogghggghggmhoighfcigoigjfogighghagoigjah 2 0300016302f08001000100618201543082015 gicogifgogghggghggnhohbajgohbngighgjagohbhajokda 3 030000ca02f080010001006181bc308169020 gjgpgifgogghggghggmhoigifaigoigifmgighgjagoighah 4 0300009e02f0800100010061819030818d020 gjgogifgogghggghggmhoigifpigoigiflgighgjagoifajh 5 030004c2020f08001000100618204b3308204a ggongifgogghggghggmhnajgnogighgiagnjajnhagmfa 6 524c2f59584747494f3424535424496e64313 ggomgifgogghggghggmhnpigmgighgiagniajngagmea 7 0300016302f08001000100618201543082015 ggongifgogghggghggmhnajgnogighgjagnjajnhagmfah 8 0300005f02f0800100010061523050020103 gigpgifgogghggghggmhoigifaigoigifmgighgjagoigjng 9 0300005f02f0800100010061523050020103 gigogifgogghggghggmhoigifpigoigiflgighgjagoigjni 10 0300005f02f0800100010061523050020103 gigggifgogghggghggmhoigifpigoigiflgighgjagoigjnj

[0061] Table 1 Comparison diagram of payload before and after processing

[0062] Step S204, use space characters to split the string according to length L, and output the first sample data of the current message, wherein the first sample data includes source IP, source port, destination IP, destination port, source MAC, destination MAC, protocol and a string set of length L.

[0063] Specifically, the pure letter string is segmented into words and sentences using a space character according to an appropriate length L, and the output is in a sentence-like form. In the embodiment of the present application, L is set to 8, as shown in Table 2 below, but a person skilled in the art can adaptively adjust L according to the actual application scenario. The first sample data obtained after parsing and preprocessing includes a source IP, a source port, a destination IP, a destination port, a source MAC, a destination MAC, a protocol, and a hexadecimal string set of length L.

[0064] Serial number Payload (a string of length L) 1 gjgbgifgogghggghggmhoighfcigoigjfogighghagoigjah 2 gicogifgogghggghggnhohbajgohbngighgjagohbhajokda 3 gjgpgifgogghggghggmhoigifaigoigifmgighgjagoighah 4 gjgogifgogghggghggmhoigifpigoigiflgighgjagoifajh 5 ggongifgogghggghggmhnajgnogighgiagnjajnhagmfa 6 ggomgifgogghggghggmhnpigmgighgiagniajngagmea 7 ggongifgogghggghggmhnajgnogighgjagnjajnhagmfah 8 gigpgifgogghggghggmhoigifaigoigifmgighgjagoigjng 9 gigogifgogghggghggmhoigifpigoigiflgighgjagoigjni 10 gigggifgogghggghggmhoigifpigoigiflgighgjagoigjnj

[0065] Table 2 Schematic diagram of the payload of the first sample data of the message

[0066] Step S300: Use the device type and the manufacturer preset mapping table to perform association mapping on the first sample data of the message to obtain the second sample data of the message.

[0067] like Figure 3 As shown, in the embodiment of the present application, the first sample data of the message is associated and mapped using the device type and the manufacturer preset mapping table, and the specific content of the second sample data of the message is obtained as follows:

[0068] Step S301: Combine the substation SCD file and asset ledger data to obtain the equipment type and manufacturer corresponding to each device in the production environment, and output the equipment type and manufacturer preset mapping table corresponding to each device.

[0069] It should be noted that in the network field, each device has its own unique identification information, such as device ID or unique identifier. In this application, the device identification information is device IP or device MAC, and the device IP is used as an example. First, collect the SCD file and asset ledger data information of the substation (including smart substation and non-smart substation), and then obtain the corresponding device type and manufacturer according to the device identification information, and output the device type and manufacturer preset mapping table corresponding to each IP according to a table similar to that shown in Table 3 below.

[0070]

[0071]

[0072] Table 3 (Part) Device type and manufacturer preset mapping table corresponding to device identification information

[0073] Step S302: firstly associate the first sample data of the message with the device type and manufacturer preset mapping table corresponding to each device identification information, and then map the device type and manufacturer for the string set of length L in the first sample data of the message, so as to obtain the second sample data of the message.

[0074] It should be specifically explained that the device type and manufacturer preset mapping table is used to search for records matching the device IP in the first sample data of the message; if a match is found, the first sample data of the message corresponding to the device IP is extracted, and then the device type and manufacturer preset mapping table is used to search for the device attributes corresponding to the string set of length L in the first sample data of the message, such as the device type (for example, integrated power supply, online status monitoring, measurement and control, etc.) and the manufacturer (such as: Xuji Electric, Beijing Sifang, etc.); then the found device type and manufacturer information are added to the first sample data to form the second sample data of the current message, as shown in Table 4 below.

[0075]

[0076] Table 4 Schematic diagram of the second sample data of the message

[0077] Step S400: Combine the second sample data of the message and use the BiLSTM algorithm to construct an identification model for the device type and manufacturer, and identify the device type and manufacturer in real time through the constructed identification model.

[0078] It should be noted that this application uses the BiLSTM algorithm (bidirectional long short-term memory network) to build a model to identify device types and manufacturers in real time, which requires multiple rounds of training. Figure 4 As shown, in the embodiment of the present application, the specific content of combining the second sample data of the device communication and using the BiLSTM algorithm to construct the identification model for the device type and manufacturer is:

[0079] Step S401: Divide the second sample data of the message into a training set, a validation set and a test set according to a preset ratio.

[0080] It should be noted that the second sample data of the message mentioned here refers to all the second sample data obtained as a data set, that is, the data set contains the second sample data of multiple devices, not just the second sample data set of one device. In this application, the second sample data of the message is divided into a training set, a validation set and a test set according to a preset ratio, wherein the preset ratio can be randomly divided, or can be selected based on actual experience and application scenarios, such as dividing the sample data into a training set, a validation set and a test set according to 8:1:1 to ensure the generalization ability of the model.

[0081] Step S402: input the training set into the network structure built by BiLSTM to train the recognition model, and regularly evaluate the recognition model performance on the validation set.

[0082] It should be noted that BiLSTM is used to build the network structure. This method designs three hidden layer units, the sample data alignment length is 500 units, the batch size can be set according to the machine performance, and the learning rate can be an automatic optimization strategy. Specifically, the training set is used for model training, and the model performance is evaluated on the validation set regularly (for example, every 5 iterations) to avoid overfitting.

[0083] Step S403: until the detection accuracy of the trained recognition model evaluated by the test set reaches a preset threshold, the recognition model training is completed and the current recognition model is output.

[0084] Specifically, the recognition accuracy of the model is evaluated on the test set to ensure the effectiveness and reliability of the model, and the recognition accuracy can exceed 95%. After the training is completed, the best model weights are saved for subsequent loading; integrated into the system: the trained model is integrated into the real-time monitoring system used; when a new message arrives, its features are extracted and passed to the model for prediction.

[0085] like Figure 5 As shown, in the embodiment of the present application, the specific content of identifying the device type and manufacturer through the constructed identification model is:

[0086] Step S404: pre-process the real-time collected device communication flow data to generate data in the same format as the first sample data.

[0087] Step S405: Use the output recognition model to infer the data in the same format as the first sample data to identify the device type and manufacturer corresponding to the real-time collected device communication traffic data.

[0088] Specifically, based on the first sample data of each message obtained, the corpus and file conversion model are used to load the recognition model (the inference model of the device type and manufacturer) output by the above training, and the real-time traffic data is inferred. The specific process includes: inputting the collected real-time traffic data into the preprocessing module to generate features in the same format as the training data; using the loaded model to infer the processed data to obtain the recognition result; providing the inference result in the form of an interface, which can be Kafka, TCP, local database API or SDK, to facilitate the integration and use of subsequent systems.

[0089] As more data accumulates, the recognition model needs to be continuously optimized to improve recognition accuracy. In the present application, it also includes obtaining second sample data of new messages at a preset specified time; optimizing the recognition model using the second sample data of the new messages to obtain an optimized recognition model.

[0090] In summary, the present invention ensures the operability and repeatability of each link through specific steps and methods. The steps of traffic collection and analysis, data preprocessing, etc. all adopt mature technical means to ensure the accuracy and effectiveness of the data. The process of training the model also follows the standard machine learning process, and the BiLSTM algorithm is used for training to ensure the efficiency and accuracy of the model. The design of the real-time reasoning step is easy to integrate with the existing system, providing good scalability and applicability. Therefore, the implementation scheme of the present invention has strong feasibility and promotion value.

[0091] Figure 6A structural diagram of an asset type and manufacturer identification device in a power system provided in another embodiment of the present application, such as Figure 6 As shown, an asset type and manufacturer identification device for a power system includes: a memory 50 for storing a computer program;

[0092] The processor 51 is used to implement the steps of the asset type and manufacturer identification method in the power system as described in the above embodiment when executing the computer program.

[0093] The asset type and manufacturer identification device provided in this embodiment for use in a power system may include but is not limited to a smart substation, a management platform, a laptop or desktop computer, etc.

[0094] Among them, the processor 51 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 51 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 41 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 51 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 51 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0095] The memory 50 may include one or more computer-readable storage media, which may be non-transitory. The memory 50 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 50 is at least used to store the following computer program 501, wherein, after the computer program is loaded and executed by the processor 51, it can implement the relevant steps of an asset identification method for a power system disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 50 may also include an operating system 502 and data 503, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 502 may include Windows, Unix, Linux, etc. Data 503 may include, but is not limited to, a method for identifying asset types and manufacturers in a power system, etc.

[0096] In some embodiments, an asset type and manufacturer identification device for use in a power system may further include a display screen 52 , an input and output interface 53 , a communication interface 54 , a power supply 55 , and a communication bus 56 .

[0097] Those skilled in the art will understand that Figure 2 The structure shown in the figure does not constitute a limitation on an asset type and manufacturer identification device used in an electric power system, and may include more or fewer components than shown in the figure.

[0098] An embodiment of the present application provides an asset type and manufacturer identification device for an electric power system, including a memory and a processor. When the processor executes a program stored in the memory, it can implement the following method: an asset type and manufacturer identification method for an electric power system.

[0099] The asset type and manufacturer identification device provided in the present embodiment is used in the power system. The processor executes the computer program stored in the memory to realize the analysis and extraction of the communication flow data of the equipment, the preprocessing of the obtained message data, and the combination of the same training algorithm model. It can not only be used for the identification of intelligent stations, but also effectively support the identification of non-intelligent stations, so as to make it more versatile; and it can also provide comprehensive asset type data for algorithm learning, so that the model can adapt to different scenarios and achieve higher recognition coverage and accuracy. Therefore, the asset type and manufacturer identification device provided in the present embodiment, through the steps of flow collection and analysis, data preprocessing, etc., adopts mature technical means to ensure the accuracy and effectiveness of the data; the process of training the model also follows the standard machine learning process, and uses the BiLSTM algorithm for training to ensure the efficiency and accuracy of the model; the design of the online reasoning module is easy to integrate with the existing system, and provides good scalability and applicability.

[0100] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0101] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0102] The computer-readable storage medium provided in this embodiment, when the computer program stored therein is executed, can be realized by parsing and extracting the communication flow data of the equipment, preprocessing the obtained message data, and combining and reusing the same training algorithm model, which can not only be used for the identification of intelligent stations, but also effectively support the identification of non-intelligent stations, thereby making it more versatile; and it can also provide comprehensive asset type data for algorithm learning, so that the model can adapt to different scenarios and achieve higher recognition coverage and accuracy. Therefore, the asset type and manufacturer identification device for the power system provided in this embodiment adopts mature technical means through the steps of flow collection and analysis, data preprocessing, etc., to ensure the accuracy and effectiveness of the data; the process of training the model also follows the standard machine learning process, and uses the BiLSTM algorithm for training to ensure the efficiency and accuracy of the model; the design of the online reasoning module is easy to integrate with the existing system, providing good scalability and applicability.

[0103] The above is a detailed introduction to the asset type and manufacturer identification method, equipment and medium for the power system provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can refer to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can refer to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0104] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A method for identifying asset types and manufacturers in a power system, characterized in that: include: Acquire device communication flow data, parse and extract the device communication flow data, and obtain seven-tuple information of each message; wherein the seven-tuple information includes source IP, source port, destination IP, destination port, source MAC, destination MAC, and protocol; Obtaining the payload of the message by parsing the protocol content in the seven-tuple information of each message, and preprocessing the acquired payload to obtain first sample data of each message; Using the device type and the manufacturer preset mapping table to associate and map the first sample data of the message to obtain the second sample data of the message; The second sample data of the message is combined with the BiLSTM algorithm to construct an identification model for the device type and manufacturer, and the device type and manufacturer are identified through the constructed identification model.

2. The method for identifying asset types and manufacturers in a power system according to claim 1, characterized in that: The device communication network flow data is obtained, and the device communication network flow data is parsed and extracted to obtain the specific content of the seven-tuple information of each message: Use bypass deployment to collect traffic data from the core switch ports of the plant or main station to obtain device communication data; The acquired device communication data is subjected to deep message analysis, and the seven-tuple information of each message is extracted according to the principle of the same source IP to the same destination IP.

3. The method for identifying asset types and manufacturers in a power system according to claim 1, characterized in that: The payload of the message is obtained by parsing the protocol content in the seven-tuple information of each message, and the obtained payload is preprocessed to obtain the specific content of the first sample data of each message: Parse the protocol content in the seven-tuple information of each message and obtain the Payload of each message; Convert the payload of each obtained message into a hexadecimal string; Mapping the numerical value in the hexadecimal string into letters using a coding rule so that the hexadecimal string is in letter form; The string is split by space character according to length L, and the first sample data of the message is output, wherein the first sample data includes source IP, source port, destination IP, destination port, source MAC, destination MAC, protocol and a string set of length L.

4. The method for identifying asset types and manufacturers in a power system according to claim 1, characterized in that: The specific content of the second sample data of the message obtained by using the device type and the manufacturer preset mapping table to associate and map the first sample data of the message is: Combine the substation SCD file and asset ledger data to obtain the device type and manufacturer corresponding to each device in the production environment, and output the device type and manufacturer preset mapping table corresponding to the device; Firstly, the first sample data of the message is associated with the device type and manufacturer preset mapping table, and then the device type and manufacturer are mapped to the character string set with a length of L in the first sample data of the message, so as to obtain the second sample data of the message.

5. The method for identifying asset types and manufacturers in a power system according to claim 1, characterized in that: The specific content of combining the second sample data of the message and using the BiLSTM algorithm to construct an identification model for the device type and manufacturer is: Dividing the second sample data of the message into a training set, a validation set and a test set according to a preset ratio; The training set is input into the network structure built by BiLSTM to train the recognition model, and the recognition model performance is regularly evaluated on the validation set; When the detection accuracy of the trained recognition model evaluated by the test set reaches a preset threshold, the recognition model training is completed and the recognition model is output.

6. The method for identifying asset types and manufacturers in a power system according to claim 2, characterized in that: The specific content of identifying the device type and manufacturer through the constructed identification model is: Preprocessing the real-time collected device communication flow data to generate data in the same format as the first sample data; The output recognition model is used to infer the data in the same format as the first sample data to identify the device type and manufacturer corresponding to the real-time collected device communication traffic data.

7. The method for identifying asset types and manufacturers in a power system according to claim 1, characterized in that: The protocol in the seven-tuple information of each message is the MMS protocol or the 103 protocol.

8. The method for identifying asset types and manufacturers in a power system according to claim 1, characterized in that: Also includes: Acquire second sample data of the new message according to a preset specified time; The recognition model is optimized using the second sample data of the new message to obtain an optimized recognition model.

9. An asset type and manufacturer identification device for use in a power system, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for identifying asset types and manufacturers in a power system as claimed in any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for identifying asset types and manufacturers in a power system as claimed in any one of claims 1 to 8 are implemented.

Images