Power grid telecontrol information real-time closed loop checking method

Abstract

The invention provides a power grid telecontrol information real-time closed-loop checking method, and relates to the technical field of power data analysis, and the method comprises the steps: obtaining a telecontrol configuration file data set of a power grid; based on data sampling, constructing a plurality of sub-forest anomaly detectors and a base forest anomaly detector by using a telecontrol configuration file data set; performing anomaly detection on the data entering the sliding window by using a base forest anomaly detector; streaming data entering the sliding window are randomly sampled and then stored in a buffer area; when the sliding window is full of data, calculating the data exception rate of the sliding window; when the data volume of the buffer area exceeds a preset data volume threshold value or the sliding window data anomaly rate exceeds a preset anomaly rate threshold value, updating the base forest anomaly detector; and performing anomaly detection on the power grid telecontrol information acquired in real time by using the updated base forest anomaly detector, and checking according to an anomaly detection result. According to the scheme, the accuracy and efficiency of power grid telecontrol information checking can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of power data analysis, and in particular to a real-time closed-loop verification method for power grid telecontrol information. Background Art

[0002] Telecontrol system is a core system used to collect, transmit, process and store remote equipment data. It is widely used in power systems, industrial automation, traffic monitoring and other fields. Traditional telecontrol systems mainly rely on technologies such as supervisory control and data acquisition. Through real-time monitoring and control of remote equipment, the system status can be perceived and remotely operated. In the field of power, the telecontrol information of the power grid can mainly include the equipment status information, operation instruction information, remote control / remote adjustment information, data transmission information and statistical analysis information of the monitored power grid. By monitoring and analyzing the telecontrol information of various power grid equipment in the power grid, it is possible to determine whether the power grid operation status and equipment status are normal, and then timely discover and handle power grid faults and other problems. It is of great significance to verify the telecontrol information.

[0003] In the existing technical system, the point verification of telecontrol data configuration of smart substations is a complex and tedious task. As the configuration of substation systems becomes increasingly complex, if configuration problems are found during the point verification of telecontrol data, all telecontrol signals usually need to be re-verified after configuration adjustments are made, which not only increases the workload but also may lead to errors in the verification process.

[0004] At present, the automatic verification method of telecontrol data configuration mainly adopts the IEC61850 simulation method. This method requires exporting the dispatch signal table from the master station side, finding the corresponding signal point from the substation configuration through name matching, and then the simulation device generates the signal change of the corresponding signal point, so that the corresponding change signal generated by the telecontrol machine is sent to the dispatch master station. Further closed-loop verification is performed by comparing the consistency of the simulated change signal and the change signal received by the dispatch master station. However, this method not only has low verification accuracy, but also low verification efficiency, which is not conducive to improving the safety of power grid operation. Summary of the invention

[0005] In view of this, in order to address the above shortcomings, it is necessary to propose a real-time closed-loop verification method for power grid telecontrol information to improve the accuracy and efficiency of power grid telecontrol information verification.

[0006] The present invention provides a real-time closed-loop verification method for power grid telecontrol information, comprising:

[0007] Obtaining a telecontrol configuration file dataset of the power grid;

[0008] Based on data sampling, a plurality of sub-forest anomaly detectors are constructed using the telecontrol configuration file data set, and each sub-forest anomaly detector is used to form a base forest anomaly detector; wherein the sub-forest anomaly detector is used to detect abnormal data points in the telecontrol configuration file data;

[0009] Using the base forest anomaly detector to perform anomaly detection on the data entering the sliding window;

[0010] Randomly sample the stream data entering the sliding window and store the randomly sampled data in the buffer;

[0011] When the sliding window is full of data, the data abnormality rate of the sliding window is calculated;

[0012] When the amount of data in the buffer exceeds a preset data amount threshold or the data anomaly rate of the sliding window exceeds a preset anomaly rate threshold, updating the base forest anomaly detector to obtain a new base forest anomaly detector;

[0013] The new base forest anomaly detector is used to detect anomalies in the real-time collected power grid telecontrol information, and the anomaly detection results are verified.

[0014] Preferably, the step of constructing a plurality of sub-forest anomaly detectors using the telecontrol configuration file dataset comprises:

[0015] The telecontrol configuration file data set is sampled by a systematic sampling method to obtain sample training data for constructing a plurality of isolation trees based on an isolation forest algorithm;

[0016] When constructing each isolation tree, a certain amount of data is uniformly sampled from the sample training data as isolation tree samples of the current isolation tree;

[0017] For each isolation tree sample, a feature is randomly selected, and a value between the minimum and maximum values ​​of the feature is randomly selected as the dividing point to divide the isolation tree sample into two parts;

[0018] For each divided part, the division operation is performed again through the previous step until the preset termination condition is met;

[0019] Using the systematic sampling method, several isolated trees are combined into a sub-forest anomaly detector.

[0020] Preferably, the preset termination condition includes at least one of the following:

[0021] The divided data itself cannot be divided any further;

[0022] The height of the isolation tree reaches the preset height.

[0023] Preferably, the method of using the base forest anomaly detector to perform anomaly detection on the data entering the sliding window includes:

[0024] The process CPU occupancy, memory occupancy, disk IO, network IO, number of processes and number of network connections corresponding to the data arriving at the sliding window are used as the input of the base forest anomaly detector;

[0025] When the output value belongs to the range of (0, h), the data is determined to be in a normal state; when the output value belongs to the range of [h, 1), the data is determined to be in an abnormal state.

[0026] Preferably, h is determined by:

[0027] h=-QUARTILE(-F(x),100(1-c))

[0028] Among them, QUARTILE represents the quantile function, F(x) represents the base forest anomaly detector detection function, x represents the isolation tree sample, and c represents the proportion of abnormal samples in the isolation tree sample.

[0029] Preferably, the randomly sampling the stream data entering the sliding window and storing the randomly sampled data into a buffer comprises:

[0030] The newly arrived data in the sliding window are sampled based on Bernoulli distribution random sampling, and the sampled data are stored in the buffer; if the data in the sliding window is full, the newly arrived data replaces the data that enters the sliding window earliest.

[0031] Preferably, the calculation of the sliding window data abnormality rate at this time includes:

[0032] The ratio of the number of abnormal data in the current sliding window to the number of all data in the current sliding window is calculated to obtain the abnormal rate of the current sliding window data.

[0033] Preferably, when the amount of data in the buffer exceeds a preset data amount threshold or the sliding window data anomaly rate exceeds a preset anomaly rate threshold, updating the base forest anomaly detector includes:

[0034] When the amount of data in the buffer exceeds a preset data amount threshold, updating the base forest anomaly detector at a first update rate;

[0035] When the sliding window data anomaly rate exceeds a preset anomaly rate threshold, the base forest anomaly detector is updated at a second update rate; wherein the second update rate is greater than the first update rate.

[0036] Preferably, the updating of the base forest anomaly detector comprises:

[0037] For each sub-forest anomaly detector, perform:

[0038] Determine the anomaly rate of the current sub-forest anomaly detector and the base forest anomaly detector for the telecontrol profile data set;

[0039] Based on the following calculation formula, the anomaly deviation rate between the current sub-forest anomaly detector and the base forest anomaly detector is calculated;

[0040]

[0041] Among them, R i Used to characterize the anomaly deviation rate between the i-th sub-forest anomaly detector and the base forest anomaly detector, μ i Used to characterize the anomaly rate of the i-th sub-forest anomaly detector on the telemotion profile dataset, μ all It is used to characterize the anomaly rate of the base forest anomaly detector on the telemotion profile dataset;

[0042] Determine whether the anomaly deviation rate corresponding to the current sub-forest anomaly detector is greater than the preset threshold; if so, remove the current sub-forest anomaly detector and construct a new sub-forest anomaly detector to supplement it.

[0043] Preferably, the checking according to the abnormality detection result includes:

[0044] When the abnormal telecontrol configuration file is the internal configuration file of the background telecontrol host, the automatic joint debugging and acceptance platform simulates the main station network port and the simulated substation network port to simultaneously connect to the exit and entrance of the telecontrol host, send the simulated device signal through the set automatic acceptance device, and upload it to the automatic joint debugging and acceptance platform through the exit of the telecontrol host to perform a complete closed-loop test;

[0045] When the abnormal telecontrol configuration file is a common telesignaling signal configuration file, the interval time of common telesignaling signal action and reset is generated; and the signals that fail the verification are recorded, and the connection status display bar between the automatic joint commissioning acceptance platform and the telecontrol host is used to display the connection problem of the telesignaling signal configuration;

[0046] When the abnormal telecontrol profile is a communication interruption signal profile, manually configure the signal interval time and customize the sending interval time of the signal action and reset signal.

[0047] It can be seen from the above technical scheme that in the real-time closed-loop verification method of power grid telecontrol information provided by the present invention, firstly, the telecontrol configuration file data set of the power grid is obtained, and then based on data sampling, several sub-forest anomaly detectors are constructed using the telecontrol configuration file data set, and each sub-forest anomaly detector is used to form a base forest anomaly detector; further, the base forest anomaly detector is used to perform anomaly detection on the data entering the sliding window, and the sampled data is randomly sampled after the flow data entering the sliding window is stored in the buffer; when the sliding window is full of data, the data anomaly rate of the sliding window at this time is calculated; further, when the data volume of the buffer exceeds the preset data volume threshold or the sliding window data anomaly rate exceeds the preset anomaly rate threshold, the forest anomaly detector is updated, and then the new base forest anomaly detector can be used to perform anomaly detection on the real-time collected power grid telecontrol information, and the verification is performed according to the anomaly detection result. It can be seen that this scheme constructs a base forest anomaly detector based on the isolation forest method, and iteratively updates the base forest anomaly detector, which greatly improves the accuracy of the base forest anomaly detector in detecting anomalies of power grid telecontrol information, thereby improving the accuracy of the verification of power grid telecontrol information. Moreover, the verification method provided by this solution can automatically detect abnormal power grid telecontrol information, thereby helping to improve the efficiency of power grid telecontrol information verification and the safety of power grid operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The present invention provides a flow chart of a method for real-time closed-loop verification of power grid telecontrol information in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0050] like Figure 1 As shown, the present invention provides a method for real-time closed-loop verification of power grid telecontrol information, which may include the following steps:

[0051] Step 101: Obtain a telecontrol configuration file data set of a power grid;

[0052] Step 102: Based on data sampling, a plurality of sub-forest anomaly detectors are constructed using the telecontrol configuration file data set, and each sub-forest anomaly detector is used to form a base forest anomaly detector; wherein the sub-forest anomaly detector is used to detect abnormal data points in the telecontrol configuration file data;

[0053] Step 103: Use the base forest anomaly detector to perform anomaly detection on the data entering the sliding window;

[0054] Step 104: randomly sampling the stream data entering the sliding window, and storing the randomly sampled data into a buffer;

[0055] Step 105: When the sliding window is full of data, the data abnormality rate of the sliding window is calculated;

[0056] Step 106: When the data volume in the buffer exceeds a preset data volume threshold or the data anomaly rate in the sliding window exceeds a preset anomaly rate threshold, the base forest anomaly detector is updated to obtain a new base forest anomaly detector;

[0057] Step 107: Use the new base forest anomaly detector to perform anomaly detection on the real-time collected power grid telecontrol information, and perform verification based on the anomaly detection result.

[0058] In this embodiment, a base forest anomaly detector is constructed based on an isolation forest method, and the base forest anomaly detector is iteratively updated, which greatly improves the accuracy of the base forest anomaly detector in detecting anomalies in power grid telecontrol information, thereby improving the accuracy of power grid telecontrol information verification. Moreover, the verification method provided by this solution can automatically detect abnormal power grid telecontrol information, thereby helping to improve the efficiency of power grid telecontrol information verification and the safety of power grid operation.

[0059] For step 101, a telecontrol configuration file data set of a power grid is obtained;

[0060] In this step, the telecontrol configuration file data set may be formed from data obtained from the telecontrol system and the power dispatching system of the power grid.

[0061] In step 102, based on data sampling, a plurality of sub-forest anomaly detectors are constructed using the telecontrol profile data set, and each sub-forest anomaly detector is used to form a base forest anomaly detector; wherein the sub-forest anomaly detector is used to detect abnormal data points in the telecontrol profile data;

[0062] In this step, the sub-forest anomaly detector is an anomaly detection model based on the isolation forest algorithm. Isolation forest is an unsupervised anomaly detection algorithm that constructs multiple decision trees (i.e., isolation trees) by randomly selecting features and data points to form a forest. In this forest, abnormal data points are usually more likely to be "isolated" (i.e., reach leaf nodes faster) because they have different feature distributions from normal data points. Therefore, this embodiment considers using the telecontrol profile data set to construct several sub-forest anomaly detectors.

[0063] Specifically, when constructing several sub-forest anomaly detectors using the telecontrol profile dataset, it can be implemented as follows:

[0064] The telecontrol configuration file data set is sampled by a systematic sampling method to obtain sample training data for building several isolation trees based on the isolation forest algorithm;

[0065] When constructing each isolation tree, a certain amount of data is uniformly sampled from the sample training data as the isolation tree sample of the current isolation tree;

[0066] For each isolation tree sample, a feature is randomly selected, and a value between the minimum and maximum values ​​of the feature is randomly selected as the dividing point to divide the isolation tree sample into two parts;

[0067] For each divided part, the division operation is performed again through the previous step until the preset termination condition is met;

[0068] Using the systematic sampling method, several isolated trees are combined into a sub-forest anomaly detector.

[0069] In this embodiment, when the isolation tree samples are divided, a feature can be randomly selected for each isolation tree sample, and then a value can be randomly selected within the range of all values ​​of the random feature, so that the samples are binary divided, and samples less than the value are divided to the left side of the node, and samples greater than or equal to the value are divided to the right side of the node, so as to obtain a split condition and left and right data sets. The above division operation is further performed on the left and right data sets respectively until the divided data itself cannot be divided any further, or the height of the isolation tree reaches a preset height.

[0070] Furthermore, for the constructed several isolation trees, a systematic sampling method is used to combine multiple isolation trees into a sub-forest anomaly detector, and then the sub-forest anomaly detectors constitute a base forest anomaly detector.

[0071] For step 103, a base forest anomaly detector is used to perform anomaly detection on the data entering the sliding window;

[0072] In this step, consider each data arriving at the sliding window and use the base forest anomaly detector to determine its abnormality. Specifically, it can be implemented in the following way:

[0073] The process CPU occupancy, memory occupancy, disk IO, network IO, number of processes and number of network connections corresponding to the data arriving at the sliding window are used as the input of the base forest anomaly detector;

[0074] When the output value belongs to the range of (0, h), the data is determined to be in a normal state; when the output value belongs to the range of [h, 1), the data is determined to be in an abnormal state.

[0075] Among them, h can be obtained by taking the quantile of the base forest anomaly detector according to the anomaly ratio value of historical data. For example, h can be determined as follows:

[0076] h=-QUARTILE(-F(x),100(1-c))

[0077] Among them, QUARTILE represents the quantile function, F(x) represents the base forest anomaly detector detection function, x represents the isolation tree sample, and c represents the proportion of abnormal samples in the isolation tree sample.

[0078] For step 104, randomly sample the stream data entering the sliding window, and store the randomly sampled data into a buffer;

[0079] In this embodiment, it is considered to sample the data newly arriving at the sliding window based on Bernoulli distribution random sampling, and store the sampled data in the buffer; if the data in the sliding window is full, the newly arrived data replaces the data that enters the sliding window earliest.

[0080] Sliding window is a technique that operates on data streams. It moves on a time series or data stream according to a given window size, and each move includes a new data point and excludes an old data point. In the subforest anomaly detector, the sliding window can be used to collect data streams within a certain period of time to form a data set. This data set will be used as the input of the subforest anomaly detector to detect anomalies in it. Moreover, within the sliding window, the subforest anomaly detector will evaluate each data point to determine whether it is abnormal. Since the window is sliding, continuous detection of anomalies in the data stream can be achieved. In addition, when the sliding window moves, new data points are included and old data points are excluded. This helps the subforest anomaly detector adapt to changes in the data stream and improve the accuracy and real-time performance of detection.

[0081] The buffer is a temporary storage area for data waiting to be processed. In the sub-forest anomaly detector, the buffer can be used to store data collected from the sliding window, waiting for the sub-forest anomaly detector to process. This helps to reduce direct operations on the data stream and improve the stability and efficiency of the system. Moreover, when the data in the buffer reaches a certain amount or meets other trigger conditions, the update process of the sub-forest anomaly detector will be triggered, which helps to ensure that the detector can adapt to changes in the data stream in a timely manner and improve the accuracy and real-time performance of detection. In addition, by reasonably setting the size of the buffer and the trigger conditions, the resource usage of the system can be optimized. For example, resource consumption caused by frequent update operations can be avoided, while ensuring that the detector can respond to anomalies in the data stream in a timely manner.

[0082] For step 105, when the sliding window is full of data, the data abnormality rate of the sliding window is calculated;

[0083] In this step, when the sliding window is full of data, the data anomaly rate of the current sliding window is obtained by calculating the ratio of the number of abnormal data in the current sliding window to the number of all data in the current sliding window.

[0084] For step 106, when the data volume in the buffer exceeds a preset data volume threshold or the data anomaly rate in the sliding window exceeds a preset anomaly rate threshold, the base forest anomaly detector is updated to obtain a new base forest anomaly detector;

[0085] In this step, when the amount of data in the buffer exceeds the preset data amount threshold, the base forest anomaly detector is updated at the first update rate; when the data anomaly rate of the sliding window exceeds the preset anomaly rate threshold, the base forest anomaly detector is updated at the second update rate; wherein the second update rate is greater than the first update rate. Both update rates are for updating the forest anomaly detector. When the buffer or sliding window reaches a certain preset condition, the base forest anomaly detector will be triggered to update. In this way, by continuously updating and selecting the sub-forest anomaly detector that is more suitable for detection, it is helpful to improve the detection efficiency and accuracy of power grid anomaly data.

[0086] When updating the base forest anomaly detector, it can be achieved in the following ways:

[0087] For each sub-forest anomaly detector, perform:

[0088] Determine the anomaly rate of the current sub-forest anomaly detector and the base forest anomaly detector for the telecontrol profile data set;

[0089] Based on the following calculation formula, the anomaly deviation rate between the current sub-forest anomaly detector and the base forest anomaly detector is calculated;

[0090]

[0091] Among them, R i Used to characterize the anomaly deviation rate between the i-th sub-forest anomaly detector and the base forest anomaly detector, μ i Used to characterize the anomaly rate of the i-th sub-forest anomaly detector on the telemotion profile dataset, μ all It is used to characterize the anomaly rate of the base forest anomaly detector on the telemotion profile dataset;

[0092] Determine whether the anomaly deviation rate corresponding to the current sub-forest anomaly detector is greater than the preset threshold; if so, remove the current sub-forest anomaly detector and construct a new sub-forest anomaly detector to supplement it.

[0093] In this embodiment, when the anomaly rate of the sliding window data exceeds the threshold or the buffer data is full, the sub-forest anomaly detector is updated. Specifically, the anomaly rate deviation of each sub-forest anomaly detector and the base forest anomaly detector can be calculated, the sub-forest anomaly detector with a large deviation can be removed, and a new sub-forest anomaly detector can be constructed to supplement it. In this way, through continuous iterative updates, until the anomaly rate deviation of each sub-forest anomaly detector and the base forest anomaly detector meets certain requirements, an updated base forest anomaly detector can be obtained. The updated base forest anomaly detector is used for anomaly detection with higher accuracy.

[0094] For step 107, the new base forest anomaly detector is used to perform anomaly detection on the real-time collected power grid telecontrol information, and verification is performed based on the anomaly detection result.

[0095] In this embodiment, when checking according to the abnormal detection result, if the abnormal telecontrol configuration file is the internal configuration file of the background telecontrol host, the automatic joint debugging and acceptance platform simulates the main station network port and the simulated substation network port to simultaneously connect to the exit and entrance of the telecontrol host, send the simulated device signal through the set automatic acceptance device, and upload it to the automatic joint debugging and acceptance platform through the exit of the telecontrol host to perform a complete closed-loop test; fully record the action of the signal, the reset signal and the time node of the signal change state, and export the verification record report;

[0096] If the abnormal telecontrol configuration file is a common telesignaling signal configuration file, then the interval time for the action and reset of the common telesignaling signal is generated; and the signals that fail the verification are recorded, and the abnormal signals are checked through the verification report, and the connection status display bar between the automatic joint commissioning acceptance platform and the telecontrol host is used to display the connection problems of the telesignaling signal configuration;

[0097] If the abnormal telecontrol profile is a communication interruption signal profile, manually configure the signal interval time and customize the interval time for sending the signal action and reset signal.

[0098] The present specification also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute a method in any one of the embodiments in the specification.

[0099] The present specification also provides a computing device, including a memory and a processor, wherein executable codes are stored in the memory, and when the processor executes the executable codes, a method in any embodiment of the present specification is implemented.

[0100] The modules or units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. The above disclosure is only the preferred embodiment of the present invention, and of course it cannot be used to limit the scope of the rights of the present invention. Those skilled in the art can understand that all or part of the processes of the above embodiment are implemented, and the equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A real-time closed-loop verification method for power grid telecontrol information, characterized in that: include: Obtaining a telecontrol configuration file dataset of the power grid; Based on data sampling, a plurality of sub-forest anomaly detectors are constructed using the telecontrol configuration file data set, and each sub-forest anomaly detector is used to form a base forest anomaly detector; wherein the sub-forest anomaly detector is used to detect abnormal data points in the telecontrol configuration file data; Using the base forest anomaly detector to perform anomaly detection on the data entering the sliding window; Randomly sample the stream data entering the sliding window and store the randomly sampled data in the buffer; When the sliding window is full of data, the data abnormality rate of the sliding window is calculated; When the amount of data in the buffer exceeds a preset data amount threshold or the data anomaly rate of the sliding window exceeds a preset anomaly rate threshold, updating the base forest anomaly detector to obtain a new base forest anomaly detector; The new base forest anomaly detector is used to detect anomalies of the real-time collected power grid telecontrol information, and the anomaly detection results are verified.

2. The real-time closed-loop verification method for power grid telecontrol information according to claim 1 is characterized in that: The method of constructing a plurality of sub-forest anomaly detectors using the telecontrol configuration file data set includes: The telecontrol configuration file data set is sampled by a systematic sampling method to obtain sample training data for constructing a plurality of isolation trees based on an isolation forest algorithm; When constructing each isolation tree, a certain amount of data is uniformly sampled from the sample training data as isolation tree samples of the current isolation tree; For each isolation tree sample, a feature is randomly selected, and a value between the minimum and maximum values ​​of the feature is randomly selected as the dividing point to divide the isolation tree sample into two parts; For each divided part, the division operation is performed again through the previous step until the preset termination condition is met; Using the systematic sampling method, several isolated trees are combined into a sub-forest anomaly detector.

3. The real-time closed-loop verification method for power grid telecontrol information according to claim 2 is characterized in that: The preset termination condition includes at least one of the following: The divided data itself cannot be divided any further; The height of the isolation tree reaches the preset height.

4. The real-time closed-loop verification method for power grid telecontrol information according to claim 2 is characterized in that: The method of using the base forest anomaly detector to perform anomaly detection on the data entering the sliding window includes: The process CPU occupancy, memory occupancy, disk IO, network IO, number of processes and number of network connections corresponding to the data arriving at the sliding window are used as the input of the base forest anomaly detector; When the output value belongs to the range of (0, h), the data is determined to be in a normal state; when the output value belongs to the range of [h, 1), the data is determined to be in an abnormal state.

5. The real-time closed-loop verification method for power grid telecontrol information according to claim 4 is characterized in that: h is determined as follows: h=-QUARTILE(-F(x),100(1-c)) Among them, QUARTILE represents the quantile function, F(x) represents the base forest anomaly detector detection function, x represents the isolation tree sample, and c represents the proportion of abnormal samples in the isolation tree sample.

6. The real-time closed-loop verification method for power grid telecontrol information according to claim 1 is characterized in that: The randomly sampling the stream data entering the sliding window and storing the randomly sampled data into the buffer includes: The newly arrived data in the sliding window are sampled based on Bernoulli distribution random sampling, and the sampled data are stored in the buffer; if the data in the sliding window is full, the newly arrived data replaces the data that enters the sliding window earliest.

7. The real-time closed-loop verification method for power grid telecontrol information according to claim 1 is characterized in that: The calculation of the sliding window data abnormality rate at this time includes: The ratio of the number of abnormal data in the current sliding window to the number of all data in the current sliding window is calculated to obtain the abnormal rate of the current sliding window data.

8. The real-time closed-loop verification method for power grid telecontrol information according to claim 1 is characterized in that: When the amount of data in the buffer exceeds a preset data amount threshold or the abnormality rate of the sliding window data exceeds a preset abnormality rate threshold, updating the base forest abnormality detector includes: When the amount of data in the buffer exceeds a preset data amount threshold, updating the base forest anomaly detector at a first update rate; When the sliding window data anomaly rate exceeds a preset anomaly rate threshold, the base forest anomaly detector is updated at a second update rate; wherein the second update rate is greater than the first update rate.

9. The real-time closed-loop verification method for power grid telecontrol information according to claim 8 is characterized in that: The updating of the base forest anomaly detector comprises: For each sub-forest anomaly detector, perform: Determine the anomaly rate of the current sub-forest anomaly detector and the base forest anomaly detector for the telecontrol profile data set; Based on the following calculation formula, the anomaly deviation rate between the current sub-forest anomaly detector and the base forest anomaly detector is calculated; Among them, R i Used to characterize the anomaly deviation rate between the i-th sub-forest anomaly detector and the base forest anomaly detector, μ i Used to characterize the anomaly rate of the i-th sub-forest anomaly detector on the telemotion profile dataset, μ all It is used to characterize the anomaly rate of the base forest anomaly detector on the telemotion profile dataset; Determine whether the anomaly deviation rate corresponding to the current sub-forest anomaly detector is greater than the preset threshold; if so, remove the current sub-forest anomaly detector and construct a new sub-forest anomaly detector to supplement it.

10. The real-time closed-loop verification method for power grid telecontrol information according to claim 1, characterized in that: The checking according to the abnormality detection result includes: When the abnormal telecontrol configuration file is the internal configuration file of the background telecontrol host, the automatic joint debugging and acceptance platform simulates the main station network port and the simulated substation network port to simultaneously connect to the exit and entrance of the telecontrol host, send the simulated device signal through the set automatic acceptance device, and upload it to the automatic joint debugging and acceptance platform through the exit of the telecontrol host to perform a complete closed-loop test; When the abnormal telecontrol configuration file is a common telesignaling signal configuration file, the interval time of common telesignaling signal action and reset is generated; and the signals that fail the verification are recorded, and the connection status display bar between the automatic joint commissioning acceptance platform and the telecontrol host is used to display the connection problem of the telesignaling signal configuration; When the abnormal telecontrol profile is a communication interruption signal profile, manually configure the signal interval time and customize the sending interval time of the signal action and reset signal.

Images