Asset identification method and equipment used in power system, and storage medium

Abstract

The invention discloses an asset identification method and device for a power system and a storage medium, and the method comprises the steps: carrying out the preprocessing of the communication interaction flow data between devices after the communication interaction flow data between the devices is obtained, and obtaining a communication feature vector set between the devices; automatically carrying out behavior pattern analysis on the obtained inter-device communication feature vector set according to a communication object by using a sequence correlation analysis algorithm so as to obtain an inter-device communication interaction behavior sequence pattern set; and tagging the inter-device communication interaction behavior sequence pattern set to obtain inter-device communication sample data, and constructing an asset classification model according to the inter-device sample data to identify assets in the power system. Based on an unsupervised mode recognition technology, under the condition of not depending on inherent ledgers and related background knowledge of the assets, classification of the assets of the electric power system can be achieved; and through neural network modeling, accurate classification of power system assets can be realized.

Description

Technical Field

[0001] The present application relates to the technical field of network asset identification, and in particular to an asset identification method, device and storage medium for use in a power system. Background Art

[0002] With the continuous development of big data and artificial intelligence technologies, as well as the diversification and intelligence level of power system business, asset identification and classification in power systems have become particularly important. As a key component of power system operations, asset management decisions directly affect the level of power supply reliability. Transmission system operators can solve two key problems by obtaining asset parameter information: how to maximize the life cycle of assets, and how to arrange and perform various asset management operations, especially assets that require shutdown operations.

[0003] Currently, in the field of industrial control, active and passive are the more common asset identification and classification methods:

[0004] 1) Active method: Actively scan the network system to obtain asset information and identify and classify it. Currently, the more mature active identification tools include Nmap, Nessus, OpenVAS, etc. Active fingerprint recognition technology collects comprehensive asset fingerprint feature information as much as possible, but it may cause network congestion, especially in large-scale power systems, which may cause PLCs, RTUs and other equipment to be overloaded, making normal requests unable to respond. In addition, power system equipment usually has a long life cycle, and the equipment is too old, making it difficult for a third party to obtain comprehensive and accurate information. Or asset management and maintenance may be performed by outsourced personnel, who may not be able to provide accurate information or provide incorrect information, resulting in low implementation feasibility.

[0005] 2) Passive method: Minimize the interference to the network and monitor the network to obtain information. At present, there are some relatively mature passive identification tools, such as Ettercap, P0f, Satori, NetworkMiner, etc. However, this method is based on network monitoring and analysis of the TCP / IP protocol stack, mainly by collecting session channel information. Therefore, the information collected by the passive method is relatively limited, and some detailed information and comprehensive asset fingerprints cannot be obtained, resulting in a low recognition rate.

[0006] Whether based on active or passive detection methods, they are imperfect for power system applications and cannot meet the business needs of users. Therefore, technicians in this field are in urgent need of an asset identification method, device and storage medium for power systems to solve the current technical problems of relying on manual intervention to obtain asset information and inaccurate information provided by manual intervention. Summary of the invention

[0007] The purpose of this application is to provide an asset identification method, device and storage medium for use in a power system to solve the current technical problems of reliance on manual intervention to obtain asset information and inaccurate information provided by humans.

[0008] In order to solve the above technical problems, the present application provides an asset identification method for a power system, which includes:

[0009] The acquired device-to-device communication interaction flow data is preprocessed to obtain a set of feature vectors of the device-to-device communication session;

[0010] The obtained feature vector set P of the inter-device communication session is automatically analyzed by the communication object using the sequence association analysis algorithm, so as to obtain the inter-device communication interaction behavior sequence pattern set M of different communication objects; wherein the inter-device communication interaction behavior sequence pattern of any communication object is: M j = {source IP of the jth communication object, destination IP of the jth communication object, data packet vector of the jth communication object, time interval ΔT between two consecutive sending or receiving data packets of the jth communication object j};

[0011] The inter-device communication interaction behavior sequence pattern set M is labeled to obtain inter-device communication sample data, and then an asset classification model is constructed based on the inter-device sample data to identify assets in the power system.

[0012] Preferably, the acquired inter-device communication interaction flow data is preprocessed to obtain the specific content of the feature vector set of the inter-device communication session:

[0013] The traffic segmentation tool is used to segment the captured device-to-device communication interaction traffic data according to five-tuple information to form a device-to-device communication session, and then feature extraction is performed to obtain a feature vector set of the device-to-device communication session.

[0014] Further preferably, the specific contents of the inter-device communication feature vector set obtained by using the traffic segmentation tool to segment the captured inter-device communication interaction traffic data according to the five-tuple information to form the inter-device transceiver communication session, and then extracting the features to obtain the inter-device communication feature vector set are:

[0015] The captured inter-device communication interaction traffic data is segmented by a traffic segmentation tool according to the same five-tuple information to form an inter-device transceiver communication session, wherein the five-tuple information is source IP, source port, destination IP, destination port, and network transmission protocol;

[0016] According to the inter-device communication session, feature extraction is performed to obtain a feature vector set P of the inter-device communication session, that is, a feature vector set P = {P(1), P(2) ... P(i)} of the inter-device communication session, wherein any feature vector P(i) in the set P = {P1, P 2， ...P k}, where P k is the kth element of the i-th eigenvector P(i), P k ={five-tuple information of the i-th session, message sequence number, k-th data packet vector of the i-th session, time interval of the k-th data packet of the i-th session}.

[0017] Preferably, the specific content of automatically analyzing the behavior patterns of the obtained feature vector set P of the inter-device communication session according to the communication objects by using the sequence association analysis algorithm is:

[0018] The feature vector P in the obtained inter-device communication feature vector set is i Classify the data according to the packet direction and protocol of the source IP, destination IP, and session data packet vector in the five-tuple information to form a subset of sending and receiving sessions from the same source IP to the same destination IP with the same protocol and the same direction;

[0019] Frequent item mining is then performed according to the packet vector and packet time interval characteristics in each subset, and the frequent item set is defined when the proportion of the same packet vector and packet time interval in each subset is not less than the set threshold, thereby obtaining a set of sequential pattern M of communication interaction behaviors between devices of different communication objects.

[0020] Preferably, the inter-device communication interaction behavior sequence pattern set M is started at a fixed time and then repeatedly analyzes the behavior patterns automatically according to the communication objects to perform full self-learning and update the database.

[0021] Preferably, the specific content of the inter-device communication sample data obtained after labeling the inter-device communication interaction behavior sequence pattern set M is:

[0022] The inter-device communication interaction behavior sequence pattern set M is automatically added with type labels through clustering, and the inter-device communication sample data is obtained through type labeling.

[0023] Preferably, the specific content of building an asset classification model based on the inter-device sample data to identify assets in the power system is:

[0024] Dividing the inter-device sample data into a training data set and a test data set in a random manner;

[0025] After modeling and training on the training data set using a deep learning algorithm, an asset classification training model is obtained, and the asset classification training model is verified with the test data set. If the verification results are consistent, the asset classification training model is the optimal asset classification model; if the verification results are inconsistent, the asset classification training model returns to self-learning at a fixed time until it is verified to be consistent with the test data set, and then the optimal asset classification model is output;

[0026] The real-time acquired inter-device communication interaction traffic data is judged according to the optimal asset classification model. If the real-time acquired inter-device communication interaction traffic data does not correspond to the data set corresponding to the optimal asset classification model, it is judged that there are unknown assets in the real-time acquired inter-device communication interaction traffic data; otherwise, there are no unknown assets.

[0027] Preferably, the deep learning algorithm is a support vector machine (SVM) algorithm or a neural network (CNN) algorithm.

[0028] In order to solve the above technical problems, the present application also provides an asset identification device for use in a power system, comprising:

[0029] Memory for storing computer programs;

[0030] A processor is used to implement the steps of the asset identification method in the power system as described above when executing the computer program.

[0031] In order to solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the asset identification method in the power system as described above are implemented.

[0032] The present application provides an asset identification method for an electric power system. After obtaining the inter-device communication interaction flow data, the inter-device communication interaction flow data is pre-processed to obtain an inter-device communication feature vector set; the obtained inter-device communication feature vector set is automatically analyzed according to the communication object using a sequence association analysis algorithm, thereby obtaining an inter-device communication interaction behavior sequence pattern set M; the inter-device communication interaction behavior sequence pattern set M is labeled to obtain inter-device communication sample data, and then an asset classification model is constructed based on the inter-device sample data to identify assets in the electric power system. The present application is not only based on unsupervised pattern recognition technology, but also can realize the classification of assets in the electric power system without relying on the inherent ledger of assets and related background knowledge; it is also based on the unsupervised pattern recognition technology analysis output results, and further based on neural network modeling is performed to realize accurate classification of electric power system assets.

[0033] The asset identification device and computer-readable storage medium for use in the power system provided in the present application correspond to the above method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 A flowchart of an asset identification method in a power system provided by the present invention;

[0036] Figure 2 for Figure 1 A specific flow chart of step S10 described in;

[0037] Figure 3 for Figure 1 The specific flow chart of step S20 described in;

[0038] Figure 4 for Figure 1 A specific flow chart of step S30 described in;

[0039] Figure 5 A structural diagram of another asset identification device used in an electric power system provided by the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] The core of this application is to provide an asset identification method, device and storage medium for use in a power system.

[0042] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0043] With the diversification and continuous improvement of the intelligence level of power system business, asset identification and classification in power systems have become particularly important. In the field of industrial control, active and passive methods are more common asset identification and classification methods. Specific brief description: 1) The active method is to collect as much comprehensive information as possible to identify asset fingerprint characteristics, which may cause network congestion, especially in large-scale power systems, which may cause overload of devices such as PLCs and RTUs, resulting in normal requests being unable to respond. In addition, most power grid equipment is long-life equipment, and the equipment is too old, so it is difficult for a third party to obtain comprehensive and accurate information, or the personnel who may perform asset management and maintenance are outsourced personnel, making it even more difficult to provide accurate information or provide wrong information. As well as the heterogeneity of equipment and dedicated protocols, it is difficult to develop a comprehensive active method, so it is not very practical. 2) The passive method is based on TCP / IP protocol stack monitoring to obtain information, mainly session channel information. Due to the long-term operation of TCP session characteristics of power system equipment, the collected information is relatively limited, and some detailed information and comprehensive asset fingerprints cannot be obtained, resulting in low recognition rate and feasibility. However, both active and passive detection methods are imperfect for power system applications and cannot meet the business needs of users well.

[0044] Therefore, in order to solve the above problems, Figure 1 As shown, the present application provides an asset identification method for a power system, wherein the specific steps of the asset identification method include:

[0045] Step S10: The acquired device-to-device communication interaction flow data is preprocessed to obtain a set of feature vectors of the device-to-device communication session.

[0046] It should be noted that in each area of ​​the power system dispatching data network, a flow collection system is deployed in a bypass manner, and the mirrored flow data of the switch port is collected through network flow mirroring to obtain the communication interaction data of the equipment and store it in the disk / disk array; in other words, the communication interaction flow data between devices is obtained through network flow mirroring, and the original flow data of the pcap / pcapng package is captured.

[0047] like Figure 2 As shown, in the embodiment of the present application, the preprocessing of the communication interaction traffic data between the devices includes first segmentation and reorganization and then feature extraction, and the specific contents are:

[0048] The collected inter-device communication interaction traffic data is segmented and reorganized into five-tuples using a traffic segmentation tool, and feature vector data is extracted for subsequent behavior pattern analysis; wherein the key feature data of the inter-device communication feature vector set include packet timing, packet vector and packet time interval, and the packet vector includes packet size and packet flow direction.

[0049] It should be noted that the traffic segmentation tool is used to segment the captured inter-device communication interaction traffic data according to the five-tuple information to form the inter-device sending and receiving communication sessions, and then the specific content of the inter-device communication feature vector set obtained by feature extraction is:

[0050] Step S11: Use a traffic segmentation tool such as tshark to segment the captured inter-device communication interaction traffic data according to the same five-tuple information to form an inter-device sending and receiving communication session.

[0051] It should be noted that the device-to-device connection refers to the connection between the source device and the destination device, wherein the communication interaction traffic between the devices is generally composed of bidirectional traffic and data packets, each data packet is composed of multiple message header files and a payload containing application data, wherein the header of a session data packet is generally represented by a five-tuple information, usually the five-tuple information is source IP, source port, destination IP, destination port, and protocol. The present application divides the inter-device transceiver communication sessions according to the same five-tuple information, mainly according to the same five-tuple information in the header of each data packet to divide and form the inter-device transceiver communication sessions, for example: the protocol is MMS, the source IP is 10.10.1.10, the destination IP is 192.168.1.120, the source port is 800, and the destination port is 51770, that is, all traffic with the same five-tuple information (10.10.1.10, 800, 192.168.1.120, 51770, MMS) is extracted as a transceiver communication session from the source IP (10.10.1.10) to the destination IP (192.168.1.120) with the protocol being MMS.

[0052] Step S12: Extract features based on the inter-device communication session to obtain a feature vector set P of the inter-device communication session, that is, a feature vector set P = {P(1), P(2) ... P(i)} of the inter-device communication session, wherein any feature vector P(i) in the set P = {P1, P 2， ...P k}, where P k is the kth element of the i-th eigenvector P(i), P k ={five-tuple information of the i-th session, message sequence number, k-th data packet vector of the i-th session, time interval of the k-th data packet of the i-th session}.

[0053] For a better understanding of the description, the following is a brief description of the 19 time-series messages captured in chronological order, as shown in the following table:

[0054]

[0055] According to the example in the above table, after feature extraction of the transceiver communication session from the source IP (10.10.1.10) to the destination IP (192.168.1.120), there are seven feature vectors of the inter-device communication session with the same five-tuple information (10.10.1.10, 800, 192.168.1.120, 51770, MMS), wherein the feature vector of the inter-device communication session includes not only the five-tuple information but also the corresponding time sequence number, packet vector, and packet time interval. Finally, the feature vector set P of the inter-device communication session is a subset of the feature vectors of one of the multiple transceiver communication sessions between devices formed by segmenting the inter-device communication interaction traffic data according to the same five-tuple information, and is stored in a standardized manner as a data packet feature vector.

[0056] For example, the captured inter-device communication interaction traffic data is segmented according to the same five-tuple information by using a traffic segmentation tool such as tshark to form three inter-device communication sessions as shown in the above table, namely: the feature vector of the inter-device communication session 1 is {P1, P2, P3, P4, P5, P6, P7}, the feature vector of the inter-device communication session 2 is {P8, P9, P10}, and the feature vector of the inter-device communication session 3 is {P1, P2, P3, P4, P5, P6, P7}. 10 , P 11 , P 12} and the feature vector of inter-device communication session 3 is {P 13 , P 14 , P 15 , P 16 , P 17 , P 18 , P 19}.

[0057] Step S20: Use a sequence association analysis algorithm to automatically analyze the behavior patterns of the obtained feature vector set P of the inter-device communication session according to the communication object, so as to obtain the inter-device communication interaction behavior sequence pattern set M of different communication objects, wherein the inter-device communication interaction behavior sequence pattern set M is composed of the inter-device communication interaction behavior sequence patterns divided according to different communication objects, that is, the inter-device communication interaction behavior sequence pattern set M of different communication objects. j , where the sequence pattern of communication interaction behavior between devices of any communication object is: M j= {source IP of the jth communication object, destination IP of the jth communication object, data packet vector of the jth communication object, time interval ΔT between two consecutive sending or receiving data packets of the jth communication object j}.

[0058] like Figure 3 As shown, in the embodiment of the present application, the sequence association analysis algorithm is used to obtain the feature vector P in the set of inter-device communication feature vectors. i The specific automatic behavior pattern analysis based on the communication object is as follows:

[0059] Step S21: The feature vector P in the obtained inter-device communication feature vector set is i The data is classified according to the packet direction and protocol of the source IP, destination IP, and session data packet vector in the five-tuple information to form a subset of sending and receiving sessions from the same source IP to the same destination IP with the same protocol and the same direction.

[0060] For example, according to the same five-tuple information, three inter-device communication sessions are formed as shown in the table above, wherein the feature vector {P1, P2, P3, P4, P5, P6, P7} of the inter-device communication session 1 is classified according to the source IP, destination IP, packet direction and protocol of the session data packet vector in the five-tuple information to obtain the sending and receiving session subsets of the same source IP to the same destination IP of the same protocol in the same direction: {P1, P2, P4}, {P3, P5, P6, P7}, and the feature vector {P8, P9, P10} of the inter-device communication session 2 is {P1, P2, P3, P4, P5, P6, P7}. 10 , P 11 , P 12 According to the source IP, destination IP, packet direction and protocol of the session packet vector in the five-tuple information, the data is classified to obtain the sending and receiving session subsets with the same source IP to the same destination IP in the same direction and the same protocol: {P8, P9}, {P 10 , P 11 , P 12}, the feature vector of the inter-device communication session 3 {P 13 , P 14 , P 15 , P 16 , P 17 , P 18 , P 19 According to the source IP, destination IP, packet direction and protocol of the session data packet vector in the five-tuple information, the data is classified to obtain the sending and receiving session subsets with the same source IP to the same destination IP in the same direction and the same protocol: {P 13 , P 14 , P 16}、{P 15 , P17 , P 18 , P 19}.

[0061] Step S22: Frequent item mining is performed according to the packet vector and packet time interval characteristics in each subset, and a frequent item set is defined when the proportion of the same packet vector and packet time interval in each subset is not less than a set threshold, thereby obtaining a set M of communication interaction behavior sequence patterns between devices of different communication objects.

[0062] For example, assuming that the proportion of the same packet vector and packet time interval in each subset is not less than the set threshold of 50% to define a frequent item set, then the packet vector and packet time interval features in the feature vector subsets {P1, P2, P4} and {P3, P5, P6, P7} of the inter-device communication session 1 are further mined for frequent items. Among them, the proportion of the packet size of 20, the packet direction of TX and the time interval ΔT of 10 in {P1, P2, P4} is as high as 66.67%, so {10.10.1.10, 192.168 .1.120, TX, 20, 10} is a communication interaction behavior sequence pattern; frequent item mining is performed on the packet vector and packet time interval features in the subset {P3, P5, P6, P7} of the feature vector of the inter-device communication session 1, among which the proportion of packet size 53, packet direction RX and time interval ΔT of 20 in {P1, P2, P4} is as high as 50%, then {10.10.1.10, 192.168.1.120, RX, 53, 20} is determined to be a communication interaction behavior sequence pattern.

[0063] The subsets {P8, P9}, {P 10 , P 11 , P 12}, wherein the packet size of 53, the packet direction of RX and the time interval of ΔT of 20 in {P8, P9} appear in a proportion of up to 100%, and {10.10.1.13, 192.168.1.120, RX, 53, 20} is determined to be a communication interaction behavior sequence pattern; the subset of the feature vectors of the inter-device communication session 2 {P 10 , P 11 , P 12} to mine frequent items based on packet vector and packet time interval features, where {P 10 , P 11 , P 12}, the proportion of packet size 30, packet direction TX and time interval ΔT 12 is as high as 66.67%, so {10.10.1.13, 192.168.1.120, TX, 30, 12} is determined to be a communication interaction behavior sequence pattern.

[0064] For the subset of feature vectors of the inter-device communication session 3 {P 13 , P 14 , P 16} to mine frequent items based on packet vector and packet time interval features, where {P 13 , P 14 , P 16}, the proportion of packet size 36, packet direction RX and time interval ΔT 5 is as high as 66.67%, then {192.168.1.121, 10.10.1.10, RX, 36, 5} is determined to be a communication interaction behavior sequence pattern; for the subset of the feature vectors of the inter-device communication session 3 {P 15 , P 17 , P 18 , P 19} to mine frequent items based on packet vector and packet time interval features, where {P 15 , P 17 , P 18 , P 19}, the proportion of packet size 20, packet direction TX and time interval ΔT 10 is as high as 75%, so {192.168.1.121, 10.10.1.10, TX, 40, 8} is determined to be a communication interaction behavior sequence pattern.

[0065] According to the above, we can obtain the inter-device communication interaction behavior sequence pattern set M={M1, M2, M3, M4, M5, M6} of the three communication objects, which is as follows:

[0066] M1={10.10.1.10, 192.168.1.120, TX, 20, 10}

[0067] M2={10.10.1.10, 192.168.1.120, RX, 53, 20}

[0068] M3={10.10.1.13, 192.168.1.120, RX, 53, 20}

[0069] M4={10.10.1.13, 192.168.1.120, TX, 30, 12}

[0070] M5={192.168.1.121, 10.10.1.10, RX, 36, 5}

[0071] M6={192.168.1.121, 10.10.1.10, TX, 40, 8}

[0072] Among them, {M1, M2} is the inter-device communication interaction behavior sequence pattern of one communication object; {M3, M4} is the inter-device communication interaction behavior sequence pattern of another communication object; {M5, M6} is the inter-device communication interaction behavior sequence pattern of the third communication object.

[0073] In the embodiments of the present application, only limited data are used as examples for ease of understanding, but in actual applications, the number of subsets is large. For example, a certain subset obtained contains 100 data with the same source IP (192.168.1.2), destination IP (192.168.1.4), and data direction TX, of which the packet size is 20 and the time interval is 10ms. There are 60 data items, so it can be determined that {192.168.1.2, 192.168.1.4, TX, 20, 10} is a communication interaction behavior sequence pattern.

[0074] In addition, it is necessary to construct the communication interaction behavior sequence pattern M between devices of different communication objects. j Stored in database / disk, disk array / file system. It should be further explained that the inter-device communication interaction behavior sequence pattern library automatically performs behavior pattern analysis according to the communication object through timed startup and then performs full self-learning and updates the database.

[0075] Step S30: labeling the inter-device communication interaction behavior sequence pattern set M to obtain inter-device communication sample data, and then constructing an asset classification model based on the inter-device sample data to identify assets in the power system.

[0076] like Figure 4 As shown, in the embodiment of the present application, the specific content of obtaining the inter-device communication sample data after labeling the inter-device communication interaction behavior sequence pattern set M is: automatically adding type labels to the inter-device communication interaction behavior sequence pattern set M through clustering, and obtaining the inter-device communication sample data through type labels. In addition, the specific content of building an asset classification model based on the inter-device sample data to identify assets in the power system is:

[0077] Step S31, dividing the inter-device sample data into a training data set and a test data set in a random manner;

[0078] Step S32: After modeling and training the training data set using a deep learning algorithm, an asset classification training model is obtained, and the asset classification training model is verified with the test data set. If the verification results are consistent, the asset classification training model is the optimal asset classification model; if the verification results are inconsistent, the asset classification training model returns to self-learning at a fixed time until the optimal asset classification model is output after verification and consistency with the test data set;

[0079] Step S33: judge the real-time acquired inter-device communication interaction traffic data according to the optimal asset classification model. If the real-time acquired inter-device communication interaction traffic data does not correspond to the data set corresponding to the optimal asset classification model, it is judged that there are unknown assets in the real-time acquired inter-device communication interaction traffic data; otherwise, there are no unknown assets.

[0080] Specifically, the inter-device communication interaction behavior sequence pattern set M outputted from the above step S20 is labeled, and the interaction flow data in the labeled inter-device communication interaction behavior sequence pattern set M is used as sample data; then, a deep learning algorithm such as SVM, neural network algorithm CNN, etc. is used to perform modeling training on the training data set to obtain an asset classification training model file or weight file, and the training model or weight file is used to perform reasoning on the verification data set to verify the accuracy of the model, and the model file or weight file that meets the expectations is output and stored in a database / disk, disk array / distributed file system, or pushed to a message queue for use in real-time data reasoning. Start a scheduled task to perform self-learning and updating of the model on a regular basis.

[0081] Another asset identification method for a power system provided in an embodiment of the present application is introduced below. The asset identification method for a power system described below can be cross-referenced with other embodiments described in this document.

[0082] This application is an asset classification method for power systems, which generally includes six parts: flow collection, feature engineering, device protocol behavior model establishment, asset classification model training, asset classification module and timing scheduling. In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the specific implementation steps are described in detail below:

[0083] 1) Traffic collection: In each area of ​​the dispatching data network, a traffic collection system is deployed in a bypass manner. The mirrored traffic data of the switch port is collected through network traffic mirroring, the communication interaction data of the equipment is obtained, and stored in the disk / disk array.

[0084] 2) Feature Engineering: Use traffic segmentation tools such as tshark to segment and reassemble the collected device communication interaction traffic data according to the five-tuple (source IP, source port, destination IP, destination port, protocol), and extract feature vectors for analysis: P i ={five-tuple of the i-th data packet, the sequence number of the i-th data packet, the packet vector of the i-th data packet, the packet time interval of the i-th data packet}, and store the normalized feature vector in a database, a file system, etc.

[0085] 3) Behavior pattern mining: Using SPADE and other sequence association analysis algorithms, the stock feature vector data obtained in 2) is modeled according to the communication object, and the interactive behavior sequence pattern library of the communication object is mined and established: j = {source IP of the jth communication object, destination IP of the jth communication object, data packet vector of the jth communication object, time interval ΔT between two consecutive sending or receiving data packets of the jth communication object j}, define the sequences with the same packet vector and packet time interval as objects with the same behavior pattern, that is, the corresponding communication objects are the same type of devices, and store the analysis results in the database, file system, etc. Start the scheduled task, and repeat the above 1) to 3) regularly to perform full self-learning and update the database for the interactive behavior pattern set.

[0086] 4) Asset classification model training: Automatically label the behavior pattern database output in 3) above and use it as sample data. Modeling training is performed on the training data set using algorithms including but not limited to SVM and neural network algorithms such as CNN to obtain asset classification training model files or weight files, and the training model or weight files are used to perform reasoning on the verification data set to verify the accuracy of the model. The model files or weight files that meet expectations are output and stored in the database / disk, disk array / distributed file system, or pushed to the message queue for use in real-time data reasoning. Start the scheduled task to perform self-learning and updating of the model regularly.

[0087] 5) Asset classification or unknown asset identification: Use the asset classification model output from 4) above to analyze and reason about the interactive communication data of the equipment, detect unknown assets in the power system, or classify assets, and continuously revise the asset library to establish a comprehensive and accurate asset information library. The detailed process is: repeat 1) and 2) above to obtain normalized data; load the asset classification model; use the model to reason about the normalized data, identify unknown assets or classify assets; output the identification or classification results, and push the results to the message queue for consumption or directly store the database, file system, etc.

[0088] In summary, the present application provides an asset identification method for an electric power system. After obtaining the inter-device communication interaction flow data, the inter-device communication interaction flow data is pre-processed to obtain an inter-device communication feature vector set; the obtained inter-device communication feature vector set is automatically analyzed according to the communication object using a sequence association analysis algorithm, thereby obtaining an inter-device communication interaction behavior sequence pattern set M; the inter-device communication interaction behavior sequence pattern set M is labeled to obtain inter-device communication sample data, and then an asset classification model is constructed based on the inter-device sample data to identify assets in the electric power system. The present application is not only based on unsupervised pattern recognition technology, but also can realize the classification of assets in the electric power system without relying on the inherent ledger of assets and related background knowledge; it is also based on the unsupervised pattern recognition technology analysis output results, and further based on neural network modeling is performed to realize accurate classification of electric power system assets.

[0089] Figure 5 A structural diagram of an asset identification device for use in a power system provided in another embodiment of the present application, such as Figure 5 As shown, an asset identification device for use in a power system includes: a memory 40 for storing a computer program;

[0090] The processor 41 is used to implement the steps of the asset identification method for a power system in the above embodiment when executing a computer program.

[0091] The asset identification device provided in this embodiment for use in a power system may include but is not limited to a smart substation, a management platform, a laptop or desktop computer, etc.

[0092] Among them, the processor 41 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 41 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 41 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 41 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 41 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0093] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 40 is at least used to store the following computer program 401, wherein, after the computer program is loaded and executed by the processor 41, it can implement the relevant steps of a method for asset identification in a power system disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 402 may include Windows, Unix, Linux, etc. Data 303 may include, but is not limited to, a method for asset identification in a power system, etc.

[0094] In some embodiments, an asset identification device for use in an electric power system may further include a display screen 42 , an input / output interface 43 , a communication interface 44 , a power supply 45 , and a communication bus 46 .

[0095] Those skilled in the art will understand that Figure 2 The structure shown in the figure does not constitute a limitation of an asset identification device used in an electric power system, and may include more or less components than those shown in the figure.

[0096] An embodiment of the present application provides an asset identification device for use in a power system, including a memory and a processor. When the processor executes a program stored in the memory, it can implement the following method: an asset identification method for use in a power system.

[0097] The asset identification device provided in the present embodiment is used in the power system. The processor executes the computer program stored in the memory to calculate the available days of the remaining disk space according to the growth rate of the remaining disk space and the capacity of the remaining disk space. The device also sets multiple preset thresholds to work in segments to ensure that the user or administrator is informed of the disk space usage in a timely manner, so as to leave the user or administrator with sufficient time to make a decision. The device can stop the cleaning work in time by dynamically calculating the available days of the disk space, so as to prevent excessive cleaning of data files. Therefore, the asset identification device provided in the present embodiment is used in the power system. Through autonomous disk cleaning, the device can not only meet the continuous and stable operation of the disk and make full use of the limited disk space, but also maintain the stability of the equipment and reduce maintenance costs.

[0098] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0099] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0100] The computer-readable storage medium provided in this embodiment, when the computer program stored therein is executed, can calculate the number of days of available disk remaining space based on the growth rate of disk remaining space usage and the capacity of disk remaining space, and perform segmented work by setting multiple preset thresholds to ensure that the user or administrator is informed of the disk space usage in a timely manner, so as to give the user or administrator sufficient time to make a decision; and by dynamically calculating the number of days of available disk space, it can stop the cleanup work in time to prevent excessive cleaning of data files. Therefore, when the computer program in the computer-readable storage medium provided in this embodiment is executed, it can be realized by autonomous disk cleanup, which can not only meet the continuous and stable operation of the disk and make full use of limited disk space, but also maintain the stability of the equipment and reduce maintenance costs.

[0101] The above is a detailed introduction to an asset identification method, device and medium for use in an electric power system provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referenced to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0102] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A method for asset identification in a power system, characterized in that: include: The acquired device-to-device communication interaction flow data is preprocessed to obtain a set of feature vectors of the device-to-device communication session; Using a sequence association analysis algorithm, the obtained feature vector set P of the inter-device communication session is automatically analyzed according to the communication object, so as to obtain a set of inter-device communication interaction behavior sequence patterns M of different communication objects; The sequence pattern of communication interaction behavior between devices of any communication object is: j = {source IP of the jth communication object, destination IP of the jth communication object, data packet vector of the jth communication object, time interval ΔT between two consecutive sending or receiving data packets of the jth communication object j }; The inter-device communication interaction behavior sequence pattern set M is labeled to obtain inter-device communication sample data, and then an asset classification model is constructed based on the inter-device sample data to identify assets in the power system.

2. The asset identification method for a power system according to claim 1, characterized in that: The preprocessing of the communication interaction traffic data between the devices includes segmentation, reorganization and feature extraction, and the specific contents are as follows: The traffic segmentation tool is used to segment the captured device-to-device communication interaction traffic data according to five-tuple information to form a device-to-device communication session, and then feature extraction is performed to obtain a set of device-to-device communication feature vectors.

3. The asset identification method for a power system according to claim 2, characterized in that: The specific contents of using the traffic segmentation tool to segment the captured device-to-device communication interaction traffic data according to the five-tuple information to form a device-to-device communication session, and then extracting the features to obtain the device-to-device communication feature vector set are: The captured inter-device communication interaction traffic data is segmented by a traffic segmentation tool according to the same five-tuple information to form an inter-device transceiver communication session, wherein the five-tuple information is source IP, source port, destination IP, destination port, and protocol; According to the inter-device communication session, feature extraction is performed to obtain a feature vector set P of the inter-device communication session, that is, a feature vector set P = {P(1), P(2) ... P(i)} of the inter-device communication session, wherein any feature vector P(i) in the set P = {P1, P 2， ...P k }, where P k is the kth element of the i-th eigenvector P(i), P k ={five-tuple information of the i-th session, message sequence number, k-th data packet vector of the i-th session, time interval of the k-th data packet of the i-th session}.

4. The asset identification method for a power system according to claim 1, characterized in that: The sequence association analysis algorithm is used to automatically analyze the behavior patterns of the feature vectors Pi in the obtained inter-device communication feature vector set according to the communication objects, so as to obtain the specific content of the inter-device communication interaction behavior sequence pattern set M of different communication objects: The feature vector P in the obtained inter-device communication feature vector set is i Classify the data according to the packet direction and protocol of the source IP, destination IP, and session data packet vector in the five-tuple information to form a subset of sending and receiving sessions from the same source IP to the same destination IP with the same protocol and the same direction; Frequent item mining is then performed according to the packet vector and packet time interval characteristics in each subset, and the frequent item set is defined when the proportion of the same packet vector and packet time interval in each subset is not less than the set threshold, thereby obtaining a set of sequential pattern M of communication interaction behaviors between devices of different communication objects.

5. The asset identification method for a power system according to claim 1, characterized in that: The inter-device communication interaction behavior sequence pattern set M is started at a fixed time and then repeatedly performs behavior pattern analysis automatically according to the communication object to perform full self-learning and update the database.

6. The asset identification method for a power system according to claim 1, characterized in that: The specific content of the inter-device communication sample data obtained by labeling the inter-device communication interaction behavior sequence pattern set M is: The inter-device communication interaction behavior sequence pattern set M is automatically added with type labels through clustering, and the inter-device communication sample data is obtained through type labeling.

7. The asset identification method for a power system according to claim 1, characterized in that: The specific content of building an asset classification model based on the sample data between devices to identify assets in the power system is: Dividing the inter-device sample data into a training data set and a test data set in a random manner; After modeling and training on the training data set using a deep learning algorithm, an asset classification training model is obtained, and the asset classification training model is verified with the test data set. If the verification results are consistent, the asset classification training model is the optimal asset classification model; if the verification results are inconsistent, the asset classification training model returns to self-learning at a fixed time until it is verified to be consistent with the test data set, and then the optimal asset classification model is output; The real-time acquired inter-device communication interaction traffic data is judged according to the optimal asset classification model. If the real-time acquired inter-device communication interaction traffic data does not correspond to the data set corresponding to the optimal asset classification model, it is judged that unknown assets exist in the real-time acquired inter-device communication interaction traffic data. Otherwise, there are no unknown assets.

8. The asset identification method for a power system according to claim 1, characterized in that: The deep learning algorithm is a support vector machine (SVM) algorithm or a neural network (CNN) algorithm.

9. An asset identification device for use in a power system, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the asset identification method for an electric power system as claimed in any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the asset identification method for a power system as claimed in any one of claims 1 to 8.

Images