Power protocol message data anomaly detection method and device, server and storage medium

Abstract

The embodiment of the invention provides an anomaly detection method and device for power protocol message data, a server and a storage medium. Relates to the field of power system automation and power communication. The method comprises the steps of obtaining a data detection request; and obtaining power protocol message data according to the data detection request. Performing anomaly detection processing on an abnormal protocol in the power protocol message data according to a preset sparse auto-encoder to obtain output data; wherein the preset sparse auto-encoder is obtained by training a plurality of self-defined weight parameters according to historical power protocol message data. Determining a mean square error value between the output data and the power protocol message data; and if it is determined that the mean square error value is greater than a preset anomaly detection threshold, determining that the power protocol message data is abnormal data. The method is used for achieving the effect of improving the detection accuracy of the power protocol transmission abnormity.

Description

Technical Field

[0001] The present application relates to the fields of power system automation and power communication, and in particular to a method, device, server and storage medium for detecting anomalies in power protocol message data. Background Art

[0002] At present, in modern power systems, power protocol transmission is a key technology for realizing power grid monitoring, control and data exchange. With the development of smart grids, the stability and reliability of power protocol transmission have become particularly important. However, due to the increasing complexity of power systems, anomalies may occur during protocol transmission, such as data packet errors. If these anomalies are not discovered and handled in time, they may lead to unstable power grid operation and even cause safety accidents.

[0003] In the prior art, traditional anomaly detection methods usually rely on manual monitoring or simple threshold alarms. However, traditional anomaly detection methods have limitations in real-time and accuracy, and are difficult to meet the requirements of modern power systems for high efficiency and high reliability.

[0004] Therefore, there is an urgent need for a method that can effectively detect power protocol transmission anomalies. Summary of the invention

[0005] The embodiments of the present application provide a method, device, server and storage medium for detecting anomalies in power protocol message data, so as to achieve the effect of improving the detection accuracy of power protocol transmission anomalies.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting anomaly in power protocol message data, comprising:

[0007] Obtaining a data detection request; obtaining power protocol message data according to the data detection request;

[0008] According to a preset sparse autoencoder, abnormal detection processing is performed on the abnormal protocol in the power protocol message data to obtain output data; wherein the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters;

[0009] Determine a mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, determine that the power protocol message data is abnormal data.

[0010] In a possible implementation manner, performing abnormality detection processing on abnormal protocols in the power protocol message data according to a preset sparse autoencoder to obtain output data includes:

[0011] According to a preset sparse autoencoder, the power protocol message data is parsed to obtain parsed data;

[0012] According to a first preset protocol in the sparse autoencoder, searching for key implicit features in the parsed data;

[0013] According to the second preset protocol in the sparse autoencoder, the key implicit features are encapsulated, and the abnormal protocols in the encapsulated data are detected to obtain output data.

[0014] In one possible implementation, the sparse autoencoder includes a sparse cost function, and the sparse cost function J(W, b) can be expressed as:

[0015]

[0016] Wherein, m is the number of samples of the power protocol message data; n is the number of data points of the power protocol message; is the number of neurons in the lth layer; is the number of neurons in the hidden layer; is the weight penalty parameter; is the weight of the sparse penalty term; is the KL divergence; is the weight value connecting the i-th neuron in the l-th layer and the j-th neuron in the l+1-th layer in the weight matrix of the l-th layer; is the number of neurons in the l+1th layer; is the i-th input sample; Represents the sparse autoencoder input The reconstructed output of .

[0017] In a possible implementation manner, before performing anomaly detection processing on an abnormal protocol in the power protocol message data according to a preset sparse autoencoder to obtain output data, the method further includes:

[0018] The flow information of the transmission layer and below in the power protocol message data is removed to obtain the load part of the transmission layer; and the load part is normalized to be exported as the power protocol message data in a preset format.

[0019] In a possible implementation, the method further includes:

[0020] Obtain historical power protocol message data of power equipment under normal operation;

[0021] In response to the first editing operation, generating a plurality of customized weight parameters;

[0022] In response to the second editing operation, the number of nodes of the input layer and the hidden layer of the sparse autoencoder are generated respectively; and initialization processing is performed to obtain a weight matrix and a bias parameter;

[0023] In response to the third editing operation, generating a batch training quantity, an optimizer, and a number of iterations of the sparse autoencoder;

[0024] Based on the customized parameter values, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for training processing until the sparse autoencoder converges.

[0025] In a possible implementation, based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for training processing until the sparse autoencoder converges, including:

[0026] Based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, inputting the historical power protocol message data into the sparse autoencoder for training processing;

[0027] Based on a preset forward algorithm, the average sparse cost function and the average activation amount are calculated; and based on a preset back propagation algorithm, the weight parameters and the bias parameters are updated according to the average sparse cost function and the average activation amount to generate a sparse cost function; wherein the sparse cost function is a trained sparse autoencoder.

[0028] In a possible implementation, based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder, including:

[0029] Based on the customized parameter values, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for offline training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder.

[0030] In a second aspect, an embodiment of the present application provides an abnormality detection device for power protocol message data, comprising:

[0031] A first acquisition module is used to acquire a data detection request; and acquire power protocol message data according to the data detection request;

[0032] A detection module, used to perform anomaly detection processing on the abnormal protocol in the power protocol message data according to a preset sparse autoencoder to obtain output data; wherein the preset sparse autoencoder is trained according to historical power protocol message data and multiple customized weight parameters;

[0033] A determination module is used to determine a mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, the power protocol message data is determined to be abnormal data.

[0034] In a possible implementation manner, the detection module is specifically used to:

[0035] According to a preset sparse autoencoder, the power protocol message data is parsed to obtain parsed data;

[0036] According to a first preset protocol in the sparse autoencoder, searching for key implicit features in the parsed data;

[0037] According to the second preset protocol in the sparse autoencoder, the key implicit features are encapsulated, and the abnormal protocols in the encapsulated data are detected to obtain output data.

[0038] In one possible implementation, the sparse autoencoder includes a sparse cost function, and the sparse cost function J(W, b) can be expressed as:

[0039]

[0040] Wherein, m is the number of samples of the power protocol message data; n is the number of data points of the power protocol message; is the number of neurons in the lth layer; is the number of neurons in the hidden layer; is the weight penalty parameter; is the weight of the sparse penalty term; is the KL divergence; is the weight value connecting the i-th neuron in the l-th layer and the j-th neuron in the l+1-th layer in the weight matrix of the l-th layer; is the number of neurons in the l+1th layer; is the i-th input sample; Represents the sparse autoencoder input The reconstructed output of .

[0041] In a possible implementation manner, the device is further specifically used for:

[0042] According to the preset sparse autoencoder, anomaly detection processing is performed on the abnormal protocol in the power protocol message data. Before obtaining the output data, the flow information of the transmission layer and below in the power protocol message data is removed to obtain the load part of the transmission layer; and the load part is normalized and exported to the power protocol message data in a preset format.

[0043] In a possible implementation, the device further includes:

[0044] A second acquisition module is used to acquire historical power protocol message data of the power equipment under normal operation;

[0045] A first generating module, configured to generate a plurality of user-defined weight parameters in response to a first editing operation;

[0046] The second generation module is used to generate the number of nodes of the input layer and the hidden layer of the sparse autoencoder in response to the second editing operation; and perform initialization processing to obtain a weight matrix and a bias parameter;

[0047] A third generating module, configured to generate, in response to a third editing operation, a batch training quantity, an optimizer, and a number of iterations of the sparse autoencoder;

[0048] A training module is used to input the historical power protocol message data into the sparse autoencoder for training processing based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations until the sparse autoencoder converges.

[0049] In a possible implementation, the training module is specifically used to:

[0050] Based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, inputting the historical power protocol message data into the sparse autoencoder for training processing;

[0051] Based on a preset forward algorithm, the average sparse cost function and the average activation amount are calculated; and based on a preset back propagation algorithm, the weight parameters and the bias parameters are updated according to the average sparse cost function and the average activation amount to generate a sparse cost function; wherein the sparse cost function is a trained sparse autoencoder.

[0052] In a possible implementation, the training module is specifically used to:

[0053] Based on the customized parameter values, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for offline training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder.

[0054] In a third aspect, an embodiment of the present application provides a server, including: a memory, a processor;

[0055] The memory stores computer-executable instructions;

[0056] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0057] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0058] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0059] The method, device, server and storage medium for detecting abnormality of power protocol message data provided by the embodiment of the present application obtain a data detection request; according to the data detection request, the power protocol message data is obtained. According to the preset sparse autoencoder, the abnormal protocol in the power protocol message data is subjected to abnormal detection processing to obtain output data; wherein, the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters. Determine the mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than the preset abnormal detection threshold, the power protocol message data is determined to be abnormal data. In this scheme, the trained sparse autoencoder is used to calculate the output data, and the abnormal detection threshold is used to determine whether the power protocol message data is abnormal. Therefore, the sparse autoencoder neural network model is used to automatically detect the abnormal protocol in the power telecontrol. The present application can realize the rapid and accurate identification of abnormal power protocol transmission, which can improve the intelligence level and operation efficiency of the power system, greatly improve the detection accuracy, and reduce the workload of the operator. It is used to achieve the effect of improving the detection accuracy of abnormal power protocol transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0061] Figure 1 A schematic diagram of a method for detecting abnormality in power protocol message data provided in this application Figure 1 ;

[0062] Figure 2 Another method for detecting abnormality of power protocol message data provided in the present application is shown in FIG. Figure 2 ;

[0063] Figure 3 A schematic diagram of a scenario of an abnormality detection method for power protocol message data provided in this application;

[0064] Figure 4 A schematic diagram of the structure of an abnormality detection device for power protocol message data provided in an embodiment of the present application;

[0065] Figure 5 A schematic diagram of the structure of another device for detecting abnormality of power protocol message data provided in an embodiment of the present application;

[0066] Figure 6 A schematic diagram of the structure of a server provided in an embodiment of the present application.

[0067] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0068] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0069] At present, in modern power systems, power protocol transmission is a key technology for realizing power grid monitoring, control and data exchange. With the development of smart grids, the stability and reliability of power protocol transmission have become particularly important. However, due to the increasing complexity of power systems, anomalies may occur during protocol transmission, such as data packet errors. If these anomalies are not discovered and handled in time, they may lead to unstable power grid operation and even cause safety accidents.

[0070] In one example, traditional anomaly detection methods usually rely on manual monitoring or simple threshold alarms. However, traditional anomaly detection methods have limitations in real-time and accuracy, and are difficult to meet the requirements of modern power systems for high efficiency and high reliability. Therefore, there is an urgent need for a method that can effectively detect power protocol transmission anomalies.

[0071] In combination with the above scenarios, it can be seen that in the prior art, there is a technical problem of poor detection accuracy of power protocol transmission anomalies.

[0072] The anomaly detection method for power protocol message data provided in the present application automatically detects abnormal protocols in power telecontrol through a sparse autoencoder neural network model, thereby solving the technical problem of poor detection accuracy of power protocol transmission anomalies.

[0073] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0074] Figure 1 A schematic diagram of a method for detecting abnormality in power protocol message data provided in this application Figure 1 ,like Figure 1 As shown, the method includes:

[0075] S101, obtaining a data detection request; obtaining power protocol message data according to the data detection request.

[0076] Exemplarily, the execution subject of this embodiment may be a server. First, a data detection request is obtained, and according to the data detection request, power protocol message data of the power equipment in the running state is obtained.

[0077] S102. According to a preset sparse autoencoder, abnormal detection processing is performed on abnormal protocols in the power protocol message data to obtain output data; wherein the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters.

[0078] Exemplarily, the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters. The server performs intelligent anomaly detection processing on abnormal protocols in the power protocol message data according to the preset sparse autoencoder to obtain output data.

[0079] S103, determining a mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, determining that the power protocol message data is abnormal data.

[0080] Exemplarily, the mean square error value MSE between the output data and the input power protocol message data is calculated, and the MSE is compared with a preset abnormality detection threshold T. When MSE>T, the power protocol message data is determined to be abnormal data, and when MSE is less than or equal to T, the power protocol message data is determined to be normal data. The abnormality detection threshold T is calculated by the kernel density estimation method.

[0081] The method for detecting anomalies in power protocol message data provided in the embodiment of the present application obtains a data detection request; and obtains power protocol message data according to the data detection request. According to the preset sparse autoencoder, the abnormal protocol in the power protocol message data is subjected to abnormal detection processing to obtain output data; wherein, the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters. Determine the mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than the preset abnormal detection threshold, the power protocol message data is determined to be abnormal data. In this scheme, the trained sparse autoencoder is used to calculate the output data, and the abnormal detection threshold is used to determine whether the power protocol message data is abnormal. Therefore, the sparse autoencoder neural network model is used to automatically detect abnormal protocols in power telecontrol. The present application can realize the rapid and accurate identification of power protocol transmission anomalies, improve the intelligence level and operation efficiency of the power system, greatly improve the detection accuracy, and reduce the workload of operators. It is used to achieve the effect of improving the detection accuracy of power protocol transmission anomalies.

[0082] Figure 2 A schematic diagram of a method for detecting abnormality in power protocol message data provided in this application Figure 2 ,like Figure 2 As shown, in this embodiment Figure 1 Based on the embodiment, a method for detecting abnormality of power protocol message data is described in detail, and the method includes:

[0083] S201. Obtain historical power protocol message data of power equipment under normal operation.

[0084] Exemplarily, the server needs to perform data collection and preprocessing. Specifically, the historical power protocol message data of the power equipment under normal operation can be obtained, and the collected data can be preprocessed to facilitate the training of the neural network. Preprocessing refers to using Wireshark traffic monitoring software to capture the real-time traffic in the power protocol message data, remove the traffic information at and below the transport layer, that is, retain the load part of the transport layer as the input data x, and export the input data x to the power protocol message data in txt format after normalization.

[0085] S202: In response to the first editing operation, generate a plurality of customized weight parameters.

[0086] Exemplarily, a sparse autoencoder is constructed. First, based on the user's first editing operation, multiple customized weight parameters are generated, where the weight parameters include sparsity parameter ρ, penalty weight parameter β, weight penalty parameter λ, training learning rate and other parameters.

[0087] S203. In response to the second editing operation, the number of nodes of the input layer and the hidden layer of the candidate model are generated respectively; and initialization processing is performed to obtain a weight matrix and bias parameters.

[0088] Exemplarily, based on the user's second editing operation, the number of nodes in the input layer and the number of nodes in the hidden layer of the candidate model are generated respectively; and the weight matrix W and the bias parameter b are initialized.

[0089] S204: In response to the third editing operation, generate the batch training quantity, optimizer, and iteration number of the candidate model.

[0090] Exemplarily, based on the user's third editing operation, the batch training quantity, optimizer, number of iterations, etc. of the candidate model are generated.

[0091] S205. Based on the customized parameter values, number of nodes, number of batch training, optimizer, and number of iterations, historical power protocol message data is input into the candidate model for training processing until the candidate model converges to obtain a sparse autoencoder.

[0092] In one example, S205 includes: based on custom parameter values, number of nodes, batch training quantity, optimizer, and number of iterations, inputting historical power protocol message data into a sparse autoencoder for training processing; based on a preset forward algorithm, calculating the average sparse cost function and the average activation amount; and based on a preset back propagation algorithm, updating weight parameters and bias parameters according to the average sparse cost function and the average activation amount to generate a sparse cost function; wherein the sparse cost function is a trained sparse autoencoder.

[0093] In one example, S205 includes: based on the customized parameter values, number of nodes, batch training quantity, optimizer, and number of iterations, inputting the historical power protocol message data into the sparse autoencoder for offline training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder.

[0094] Exemplarily, considering that the power protocol message data has many features and contains a large amount of redundant information, a sparse autoencoder is selected as the neural network model of the present application, and in the training process of the sparse autoencoder, the sparse autoencoder will learn to reconstruct the input data, extract the inherent implicit features contained in the power protocol message data, and realize intelligent anomaly detection of the power protocol message data through feature function expression. Specifically, based on the customized parameter value, number of nodes, number of batch training, optimizer, and number of iterations, the preprocessed power protocol message data is used as input for deep learning training of the sparse autoencoder. Then the forward algorithm is executed to calculate the average sparse cost function and the average activation amount ρ i Finally, the back propagation algorithm is performed to update the weight parameters and bias parameters according to the average sparse cost function and the average activation amount to obtain the final sparse autoencoder. Furthermore, the training of the sparse cost function can be done offline or online, and there is no limitation on this.

[0095] S206, obtaining a data detection request; obtaining power protocol message data according to the data detection request.

[0096] For example, this step can be referred to Figure 1 Step 101 in the above is not described in detail.

[0097] S207, removing the flow information of the transport layer and below in the power protocol message data to obtain the load part of the transport layer; and normalizing the load part to export it into the power protocol message data in a preset format.

[0098] For example, the server can use Wireshark traffic monitoring software to capture real-time traffic in the power protocol message data, remove the traffic information of the transport layer and below in the power protocol message data, and obtain the load part of the transport layer. The load part is normalized and exported as power protocol message data in a preset format. The preset format can be txt format, which is not limited to this.

[0099] S208. According to a preset sparse autoencoder, abnormal detection processing is performed on abnormal protocols in the power protocol message data to obtain output data; wherein the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters.

[0100] In one example, S208 includes: parsing the power protocol message data according to a preset sparse autoencoder to obtain parsed data; searching for key implicit features in the parsed data according to a first preset protocol in the sparse autoencoder; encapsulating the key implicit features according to a second preset protocol in the sparse autoencoder, and performing anomaly detection on abnormal protocols in the encapsulated data to obtain output data.

[0101] In one example, the sparse autoencoder includes a sparse cost function, and the sparse cost function J(W,b) can be expressed as:

[0102]

[0103] Wherein, m is the number of samples of the power protocol message data; n is the number of data points of the power protocol message; is the number of neurons in the lth layer; is the number of neurons in the hidden layer; is the weight penalty parameter; is the weight of the sparse penalty term; is the KL divergence; is the weight value connecting the i-th neuron in the l-th layer and the j-th neuron in the l+1-th layer in the weight matrix of the l-th layer; is the number of neurons in the l+1th layer; is the i-th input sample; Represents the sparse autoencoder input The reconstructed output of .

[0104] Exemplarily, the server can parse and process the power protocol message data according to a preset sparse autoencoder to obtain parsed data, for example, the parsed data includes field and other information. According to the first preset protocol in the sparse autoencoder, the key implicit features are searched in the parsed data, and according to the second preset protocol in the sparse autoencoder, the key implicit features are encapsulated, and the abnormal protocols in the encapsulated data are detected to obtain reconstructed output data. Among them, the first preset protocol and the second preset protocol are both preset protocols, the first preset protocol includes the search conditions for the key implicit features, and the second preset protocol includes the encapsulation protocol, etc., which are not limited to this.

[0105] Furthermore, the sparse autoencoder includes a sparse cost function, and the sparse cost function J(W,b) can be expressed as:

[0106]

[0107] Wherein, m is the number of samples of the power protocol message data; n is the number of data points of the power protocol message; is the number of neurons in the lth layer; is the number of neurons in the hidden layer; is the weight penalty parameter; is the weight of the sparse penalty term; is the KL divergence; is the weight value connecting the i-th neuron in the l-th layer and the j-th neuron in the l+1-th layer in the weight matrix of the l-th layer; is the number of neurons in the l+1th layer; is the i-th input sample; Represents the sparse autoencoder input The reconstructed output of .

[0108] S209, determining a mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, determining that the power protocol message data is abnormal data.

[0109] Exemplarily, the server can calculate the mean square error value MSE between the output data and the input power protocol message data, and compare the MSE with the preset anomaly detection threshold T. When MSE>T, the power protocol message data is determined to be abnormal data, and when MSE is less than or equal to T, the power protocol message data is determined to be normal data. Among them, the anomaly detection threshold T is calculated by the Kernel Density Estimation method. Furthermore, an online method is required to perform anomaly detection on real-time power protocol message data.

[0110] Among them, the calculation formula of the mean square error value MSE of the output data and the input data is:

[0111]

[0112] m is the number of samples of power protocol message data; Represents input data; Represents output data.

[0113] The method for detecting anomalies of power protocol message data provided in the embodiment of the present application obtains historical power protocol message data of power equipment under normal operation. In response to the first editing operation, a plurality of customized weight parameters are generated. In response to the second editing operation, the number of nodes of the input layer and the hidden layer of the candidate model are generated respectively; and the initialization processing is performed to obtain the weight matrix and the bias parameter. In response to the third editing operation, the batch training quantity, optimizer, and number of iterations of the candidate model are generated. Based on the customized parameter values, number of nodes, batch training quantity, optimizer, and number of iterations, the historical power protocol message data is input into the candidate model for training processing until the candidate model converges to obtain a sparse autoencoder. Obtain a data detection request; according to the data detection request, obtain the power protocol message data. Remove the traffic information of the transmission layer and below in the power protocol message data to obtain the load part of the transmission layer; and normalize the load part to export it into the power protocol message data of the preset format. According to the preset sparse autoencoder, abnormal detection processing is performed on the abnormal protocols in the power protocol message data to obtain output data; wherein, the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters. Determine the mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than the preset abnormal detection threshold, the power protocol message data is determined to be abnormal data. Therefore, using the sparse autoencoder neural network model to automatically detect abnormal protocols in power telecontrol, the present application can realize the rapid and accurate identification of power protocol transmission anomalies, which can improve the intelligence level and operation efficiency of the power system, greatly improve the detection accuracy, and reduce the workload of operators. It is used to achieve the effect of improving the detection accuracy of power protocol transmission anomalies.

[0114] In one example, Figure 3 A schematic diagram of a scenario of an abnormality detection method for power protocol message data provided in this application, such as Figure 3 As shown in the figure, the horizontal axis is the number of samples, the vertical axis is the anomaly detection index, the horizontal dotted line represents the anomaly detection threshold T, the vertical line represents the point where the power protocol transmission anomaly occurs, and the bold curve is the output data obtained by the sparse autoencoder detection. When an abnormal sample appears, the bold curve exceeds the anomaly detection threshold T, indicating that the anomaly in the power protocol transmission can be successfully detected.

[0115] Figure 4 A schematic diagram of the structure of an abnormality detection device for power protocol message data provided by the present application is shown in FIG. Figure 4 As shown, the power protocol message data anomaly detection device 30 provided in this embodiment includes:

[0116] The first acquisition module 31 is used to acquire a data detection request; and acquire power protocol message data according to the data detection request;

[0117] The detection module 32 is used to perform abnormal detection processing on abnormal protocols in the power protocol message data according to a preset sparse autoencoder to obtain output data; wherein the preset sparse autoencoder is trained according to historical power protocol message data and multiple customized weight parameters;

[0118] The determination module 33 is used to determine the mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, the power protocol message data is determined to be abnormal data.

[0119] Figure 5 A schematic diagram of the structure of another abnormality detection device for power protocol message data provided in an embodiment of the present application, Figure 4 Based on the embodiment shown, Figure 5 As shown, the detection module 32 is specifically used for:

[0120] According to the preset sparse autoencoder, the power protocol message data is parsed and processed to obtain the parsed data;

[0121] According to the first preset protocol in the sparse autoencoder, key latent features are found in the parsed data;

[0122] According to the second preset protocol in the sparse autoencoder, the key implicit features are encapsulated, and the abnormal protocols in the encapsulated data are detected to obtain output data.

[0123] In one possible implementation, the sparse autoencoder includes a sparse cost function, and the sparse cost function J(W, b) can be expressed as:

[0124]

[0125] Wherein, m is the number of samples of the power protocol message data; n is the number of data points of the power protocol message; is the number of neurons in the lth layer; is the number of neurons in the hidden layer; is the weight penalty parameter; is the weight of the sparse penalty term; is the KL divergence; is the weight value connecting the i-th neuron in the l-th layer and the j-th neuron in the l+1-th layer in the weight matrix of the l-th layer; is the number of neurons in the l+1th layer; is the i-th input sample; Represents the sparse autoencoder input The reconstructed output of .

[0126] In a possible implementation manner, the device is further specifically used for:

[0127] According to the preset sparse autoencoder, anomaly detection processing is performed on the abnormal protocols in the power protocol message data. Before obtaining the output data, the flow information of the transmission layer and below in the power protocol message data is removed to obtain the load part of the transmission layer; and the load part is normalized and exported to the power protocol message data in a preset format.

[0128] In a possible implementation, the device further includes:

[0129] The second acquisition module 41 is used to acquire historical power protocol message data of the power equipment under normal operation;

[0130] A first generating module 42, configured to generate a plurality of user-defined weight parameters in response to a first editing operation;

[0131] The second generating module 43 is used to generate the number of nodes of the input layer and the hidden layer of the sparse autoencoder respectively in response to the second editing operation; and perform initialization processing to obtain a weight matrix and a bias parameter;

[0132] A third generating module 44 is used to generate a batch training quantity, an optimizer, and a number of iterations of the sparse autoencoder in response to the third editing operation;

[0133] The training module 45 is used to input the historical power protocol message data into the sparse autoencoder for training processing based on the customized parameter values, number of nodes, batch training quantity, optimizer, and number of iterations until the sparse autoencoder converges.

[0134] In a possible implementation, the training module 45 is specifically configured to:

[0135] Based on the customized parameter values, number of nodes, number of batch training, optimizer, and number of iterations, historical power protocol message data is input into the sparse autoencoder for training processing;

[0136] Based on the preset forward algorithm, the average sparse cost function and the average activation amount are calculated; and based on the preset back propagation algorithm, the weight parameters and bias parameters are updated according to the average sparse cost function and the average activation amount to generate a sparse cost function; wherein the sparse cost function is a trained sparse autoencoder.

[0137] In a possible implementation, the training module 45 is specifically configured to:

[0138] Based on the customized parameter values, number of nodes, number of batch training, optimizer, and number of iterations, the historical power protocol message data is input into the sparse autoencoder for offline training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder.

[0139] The device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0140] Figure 6 This is a schematic diagram of the server structure provided for this application. Figure 6 As shown, the server 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the server 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0141] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0142] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0143] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0144] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0145] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0146] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0147] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0148] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0149] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0150] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0151] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0152] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0153] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0154] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0155] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for detecting anomaly in power protocol message data, characterized in that: include: Get data detection request; Acquiring power protocol message data according to the data detection request; According to a preset sparse autoencoder, abnormal detection processing is performed on the abnormal protocol in the power protocol message data to obtain output data; wherein the preset sparse autoencoder is trained based on historical power protocol message data and multiple customized weight parameters; Determine a mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, determine that the power protocol message data is abnormal data.

2. The method according to claim 1, characterized in that The method of performing abnormal detection processing on abnormal protocols in the power protocol message data according to the preset sparse autoencoder to obtain output data includes: According to a preset sparse autoencoder, the power protocol message data is parsed to obtain parsed data; According to a first preset protocol in the sparse autoencoder, searching for key implicit features in the parsed data; According to the second preset protocol in the sparse autoencoder, the key implicit features are encapsulated, and the abnormal protocols in the encapsulated data are detected to obtain output data.

3. The method according to claim 2, characterized in that The sparse autoencoder includes a sparse cost function, and the sparse cost function J(W, b) can be expressed as: Wherein, m is the number of samples of the power protocol message data; n is the number of data points of the power protocol message; is the number of neurons in the lth layer; is the number of neurons in the hidden layer; is the weight penalty parameter; is the weight of the sparse penalty term; is the KL divergence; is the weight value connecting the i-th neuron in the l-th layer and the j-th neuron in the l+1-th layer in the weight matrix of the l-th layer; is the number of neurons in the l+1th layer; is the i-th input sample; Represents the sparse autoencoder input The reconstructed output of .

4. The method according to claim 1, characterized in that: Before performing abnormality detection processing on abnormal protocols in the power protocol message data according to a preset sparse autoencoder to obtain output data, the method further includes: The flow information of the transmission layer and below in the power protocol message data is removed to obtain the load part of the transmission layer; and the load part is normalized to be exported as the power protocol message data in a preset format.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Obtain historical power protocol message data of power equipment under normal operation; In response to the first editing operation, generating a plurality of customized weight parameters; In response to the second editing operation, the number of nodes of the input layer and the hidden layer of the sparse autoencoder are generated respectively; and initialization processing is performed to obtain a weight matrix and a bias parameter; In response to the third editing operation, generating a batch training quantity, an optimizer, and a number of iterations of the sparse autoencoder; Based on the customized parameter values, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for training processing until the sparse autoencoder converges.

6. The method according to claim 5, characterized in that The step of inputting the historical power protocol message data into the sparse autoencoder for training based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations until the sparse autoencoder converges includes: Based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, inputting the historical power protocol message data into the sparse autoencoder for training processing; Based on a preset forward algorithm, the average sparse cost function and the average activation amount are calculated; and based on a preset back propagation algorithm, the weight parameters and the bias parameters are updated according to the average sparse cost function and the average activation amount to generate a sparse cost function; wherein the sparse cost function is a trained sparse autoencoder.

7. The method according to claim 5, characterized in that Based on the customized parameter value, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder, including: Based on the customized parameter values, the number of nodes, the batch training quantity, the optimizer, and the number of iterations, the historical power protocol message data is input into the sparse autoencoder for offline training processing until the sparse autoencoder converges to obtain a trained sparse autoencoder.

8. An abnormality detection device for power protocol message data, characterized in that: include: A first acquisition module, used to acquire a data detection request; Acquiring power protocol message data according to the data detection request; A detection module, used to perform anomaly detection processing on the abnormal protocol in the power protocol message data according to a preset sparse autoencoder to obtain output data; wherein the preset sparse autoencoder is trained according to historical power protocol message data and multiple customized weight parameters; A determination module is used to determine a mean square error value between the output data and the power protocol message data; if it is determined that the mean square error value is greater than a preset abnormality detection threshold, the power protocol message data is determined to be abnormal data.

9. A server, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images