New energy station network security monitoring and early warning method and system

Abstract

The invention discloses a network security monitoring and early warning method and system for a new energy station, and relates to the technical field of network security, and the method comprises the following steps: energy flow and information flow collection, comprising but not limited to key parts of power generation equipment, power transformation equipment and energy storage equipment and a main path of energy transmission, collaborative analysis of energy flow and information flow and establishment of a correlation model are organically combined, data of the energy flow and the information flow are collected and analyzed in real time, and the correlation relation between the energy flow and the information flow is established; and when the information flow is abnormal, comprehensive judgment is carried out in combination with the real-time state of the energy flow, so that network attacks which aim to interfere with the output of the energy flow are effectively identified, potential network security threats are comprehensively and accurately perceived, and in addition, by monitoring the energy conversion efficiency of the equipment in real time, the network security threats are comprehensively and accurately perceived. And analysis is performed in combination with historical data and equipment operation conditions, so that the influence of the network attack on the equipment operation state is found.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a new energy station network security monitoring and early warning method and system. Background Art

[0002] As the global demand for renewable energy continues to grow, new energy stations play an increasingly important role in the energy supply system. These stations have achieved efficient energy production and transmission through advanced network technology and equipment. However, as new energy stations increasingly rely on the network to connect and control equipment, their network security issues have become increasingly prominent. The network system of new energy stations not only faces the threat of external network attacks, but also causes unstable operation due to communication failures or data anomalies of internal equipment. Therefore, ensuring the network security of new energy stations has become the key to ensuring the stability and security of energy supply.

[0003] Traditional network security analysis methods mainly focus on the network data level, identifying potential network security threats by monitoring and analyzing network traffic, data packet content and other information. However, this method has obvious shortcomings when facing the specific scenario of new energy stations. First, the equipment in new energy stations is mostly connected and controlled through the network. Its operating status is not only affected by network data, but also closely related to the transmission and conversion of energy flow. Traditional methods are difficult to fully and accurately understand those attacks that may interfere with the normal operation of the station by affecting the energy flow. Secondly, traditional topology analysis methods have limitations in identifying network structure weaknesses, and often cannot effectively discover some potential key nodes and weak links, thereby failing to provide strong support for the formulation of network security strategies. Therefore, traditional technologies are powerless when facing network security issues in new energy stations.

[0004] In view of the above problems, it is necessary to optimize the existing network security monitoring and early warning methods and systems for new energy sites. By conducting a collaborative analysis of the energy flow and information flow in the new energy sites, taking the fluctuation of energy conversion efficiency as the key early warning indicator, and using complex network theory for topological analysis, more comprehensive and accurate network security monitoring and early warning can be achieved. Therefore, it is of great significance to develop a network security monitoring and early warning method and system for new energy sites that can comprehensively realize the above characteristics. Summary of the invention

[0005] The purpose of the present invention is to make up for the shortcomings of the prior art and to provide a new energy station network security monitoring and early warning method and system, which can collect energy flow and information flow data in new energy stations in real time, build the correlation between energy flow and information flow and carry out collaborative analysis. At the same time, it uses energy conversion efficiency fluctuations as key early warning indicators, monitors the energy conversion efficiency of equipment in real time, and analyzes it in combination with historical data and equipment operating conditions. In addition, it also uses complex network theory to perform topological analysis, discover network structure weaknesses, and determine key nodes and weak links, so as to carry out targeted key monitoring and protection, improve the timeliness and accuracy of network security early warnings, and provide a strong guarantee for the safe and stable operation of new energy stations.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: On the one hand, a new energy station network security monitoring and early warning method, the method comprises the following specific steps: Energy flow and information flow collection: Multiple energy flow monitoring points are set up on various types of equipment in new energy stations, including but not limited to key parts of power generation equipment, substation equipment, energy storage equipment, and the main paths of energy transmission, and equipped with corresponding energy flow sensors to collect energy flow-related data. At the same time, multiple information flow monitoring points are set up in the network communication system of the station to collect information flow-related data in real time; Collaborative analysis and establishment of association model: Based on the detailed equipment layout diagram, energy transmission line planning diagram and network architecture topology diagram of the new energy station, the following operations are performed to build the association relationship between energy flow and information flow and carry out collaborative analysis. Specifically, for the mapping of equipment and network links, each device that generates or processes energy flow is mapped to the network communication link involved in controlling its operation or data transmission related to it, and the association strength is calculated. For the analysis of the impact of energy flow changes on information flow, based on the operating principle and equipment characteristics of the station, when the energy flow undergoes a specific change on a certain device or transmission path, the information in the network communication link associated with it is analyzed. The impact of information flow, the reaction analysis of information flow changes on energy flow, according to the site operation mechanism, the reaction to the energy flow of the corresponding equipment when the information flow in the network communication link changes abnormally, for real-time collaborative analysis, during the operation process, the real-time collected energy flow related data and information flow related data are synchronously analyzed according to the above established association relationship. When an abnormal situation of information flow is detected, a comprehensive analysis is conducted in combination with the actual state of energy flow at the current moment. Through the set data analysis algorithm, it is determined whether there is a potential correlation pattern between the energy flow state and the information flow anomaly. If so, it is marked as a network security threat situation; Complex network modeling and optimization topology analysis: each device and system in the new energy station is regarded as a node in the complex network, and the network connection relationship between devices, systems and systems is abstracted as the edge in the complex network, so as to build a complex network model of the new energy station. For the constructed complex network model, mathematical algorithms are used to calculate and analyze its degree distribution, clustering coefficient and average path length parameters, and the key nodes and weak links in the network structure are identified based on the analysis results of the complex network characteristic parameters; Energy conversion efficiency monitoring steps: Install energy conversion efficiency monitoring sensors on each power generation equipment and key equipment involved in energy conversion in the new energy station to obtain the input energy and output energy data of the equipment in real time during operation. According to the input energy and output energy data obtained, use the preset calculation formula to calculate the energy conversion efficiency of the equipment in real time. Compare and analyze the energy conversion efficiency calculated in real time with the pre-stored historical data of the equipment and the current operating conditions of the equipment. Use the data analysis algorithm to determine whether the current energy conversion efficiency exceeds the normal range. If it exceeds, it is marked as an abnormal situation. Network security warning step: When the possibility of a network attack is inferred in the collaborative analysis and association model establishment step, or the energy conversion efficiency of the equipment is found to fluctuate significantly beyond the normal range in the energy conversion efficiency monitoring step, or abnormal conditions are found in key nodes or weak links in the complex network modeling optimization topology analysis step, a network security warning is issued. The network security warning information covers the attacked equipment or area, the preliminary inference of the attack type, and the warning level, so that the site operation and maintenance personnel can take corresponding preventive and response measures.

[0007] Furthermore, in the energy flow and information flow collection step, the energy flow related data include the voltage, current and power of the power flow and the power transmission status and the heat flow, temperature difference and heat transfer efficiency data of the heat flow, and the information flow related data include the transmission rate, interaction frequency and data packet content of the network data.

[0008] Furthermore, in the collaborative analysis and association model establishment step, for the mapping of devices and network links, each device that generates or processes energy flow is mapped to a network communication link involved in controlling its operation or data transmission related thereto, and the association strength is calculated. The calculation formula for the association strength is: ,in, Represents the strength of the synergistic change correlation between energy flow and information flow, is the time series point number of data collection, that is, the number of times the energy flow and information flow related data are collected. It is in The energy flow characteristic value at the next collection time is relative to the previous collection time The amount of change, It is in The average value of the energy flow characteristic value at the time of collection, It is in The information flow characteristic value at the next collection time is relative to the previous collection time The amount of change, It is in The average value of the information flow characteristic value at the time of collection.

[0009] Furthermore, in the collaborative analysis and association model building step, the impact of energy flow changes on information flow is analyzed, specifically, the impact weight coefficient of energy flow on information flow is calculated. ,in, Represents the weight coefficient of the impact of energy flow on information flow. A positive value indicates that the change in energy flow is positively correlated with the change in information flow, and a negative value indicates a negative correlation. represents the number of time series points of data collection, It is in The information flow characteristic value at the next collection time is relative to the previous collection time ( The amount of change, It is in The average value of the information flow characteristic value at the time of collection, It is in The energy flow characteristic value at the time of collection is calculated This allows for quantitative analysis of the extent and direction of the impact on information flow when energy flow changes.

[0010] Furthermore, in the collaborative analysis and association model building step, the reaction analysis of information flow changes on energy flow is specifically calculated by calculating the influence weight coefficient of energy flow on information flow: ,in, Represents the weight coefficient of the impact of information flow on energy flow, is the number of time series points of data collection, It is in The energy flow eigenvalue at the next collection time is relative to the previous collection time The amount of change, It is in The average value of the energy flow characteristic value at the time of collection, It is in The information flow characteristic value at the time of collection is calculated by This allows for a quantitative analysis of the extent and direction of the impact on energy flow when information flow changes.

[0011] Furthermore, in the collaborative analysis and association model establishment step, for real-time collaborative analysis, a set data analysis algorithm is used to determine whether there is a potential association pattern between the energy flow state and the information flow anomaly. The formula of the analysis algorithm is: ,in, Represents an indicator of the likelihood of potential network security threats. is the number of time series points of data collection, It is in The energy flow characteristic value at the next collection time is relative to the previous collection time ( The amount of change, It is in The average value of the energy flow characteristic value at the time of collection, It is in The information flow characteristic value at the next collection time is relative to the previous collection time ( The amount of change, It is in The average value of the information flow characteristic value at the time of collection, is the strength of the coordinated change of energy flow and information flow. When an abnormality in information flow is found through real-time monitoring, the ,like Exceeding the set threshold , then it is judged that there is a potential correlation pattern between the energy flow status and the information flow anomaly, and this situation can be marked as a network security threat situation.

[0012] Furthermore, in the step of optimizing the topological analysis of complex network modeling, mathematical algorithms are used to calculate and analyze its degree distribution, clustering coefficient and average path length parameters. Specifically, the connectivity of each node in the complex network is determined, that is, the number of other nodes directly connected to the node, and the distribution of nodes with different connectivity in the entire network is counted. For each node, the clustering coefficient is calculated by the formula Calculate the clustering coefficient, where is the clustering coefficient of the node, which is used to measure the degree of connection between the neighboring nodes of the node. is the number of actual connecting edges between the neighboring nodes of the node, is the degree distribution value of the node. For the average path length, the average path length is calculated by the formula Calculate the average of the shortest path lengths between any two nodes in the network, where is the average path length of the network, is the total number of nodes in the network, For Node and nodes The shortest path length between For The number of combinations of selecting 2 elements from the elements is calculated as follows: , by analyzing the average path length, the weak links in the network structure can be discovered.

[0013] Furthermore, in the complex network modeling optimization topology analysis step, the key nodes and weak links in the network structure are identified based on the analysis results of the complex network characteristic parameters. For the key nodes, the key node importance evaluation formula is discussed. To comprehensively evaluate the importance of nodes in the network, Represents the importance index of the node, , , is the weight coefficient, is the connectivity, is the clustering coefficient, It is the reciprocal of the average path length. For weak link determination, the weak link identification formula is used To measure the weakness of the link, Represents the link weakness indicator, , is the weight coefficient, is the maximum value of the average path length difference from a link to all other links in the network, that is, is the number of node pairs connected by a single link, is the number of all node pairs in the network.

[0014] Furthermore, in the energy conversion efficiency monitoring step, a data analysis algorithm is used to determine whether the current energy conversion efficiency exceeds the normal range. If it exceeds, it is marked as an abnormal situation. The calculation formula is: ,in, An indicator representing the degree of abnormality in energy conversion efficiency. Indicates at the current moment The energy conversion efficiency of the monitored equipment, In the past period of time arrive The average value of the energy conversion efficiency of the internal equipment, The length of the time window is set.

[0015] On the other hand, a new energy station network security monitoring and early warning system includes the following components: Energy flow monitoring module: It contains multiple energy flow sensors, which are respectively set on different equipment and energy transmission paths of new energy stations to collect energy flow related data in real time. Information flow monitoring module: includes multiple information flow sensors, which are set in the network communication system of the station and are used to collect information flow related data in real time; Data acquisition unit: receiving energy flow related data from the energy flow monitoring module and information flow related data from the information flow monitoring module, and performing preliminary sorting and preprocessing; Collaborative analysis and correlation model building module: According to the actual situation of the new energy station, including equipment layout, energy transmission path and network architecture, the correlation model building unit builds the correlation between energy flow and information flow, and conducts collaborative analysis through the collaborative analysis unit on this basis. When an abnormal information flow is found and a network attack is judged in combination with the real-time status of the energy flow, a warning trigger signal is sent to the network security warning module; Complex network modeling optimization topology analysis module: abstract the various devices, systems and network connection relationships in the new energy station into nodes and edges in the complex network, build a complex network model of the new energy station, analyze the degree distribution, clustering coefficient and average path length of the complex network characteristic parameters of the complex network model, so as to find the network structure weaknesses that are difficult to detect with traditional topology analysis methods, and determine the key nodes and weak links in the station network based on the analysis results; Energy conversion efficiency monitoring module: including sensors installed on various equipment in new energy stations and corresponding monitoring systems, used to monitor the energy conversion efficiency of equipment in real time, compare and analyze the energy conversion efficiency monitored in real time with historical data and equipment operating conditions, and send an early warning trigger signal to the network security early warning module when it is found that the energy conversion efficiency has obvious fluctuations beyond the normal range and natural environmental factors are excluded; Network security early warning module: receives early warning trigger signals from the collaborative analysis and association model building module, the complex network modeling optimization topology analysis module and the energy conversion efficiency monitoring module, and generates network security early warning information based on the early warning trigger signals.

[0016] Compared with the prior art, the new energy station network security monitoring and early warning method and system has the following beneficial effects: 1. The present invention organically combines the collaborative analysis of energy flow and information flow and the establishment of a correlation model, collects and analyzes energy flow and information flow data in real time, establishes a correlation between the two, and makes a comprehensive judgment in combination with the real-time status of the energy flow when an abnormality occurs in the information flow, thereby effectively identifying network attacks aimed at interfering with the output of energy flow, thereby comprehensively and accurately perceiving potential network security threats. In addition, by real-time monitoring of the energy conversion efficiency of the equipment and analyzing it in combination with historical data and equipment operating conditions, the impact of network attacks on the operating status of the equipment can be discovered, and network security warnings can be issued in a timely manner, thereby improving the timeliness and accuracy of the warnings.

[0017] 2. The present invention uses complex network theory to perform topological analysis, which can focus on monitoring and protecting these key nodes and weak links, thereby optimizing the network security strategy. It not only improves the overall anti-attack capability of the network, but also further ensures the safe and stable operation of the new energy station network. In addition, by continuously analyzing and updating the characteristic parameters of the network structure, it can adapt to the subsequent transformation and equipment updates of the new energy stations, thereby ensuring the effectiveness and timeliness of the network security strategy.

[0018] Other advantages, objectives and features of the present invention will be set forth in part in the following description and, in part, will be apparent to those skilled in the art based on an examination of the following or may be taught from the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 The present invention is a process operation diagram of a network security monitoring and early warning method for new energy sites.

[0021] Figure 2 This is a schematic diagram of a network security monitoring and early warning system for new energy sites. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Embodiment 1 This embodiment describes in detail a specific application of a new energy site network security monitoring and early warning method and system in wind farm network security monitoring and early warning. Through the present invention, operation and maintenance personnel are helped to take measures to ensure the safe and stable operation of the wind farm, and effectively improve the network security protection capability and operation reliability of the wind farm.

[0024] During the energy flow and information flow collection stage, energy flow and information flow monitoring points are set up at wind turbines (power generation equipment), box transformers (power transformation equipment), wind farm monitoring system network nodes and other locations. The energy flow monitoring points are equipped with wind speed sensors, power sensors and other devices to collect wind energy-related energy flow data, such as wind speed, wind turbine output power, etc. The information flow monitoring points collect information flow data related to monitoring data transmission, such as data transmission rate, data packet size and frequency, etc. Taking a wind farm with 50 wind turbines as an example, a total of 80 energy flow monitoring points and 15 information flow monitoring points are set up in each wind turbine cabin, tower base box transformer and monitoring center network equipment, fully covering the power generation, power transformation and monitoring links of the wind farm.

[0025] In the collaborative analysis and association model establishment stage, each wind turbine is mapped to the network link that monitors its operating status and transmits control instructions, and the association strength is calculated. The calculation formula for the association strength is: For example, for a wind turbine, data was collected 8 times over a period of time. , the change in wind turbine output power during a certain collection 20 kW, the previous power average For 180 kW, the size of the information flow packet changes 5 kilobytes, the average size of the previous data packet is 45 kilobytes. Substituting these values ​​into the formula, we can get the association strength between the wind turbine and the corresponding network link. , so as to clarify the relationship between equipment and network. When the wind speed changes and causes the output power (energy flow) of wind turbines to fluctuate, analyze the impact on monitoring data transmission (information flow) and calculate the weight coefficient of the impact of energy flow on information flow. If the calculation result shows a positive correlation, it means that when the wind speed increases and the power generation increases, the amount of data transmitted by the monitoring system will also increase accordingly to reflect the changes in the operating status of the wind turbine. Otherwise, it is a negative correlation. If there is data packet loss or delay in network communication (information flow changes), the impact on the transmission of control instructions of wind turbines is studied, and then the reaction to energy flow is analyzed. By calculating the weight coefficient of the impact of information flow on the source flow of the wind turbine, the influence of information flow on the source flow of the wind turbine is analyzed. , determine the degree and direction of the impact of abnormal information flow on the power generation of wind turbines. For example, control command delay may cause the wind turbine to be unable to adjust the pitch angle in time, affecting the power generation efficiency. During operation, if the information flow monitoring detects a sudden decrease in the monitoring data transmission rate at a certain moment (abnormal condition), combined with the current energy flow status of the wind turbine (such as normal power generation), the data analysis algorithm is used to calculate the possibility of potential network security threats. ,like Exceeding the set threshold , it is judged that there may be network security threats, such as network congestion or malicious attacks that lead to poor monitoring data transmission, affecting the operation and management of the wind farm.

[0026] In the topological analysis stage of complex network modeling optimization, wind turbines, box transformers, monitoring system servers and other equipment and systems are regarded as nodes in the complex network. The power connection and network connection relationship between the equipment are abstracted as edges. The complex network model of the wind farm is constructed, and the degree distribution, clustering coefficient and average path length parameters of the model are calculated. The connectivity of each node in the complex network is determined, that is, the number of other nodes directly connected to the node. The distribution of nodes with different connectivity degrees in the entire network is counted. For each node, the clustering coefficient calculation formula is used Calculate the clustering coefficient, where is the clustering coefficient of the node, which is used to measure the degree of connection between the neighboring nodes of the node. is the number of actual connecting edges between the neighboring nodes of the node, is the degree distribution value of the node. For the average path length, the average path length is calculated by the formula Calculate the average of the shortest path lengths between any two nodes in the network, where is the average path length of the network, is the total number of nodes in the network, For Node and nodes The shortest path length between For The number of combinations of selecting 2 elements from the elements is calculated as follows: For example, the connectivity of a box-type transformer node is determined to be 6, and its clustering coefficient is calculated to measure the degree of connection between neighboring nodes. Then, the average path length of the network is calculated according to the average path length calculation formula. If there are 150 nodes in the wind farm network, the weak links in the network structure can be found by calculating the average value of the shortest path length between nodes. For example, the communication link between the wind turbine located at the edge of the wind farm and the monitoring center may be prone to failure due to the long distance and many intermediate nodes. The key nodes and weak links are identified based on the characteristic parameters of the complex network. For the key nodes, the key node importance evaluation formula is used. To comprehensively evaluate the importance of nodes in the network, Represents the importance index of the node, , , is the weight coefficient, is the connectivity, is the clustering coefficient, is the average path length, such as the connectivity of a large wind turbine. 8, clustering coefficient Set the weight coefficient to 0.5 and the inverse of the average path length to 0.08 , , , calculate the importance index It is higher, indicating that the wind turbine has a greater impact on the stability of wind farm power generation. For weak links, according to the weak link identification formula To measure the weakness of the link, Represents the link weakness indicator, , is the weight coefficient, It is the maximum value of the average path length difference from a link to all other links in the network. is the number of node pairs connected by a single link, is the number of all node pairs in the network. If a link Larger, and the number of connected single-link node pairs Relatively more, weight coefficient , , calculate the link weakness index If the value is high, it means that the link is likely to cause network problems and requires enhanced maintenance and monitoring.

[0027] During the energy conversion efficiency monitoring phase, energy conversion efficiency monitoring sensors are installed at key locations such as the gearbox and generator of each wind turbine to obtain real-time input mechanical energy (converted from wind energy) and output electrical energy data. The data analysis algorithm is used to determine whether the current energy conversion efficiency exceeds the normal range. The calculation formula is: , assuming that a wind turbine is Energy conversion efficiency 40% in the past half hour Average conversion efficiency within 1 hour is 38%, and the abnormality index can be obtained by substituting it into the formula ,like If it exceeds the normal range (such as 3%), it indicates that the fan energy conversion efficiency is abnormal, which may be caused by fan blade damage, gearbox wear or other mechanical failures, and maintenance personnel need to be arranged to inspect and repair it.

[0028] In the network security early warning stage, when the collaborative analysis and association model establishment steps infer the possibility of network attacks (such as real-time collaborative analysis to determine the potential correlation pattern between information flow anomalies and energy flow status), or the energy conversion efficiency monitoring step finds abnormal fluctuations in equipment energy conversion efficiency, or the complex network modeling optimization topology analysis step finds abnormal conditions in key nodes or weak links (such as key wind turbine failures or weak link communication failures), a network security early warning is issued. The early warning information includes the affected equipment (such as specific wind turbine numbers or network equipment names) or areas (such as a row of wind turbines), preliminary inferences on attack types (such as network interference attacks or chain reactions caused by equipment performance degradation), and early warning levels (divided according to the severity of the abnormality), so that site operation and maintenance personnel can quickly take corresponding measures based on the early warning information, such as checking network lines, repairing faulty wind turbine components, optimizing network configuration, etc., to ensure the safe and stable operation of wind farms.

[0029] Embodiment 2 This embodiment describes in detail a new energy site network security monitoring and early warning method and system for specific applications in network security monitoring and early warning of large-scale photovoltaic power generation sites. By adopting the present invention, effective technical means are provided for network security management of photovoltaic power plants, thereby improving overall operational reliability and safety.

[0030] During the energy flow and information flow collection stage, energy flow monitoring points are set up at key locations such as photovoltaic panel arrays (power generation equipment), inverters (transformer equipment), battery packs (energy storage equipment) and transmission lines (energy transmission paths) in photovoltaic power plants, and voltage sensors, current sensors, power sensors and the like are installed to collect power flow data, including voltage, current, power and electric energy transmission conditions. At the same time, information flow monitoring points are set up at key nodes such as data switches and communication servers in the network communication system to collect information such as the transmission rate, interaction frequency and data packet content of network data. For example, in a photovoltaic power plant with an installed capacity of 100 MW, a total of 100 energy flow monitoring points and 20 information flow monitoring points are set up to ensure comprehensive monitoring of the energy flow and information flow of the entire station.

[0031] In the collaborative analysis and association model establishment stage, each photovoltaic panel is mapped to the network link that monitors its power generation data transmission, and the association strength is calculated. Assuming that there are 50 photovoltaic panels and 10 data are collected (n=10), the change in the energy flow power of a photovoltaic panel during a certain collection is 5 kilowatts, and the average power at the previous collection time is 45 kilowatts. The change in the information flow transmission rate is 10 megabits per second, and the average transmission rate at the previous collection time is 90 megabits per second. Substituting it into the association strength calculation formula can obtain the association strength between the photovoltaic panel and the corresponding network link, thereby determining the degree of association between each device and the network link. Based on the principle of photovoltaic power generation, when the change in light intensity causes the photovoltaic panel power generation power (energy flow) to change, the impact on the monitoring data transmission (information flow) is analyzed, and the weight coefficient of the energy flow on the information flow is calculated. If the calculation result is a positive value, it means that the energy flow change is closely related to the information flow. The information flow changes are positively correlated. For example, when the light is enhanced, the power generation increases, and the amount of monitoring data also increases accordingly. If it is a negative value, it is negatively correlated. When the network communication fails and the information flow transmission rate decreases, the impact on the transmission of operating control instructions of equipment such as inverters is studied, and then the reaction to the energy flow is analyzed. By calculating the weight coefficient of the impact of information flow on energy flow, the degree and direction of this impact are quantified. For example, information flow anomalies may cause the inverter output power to be unstable. During operation, it is assumed that the information flow monitors a sudden and substantial increase in the frequency of network data interaction (abnormal condition) at a certain moment. At the same time, combined with the energy flow data at the current moment (such as normal power generation of photovoltaic panels), the potential network security threat possibility index is calculated through the set data analysis algorithm. If it exceeds the set threshold, it is judged that there may be a network security threat, such as a network attack that causes an increase in false data traffic, affecting the normal operation monitoring of the site.

[0032] In the topological analysis stage of complex network modeling optimization, each photovoltaic panel, inverter, battery pack and network communication equipment is regarded as a node in the complex network. The electrical connection and network connection relationship between the equipment are abstracted as edges. The complex network model of the photovoltaic power station is constructed, and the degree distribution, clustering coefficient and average path length parameters of the model are calculated. For example, the connectivity of a certain inverter node is determined to be 8 (directly connected to 8 other devices). The clustering coefficient is calculated by the clustering coefficient calculation formula, the tightness of the connection between its neighboring nodes is analyzed, and the average path length of the network is calculated according to the average path length calculation formula. Assuming that there are 200 nodes in the network, the weak links in the network structure are found by calculating the average value of the shortest path length between the nodes. For example, some photovoltaic panel areas far away from the core communication nodes have long data transmission paths, which are prone to communication delays or interruptions. According to the analysis results of the characteristic parameters of the complex network, key nodes and weak links are identified. For key nodes, their importance index is calculated by the key node importance evaluation formula. Assuming that the connectivity of an inverter is 10, the clustering coefficient is 0.6, the inverse of the average path length is 0.1, and the weight coefficients α=0.4, β=0.3, and γ=0.3, the calculation shows that its importance index is relatively high, indicating that the inverter is crucial to the overall operation of the station. For weak links, the link weakness index is calculated according to the weak link identification formula. If a link is large and the number of single link node pairs connected is relatively large, the weight coefficient =0.6, =0.4, the calculated link weakness index is high, indicating that the link is prone to cause network failures and requires special attention.

[0033] During the energy conversion efficiency monitoring stage, energy conversion efficiency monitoring sensors are installed on each photovoltaic panel and inverter to obtain input energy (such as light energy) and output energy (electrical energy) data in real time. Assuming that the energy conversion efficiency of a photovoltaic panel at the current moment is 18%, and the average conversion efficiency in the past hour is 16%, the abnormality index can be substituted into the energy conversion efficiency abnormality calculation formula. If it exceeds the set normal range (such as 5%), the energy conversion efficiency of the photovoltaic panel is marked as abnormal, which may be caused by aging, dust accumulation or other faults of the photovoltaic panel, and timely inspection and maintenance are required.

[0034] In the network security early warning stage, when the collaborative analysis and association model establishment steps infer the possibility of network attacks (such as the determination of potential correlation patterns between information flow anomalies and energy flow status in the above-mentioned real-time collaborative analysis), or the energy conversion efficiency monitoring step finds abnormal fluctuations in the equipment energy conversion efficiency, or the complex network modeling optimization topology analysis step finds abnormal conditions in key nodes or weak links (such as key inverter failures or weak link communication interruptions), a network security early warning is issued. The early warning information includes the attacked device (such as the specific photovoltaic panel number or the name of the network communication device) or area (such as a photovoltaic panel array area), a preliminary inference of the attack type (such as indirect effects caused by abnormal network traffic attacks or equipment performance degradation), and the early warning level (such as high, medium, and low levels according to the severity of the abnormality), so that the site operation and maintenance personnel can take corresponding preventive and response measures according to the early warning information, such as checking network equipment, repairing faulty links, cleaning or replacing photovoltaic panels, etc.

[0035] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A new energy station network security monitoring and early warning method, characterized in that: The method comprises the following specific steps: Energy flow and information flow collection: Multiple energy flow monitoring points are set up on various types of equipment in new energy stations, including but not limited to key parts of power generation equipment, substation equipment, energy storage equipment, and the main paths of energy transmission, and equipped with corresponding energy flow sensors to collect energy flow-related data. At the same time, multiple information flow monitoring points are set up in the network communication system of the station to collect information flow-related data in real time; Collaborative analysis and establishment of association model: Based on the detailed equipment layout diagram, energy transmission line planning diagram and network architecture topology diagram of the new energy station, the following operations are performed to build the association relationship between energy flow and information flow and carry out collaborative analysis. Specifically, for the mapping of equipment and network links, each device that generates or processes energy flow is mapped to the network communication link involved in controlling its operation or data transmission related to it, and the association strength is calculated. For the analysis of the impact of energy flow changes on information flow, based on the operating principle and equipment characteristics of the station, when the energy flow undergoes a specific change on a certain device or transmission path, the information in the network communication link associated with it is analyzed. The impact of information flow, the reaction analysis of information flow changes on energy flow, according to the site operation mechanism, the reaction to the energy flow of the corresponding equipment when the information flow in the network communication link changes abnormally, for real-time collaborative analysis, during the operation process, the real-time collected energy flow related data and information flow related data are synchronously analyzed according to the above established association relationship. When an abnormal situation of information flow is detected, a comprehensive analysis is conducted in combination with the actual state of energy flow at the current moment. Through the set data analysis algorithm, it is determined whether there is a potential correlation pattern between the energy flow state and the information flow anomaly. If so, it is marked as a network security threat situation; Complex network modeling and optimization topology analysis: each device and system in the new energy station is regarded as a node in the complex network, and the network connection relationship between devices, systems and systems is abstracted as the edge in the complex network, so as to build a complex network model of the new energy station. For the constructed complex network model, mathematical algorithms are used to calculate and analyze its degree distribution, clustering coefficient and average path length parameters, and the key nodes and weak links in the network structure are identified based on the analysis results of the complex network characteristic parameters; Energy conversion efficiency monitoring steps: Install energy conversion efficiency monitoring sensors on each power generation equipment and key equipment involved in energy conversion in the new energy station to obtain the input energy and output energy data of the equipment in real time during operation. According to the input energy and output energy data obtained, use the preset calculation formula to calculate the energy conversion efficiency of the equipment in real time. Compare and analyze the energy conversion efficiency calculated in real time with the pre-stored historical data of the equipment and the current operating conditions of the equipment. Use the data analysis algorithm to determine whether the current energy conversion efficiency exceeds the normal range. If it exceeds, it is marked as an abnormal situation. Network security warning step: When the possibility of a network attack is inferred in the collaborative analysis and association model establishment step, or the energy conversion efficiency of the equipment is found to fluctuate significantly beyond the normal range in the energy conversion efficiency monitoring step, or abnormal conditions are found in key nodes or weak links in the complex network modeling optimization topology analysis step, a network security warning is issued. The network security warning information covers the attacked equipment or area, the preliminary inference of the attack type, and the warning level, so that the site operation and maintenance personnel can take corresponding preventive and response measures.

2. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the energy flow and information flow collection step, the energy flow related data include the voltage, current and power of the power flow and the power transmission status and the heat flow, temperature difference and heat transfer efficiency data of the heat flow; the information flow related data include the transmission rate, interaction frequency and data packet content of the network data.

3. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the collaborative analysis and association model establishment step, for the mapping of equipment and network links, each equipment that generates or processes energy flow is mapped to the network communication link involved in controlling its operation or data transmission related to it, and the association strength is calculated. The calculation formula of the association strength is: ,in, Represents the strength of the synergistic change correlation between energy flow and information flow, is the time series point number of data collection, that is, the number of times the energy flow and information flow related data are collected. It is in The energy flow characteristic value at the next collection time is relative to the previous collection time The amount of change, It is in The average value of the energy flow characteristic value at the time of collection, It is in The information flow characteristic value at the next collection time is relative to the previous collection time The amount of change, It is in The average value of the information flow characteristic value at the time of collection.

4. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the collaborative analysis and association model building step, the impact of energy flow changes on information flow is analyzed. Specifically, the impact weight coefficient of energy flow on information flow is calculated. ,in, Represents the weight coefficient of the impact of energy flow on information flow. A positive value indicates that the change in energy flow is positively correlated with the change in information flow, and a negative value indicates a negative correlation. represents the number of time series points of data collection, It is in The information flow characteristic value at the next collection time is relative to the previous collection time ( The amount of change, It is in The average value of the information flow characteristic value at the time of collection, It is in The energy flow characteristic value at the time of collection is calculated This allows for quantitative analysis of the extent and direction of the impact on information flow when energy flow changes.

5. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the collaborative analysis and association model building step, the reaction analysis of information flow changes on energy flow is specifically calculated by calculating the influence weight coefficient of energy flow on information flow: ,in, Represents the weight coefficient of the impact of information flow on energy flow, is the number of time series points of data collection, It is in The energy flow eigenvalue at the next collection time is relative to the previous collection time The amount of change, It is in The average value of the energy flow characteristic value at the time of collection, It is in The information flow characteristic value at the time of collection is calculated by This allows for a quantitative analysis of the extent and direction of the impact on energy flow when information flow changes.

6. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the collaborative analysis and association model establishment step, for real-time collaborative analysis, a set data analysis algorithm is used to determine whether there is a potential association pattern between the energy flow state and the information flow anomaly. The formula of the analysis algorithm is: ,in, Represents an indicator of the likelihood of potential network security threats. is the number of time series points of data collection, It is in The energy flow characteristic value at the next collection time is relative to the previous collection time ( The amount of change, It is in The average value of the energy flow characteristic value at the time of collection, It is in The information flow characteristic value at the next collection time is relative to the previous collection time ( The amount of change, It is in The average value of the information flow characteristic value at the time of collection, is the strength of the coordinated change of energy flow and information flow. When an abnormality in information flow is found through real-time monitoring, the ,like Exceeding the set threshold , then it is judged that there is a potential correlation pattern between the energy flow status and the information flow anomaly, and this situation can be marked as a network security threat situation.

7. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the complex network modeling optimization topology analysis step, mathematical algorithms are used to calculate and analyze its degree distribution, clustering coefficient and average path length parameters. Specifically, the connectivity of each node in the complex network is determined, that is, the number of other nodes directly connected to the node, and the distribution of nodes with different connectivity in the entire network is counted. For each node, the clustering coefficient is calculated by the formula Calculate the clustering coefficient, where is the clustering coefficient of the node, which is used to measure the degree of connection between the neighboring nodes of the node. is the number of actual connecting edges between the neighboring nodes of the node, is the degree distribution value of the node. For the average path length, the average path length is calculated by the formula Calculate the average of the shortest path lengths between any two nodes in the network, where is the average path length of the network, is the total number of nodes in the network, For Node and nodes The shortest path length between For The number of combinations of selecting 2 elements from the elements is calculated as follows: , by analyzing the average path length, the weak links in the network structure can be discovered.

8. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the complex network modeling optimization topology analysis step, the key nodes and weak links in the network structure are identified based on the analysis results of the complex network characteristic parameters. For the key nodes, the key node importance evaluation formula is discussed. To comprehensively evaluate the importance of nodes in the network, Represents the importance index of the node, , , is the weight coefficient, is the connectivity, is the clustering coefficient, It is the reciprocal of the average path length. For weak link determination, the weak link identification formula is used To measure the weakness of the link, Represents the link weakness indicator, , is the weight coefficient, is the maximum value of the average path length difference from a link to all other links in the network, that is, is the number of node pairs connected by a single link, is the number of all node pairs in the network.

9. A new energy station network security monitoring and early warning method according to claim 1, characterized in that: In the energy conversion efficiency monitoring step, a data analysis algorithm is used to determine whether the current energy conversion efficiency exceeds the normal range. If it exceeds, it is marked as an abnormal situation. The calculation formula is: ,in, An indicator representing the degree of abnormality in energy conversion efficiency. Indicates at the current moment The energy conversion efficiency of the monitored equipment, In the past period of time arrive The average value of the energy conversion efficiency of the internal equipment, The length of the set time window.

10. A new energy station network security monitoring and early warning system, characterized in that: The system consists of the following components: Energy flow monitoring module: It contains multiple energy flow sensors, which are respectively set on different equipment and energy transmission paths of new energy stations to collect energy flow related data in real time. Information flow monitoring module: includes multiple information flow sensors, which are set in the network communication system of the station and are used to collect information flow related data in real time; Data acquisition unit: receiving energy flow related data from the energy flow monitoring module and information flow related data from the information flow monitoring module, and performing preliminary sorting and preprocessing; Collaborative analysis and correlation model building module: According to the actual situation of the new energy station, including equipment layout, energy transmission path and network architecture, the correlation model building unit builds the correlation between energy flow and information flow, and conducts collaborative analysis through the collaborative analysis unit on this basis. When an abnormal information flow is found and a network attack is judged in combination with the real-time status of the energy flow, a warning trigger signal is sent to the network security warning module; Complex network modeling optimization topology analysis module: abstract the various devices, systems and network connection relationships in the new energy station into nodes and edges in the complex network, build a complex network model of the new energy station, analyze the degree distribution, clustering coefficient and average path length of the complex network characteristic parameters of the complex network model, so as to find the network structure weaknesses that are difficult to detect with traditional topology analysis methods, and determine the key nodes and weak links in the station network based on the analysis results; Energy conversion efficiency monitoring module: including sensors installed on various equipment in new energy stations and corresponding monitoring systems, used to monitor the energy conversion efficiency of equipment in real time, compare and analyze the energy conversion efficiency monitored in real time with historical data and equipment operating conditions, and send an early warning trigger signal to the network security early warning module when it is found that the energy conversion efficiency has obvious fluctuations beyond the normal range and natural environmental factors are excluded; Network security early warning module: receives early warning trigger signals from the collaborative analysis and association model building module, the complex network modeling optimization topology analysis module and the energy conversion efficiency monitoring module, and generates network security early warning information based on the early warning trigger signals.

Images