Network security monitoring main and standby link election method and system of substation monitoring system

Abstract

The invention provides a network security monitoring main and standby link election method and system for a substation monitoring system, and the method comprises the steps: selecting a main link in an effective state according to the priority through a vote box, and changing the data transmission states of the main link and a standby link; classifying the network security monitoring information according to item categories, and storing or / and sending items of related categories according to a predetermined sequence by using a main link; and when detecting that a link with a higher priority recovers communication in the ticket selecting box, starting a main link switching process, switching the link with the higher priority into a main link, and changing the original main link into a standby link. According to the invention, the problem of random invalid switching of multiple links and the problem of information transmission omission in the link switching process are effectively solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security monitoring, and particularly relates to a method and system for electing primary and backup links for network security monitoring of a substation monitoring system. Background Technique

[0002] The statements in this part only provide background technical information related to the present invention, and do not necessarily constitute prior art.

[0003] In some monitoring systems, such as the new generation of highly reliable substation monitoring systems, it is necessary to send network security monitoring information to the network security management platforms of multiple dispatching master stations through a data communication network shutdown device to achieve effective monitoring and management of the network security of relevant devices in the monitoring environment by the dispatching.

[0004] Currently, the network shutdown device and the network security management platform can adopt single-link or multi-link communication methods. When adopting the single-link communication method, although the information can be effectively transmitted, due to the lack of redundant backup for the link, once the link communication is interrupted, the information cannot be transmitted. When adopting the multi-link communication method, the link realizes redundant backup, but there are still problems such as the lack of an effective link status judgment mechanism, random link switching, and information leakage during the link switching process. Summary of the Invention

[0005] The present invention proposes a method and system for electing primary and backup links for network security monitoring of a substation monitoring system, which effectively solves the problems of random invalid switching of multi-links and information leakage during the link switching process.

[0006] According to some embodiments, the present invention adopts the following technical solutions:

[0007] A method for electing primary and backup links for network security monitoring of a substation monitoring system includes the following steps:

[0008] Using a ballot box, select the primary link in the effective state according to the priority, and change the data sending status of the primary link and the backup link;

[0009] Classify the network security monitoring information according to the matter category, and use the primary link to store and / or send related categories of matters in a predetermined order;

[0010] When a link with a higher priority is detected to resume communication in the ballot box, start the primary link switching process, switch the link with a higher priority to be the primary link, and the original primary link becomes the backup link.

[0011] As an alternative implementation, during the process of using ballot boxes to select the active main link according to the priority, there are multiple ballot boxes, which are grouped according to different network security management platforms. Each ballot box corresponds to a group, and each ballot box forms a ballot bin.

[0012] As an alternative implementation, during the process of using ballot boxes to select the active main link according to the priority, all links that have passed security authentication can participate in the election. The state of this link is the active state. The priority is determined according to the packet loss rate and delay rate of each link in the ballot box. The lower the packet loss rate and delay rate, the higher the priority.

[0013] As a further defined implementation, the initial state of each link in each ballot box is the to-be-elected state, and the state changes to the active state after the link passes security verification.

[0014] As an alternative implementation, during the process of using ballot boxes to select the active main link according to the priority, at the start of the election, first detect whether there is a high-priority link in the ballot box that is in the active state. If so, this link is used as the main link, and other links are used as backup links; if not, sequentially find the active state link in the next priority level as the main link; if no active state link is found, continue the election process until the main link is elected.

[0015] As an alternative implementation, during the process of using ballot boxes to select the active main link according to the priority, if there are multiple links that are in the active state and have the same priority level, randomly select one of the links as the main link.

[0016] As an alternative implementation, the process of changing the data sending status of the main link and backup links includes: changing the data sending status of the main link to the data-sendable status, and changing the data sending status of other backup links to the to-be-sent data status.

[0017] As an alternative implementation, during the process of using ballot boxes to select the active main link according to the priority, when there is an abnormal communication of the main link, start the election process again. After the abnormal communication of the backup link, do not start the election process.

[0018] As an alternative implementation, during the process of classifying network security monitoring information according to matter categories, if network security monitoring information is generated during the election process, cache the network security monitoring information.

[0019] As an alternative implementation, the process of classifying network security monitoring information according to matter categories includes: configuring an observer matter queue, a cached matter queue, and an unconfirmed matter queue in the ballot box, and classifying the network security monitoring information according to the above queues respectively.

[0020] As an alternative implementation, the process of storing or / and sending matters of related categories in a predetermined order using the primary link includes, after the election, the primary link sequentially sending matters to the network security management platform in the order of the unconfirmed matter queue, the cached matter queue, and the observer matter queue.

[0021] As a further step, after the primary link sends a matter to the network security management platform, the matter is placed in the unconfirmed matter queue, and when the confirmation information from the network security management platform is received, the matter in the unconfirmed matter queue is deleted.

[0022] As a further step, the specific process includes:

[0023] The primary link first sends the matters in the unconfirmed queue, and if there are none, it does not send; after sending the unconfirmed queue, the primary link sends the matters in the cached queue;

[0024] After sending the cached queue, the primary link sends the matters in the observer queue;

[0025] The primary link sends a matter or a heartbeat message to the network security management platform and places the matter in the unconfirmed queue;

[0026] Receiving the confirmation information from the network security management platform and deleting the confirmed matters.

[0027] As a further step, when a standby link is upgraded to the primary link, it preferentially sends the information in the unconfirmed matter queue, and then sends the information in the cached matter queue and the observer matter queue.

[0028] As an alternative implementation, when a link with a higher priority is detected to resume communication in the ballot box during the process of starting the primary link switching process, the current primary link sends a stop frame to the network security management platform. After the network security management platform responds with a stop confirmation frame, the current primary link becomes a standby link, and the corresponding ballot box conducts a re-election to select a link with a higher priority as the new primary link.

[0029] As an alternative implementation, all links send test frames for heartbeat detection during connection idle time to maintain the active state of the link. When it is detected that a certain link no longer sends test frames, it continues to monitor at intervals of a set time until the set number of monitoring times is reached. If during this process, the link still does not send test frames, it is considered that the link is abnormal, and the status of the corresponding link is set to the invalid state.

[0030] A network security monitoring primary and standby link election system for a substation monitoring system, including:

[0031] An election module, configured to use a ballot box to select a primary link in an active state according to priorities, and change the data sending states of the primary link and the backup link;

[0032] A monitoring information processing module, configured to classify network security monitoring information according to matter categories, and use the primary link to store and / or send relevant categories of matters in a predetermined order;

[0033] A switching module, configured to start a primary link switching process when a link with a higher priority is detected to resume communication in the ballot box, switch the link with the higher priority to be the primary link, and change the original primary link to be the backup link.

[0034] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the steps in the above method.

[0035] An electronic device, including a memory, a processor, and computer instructions stored on the memory and running on the processor, which, when run by the processor, complete the steps in the above method.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] The present invention constructs a ballot bin, uses a ballot box mechanism to elect the primary and backup links, and only links that have passed two-way security authentication can participate in the election of the primary and backup links, ensuring the security of data transmission.

[0038] Through the design of the effectiveness of the link state and in combination with the link priority mechanism, the present invention ensures the effective switching of the primary and backup links, and ensures that the elected primary link is in an active state in the current communication environment and has the optimal packet loss rate and delay rate.

[0039] By designing an unconfirmed matter queue, a cached matter queue, an observer matter queue for network security monitoring matters in the ballot box and corresponding transmission mechanisms and orders, the present invention ensures that matters are not missed and effectively improves the reliability of information transmission.

[0040] When the priority of the original primary link is not the current optimal or an abnormality occurs, the ballot box re-elects in the present invention. When the ballot box is electing, the original primary link is prohibited from sending network security monitoring matters. After the election is completed, the new primary link continues to send network security monitoring matters, ensuring the uniqueness of the data export.

[0041] The present invention designs a link heartbeat mechanism. By flexibly setting the interval time and the number of monitoring times, it can effectively maintain the active state of the link and ensure the rapid switching of the link.

[0042] To make the above objects, features, and advantages of the present invention more apparent and understandable, the following provides preferred embodiments in conjunction with the accompanying drawings and describes them in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The specification drawings forming a part of the present invention are used to provide a further understanding of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation to the present invention.

[0044] Figure 1 It is a schematic diagram of the network security monitoring primary and standby link election process of the substation monitoring system in an embodiment;

[0045] Figure 2 It is a schematic diagram of the process of sending primary and standby link information for network security monitoring in an embodiment;

[0046] Figure 3 It is a schematic diagram of the structure of an electronic device in an embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0047] The present invention will be further described below in conjunction with the drawings and embodiments.

[0048] It should be noted that the following detailed descriptions are all illustrative and are intended to provide a further description of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs.

[0049] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0050] In the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0051] Embodiment 1

[0052] In this embodiment, the substation monitoring system is used as the application object to introduce in detail the method for electing the primary and standby links for network security monitoring of the substation monitoring system.

[0053] However, it does not mean that the method provided by the present invention can only be used in this field. Any monitoring system / field that requires device network security monitoring can use the technical solution provided by the present invention.

[0054] In this embodiment, it mainly solves the problems of random invalid switching of links and information loss during link switching when the substation monitoring system and the dispatching master station security management platform adopt a multi-link communication method.

[0055] This embodiment provides a method for electing the primary and backup links for network security monitoring of a substation monitoring system, which not only realizes the function of effectively selecting the primary link, but also realizes that after the election, the new primary link retransmits the unacknowledged information sent by the original primary link to the network security management platform, and the new network security monitoring information generated during the link switching process is also forwarded to the network security management platform.

[0056] The following introduces the detailed content.

[0057] First of all, this method proposes a primary link differential election mechanism, that is, using a ballot box to select the primary link in the valid state according to the priority, and changing the data sending states of the primary link and the backup link.

[0058] In this embodiment, each link can be regarded as a candidate. The candidate has ballot information, which includes the candidate name (i.e., the link name), the ballot box number where the candidate is located (i.e., the group number of the link group), the priority, and the candidate valid state (i.e., the link valid state).

[0059] The network security management platform can be regarded as a ballot box (i.e., distinguished according to the group number of the link group), which has multiple communication links, but there is only one elected primary link.

[0060] All network security management platforms can be regarded as a ballot warehouse, which has multiple ballot boxes.

[0061] As Figure 1 shown, each link in each ballot box needs to perform a security authentication process. To ensure the reliability of transmission, the links that do not pass the security authentication are not allowed to participate in the election of the primary link. The links that pass the security authentication (i.e., qualified candidates) can participate in the election, and the state of this link is "valid state".

[0062] In this embodiment, the security authentication process is a two-way security authentication. The process of two-way security authentication can select existing algorithms or technologies, which will not be elaborated here.

[0063] Establish ballot boxes according to link grouping for different network security management platforms. Each link in each ballot box has the same group number. Determine the priority of each link according to the preset priority standard.

[0064] In this embodiment, analyze the packet loss rate and delay rate of each link in the same ballot box, determine the priority according to the high and low of the packet loss rate and delay rate, and configure each link in the ballot box according to the high and low of the priority.

[0065] Of course, in other embodiments, the priority can be determined according to other communication metrics, such as the level of network performance (e.g., stability) or / and the level of data transmission ability, etc., for priority configuration.

[0066] The corresponding ballot box conducts the primary link election based on the status of each link. The initial status of the link is the "to-be-elected status", and when the link passes the security verification, the status changes to the "valid status".

[0067] If the link group number is 0, it means not grouped, no ballot box is formed, the ungrouped links do not involve primary and backup links, and do not participate in the election.

[0068] In some embodiments, when initializing the link, the candidate information can be registered in the ballot box first. The election process is designed as a thread control process, and if the candidate status changes, a new election is conducted. When starting the election for the primary and backup links, first check if there is a link with a high priority in the "valid status" in the ballot box. If so, this link is used as the primary link, and other links are used as backup links; if not, sequentially find the link in the "valid status" with the next priority as the primary link; if no "valid status" link is found, continue the election to find the primary link.

[0069] It should be noted that if there are multiple links with the same priority and their statuses are all "valid status", then randomly select one of the links as the primary link.

[0070] After electing the primary link, change its data transmission status to the "data transmissible status", and change the data transmission status of other backup links to the "data to-be-transmitted status".

[0071] Then use the primary link to process the network security monitoring information, that is, classify the network security monitoring information according to the matter category, and use the primary link to store or / and send relevant categories of matters in a predetermined order.

[0072] In this embodiment, an observer matter queue (each link can receive a notice and update when there is a change in the matter to ensure that the matters of each valid link are not lost), a cached matter queue, and an unconfirmed matter queue are designed. After the primary link sends a matter to the network security management platform, put this matter into the unconfirmed matter queue. When receiving the confirmation information from the network security management platform, delete this matter from the unconfirmed matter queue. After the backup link is upgraded to the primary link, it preferentially sends the information in the unconfirmed matter queue, and then sends the information in the cached matter queue and the observer matter queue.

[0073] In this embodiment, the above process is further described in detail, as Figure 2 shown, specifically including the following steps:

[0074] (1) The primary link first sends the unacknowledged queue items. If there are none, it does not send.

[0075] (2) After sending the unacknowledged queue, the primary link sends the buffer queue items.

[0076] (3) After sending the buffer queue, the primary link sends the observer queue items.

[0077] (4) The primary link sends items or heartbeat information to the network security management platform.

[0078] (5) The network security management platform sends acknowledgment information to the primary link.

[0079] (6) After sending the items, the primary link places the items in the unacknowledged queue.

[0080] (7) After receiving the acknowledgment information from the network security management platform, the primary link deletes the acknowledged items.

[0081] (8) When there are no items to send on the link, heartbeat information is sent.

[0082] (9) The standby link only sends heartbeat information to the network security management platform.

[0083] It should also be noted that the primary link starts an election after communication anomalies, while the standby link does not start an election after communication anomalies.

[0084] During the election process, the newly generated network security monitoring information is cached. After the election ends, the new primary link sends items to the network security management platform in the order of the unacknowledged item queue, buffer item queue, and observer item queue.

[0085] When a link with a higher priority is detected to have restored communication in the ballot box, the primary link switchover process is started, and the link with the higher priority is switched to be the primary link, and the original primary link becomes the standby link.

[0086] That is, when the current primary link is normal, if a link with a higher priority is detected to have restored in the ballot box, the primary link switchover process is started. The current primary link sends a stop frame to the network security management platform. After the network security management platform responds with a stop acknowledgment frame, this link becomes the standby link, and the ballot box re-elects, selecting the link with the higher priority as the primary link.

[0087] In this embodiment, for all primary and standby links, when their connections are idle, test frames are sent for heartbeat detection processing to maintain the active state of the links.

[0088] When it is detected that a certain link no longer sends test frames, monitoring continues after an interval of the set time. When the set number of monitoring times is reached, if this link still does not send test frames, this link is considered abnormal, and the status of this link is set to "invalid state".

[0089] The above set time and number of monitoring times can be flexibly set / configured according to specific monitoring requirements, the amount of monitoring data, etc.

[0090] In this embodiment, when the link connection is idle, it mainly means that when there is no matter to be sent on the main link, heartbeat information is sent; the standby link only sends heartbeat information to the network security management platform.

[0091] Embodiment Two

[0092] A network security monitoring primary and standby link election system for a substation monitoring system, comprising:

[0093] An election module, configured to use a ballot box to select a primary link in the valid state according to the priority, and change the data sending states of the primary link and the standby link;

[0094] A monitoring information processing module, configured to classify network security monitoring information according to matter categories, and use the primary link to store and / or send related categories of matters in a predetermined order;

[0095] A switching module, configured to start the primary link switching process when a link with a higher priority is detected to resume communication in the ballot box, switch the link with the higher priority to be the primary link, and change the original primary link to be the standby link.

[0096] In this embodiment, there are multiple ballot boxes, which are grouped according to different network security management platforms. Each ballot box corresponds to a group, and each ballot box forms a ballot bin.

[0097] In this embodiment, all links that pass the security authentication can participate in the election, and the state of this link is the valid state. The priority is determined according to the packet loss rate and delay rate of each link in the ballot box. The lower the packet loss rate and delay rate, the higher the priority.

[0098] The initial state of each link in each ballot box is the to-be-elected state, and the state becomes the valid state after the link passes the security verification.

[0099] In this embodiment, when starting the election, the election module is configured to first detect whether there is a link with a high priority in the valid state in the ballot box. If so, this link is used as the primary link, and other links are used as the standby links; if not, sequentially find a link in the valid state in the next priority level as the primary link; if no link in the valid state is found, continue the election process until the primary link is elected.

[0100] In this embodiment, when the election module is in the valid state and there are multiple links with the same priority level, randomly select one of the links as the primary link.

[0101] In this embodiment, the election module is configured to change the data sending status of the primary link to the data-sendable status and change the data sending status of other standby links to the data-to-be-sent status.

[0102] The election module is configured to restart the election process when there is an abnormality in the primary link communication, and not to start the election process when there is an abnormality in the standby link communication.

[0103] In this embodiment, during the process of classifying network security monitoring information by matter category by the monitoring information processing module, if network security monitoring information is generated during the election process, the network security monitoring information is cached.

[0104] The ballot box configures an observer matter queue, a cached matter queue, and an unconfirmed matter queue, and classifies network security monitoring information according to the above queues respectively.

[0105] The process that the monitoring information processing module is configured to store and / or send relevant categories of matters in a predetermined order using the primary link includes that after the election ends, the primary link sends matters to the network security management platform in the order of the unconfirmed matter queue, the cached matter queue, and the observer matter queue;

[0106] After the primary link sends a matter to the network security management platform, the matter is placed in the unconfirmed matter queue, and when the confirmation information from the network security management platform is received, the matter in the unconfirmed matter queue is deleted.

[0107] In this embodiment, the monitoring information processing module is specifically configured as follows:

[0108] The primary link first sends the matters in the unconfirmed queue, and if there are none, it does not send; after the primary link sends the unconfirmed queue, it sends the matters in the cached queue;

[0109] After the primary link sends the cached queue, it sends the matters in the observer queue;

[0110] The primary link sends a matter or a heartbeat message to the network security management platform and places the matter in the unconfirmed queue;

[0111] Receives the confirmation information from the network security management platform and deletes the confirmed matters.

[0112] In this embodiment, the switching module is configured to, when a link with a higher priority is detected to resume communication in the ballot box during the process of starting the primary link switching process, the current primary link sends a stop frame to the network security management platform. After the network security management platform responds with a stop confirmation frame, the current primary link becomes a standby link, and the corresponding ballot box conducts a re-election to select a link with a higher priority as the new primary link.

[0113] When all links are idle, they are configured to send test frames for heartbeat detection to maintain the active state of the links. When it is detected that a certain link no longer sends test frames, continuous monitoring is carried out at an interval of a set time until the set number of monitoring times is reached. If the link still does not send test frames during this process, it is considered that the link is abnormal, and the state of the corresponding link is set to the invalid state.

[0114] Embodiment III

[0115] An electronic device, as Figure 3 shown, the electronic device includes a processor 1001, a communication interface 1002, and a computer-readable storage medium 1003. Among them, the processor 1001, the communication interface 1002, and the computer-readable storage medium 1003 can be connected through a bus or other means.

[0116] Among them, the communication interface 1002 is used to receive and send data. The computer-readable storage medium 1003 can be stored in the memory of the electronic device. The computer-readable storage medium 1003 is used to store computer programs. The computer programs include program instructions. The processor 1001 is used to execute the program instructions stored in the computer-readable storage medium 1003.

[0117] The processor 1001 (or CPU (Central Processing Unit, central processor)) is the computing core and control core of the electronic device, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement the corresponding method flow or corresponding function.

[0118] The processor 1001 is configured to:

[0119] Use a ballot box to select the active main link according to the priority, and change the data sending states of the main link and the backup link;

[0120] Classify the network security monitoring information according to the matter categories, and use the main link to store or / and send the relevant categories of matters in a predetermined order;

[0121] When it is detected in the ballot box that a link with a higher priority resumes communication, start the main link switching process, switch the link with a higher priority to be the main link, and the original main link becomes the backup link.

[0122] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) that contain computer-usable program code.

[0123] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0124] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means that implement the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0125] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0126] The above is only the preferred embodiment of the present invention and is not used to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modifications, equivalent replacements, improvements, etc. made by those skilled in the art without creative efforts within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for selecting a primary and standby link for network security monitoring of a substation monitoring system, characterized in that: The following steps are involved: Use the ballot box to select the active main link according to the priority, and change the data transmission status of the main link and the backup link; Classify network security monitoring information according to the category of matters, and use the main link to store and / or send matters of related categories in a predetermined order; When the ballot box detects that a link with a higher priority has resumed communication, the main link switching process is initiated, and the link with a higher priority is switched to become the main link, and the original main link becomes the backup link.

2. A method for selecting a primary and standby link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: In the process of selecting the main link in a valid state according to priority using the ballot box, the ballot box includes multiple ones, and the links are grouped according to different network security management platforms. Each ballot box corresponds to a group, and each ballot box forms a ballot bin.

3. A method for selecting a primary and standby link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: In the process of selecting the main link in the valid state according to the priority by using the ballot box, all links that have passed the security authentication can participate in the election, and the state of the link is valid. The priority is determined according to the packet loss rate and delay rate of each link in the ballot box. The lower the packet loss rate and delay rate, the higher the priority. The initial state of each link in each ballot box is the waiting state, and the state becomes valid after the link passes the security authentication.

4. A method for selecting a primary and backup link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: In the process of selecting the main link in the valid state according to the priority by using the ballot box, when the election starts, first check whether there is a link with a high priority in the ballot box in the valid state. If so, the link will be used as the main link and the other links will be used as backup links. If not, search for the valid link in the next priority in turn as the main link. If no valid link is found, the election process continues until the primary link is selected. In the process of selecting the primary link in the valid state according to the priority, if there are multiple valid links with the same priority level, one of the links is randomly selected as the primary link.

5. A method for selecting a primary and backup link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: The process of changing the data transmission status of the main link and the standby link includes: changing the data transmission status of the main link to a data-transmittable state, and changing the data transmission status of other standby links to a data-to-be-transmitted state.

6. A method for selecting a primary and standby link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: The ballot box is used to select the effective main link according to the priority. When the main link communication is abnormal, the election process is started again. When the standby link communication is abnormal, the election process is not started.

7. A method for selecting a primary and backup link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: In the process of classifying network security monitoring information according to the item category, if network security monitoring information is generated during the election process, the network security monitoring information is cached. The process of classifying the item category includes: configuring the ballot box observer item queue, the cache item queue and the unconfirmed item queue, and classifying the network security monitoring information according to the above queues.

8. A method for selecting a primary and standby link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: The process of using the main link to store and / or send items of related categories in a predetermined order includes that after the election is over, the main link sends items to the network security management platform in the order of the unconfirmed item queue, the cached item queue and the observer item queue. When the main link sends an item to the network security management platform, the item is placed in the unconfirmed item queue, and when the confirmation information is received from the network security management platform, the item in the unconfirmed item queue is deleted.

9. A method for selecting a primary and backup link for network security monitoring of a substation monitoring system as claimed in claim 8, characterized in that: The specific process includes: The main link first sends the unconfirmed queue items, and does not send if there are none; the main link sends the cache queue items after sending the unconfirmed queue; The main link sends the observer queue events after sending the cache queue; The main link sends events or heartbeat information to the network security management platform and puts the events into the unconfirmed queue; Receive confirmation information from the network security management platform and delete confirmed items.

10. A method for selecting a primary and backup link for network security monitoring of a substation monitoring system according to claim 8, characterized in that: When the backup link is upgraded to the primary link, the unconfirmed event queue information is sent first, and then the cached event queue and observer event queue information are sent.

11. A method for selecting a primary and standby link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: When the ballot box detects that a link with a higher priority has resumed communication, the main link switching process is initiated. The current main link sends a stop frame to the network security management platform. After the network security management platform responds to the stop confirmation frame, the current main link becomes a backup link, and the corresponding ballot box is re-elected to select a link with a higher priority as the new main link.

12. A method for selecting a primary and backup link for network security monitoring of a substation monitoring system according to claim 1, characterized in that: All links send test frames for heartbeat detection when the connection is idle to maintain the active state of the link. When it is detected that a link no longer sends test frames, monitoring continues at set intervals until the set number of monitoring times is reached. If the link still does not send test frames during this process, it is considered that the link is abnormal and the status of the corresponding link is set to invalid.

13. A network security monitoring primary and standby link election system for a substation monitoring system, characterized in that: include: The election module is configured to use a ballot box to select a primary link in a valid state according to a priority, and change a data transmission state of the primary link and the backup link; A monitoring information processing module is configured to classify network security monitoring information according to the category of matters, and store and / or send matters of related categories according to a predetermined order using a main link; The switching module is configured to start the main link switching process when it is detected in the ballot box that a link with a higher priority has resumed communication, and switch the link with a higher priority to become the main link, and the original main link becomes the backup link.

14. An electronic device, characterized in that: The method comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor, wherein when the computer instructions are executed by the processor, the steps in the method according to any one of claims 1 to 12 are completed.

Images