Equipment security measure automatic generation rule base construction method and system

Abstract

The invention provides an equipment safety measure automatic generation rule base construction method and system, and relates to the technical field of equipment safety management.The method comprises the steps that initial deployment states of a power grid and power grid equipment are obtained, and initial comprehensive environment characteristics are generated; generating an initial security measure rule base according to the initial comprehensive environment characteristics; monitoring the power grid and the power grid equipment to obtain current operation data, and fusing the current operation data to obtain multi-source data of the power grid equipment; performing feature extraction on the multi-source data to obtain current comprehensive environment features; judging whether the operation environment of the power grid equipment is changed or not according to the current comprehensive environment characteristics and the initial comprehensive environment characteristics; if yes, updating the initial security measure rule base through a deep enhancement model according to the current comprehensive environment features and the initial comprehensive environment features, and obtaining a current security measure rule base. According to the invention, a more reliable and intelligent safety guarantee is provided for power grid equipment in a complex and changeable operation environment.

Description

Technical Field

[0001] The present invention relates to the technical field of equipment safety management, and more particularly, to a method and system for constructing a rule library for automatically generating equipment safety measures. Background Art

[0002] For the management of the operation safety of equipment in the power grid, it is usually based on the initial fixed deployment state of the equipment, mainly relying on static data such as equipment type, basic configuration information, and known historical records of security events, and forming a rule library through manual experience summary or simple algorithm analysis. To a certain extent, it provides basic protection for the equipment and ensures the safe operation of the equipment in a conventional environment.

[0003] In the related art, since the operating environment of the equipment is usually in a constantly changing state, such as network topology adjustment, physical location migration of the equipment, or connection of new peripherals. However, the existing rule library is generally constructed based on static data, so it is not sensitive to the dynamic changes of the equipment's operating environment, and thus cannot detect the changes in the operating environment in a timely manner, resulting in the original rules being unable to cope with the security risks in the new environment, presenting a security protection gap and seriously threatening the safe operation of the equipment. Summary of the Invention

[0004] The problem solved by the present invention is how to improve the security of the equipment safety measure rule library.

[0005] To solve the above problems, the present invention provides a method and system for constructing a rule library for automatically generating equipment safety measures.

[0006] In a first aspect, a method for constructing a rule library for automatically generating equipment safety measures according to the present invention, the method is applied to a power grid, the power grid includes a plurality of power grid devices, and each of the power grid devices is respectively deployed at each node of the power grid. The method includes: Obtain the initial deployment state of the power grid and the initial deployment state of the power grid device corresponding to each node of the power grid; Generate the initial comprehensive environment characteristics of the power grid device according to the initial deployment state of the power grid and the initial deployment state of the power grid device; Generate the initial safety measure rule library of the power grid device according to the initial comprehensive environment characteristics; Monitor the power grid and the power grid devices to obtain the current operation data of the power grid and the current operation data of the power grid devices, and fuse the current operation data of the power grid and the current operation data of the power grid devices to obtain the multi-source data of the power grid devices; Extract features from the multi-source data to obtain the current comprehensive environment characteristics of the power grid device; Determine whether the operating environment of the power grid equipment has changed according to the current comprehensive environment characteristics and the initial comprehensive environment characteristics; When the operating environment changes, update the initial safety measure rule library according to the current comprehensive environment characteristics and the initial comprehensive environment characteristics through a deep reinforcement model to obtain the current safety measure rule library of the power grid equipment.

[0007] Optionally, generating the initial comprehensive environment characteristics of the power grid equipment according to the initial deployment state of the power grid and the initial deployment state of the power grid equipment includes: determining the initial operation data of the power grid and the initial operation data of the power grid equipment according to the initial deployment state of the power grid and the initial deployment state of the power grid equipment; respectively performing feature extraction on the initial operation data of the power grid and the initial operation data of the power grid equipment to obtain the equipment state characteristics of the power grid equipment and the power grid operation characteristics of the power grid; fusing the equipment state characteristics and the power grid operation characteristics to obtain a fusion feature, and using the fusion feature as the initial comprehensive environment characteristics.

[0008] Optionally, generating the initial safety measure rule library of the power grid equipment according to the initial comprehensive environment characteristics includes: decomposing the initial comprehensive environment characteristics into multiple key feature dimensions, and establishing a relationship model between the feature dimensions and the safety risks of the power grid equipment; determining the weight value of each key feature dimension according to the equipment parameters of the power grid equipment; determining the safety risk value of the power grid equipment according to the relationship model and the weight value; setting the initial safety measure rule library according to the safety risk value.

[0009] Optionally, monitoring the power grid and power grid equipment to obtain the current operation data of the power grid and the current operation data of the power grid equipment includes: obtaining the monitoring frequency for monitoring the power grid and power grid equipment by mapping the safety risk value to a preset mapping table; monitoring the power grid and power grid equipment according to the monitoring frequency to obtain the current operation data of the power grid and the power grid equipment at the current time point.

[0010] Optionally, fusing the current operation data of the power grid and the current operation data of the power grid equipment to obtain the multi-source data of the power grid equipment includes: performing format conversion on the current operation data of the power grid and the current operation data of the power grid equipment to obtain the current operation data with the same time stamp and data format; fusing the current operation data with the same time stamp and data format through a Kalman filtering algorithm to obtain the multi-source data of the power grid equipment.

[0011] Optionally, the feature extraction of the multi-source data to obtain the current comprehensive environmental features of the power grid equipment includes: dividing the multi-source data into data windows with the same time period, and calculating the data analysis parameters within each data window, where the data analysis parameters include the data average value, variance, standard deviation, peak value, root mean square value, kurtosis, skewness, zero crossing rate, and absolute average value of the data within the data window; integrating the data analysis parameters to obtain the time domain features of the multi-source data; converting the multi-source data from the time domain to the frequency domain through Fourier transform to obtain the frequency domain features of the multi-source data; and obtaining the current comprehensive environmental features according to the time domain features and the frequency domain features.

[0012] Optionally, the judging whether the operating environment of the power grid equipment has changed according to the current comprehensive environmental features and the initial comprehensive environmental features includes: performing a comparison calculation on the current comprehensive environmental features and the initial comprehensive environmental features to obtain the feature difference degree between the current comprehensive environmental features and the initial comprehensive environmental features; judging whether the operating environment of the power grid equipment has changed according to the relationship between the feature difference degree and a preset difference degree threshold; where when the feature difference degree is greater than or equal to the preset difference degree threshold, it is determined that the operating environment of the power grid equipment has changed; when the feature difference degree is less than the preset difference degree threshold, it is determined that the operating environment of the power grid equipment has not changed.

[0013] Optionally, the performing a comparison calculation on the current comprehensive environmental features and the initial comprehensive environmental features to obtain the feature difference degree between the current comprehensive environmental features and the initial comprehensive environmental features includes: respectively decomposing the current comprehensive environmental features and the initial comprehensive environmental features into multiple corresponding dimensions, and assigning corresponding weight values to each dimension, where each dimension of the current comprehensive environmental features and the initial comprehensive environmental features corresponds to each other; calculating the absolute difference corresponding to each dimension according to the difference calculation method corresponding to each dimension; and performing a weighted sum according to the absolute differences and the weight values of all the dimensions to obtain the feature difference degree.

[0014] Optionally, the current security measure rule base of the grid equipment is obtained by updating the initial security measure rule base according to the current comprehensive environment feature and the initial comprehensive environment feature through the deep reinforcement model, including: inputting the current comprehensive environment feature and the initial comprehensive environment feature into the deep reinforcement model, taking the operating environment feature of the grid equipment as the state, and taking the update operation of the initial security measure rule base as the action; iteratively updating the action through the deep reinforcement model, then optimizing the initial security measure rule base according to the action, and judging whether the update of the action is completed through the state; after the update of the action is completed, updating the initial security measure rule base according to the update operation corresponding to the action to obtain the current security measure rule base.

[0015] In a second aspect, the present invention provides a system for constructing an automatic generation rule base for equipment security measures, which is applied to a power grid. The power grid includes a plurality of grid equipment, and each grid equipment is respectively deployed at each node of the power grid. The system includes: An acquisition unit, configured to acquire the initial deployment state of the power grid and the initial deployment state of each grid equipment corresponding to each node of the power grid; An initial setting unit, configured to generate the initial comprehensive environment feature of the grid equipment according to the initial deployment state of the power grid and the initial deployment state of the grid equipment; The initial setting unit is further configured to generate the initial security measure rule base of the grid equipment according to the initial comprehensive environment feature; A monitoring unit, configured to monitor the power grid and the grid equipment to obtain the current operation data of the power grid and the current operation data of the grid equipment, and fuse the current operation data of the power grid and the current operation data of the grid equipment to obtain the multi-source data of the grid equipment; A feature extraction unit, configured to extract features from the multi-source data to obtain the current comprehensive environment feature of the grid equipment; A judgment unit, configured to judge whether the operating environment of the grid equipment has changed according to the current comprehensive environment feature and the initial comprehensive environment feature; An optimization unit, configured to, when the operating environment changes, update the initial security measure rule base according to the current comprehensive environment feature and the initial comprehensive environment feature through a deep reinforcement model to obtain the current security measure rule base of the grid equipment.

[0016] The method and system for constructing a rule base for automatically generating device security measures of the present invention construct and update security measure rules for power grid devices deployed at each node of the power grid respectively. Since the operating environments, functions, and risks faced by power grid devices at different nodes are different, the present invention can generate practical security measure rules for each device according to its specific situation, achieving more accurate and detailed security protection. Specifically: The generation of the initial comprehensive environmental characteristics provides basic data support for the construction of the initial rule base and also serves as a reference standard for subsequent environmental change detection; the multi-source data fusion and feature extraction technology ensure that the system can comprehensively and accurately capture the real-time state of the operating environment of the power grid device and convert it into analyzable feature data. The environmental change judgment mechanism is used to compare the current features with the initial features, timely detect any subtle changes in the environment, and trigger the rule base update process. The deep reinforcement model, as the core of intelligent decision-making, dynamically adjusts the rule base according to the changed environmental characteristics to keep it always matching the current operating environment.

[0017] Specifically, by obtaining the initial deployment status of the power grid and devices and generating the initial comprehensive environmental characteristics, it not only provides a comprehensive and dynamic basic description for the construction of the initial security measure rule base but also establishes a reference benchmark for subsequent environmental change judgment. Secondly, by continuously monitoring the current operating data of the power grid and devices, fusing these data with the power grid data to form multi-source data, and further extracting features to obtain the current comprehensive environmental characteristics, it realizes the real-time perception of the dynamic operating environment and the accurate feature extraction, in sharp contrast to the traditional method that only relies on static data, and solves the problem that the existing rule base is insensitive to environmental changes; the traditional method constructs the rule base relying on static data and cannot timely respond to new risks brought by environmental changes. Thirdly, by comparing the current comprehensive environmental characteristics with the initial comprehensive environmental characteristics, it can accurately judge whether the operating environment of the power grid device has changed. Once an environmental change is detected, using the deep reinforcement model, the initial security measure rule base is intelligently updated by combining the current and initial features to generate the current security measure rule base adapted to the new environment; the deep reinforcement model adaptively adjusts the rules according to the changes in the environmental characteristics, thus realizing the dynamic update and optimization of the rule base.

[0018] The power grid of the present invention includes various types of power grid equipment, such as medium-voltage switch stations, ring network units, distribution transformers, smart meters, etc., and the deployment nodes and operating environments of different equipment are different. The present invention can respectively construct and update the security measure rule base for these different types of equipment, without the need to separately develop specific security measure generation schemes for each type of equipment, and has good compatibility. Whether it is a newly built power grid or an upgrade and transformation of an existing power grid, it can be applied, has strong versatility, and can be widely applied to various power grid scenarios. When the scale of the power grid expands or the equipment is updated, the present invention can conveniently incorporate new equipment into the monitoring and rule generation system. Only by obtaining the initial deployment status and relevant operation data of the new equipment can corresponding security measure rules be generated for it and integrated into the existing rule base. At the same time, with the continuous learning and optimization of the deep reinforcement model, the entire system can naturally adapt to the changes and development of the power grid, without the need for large-scale transformation or reconstruction of the original system, and it is easy to realize the expansion and upgrade of the power grid security measure rule base, ensuring the safe operation of the power grid at different development stages.

[0019] In summary, through continuous monitoring and feature extraction, the present invention can perceive environmental changes in real time, and use the deep reinforcement model to dynamically update the rule base to ensure that it is always adapted to the current environment, effectively eliminating the security protection gaps caused by environmental changes. Moreover, the application of the deep reinforcement model enables the rule base to adaptively update and optimize, effectively coping with various security risks in the new environment, and significantly improving the security and adaptability of the power grid equipment security measure rule base. In addition, this dynamic update mechanism also reduces the dependence on manual experience, reduces the possibility of human errors, and improves the efficiency of rule base construction and update. Finally, the present invention provides a more reliable and intelligent security guarantee for power grid equipment in a complex and changeable operating environment. Description of the Drawings

[0020] Figure 1 It is a flowchart of the method for constructing an automatic generation rule base for equipment security measures according to an embodiment of the present invention; Figure 2 It is a structural block diagram of a system for constructing an automatic generation rule base for equipment security measures according to an embodiment of the present invention. Detailed Embodiments

[0021] To make the above objects, features, and advantages of the present invention more obvious and understandable, the following will describe the specific embodiments of the present invention in detail with reference to the accompanying drawings. Although some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments described herein. On the contrary, these embodiments are provided to more thoroughly and completely understand the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not used to limit the protection scope of the present invention.

[0022] It should be understood that the various steps described in the method embodiments of the present invention can be executed in different orders and / or executed in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this regard.

[0023] As used herein, the term "comprising" and its variations are open-ended, i.e., "including but not limited to"; the term "based on" means "at least partially based on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments"; the term "optionally" means "optional embodiment". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0024] It should be noted that the modification of "one" and "plural" mentioned in the present invention is illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise clearly specified in the context, it should be understood as "one or more".

[0025] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only for illustrative purposes and are not used to limit the scope of these messages or information.

[0026] In the field of power grid equipment operation safety management, the traditional rule base construction method mainly relies on the initial fixed deployment state of the equipment, and forms a rule base through manual experience summary or simple algorithm analysis based on static data such as equipment type, basic configuration information, and known safety event history records. These static data are basically determined before the equipment is put into operation and are relatively stable during the operation of the equipment. Among them, the equipment type determines the basic functions and operating characteristics of the equipment, the basic configuration information includes the initial settings such as the network parameters and user permissions of the equipment, and the known safety event history record provides an empirical reference for the past safety problems of the equipment. Manual experience summary depends on the induction of professional personnel on equipment operation knowledge and safety events, and simple algorithm analysis processes the data through methods such as statistics and association rule mining. Although this method based on static data and manual experience can provide basic protection for the equipment to a certain extent and ensure the safe operation of the equipment in a conventional environment, there are some significant limitations.

[0027] However, the actual operating environment of power grid equipment is constantly changing. Network topology adjustment is a common phenomenon. With the expansion and optimization upgrade of the power grid scale, the network connection method may change, affecting the communication and data transmission security between devices. The physical location of the device may also change due to power grid layout adjustment or device maintenance migration, which may lead to the device facing different physical security threats, such as changes in environmental temperature and humidity or the risk of human damage. In addition, connecting new peripherals is also a common operation during device operation. The new peripherals may introduce new security vulnerabilities or compatibility problems with existing devices. These dynamic changes make it difficult for the rule base built based on static data to detect security risks in the new environment in a timely manner, because the existing rule base cannot dynamically adapt to these changes, resulting in the original rules being unable to cope with security threats in new situations, thus creating a security protection gap and seriously threatening the safe operation of the device. For example, newly added devices may bring unknown vulnerabilities, peripheral connections may introduce malware, and network topology changes may cause data transmission paths to pass through insecure areas. These situations may all make the device face new security risks. Since the traditional rule base lacks the ability to perceive and respond to dynamic changes, it cannot provide effective security protection measures in a timely manner, thus increasing the possibility of power grid equipment being subject to security attacks and reducing the reliability and stability of power grid operation.

[0028] In view of the problems existing in the above related technologies, this embodiment provides a method and system for constructing a rule base for automatically generating device security measures.

[0029] Combined with Figure 1 As shown, a method for constructing a rule base for automatically generating device security measures provided by an embodiment of the present invention is applied to a power grid, and the power grid includes a plurality of power grid devices, and each of the power grid devices is respectively deployed at each node of the power grid.

[0030] Specifically, the power grid is a distribution network, including various power grid devices, and these devices are distributed at each node of the power grid. The power grid devices specifically include, for example, medium-voltage switch stations. As the key nodes of the power grid, they connect multiple distribution lines and play the role of collecting and distributing electric energy. There are switching devices in the switch station, such as circuit breakers and disconnectors, which can realize the control and protection of different lines. For example, in the distribution network of a small industrial park, the medium-voltage switch station is the intersection of the main line and each branch line. When a fault occurs in a certain branch line, the circuit breaker in the switch station can quickly cut off the faulty line to prevent the fault from spreading to the entire distribution network.

[0031] Another example is the ring main unit, which is usually installed at the ring main nodes of the distribution network. Its main equipment includes load switches and fuses. The ring main unit makes the power supply of the distribution network more flexible and reliable, and can achieve the hand-in-hand power supply mode. For example, in the distribution network of urban residential areas, multiple ring main units are interconnected to form a ring main power supply structure. Under normal circumstances, each ring main unit is powered by two adjacent power supply points. When one of the power supply points fails, the load switch of the ring main unit can be switched to continue power supply by the other power supply point, ensuring that the electricity consumption of residents is not affected.

[0032] Or a distribution transformer, which is located at the end node of the distribution network and is a key device for converting medium-voltage electrical energy into low-voltage electrical energy. The operating state of the transformer directly affects the power supply quality of users. For example, in the distribution network of rural areas, each village or small production and processing area has one or more distribution transformers. If the distribution transformer is overloaded or fails, it may cause voltage instability or even power outage in the area, affecting residents' lives and production activities.

[0033] An intelligent electricity meter is deployed at the node of the user side and is used to measure the electricity consumption of users. It can collect electricity consumption data in real time and upload it to the monitoring system of the distribution network. For example, in the distribution network of urban commercial office buildings, each office is installed with an intelligent electricity meter, which can accurately measure the electricity consumption of each user and also provide data support for load management and energy efficiency analysis of the distribution network.

[0034] The method includes: Obtaining the initial deployment state of the power grid and the initial deployment state of the grid equipment corresponding to each node of the power grid.

[0035] Specifically, collect the geographical information of the area covered by the power grid, including terrain, landform, building distribution, etc., so as to obtain the distribution characteristics of power grid equipment in the geographical space and environmental factors. For example, through Geographic Information System (GIS) technology, draw the geographical layout map of the power grid, mark geographical elements such as mountains, rivers, roads, etc., so as to consider the impact of these geographical factors on power grid equipment in the subsequent formulation of safety measures. For example, equipment in mountainous areas may face lightning strike risks, and equipment near rivers may need to pay attention to flood risks, etc. Clarify the connection relationship of the power grid, including the electrical connection methods between components such as substations, switch stations, ring network units, distribution lines, distribution transformers, etc. Obtain through materials such as the design drawings and wiring diagrams of the power grid. For example, by drawing single-line diagrams, network topology diagrams, etc., obtain the connection lines between each node and adjacent nodes, as well as the position and role of each node in the power grid, and determine the current flow path and power supply range. Collect the basic parameters of the distribution line, such as line length, conductor type, wire diameter, resistance, reactance, etc. These parameters are used to calculate information such as voltage loss, current carrying capacity, and loss of the line. For example, according to the conductor type and length of the line, the impedance of the line can be calculated, and then the voltage drop and power loss of the line under different load conditions can be evaluated, providing a basis for the economic operation of the power grid and the formulation of safety measures.

[0036] At each node of the power grid, determine the type and specific model of the deployed power grid equipment. Common equipment types include circuit breakers, disconnect switches, fuses, distribution transformers, smart meters, reactive power compensation devices, relay protection devices, etc. Different types of equipment have different functions and operating characteristics, and different models of the same type of equipment may also have differences in parameters and technical indicators. For example, for different models of distribution transformers, parameters such as rated capacity, turns ratio, and impedance voltage are different, and this information will directly affect the safe operation of the equipment and corresponding safety measures.

[0037] Record the specific installation location of each power grid equipment on the power grid node, including its specific location information in places such as substations, switch stations, distribution rooms, outdoor poles, etc. At the same time, collect relevant information on the surrounding environment of the equipment, such as temperature, humidity, altitude, pollution level, etc. For example, equipment installed outdoors may be affected by harsh weather conditions, while equipment installed in the basement may face problems of high humidity. These environmental factors will exacerbate the aging and failure risks of the equipment. Therefore, corresponding protection measures need to be formulated for equipment in different environments in the safety measure rule library. For example, take lightning protection, wind protection, and waterproof measures for outdoor equipment, and strengthen moisture-proof and anti-condensation measures for basement equipment.

[0038] Obtain the initial parameter configurations of grid equipment, such as the rated current of circuit breakers, protection setting values, tap changer positions of distribution transformers, load rates, metering parameters of smart meters, communication parameters, etc. These parameters are the basis for the normal operation of the equipment and also important bases for judging whether the equipment is in a safe operating state. By collecting these parameters, the initial operating state and performance indicators of the equipment can be understood, providing a reference for subsequent monitoring and safety measure updates. For example, the load rate parameter of a distribution transformer can help determine its load level in the initial state. When the operating environment changes or the load increases, this parameter can be used to evaluate whether the equipment will have an overload risk, and relevant content in the safety measure rule base can be adjusted in a timely manner, such as adjusting the load distribution strategy or increasing heat dissipation measures, etc.

[0039] Comprehensively collect the initial deployment status of the grid and equipment from materials such as grid planning and design documents, equipment procurement lists, installation and commissioning records, etc. Specifically include the grid topology structure (such as substation distribution, transmission line connection methods, etc.), equipment types (such as transformers, circuit breakers, relay protection devices, etc.), basic configuration information of the equipment (such as network parameters, user permission settings, initial values of equipment parameters, etc.), physical locations of the equipment (such as installation position coordinates of equipment in the substation, geographical coordinates of outdoor equipment, etc.), and the initial connected peripheral situations (such as monitoring sensors, communication modules, etc.).

[0040] Generate the initial comprehensive environmental characteristics of the grid equipment according to the initial deployment status of the grid and the initial deployment status of the grid equipment.

[0041] Specifically, extract key features from the preprocessed initial deployment status to construct an initial comprehensive environmental feature vector. For example, for the grid topology structure, extract features such as the number of nodes and the complexity of connection relationships; for equipment types, convert them into numerical features using one-hot encoding, etc.; for configuration parameters, numerically process the key parameters and extract their initial values as features; for physical locations, generate location features based on geographical coordinates or relative position encoding; for initially connected peripherals, also use one-hot encoding and other representation methods to extract peripheral type and connection status features. Standardize the extracted features to eliminate the dimension difference, and then determine the weights according to the importance of each feature to equipment safety, and perform weighted fusion to construct the initial comprehensive environmental feature vector. The weights can be determined by methods such as expert scoring and historical data analysis. For example, equipment types and configuration parameters are usually more important in safety assessments and can be given relatively higher weights.

[0042] Generate the initial safety measure rule base of the grid equipment according to the initial comprehensive environmental characteristics.

[0043] Specifically, based on the initial comprehensive environmental characteristics, safety analysis models and algorithms (such as fault tree analysis, risk matrix method, etc.) are used, combined with the safety operation standards and specifications of power grid equipment, to analyze the potential safety risk points that power grid equipment may face in the initial environment. For example, according to the position and connection relationship of the equipment in the network topology, identify the equipment nodes vulnerable to network attacks; according to the initial values of the configuration parameters, discover the configuration items that may have safety hazards.

[0044] Exemplarily, taking the transformer protection system in the power grid as an example, if we want to analyze the possible causes of power outage due to transformer failure, we use a safety analysis model, such as a fault tree model, to construct a fault tree model. Construct the fault tree: including intermediate events such as "overload", "short circuit", "insulation failure", etc., and then break them down into basic events such as "load exceeding the rated capacity", "relay protection device failure", etc. According to the results of the fault tree analysis, calculate the occurrence probabilities of each basic event and determine the key influencing factors. For example, it is found that "relay failure" has a greater impact on the refusal of the protection device to operate, and its occurrence probability is relatively high. Combining with the safety operation standards and specifications of power grid equipment (such as "Operating Regulations for Power Transformers"), formulate safety measure rules for these key factors. For example, according to the regulations, shorten the regular inspection and maintenance cycle of the relay to once every 3 months; perform redundant design on the protection circuit to ensure that another circuit can be enabled in time when one circuit fails. Finally, organize and store these safety measure rules to construct the initial safety measure rule library for the transformer. For example, rule number 001: "Monitor the status of the transformer relay monthly, record its operation times and response time. If the operation times exceed the set threshold or the response time is delayed beyond the specified value, perform maintenance or replacement immediately." In this way, based on the initial comprehensive environmental characteristics and the fault tree model, an initial safety measure rule library that matches the actual operating environment of the transformer is generated, providing a basic guarantee for the safe operation of the transformer.

[0045] For the identified safety risk points, combined with the experience of safety experts and known safety policies, formulate corresponding safety measure rules. The rules include elements such as rule name, applicable conditions, operation content, etc. For example, for the access control rules of important equipment, it should clearly stipulate the user roles allowed to access, the access time range, the authentication method, etc. Organize and store the formulated safety measure rules into the initial safety measure rule library. The rule library can be in the form of a database or a configuration file, etc., to facilitate subsequent query and update operations.

[0046] Monitor the power grid and power grid equipment to obtain the current operation data of the power grid and the current operation data of the power grid equipment, and fuse the current operation data of the power grid and the current operation data of the power grid equipment to obtain the multi-source data of the power grid equipment.

[0047] Specifically, the monitoring system of the power grid (such as SCADA system, network traffic monitoring tools, etc.) is used to collect the operation data of the power grid in real time, including network traffic, power transmission, voltage and current values, etc. These data reflect the overall operation status and network transmission situation of the power grid. For example, through the SCADA system, real-time power data, line voltage and current and other information of each substation in the power grid can be obtained, and through the network traffic monitoring tool, the traffic size, data packet transmission rate, etc. of the power grid communication network can be understood.

[0048] The operation status data of the power grid equipment is obtained through means such as the equipment management system, log collection tools, etc., including the performance indicators of the equipment (such as CPU usage rate, memory occupancy rate, disk I / O operation frequency, etc.), equipment log information (such as equipment start-up, shutdown time, operation records, fault alarm information, etc.), and the state changes of connected peripherals (such as plugging and unplugging of peripherals, switching of working modes, etc.). These data can reflect the real-time operation situation and performance of the equipment.

[0049] The currently collected operation data of the power grid and the currently collected operation data of the power grid equipment are fused to obtain multi-source data. Data fusion algorithms can be used for data fusion, such as Kalman filtering, weighted average and other methods. For example, by combining network traffic data and equipment performance data, weighted average is performed on the two according to certain weights to obtain comprehensive data that can more comprehensively reflect the operation status of the equipment. At the same time, time synchronization and format unification processing are performed on the data to ensure the consistency and integrity of the multi-source data for subsequent feature extraction and analysis.

[0050] Feature extraction is performed on the multi-source data to obtain the current comprehensive environmental features of the power grid equipment.

[0051] Specifically, feature extraction is performed on the fused multi-source data, and the extracted features should correspond to the initial comprehensive environmental features for subsequent comparative analysis. Methods such as signal processing, statistical analysis, and machine learning can be used to extract features. For example, traffic features are extracted from network traffic data, such as the mean and variance of traffic size, the peak and valley values of traffic rate, etc.; performance features are extracted from equipment performance data, such as the peak value of CPU usage rate, the average value of memory occupancy rate, etc.; log features are extracted from equipment log information, such as log type distribution, log frequency, etc.

[0052] The extracted features are standardized to eliminate the dimension difference and make different features comparable. Then, using the same weights and fusion methods as those used in constructing the initial comprehensive environmental features, the currently extracted features are weighted and fused to construct the current comprehensive environmental feature vector. This can ensure that the current comprehensive environmental features and the initial comprehensive environmental features are in the same feature space, which is convenient for subsequent similarity comparison and environmental change judgment.

[0053] Based on the current comprehensive environmental characteristics and the initial comprehensive environmental characteristics, determine whether the operating environment of the power grid equipment has changed.

[0054] Specifically, calculate the similarity between the current comprehensive environmental feature vector and the initial comprehensive environmental feature vector. Methods such as Euclidean distance, cosine similarity, and Manhattan distance can be used. For example, use the Euclidean distance formula to calculate the distance between two feature vectors in the feature space. The larger the distance, the greater the difference between the two feature vectors, that is, the more obvious the change in the operating environment; use cosine similarity to calculate the cosine value of the angle between two vectors. The smaller the cosine value, the greater the difference in vector directions, indicating that the operating environment may have changed.

[0055] Set a reasonable similarity threshold. The determination of the threshold should be based on historical data and actual operating experience. When the calculated similarity is less than the set threshold, it is considered that the operating environment of the power grid equipment has changed; otherwise, it is considered that the operating environment has not changed. In practical applications, the threshold setting can be continuously optimized through the analysis of historical data and experimental verification to balance the false positive rate and the false negative rate and ensure the timely and accurate detection of changes in the operating environment.

[0056] When the operating environment changes, through the deep reinforcement model, update the initial safety measure rule base according to the current comprehensive environmental characteristics and the initial comprehensive environmental characteristics to obtain the current safety measure rule base of the power grid equipment.

[0057] Specifically, a deep reinforcement learning model is constructed. In a preferred embodiment of the present invention, the deep reinforcement learning model adopts a deep Q-network (DQN) architecture, and its main components include: an experience replay pool, which is used to store the state information before and after the change of the power grid equipment operation environment, the rule update actions taken, and the corresponding reward signals. It is trained by randomly sampling mini-batch data to break the correlation between data and improve the stability and convergence speed of the model. The deep neural network (DNN) consists of multiple hidden layers, including fully connected layers, convolutional layers, etc. The input layer receives the difference features between the current comprehensive environment feature vector and the initial comprehensive environment feature vector, as well as the rule features in the initial security measure rule library. The hidden layer extracts and learns the complex patterns and features in the data through non-linear activation functions, and the output layer outputs the update actions for the initial security measure rule library, such as adding rules, deleting rules, modifying rule parameters, etc. The target network has the same structure as the DNN but fixed parameters, and periodically copies the parameters from the DNN to generate the target Q value, stabilize the training process, and improve the convergence and performance of the model. The environment simulation constructs a power grid equipment operation environment simulator to simulate environmental changes and security risk scenarios, and generate a large number of environmental feature samples and corresponding optimal rule update strategies. The training process inputs the data obtained from the simulation into the DNN, calculates the Q values of each possible action in the current state through interaction with the environment simulator, measures the difference between the predicted Q value and the target Q value using a loss function, and updates the network parameters using an optimization algorithm (such as Adam). The target network periodically copies the parameters from the DNN and continuously iterates the training until the model converges.

[0058] Specifically, when it is detected that the operation environment of the power grid equipment changes, the difference features between the current comprehensive environment feature vector and the initial comprehensive environment feature vector, as well as the rule features of the initial security measure rule library, are used as inputs and input into the trained deep reinforcement learning model. The model calculates through forward propagation and outputs the update actions for the initial security measure rule library, such as adding rules, deleting rules, modifying rule parameters, etc. These update actions are executed by the rule management module to generate the current security measure rule library to adapt to the change of the power grid equipment operation environment and improve the effectiveness of security protection.

[0059] The inputs of the model include the difference features between the current comprehensive environment feature vector and the initial comprehensive environment feature vector, as well as the rule features in the initial security measure rule library. The rule features can vectorize the rules, such as rule types (access control rules, data encryption rules, etc.), rule parameters (such as access permission levels, encryption algorithm types, etc.). The output of the model is the update actions for the initial security measure rule library, including operations such as adding rules, deleting rules, modifying rule parameters, etc.

[0060] In the model training stage, a large number of environmental feature samples and corresponding optimal rule update strategies are generated by simulating the changes in the operating environment of power grid equipment, and a training dataset is constructed. The model is trained using deep reinforcement learning algorithms (such as DQN, DDPG, etc.). The model continuously interacts with the environment in the simulated environment, tries different rule update actions, and adjusts the model parameters according to the reward signals feedback by the environment (such as the security protection effect after rule update, system operation efficiency, etc.), gradually learning the optimal rule update strategy until the model converges.

[0061] When it is detected that the operating environment of the power grid equipment has changed, the difference features between the current comprehensive environmental feature vector and the initial comprehensive environmental feature vector, as well as the rule features of the initial security measure rule base, are input into the trained deep reinforcement model. The model outputs the update actions for the initial security measure rule base according to the learned strategy, and these actions are executed by the rule management module, such as adding rules for new environmental security risks, deleting no-longer-applicable rules, adjusting the parameters of existing rules, etc., so as to obtain the current security measure rule base to adapt to the changes in the operating environment of the power grid equipment and improve the effectiveness of security protection.

[0062] The method and system for automatically generating a rule base for equipment security measures of the present invention construct and update security measure rules for the power grid equipment deployed on each node of the power grid respectively. Since the operating environments, functions and risks faced by the power grid equipment at different nodes are different, the present invention can generate practical security measure rules for each equipment according to its specific situation, realizing more accurate and detailed security protection. Specifically: The generation of the initial comprehensive environmental features provides the basic data support for the construction of the initial rule base, and also serves as a reference standard for subsequent environmental change detection; the multi-source data fusion and feature extraction technology ensures that the system can comprehensively and accurately capture the real-time state of the operating environment of the power grid equipment and convert it into analyzable feature data. The environmental change judgment mechanism is used to compare the current features with the initial features, timely detect any subtle changes in the environment, and trigger the rule base update process. The deep reinforcement model, as the core of intelligent decision-making, dynamically adjusts the rule base according to the changed environmental features, so that it always maintains a matching degree with the current operating environment.

[0063] Specifically, by obtaining the initial deployment status of the power grid and equipment and generating the initial comprehensive environmental characteristics, it not only provides a comprehensive and dynamic basic description for the construction of the initial security measure rule base, but also establishes a benchmark reference for subsequent environmental change judgment. Secondly, by continuously monitoring the current operation data of the power grid and equipment, fusing these data with the power grid data to form multi-source data, and further extracting features to obtain the current comprehensive environmental characteristics; it realizes the real-time perception of the dynamic operation environment and the accurate feature extraction, in sharp contrast to the traditional method that only relies on static data, and solves the problem that the existing rule base is insensitive to environmental changes; the traditional method constructs the rule base relying on static data and cannot timely respond to the new risks brought by environmental changes. Thirdly, by comparing the current comprehensive environmental characteristics with the initial comprehensive environmental characteristics, it can accurately judge whether the operation environment of the power grid equipment has changed. Once environmental changes are detected, using the deep reinforcement model, combined with the current and initial characteristics, the initial security measure rule base is intelligently updated to generate the current security measure rule base adapted to the new environment; the deep reinforcement model adaptively adjusts the rules according to the changes in environmental characteristics, thus realizing the dynamic update and optimization of the rule base.

[0064] The power grid of the present invention includes various types of power grid equipment, such as medium-voltage switch stations, ring network units, distribution transformers, smart meters, etc., and the deployment nodes and operation environments of different equipment are different. The present invention can separately construct and update the security measure rule base for these different types of equipment, without separately developing a specific security measure generation scheme for each type of equipment, and has good compatibility. Whether it is a newly built power grid or an upgrade and transformation of an existing power grid, it can be applied, has strong versatility, and can be widely applied to various power grid scenarios. When the scale of the power grid expands or the equipment is updated, the present invention can conveniently incorporate new equipment into the monitoring and rule generation system. Only by obtaining the initial deployment status and related operation data of the new equipment can the corresponding security measure rules be generated for it and integrated into the existing rule base. At the same time, with the continuous learning and optimization of the deep reinforcement model, the entire system can naturally adapt to the changes and development of the power grid without large-scale transformation or reconstruction of the original system, and it is easy to realize the expansion and upgrade of the power grid security measure rule base to ensure the safe operation of the power grid at different development stages.

[0065] In summary, through continuous monitoring and feature extraction, the present invention can perceive environmental changes in real time, and use a deep reinforcement model to dynamically update the rule base to ensure that it is always adapted to the current environment, effectively eliminating the security protection gaps caused by environmental changes. Moreover, the application of the deep reinforcement model enables the rule base to be updated and optimized adaptively, effectively coping with various security risks in the new environment, and significantly improving the security and adaptability of the rule base for the safety measures of power grid equipment. In addition, this dynamic update mechanism also reduces the dependence on manual experience, reduces the possibility of human errors, and improves the efficiency of rule base construction and update. Finally, the present invention provides a more reliable and intelligent security guarantee for power grid equipment in a complex and changeable operating environment.

[0066] Optionally, generating the initial comprehensive environmental features of the power grid equipment according to the initial deployment state of the power grid and the initial deployment state of the power grid equipment includes: determining the initial operation data of the power grid and the initial operation data of the power grid equipment according to the initial deployment state of the power grid and the initial deployment state of the power grid equipment; respectively performing feature extraction on the initial operation data of the power grid and the initial operation data of the power grid equipment to obtain the equipment state features of the power grid equipment and the power grid operation features of the power grid; fusing the equipment state features and the power grid operation features to obtain a fused feature, and using the fused feature as the initial comprehensive environmental feature.

[0067] Specifically, extract the initial operation data of the power grid from the power grid's planning and design documents and historical operation records, including the initial network topology (substation locations, transmission line connection relationships, etc.), initial power transmission parameters (initial power transmission values of each line, initial power injection values of substations, etc.), initial voltage and current values (initial voltage amplitudes and phase angles of each node, initial current values of each line, etc.), and the initial operation mode of the power grid (normal operation mode, maintenance mode, etc.). These data reflect the operation conditions and network status of the power grid in the initial deployment state. Obtain the initial operation status information of the equipment from the equipment's factory information, installation and commissioning records, and initial operation logs, including the initial performance indicators of the equipment (such as the initial load rate of the transformer, the initial operation times of the circuit breaker, etc.), initial configuration parameters (such as the network parameters of the equipment, protection setting values, etc.), initial connection status (such as the connection status between the equipment and the superior power grid, the communication status with other equipment, etc.), and the initial health status of the equipment (such as the initial insulation level of the equipment, mechanical status, etc.). These data reflect the operation performance and status of the equipment in the initial deployment state. For the initial operation data of power grid equipment, extract the features that can characterize the equipment status. For example, for a transformer, extract features such as its initial load rate, oil temperature, insulation resistance, etc.; for a circuit breaker, extract features such as its initial operation times, cumulative operation time, contact resistance, etc. These features can be directly obtained through the equipment's monitoring system (such as the oil temperature monitoring device of the transformer, the operation counter of the circuit breaker, etc.), or can be indirectly calculated through the equipment's performance evaluation model (such as the load rate calculation model based on equipment operation data, the insulation aging evaluation model, etc.). For the initial operation data of the power grid, extract the features that can reflect the operation status of the power grid. For example, extract the initial network topology features of the power grid (such as the number of nodes, connection relationship matrix, etc.), initial power transmission features (such as the power transmission values of each line, power flow direction, etc.), initial voltage and current features (such as the voltage amplitudes and phase angles of each node, the current values of each line, etc.), and the initial operation mode features of the power grid (such as operation mode identifiers, etc.). These features can be directly collected through the power grid's dispatching automation system (such as the SCADA system), or can be indirectly calculated through tools such as the power flow calculation model of the power grid (such as the Newton-Raphson power flow calculation algorithm).

[0068] Perform standardization processing on the extracted equipment status features and power grid operation features respectively to eliminate the dimension differences. For example, adopt the Z-score standardization method to convert each feature value into the degree of deviation relative to the average value of this feature. The calculation formula is: , where represents the standardized feature value, X represents the original feature value, μ represents the average value of this feature, σIt represents the standard deviation of this feature. The weighted fusion method is used to fuse the standardized device status features and grid operation features to obtain the fused features. The determination of the weights can be achieved by methods such as the expert scoring method and the principal component analysis method (PCA).

[0069] For example, according to expert experience, the weights of the device status feature and the grid operation feature in the comprehensive environmental feature are 0.4 and 0.6 respectively. Suppose the vector of the device status feature after standardization is [0.5, 0.3, 0.8], and the vector of the grid operation feature after standardization is: [0.6, 0.4, 0.7, 0.5]; then the calculation formula for the fused feature is: , that is, adding the two feature vectors according to the weights to obtain the fused feature vector [0.64, 0.36, 0.76, 0.3]. Finally, the fused feature is used as the initial comprehensive environmental feature for the subsequent generation step of the initial security measure rule base.

[0070] In this optional embodiment, by separately extracting the device status feature and the grid operation feature from the initial operation data of the grid device and performing feature fusion to obtain the initial comprehensive environmental feature, it can comprehensively and accurately reflect the operation environment of the grid device in the initial deployment state. On the one hand, separately extracting the device status feature and the grid operation feature can specifically analyze the device's own status and the grid operation situation to ensure that key information is not lost; on the other hand, the feature fusion process comprehensively considers the mutual influence of the two, making the initial comprehensive environmental feature closer to the actual operation environment. And it provides a strong basis for accurately judging the changes in the operation environment and dynamically updating the security measure rule base in the future, effectively improving the refinement level and dynamic adaptability of the grid device security management.

[0071] Optionally, generating the initial security measure rule base for the grid device according to the initial comprehensive environmental feature includes: decomposing the initial comprehensive environmental feature into multiple key feature dimensions, and establishing a relationship model between the feature dimension and the security risk of the grid device; determining the weight value of each key feature dimension according to the device parameters of the grid device; determining the security risk value of the grid device according to the relationship model and the weight value; setting the initial security measure rule base according to the security risk value.

[0072] Specifically, the initial comprehensive environmental feature is decomposed into multiple key feature dimensions. First, analyze each element of the initial comprehensive environmental feature vector to determine the specific feature meaning represented by each element. For example, the initial comprehensive environmental feature vector may include multiple elements such as device type code, initial device load rate, initial device insulation resistance, initial grid power flow distribution, and initial grid voltage stability.

[0073] Based on the safe operation principle of power grid equipment and historical safety event data, establish a relationship model between each key feature dimension and the safety risk of power grid equipment. For example, for the feature dimension of equipment load rate, through the analysis of historical data, it is found that when the equipment load rate exceeds 80%, the risk of equipment failure due to overheating increases significantly. A linear regression model can be established to describe the relationship between the equipment load rate and the overheating failure risk. The model form is: overheating failure risk value = α × equipment load rate + β, where α and β are model parameters obtained by fitting historical data.

[0074] Collect equipment parameters of power grid equipment, including the rated capacity, insulation level, operation years, maintenance cycle, etc. of the equipment. These parameters reflect the inherent characteristics and operation status of the equipment. According to the equipment parameters and expert experience, determine the weight value of each key feature dimension. For example, for a transformer with a long operation years, the influence of the insulation resistance feature dimension on the safety risk may be greater, so a higher weight can be assigned to the insulation resistance feature dimension. The determination of the weight value can adopt the Analytic Hierarchy Process (AHP). First, construct a judgment matrix, compare and score the importance of each key feature dimension in affecting the safety risk of power grid equipment pairwise, and then obtain the weight vector through consistency test and normalization processing. Substitute the feature value of each key feature dimension into the corresponding relationship model to calculate the risk contribution value of each feature dimension. For example, for the equipment load rate feature dimension, according to the above-established linear regression model, substitute the initial load rate of the equipment into the model to calculate the overheating failure risk contribution value. According to the weight values of each key feature dimension, perform weighted summation on the risk contribution values of each feature dimension. The calculation formula is: power grid equipment safety risk value = ∑(weight value × risk contribution value). For example, assume that the weight value of the equipment load rate feature dimension is 0.3, and its risk contribution value is 0.6; the weight value of the insulation resistance feature dimension is 0.5, and its risk contribution value is 0.4; the weight value of the power grid power flow distribution feature dimension is 0.2, and its risk contribution value is 0.5. Then the power grid equipment safety risk value = 0.3×0.6 + 0.5×0.4 + 0.2×0.5 = 0.44.

[0075] Based on the calculated safety risk values of power grid equipment, combined with safety standards and specifications, an initial safety measure rule library is set up. The safety risk values are divided into different risk level intervals. For example, a safety risk value between 0 and 0.3 is a low risk, and the corresponding safety measure rules can be regular inspections and routine maintenance; between 0.3 and 0.6 is a medium risk, and the corresponding safety measure rules can be enhanced monitoring and increased maintenance frequency; between 0.6 and 1.0 is a high risk, and the corresponding safety measure rules can be immediate shutdown for maintenance and taking emergency protection measures, etc. For each risk level, detailed safety measure rules are formulated, including monitoring index thresholds, operation procedures, responsible personnel, etc. For example, for the high risk level, the thresholds of the key monitoring indexes (such as temperature, pressure, etc.) of the equipment are specified. When the monitoring index exceeds the threshold, an alarm is automatically triggered and the corresponding emergency operation procedure is executed, and at the same time, the designated responsible personnel are notified for handling. These safety measure rules are sorted out and stored in the initial safety measure rule library for convenient subsequent query and execution.

[0076] In this optional embodiment, the initial comprehensive environmental characteristics are decomposed into multiple key feature dimensions, and a relationship model between the feature dimensions and safety risks is established, making the assessment of the safety risks of power grid equipment more detailed and accurate. By considering the influence of each key feature dimension separately, the potential risks of power grid equipment in different aspects can be comprehensively identified, avoiding omissions or misjudgments that may be caused by single-index assessment. The weight values of each key feature dimension are determined based on the equipment parameters of the power grid equipment, fully considering the individual differences and operation characteristics of different equipment. Such personalized weight allocation makes the safety risk assessment results more in line with the actual operation situation, improving the scientificity and reliability of the assessment. Furthermore, the safety risk value of the power grid equipment is calculated by combining the relationship model and the weight value, realizing the quantitative description of the safety risk. This quantitative risk expression method helps to more intuitively compare the safety risk levels of different equipment or different operating states, providing a clear quantitative basis for the subsequent formulation of safety measures. Setting up the initial safety measure rule library according to the safety risk value ensures the pertinence and effectiveness of the safety measures. Different risk levels correspond to different safety measure rules, which can take effective protection measures for high-risk equipment or high-risk states in a timely manner, reducing the probability and impact of safety incidents. It provides convenience for the subsequent adjustment of safety measures. When the operating environment or equipment parameters of the power grid equipment change, the safety risk value can be re-evaluated according to the new initial comprehensive environmental characteristics, and the safety measure rule library can be updated accordingly to ensure the continuous effectiveness of the safety measures.

[0077] Optionally, monitoring the power grid and power grid equipment to obtain the current operation data of the power grid and the current operation data of the power grid equipment includes: mapping the safety risk value with a preset mapping table to obtain the monitoring frequency for monitoring the power grid and power grid equipment; monitoring the power grid and power grid equipment according to the monitoring frequency to obtain the current operation data of the power grid and the power grid equipment at the current time point.

[0078] Specifically, first, by mapping the safety risk value with a preset mapping table, the monitoring frequency for monitoring the power grid and power grid equipment is determined. The preset mapping table is predefined based on the historical operation data, safety standards, and expert experience of the power grid equipment, and clearly stipulates the monitoring frequencies corresponding to different safety risk value intervals. For example, when the safety risk value is in the low-risk interval (such as 0 - 0.3), the corresponding monitoring frequency can be set to once per hour; when the safety risk value is in the medium-risk interval (such as 0.3 - 0.6), the corresponding monitoring frequency is increased to once every half hour; and when the safety risk value is in the high-risk interval (such as 0.6 - 1.0), the corresponding monitoring frequency is further increased to once every ten minutes. The formulation of the preset mapping table fully considers the requirements for the monitoring frequency under different risk levels to ensure that potential safety hazards can be captured in a timely manner. Then, the power grid and power grid equipment are monitored according to the determined monitoring frequency to obtain the current operation data of the power grid and the power grid equipment at the current time point.

[0079] In an alternative embodiment of the present invention, the monitoring process involves a variety of monitoring means and technologies, including but not limited to the following aspects: Monitoring of power grid operating parameters: Using the Supervisory Control And Data Acquisition (SCADA) system of the power grid, the operating parameters of the power grid are collected in real time, such as the voltage, current, power, etc. of each node. The SCADA system can accurately collect these key parameters at a set time interval (i.e., the monitoring frequency) through a sensor network deployed in the power grid and transmit them to the monitoring center. Monitoring of equipment status: An equipment status monitoring system is adopted to track the operating status of power grid equipment in real time. For example, by installing temperature sensors, pressure sensors, vibration sensors, etc. on the equipment, key indicators such as the temperature, pressure, and vibration of the equipment are monitored. These sensors can collect data at a set monitoring frequency and send the data to the monitoring system through a data acquisition card or communication module. Monitoring of network traffic: For the communication network of the power grid, network traffic monitoring tools are used to monitor network traffic in real time. These tools can statistically analyze information such as the incoming and outgoing traffic of the network and the data packet transmission rate at a set monitoring frequency to promptly detect network anomalies or potential network attacks. Monitoring of security events: Using a Security Information and Event Management (SIEM) system, the security event logs of the power grid and equipment are collected and analyzed. The SIEM system can obtain log information from various security devices and systems and perform analysis and summarization at a set monitoring frequency to promptly detect signs of security events.

[0080] In this alternative embodiment, the currently monitored operating data will be recorded and stored for subsequent data fusion and feature extraction. These data are not only a direct reflection of the current operating status of the power grid and equipment but also an important basis for evaluating the security status of the power grid and equipment. By performing regular monitoring according to the monitoring frequency, it is possible to ensure timely acquisition of the latest operating data, thereby providing timely and accurate data support for subsequent judgment of changes in the operating environment and update of the security measure rule base.

[0081] Optionally, the process of fusing the current operating data of the power grid and the current operating data of the power grid equipment to obtain the multi-source data of the power grid equipment includes: performing format conversion on the current operating data of the power grid and the current operating data of the power grid equipment to obtain the current operating data with the same time stamp and data format; and fusing the current operating data with the same time stamp and data format through a Kalman filtering algorithm to obtain the multi-source data of the power grid equipment.

[0082] Specifically, since the current operation data of the power grid and the current operation data of power grid equipment may come from different monitoring systems, their timestamp formats may not be consistent. For example, the timestamp of the power grid operation data is expressed in Coordinated Universal Time (UTC), while the timestamp of the equipment operation data is local time. It is necessary to convert the timestamps of all data to a unified time standard. In this embodiment, a time conversion algorithm is used to convert timestamps in different time formats to a unified absolute timestamp (such as Unix timestamp, that is, the number of seconds since January 1, 1970, 00:00:00 UTC). For example, for the timestamp "2024-07-10 14:30:00 UTC" in the power grid operation data, its conversion to Unix timestamp is 1720591800 seconds; for the local timestamp "2024-07-10 22:30:00+08:00" (Beijing time) in the equipment operation data, it is also converted to Unix timestamp 1720591800 seconds.

[0083] At the same time, considering that the data formats output by different monitoring systems may be different. The power grid operation data may be stored in XML format, including information such as equipment number, parameter name, parameter value, and timestamp; while the equipment operation data may be stored in CSV format, with columns including time, equipment ID, operation status, etc. It is necessary to convert these data to a unified internal data format. A general data structure can be defined, for example, using a dictionary or JSON format, which contains fields such as "equipment identifier", "parameter type", "parameter value", and "timestamp". For the XML-formatted power grid operation data, an XML parser is used to extract the corresponding fields and fill them into the general data structure; for the CSV-formatted equipment operation data, a CSV reader is used to read the data and also fill it into the general data structure.

[0084] Initialize the model parameters first through the Kalman filter algorithm, including the initial value of the state vector (which can be the initial measurement values of the power grid and equipment operation data, such as the initial voltage value, the initial equipment temperature value, etc.), the state transition matrix (determined according to the system dynamic characteristics. For example, for a linear system, the state transition matrix can be the identity matrix plus a matrix of dynamic factors such as the time step multiplied by the speed), the observation matrix (defining how to obtain the observation values from the state vector, usually a matrix for extracting parameter values), the process noise covariance matrix (reflecting the uncertainty of the system process, which can be estimated and initialized based on experience or system characteristics), and the measurement noise covariance matrix (reflecting the uncertainty of the measurement data, which can be initialized based on information such as sensor accuracy). For the current operation data with the same timestamp and unified data format, use it as the input observation value of the Kalman filter algorithm. For example, assume that the voltage value in the power grid operation data is 102.5V and the equipment temperature value in the equipment operation data is 55.3°C, and these data have the same timestamp. Substitute these observation values into the Kalman filter algorithm. The algorithm first predicts the next state according to the state transition matrix, then updates the state estimate according to the observation values and the observation matrix, and at the same time adjusts the uncertainty of the estimate according to the process noise and the measurement noise covariance matrix. After iterative calculations, the multi-source data of the power grid equipment after fusion is obtained. This data synthesizes the information of the power grid operation data and the equipment operation data, reduces the uncertainty of the data, and improves the accuracy and reliability of the data.

[0085] In this alternative embodiment, the consistency of the current operating data of the power grid and devices in terms of timestamp and data format is ensured through data format conversion. The unified timestamp eliminates the time differences between different data sources, enabling data to be analyzed and processed under the same time reference. The unified data format simplifies the complexity of subsequent data processing, improving the operability and interoperability of the data. This unity provides a solid foundation for the fusion and comprehensive analysis of multi-source data. Secondly, the application of the Kalman filtering algorithm effectively improves the quality and reliability of the data. Through prediction and update steps, the Kalman filter can dynamically estimate the system state, reducing measurement noise and uncertainty in the data. When processing data from multiple sensors or monitoring systems, it can comprehensively consider the characteristics of each data source and assign appropriate weights to each data source. This method not only improves the accuracy of the data but also enhances the robustness of the data, making the fused multi-source data more accurately reflect the actual operating state of the power grid equipment. In addition, the fusion of multi-source data provides a more comprehensive view of the operation of power grid equipment. By integrating power grid operation data and device operation data, it is possible to understand the operating environment and state of the device from multiple perspectives. This comprehensive perspective helps to more accurately assess the safety risks of power grid equipment, timely detect potential problems, and make more effective decisions. Finally, high-quality multi-source data supports better subsequent analysis and processing. Whether it is used for feature extraction to update the comprehensive environmental features or for training and optimizing the deep reinforcement learning model, accurate and reliable input data is the key to ensuring the performance of the entire system. By providing high-quality multi-source data, the efficiency and effectiveness of the entire automatic power grid equipment safety measure generation system can be improved, thereby enhancing the safety management and operation stability of power grid equipment.

[0086] Optionally, the feature extraction of the multi-source data to obtain the current comprehensive environmental features of the power grid equipment includes: dividing the multi-source data into data windows with the same time period, and calculating the data analysis parameters within each data window, where the data analysis parameters include the data average value, variance, standard deviation, peak value, root mean square value, kurtosis, skewness, zero crossing rate, and absolute average value of the data within the data window; integrating the data analysis parameters to obtain the time-domain features of the multi-source data; converting the multi-source data from the time domain to the frequency domain through Fourier transform to obtain the frequency-domain features of the multi-source data; and obtaining the current comprehensive environmental features according to the time-domain features and the frequency-domain features.

[0087] Specifically, the multi-source data is segmented into multiple data windows at fixed time intervals, and each window contains data for a time period of the same length. For example, if the sampling frequency of the multi-source data is once per second and the selected time window length is 10 seconds, then each data window will contain data for 10 sampling points. The data windows can overlap, for example, there is an overlap of 5 sampling points between adjacent windows, which can ensure the continuity and smoothness of the data. For the data within each data window, a series of data analysis parameters are calculated.

[0088] These parameters include: Mean value of data: Calculate the arithmetic mean of all data points within the data window, and the formula is , where is the number of data points, is the value of each data point; Variance is used to measure the degree of deviation of data points from the mean value, and the formula is ; Standard deviation is the square root of the variance and is used to measure the degree of dispersion of the data, and the formula is ; Peak value is used to find the maximum value within the data window, and a simple iterative algorithm can be used to traverse all data points and record the maximum value. Root mean square value is used to measure the effective value of the data, especially suitable for periodic data, and the formula is ; Kurtosis is used to describe the degree of peak of the data distribution, and the formula is ; Skewness is used to measure the symmetry of the data distribution, and the calculation formula is ; Zero crossing rate is used to calculate the number of times the signal crosses the zero axis from positive to negative or from negative to positive within the data window. The zero crossing points can be judged by comparing the signs of adjacent data points, and the number of times can be counted; Absolute mean value is used to calculate the mean value of the absolute values of data points, and the formula is .

[0089] Integrate the above calculated data analysis parameters to form the time-domain characteristics of the multi-source data. For example, arrange the parameters such as the mean value, variance, and standard deviation of each data window in sequence to form a feature vector. If each data window has 9 analysis parameters, then each window corresponds to a 9-dimensional time-domain feature vector. Convert the multi-source data from the time domain to the frequency domain using the Fast Fourier Transform (FFT) algorithm. For the data within each data window, apply FFT to calculate its spectrum. The FFT algorithm decomposes the time-domain signal into multiple sine wave components and obtains the amplitude and phase information of each frequency component. For example, for a data window with a length of , FFT will output frequency components (assuming (is an even number). According to the result of FFT, extract the frequency-domain features. Common frequency-domain features include: the main frequency, which is the frequency component with the largest amplitude in the spectrum and can be determined by finding the frequency corresponding to the largest amplitude in the FFT result. The spectral power, which calculates the power of each frequency component, specifically the square of the amplitude, with the formula , where is the frequency and

[0090] is the amplitude at that frequency. The spectral energy, which calculates the integral or sum of the spectral power within a specified frequency range and is used to measure the energy distribution of the signal in the frequency domain.

[0091] In this optional embodiment, by calculating data analysis parameters such as the average value, variance, standard deviation, peak value, root mean square value, kurtosis, skewness, zero crossing rate, and absolute average value within the data window, the statistical characteristics of the data are comprehensively captured, reflecting the short-term operation fluctuations and trends of power grid equipment. These parameters describe the central tendency, dispersion degree, and distribution form of the data from different perspectives, and can effectively identify abnormal fluctuations and potential problems in the data. Through Fourier transform, multi-source data is transformed from the time domain to the frequency domain to obtain frequency domain characteristics. Frequency domain analysis can reveal the periodic changes and frequency components in the data, helping to identify periodic interferences or potential fault modes during the operation of power grid equipment. For example, the appearance of certain specific frequency components may indicate abnormal operation of the equipment, and the frequency domain characteristics can accurately capture this information. Integrating the time domain characteristics and the frequency domain characteristics forms the current comprehensive environmental characteristics. This fusion method makes full use of the advantages of the time domain and frequency domain characteristics, considering both the short-term fluctuations and statistical characteristics of the data, as well as the periodicity and frequency distribution of the data. The fused feature vector is more comprehensive and richer, and can more accurately reflect the actual operating environment of power grid equipment, providing more reliable data support for subsequent security risk assessment and rule base update. By calculating parameters sensitive to the data distribution form such as kurtosis and skewness, subtle changes in the data distribution can be detected more sensitively, and these changes may indicate abnormal operation states of the equipment. Information such as the main frequency change in the frequency domain characteristics can also timely reflect abnormal deviations in the operating frequency of the equipment, helping to detect equipment failures or potential security risks in advance and enhancing the system's fault warning ability. The generated current comprehensive environmental characteristics provide high-quality input data for subsequent intelligent analysis such as deep reinforcement learning models. These feature vectors contain both the statistical characteristics of the data and the frequency distribution information, which can help the model more accurately learn the mapping relationship between the operating environment of power grid equipment and security risks, thereby improving the scientificity and effectiveness of the update of the security measure rule base and enhancing the intelligent level of the entire power grid equipment security management system. By calculating parameters such as standard deviation and root mean square value, the stability and reliability of the data can be evaluated. The changes in these parameters can timely reflect the changes in data quality and help the system adjust the monitoring strategy in a timely manner. At the same time, the stability analysis of the frequency domain characteristics can further enhance the system's adaptability and robustness to data changes.

[0092] In summary, this embodiment not only improves the comprehensiveness and accuracy of the operation state monitoring of power grid equipment, but also enhances the system's abnormal detection ability and intelligent decision-making support, providing a strong guarantee for the safe operation of power grid equipment.

[0093] Optionally, determining whether the operating environment of the power grid device has changed based on the current comprehensive environmental characteristics and the initial comprehensive environmental characteristics includes: performing a comparison calculation on the current comprehensive environmental characteristics and the initial comprehensive environmental characteristics to obtain a characteristic difference degree between the current comprehensive environmental characteristics and the initial comprehensive environmental characteristics; determining whether the operating environment of the power grid device has changed according to the relationship between the characteristic difference degree and a preset difference degree threshold; wherein, when the characteristic difference degree is greater than or equal to the preset difference degree threshold, it is determined that the operating environment of the power grid device has changed; when the characteristic difference degree is less than the preset difference degree threshold, it is determined that the operating environment of the power grid device has not changed.

[0094] Specifically, compare the current comprehensive environmental characteristics with the initial comprehensive environmental characteristics and calculate the characteristic difference degree between them. The calculation method can use Euclidean distance, Manhattan distance, cosine similarity, etc.

[0095] For example, use the Euclidean distance formula to calculate the difference between two feature vectors. The formula is: ; where represents the th eigenvalue of the current comprehensive environmental characteristics, represents the th eigenvalue of the initial comprehensive environmental characteristics, is the dimension number of the feature vector.

[0096] Preset a characteristic difference degree threshold based on historical data and expert experience. For example, the threshold can be set to 0.5 (this value needs to be adjusted according to the actual application scenario and data characteristics). If the calculated characteristic difference degree is greater than or equal to 0.5, it is determined that the operating environment of the power grid device has changed. This indicates that there are significant differences between the current operating environment and the initial environment, which may introduce new security risks. If the characteristic difference degree is less than 0.5, it is determined that the operating environment of the power grid device has not changed. At this time, it can be considered that the operating environment of the power grid device is relatively stable, and the existing security measure rule library still applies.

[0097] In this alternative embodiment, by calculating the feature difference degree, the change in the operating environment of grid equipment is quantified into a specific value. This quantification method makes the change in the operating environment intuitive and measurable, facilitating subsequent judgment and decision-making. For example, using the Euclidean distance to calculate the feature difference degree can clearly reflect the degree of difference between the current operating environment and the initial environment, providing a clear basis for whether to update the safety measure rule base. Making a judgment based on the relationship between the feature difference degree and the preset difference degree threshold can promptly detect significant changes in the operating environment of grid equipment. When the feature difference degree is greater than or equal to the preset difference degree threshold, it is immediately determined that the operating environment has changed, thereby triggering the update process of the safety measure rule base. This timely response mechanism helps grid equipment maintain safe and stable operation in a dynamically changing operating environment, reducing safety risks caused by environmental changes. By setting a reasonable preset difference degree threshold, false judgments caused by random noise or minor fluctuations can be effectively reduced, while omissions caused by too high a threshold can be avoided. The determination of the threshold is based on historical data and expert experience, ensuring the accuracy and reliability of the judgment.

[0098] For example, by analyzing a large amount of historical data, it is determined that when the feature difference degree reaches a certain value in a specific scenario, the change in the operating environment will have a significant impact on equipment safety, thereby reasonably setting the threshold. And when the feature difference degree exceeds the threshold, it clearly indicates that the safety measure rule base needs to be updated; while when the feature difference degree is lower than the threshold, it indicates that the existing rule base is still applicable. This clear judgment criterion helps to automate and standardize the safety management process, reducing the uncertainty brought by human intervention and subjective judgment. The calculation and judgment results of the feature difference degree provide a trigger signal for the dynamic adjustment of the deep reinforcement learning model. When the operating environment changes, the deep reinforcement learning model is promptly notified to update the safety measure rule base, ensuring that the model always learns and optimizes based on the latest operating environment features, improving the adaptability and effectiveness of the model.

[0099] In summary, through the calculation of the feature difference degree and threshold judgment, a quantitative evaluation, timely response, and accurate judgment of the change in the operating environment of grid equipment are achieved, providing reliable support for the safety management of grid equipment and ensuring that grid equipment can always maintain safe and stable operation in a constantly changing operating environment.

[0100] Optionally, the comparison calculation of the current comprehensive environment feature and the initial comprehensive environment feature to obtain the feature difference degree between the current comprehensive environment feature and the initial comprehensive environment feature includes: decomposing the current comprehensive environment feature and the initial comprehensive environment feature into multiple corresponding dimensions respectively, and assigning corresponding weight values to each dimension, where each dimension of the current comprehensive environment feature and the initial comprehensive environment feature corresponds to each other; calculating the absolute difference value corresponding to each dimension according to the difference calculation method corresponding to each dimension; performing weighted summation according to the absolute difference values and the weight values of all dimensions to obtain the feature difference degree.

[0101] Specifically, the current comprehensive environment feature and the initial comprehensive environment feature are respectively decomposed into multiple corresponding dimensions. For example, assume that the comprehensive environment feature includes 5 dimensions such as equipment load rate, insulation resistance, power grid power flow distribution, equipment temperature, and voltage stability. Ensure that each dimension of the current feature and the initial feature corresponds to each other, that is, the equipment load rate dimension corresponds to the same position or identifier in the two features. If the current comprehensive environment feature is represented as a vector: , and the initial comprehensive environment feature is represented as: , then the index of each dimension corresponds to the same feature type. Assign corresponding weight values to each dimension. The weight value reflects the importance of this dimension in the overall feature difference. The weight assignment can be based on expert experience, historical data analysis, or feature importance evaluation algorithms (such as principal component analysis). For example, assume that the equipment load rate and insulation resistance have a greater impact on safety, and the weights are 0.3 and 0.25 respectively; the weight of the power grid power flow distribution is 0.2; the weights of the equipment temperature and voltage stability are 0.15 and 0.1 respectively. The weight vector is represented as: . The assignment of weight values needs to satisfy that the sum of all weight values is 1. Select a suitable difference calculation method according to the characteristics of each dimension. For continuous numerical dimensions (such as equipment load rate, insulation resistance, etc.), the absolute difference calculation method can be used.

[0102] For example, the absolute difference calculation formula for the equipment load rate is: . For other types of data (such as categorical data or ordinal data), different difference measurement methods may be required, such as Hamming distance, etc. Calculate the absolute difference value of each dimension according to the selected difference calculation method. For example, assume that the equipment load rate of the current comprehensive environment feature is 80% and the equipment load rate of the initial comprehensive environment feature is 70%, then the absolute difference value of the equipment load rate dimension is: . Similarly, calculate the absolute difference values of other dimensions: .

[0103] Perform weighted summation according to the absolute difference values and weight values of all dimensions to obtain the feature difference degree. The calculation formula is: , where represents the absolute difference of the -th dimension, represents the weight value of the -th dimension, is the number of dimensions. Assume that the absolute differences of each dimension calculated are: , and the weight vector is: , then the feature difference degree is calculated as: , which indicates that the feature difference degree between the current comprehensive environment feature and the initial comprehensive environment feature is 6.5.

[0104] In this optional embodiment, decomposing the feature into multiple dimensions and calculating the differences one by one can more precisely identify which specific aspects have changed. For example, by calculating the differences of dimensions such as equipment load rate and insulation resistance respectively, it can be determined whether the overall difference is caused by load changes or a decrease in insulation performance, providing a basis for subsequent targeted safety measures. And weight values are assigned to each dimension, fully considering the importance of different dimensions to the operation environment of power grid equipment. This avoids the errors that may be caused by simple average calculation, making the feature difference degree more able to truly reflect the significance and criticality of the change in the operation environment. By clarifying the differences of each dimension and their weight contributions, it provides a detailed explanation for the judgment of whether the operation environment has changed. It helps the operation and maintenance personnel understand which specific factors trigger the determination of environmental changes, enhancing the transparency and credibility of decision-making. The weight assignment can be adjusted according to different types of power grid equipment or specific application scenarios. For example, for old equipment, the weight of the insulation resistance dimension can be increased to achieve precise difference evaluation for specific equipment in a specific environment. The obtained feature difference degree is a quantitative index that comprehensively considers the changes of each dimension and weights, providing a precise quantitative basis for whether to update the safety measure rule base subsequently, avoiding unnecessary rule updates or missed updates, and improving the efficiency and effectiveness of the entire safety management process.

[0105] Optionally, updating the initial safety measure rule base of the power grid equipment to obtain the current safety measure rule base of the power grid equipment according to the current comprehensive environment feature and the initial comprehensive environment feature through the deep reinforcement model includes: inputting the current comprehensive environment feature and the initial comprehensive environment feature into the deep reinforcement model, using the operation environment feature of the power grid equipment as the state, and using the update operation of the initial safety measure rule base as the action; iteratively updating the action through the deep reinforcement model, then optimizing the initial safety measure rule base according to the action, and judging whether to complete the update of the action through the state; when the update of the action is completed, updating the initial safety measure rule base according to the update operation corresponding to the action to obtain the current safety measure rule base.

[0106] Specifically, the current comprehensive environmental feature and the initial comprehensive environmental feature are integrated into a feature vector as the state input of the deep reinforcement model.

[0107] For example, assume that the current comprehensive environmental feature is: and the initial comprehensive environmental feature is: Then the state input can be represented as the concatenated vector of the two: . Among them, where, represents the current comprehensive environmental feature vector. are the feature values of each dimension of the current comprehensive environmental feature vector, and each represents the value of a specific feature in the current environment, such as the device load rate, insulation resistance, etc., represents the total number of features. where, represents the initial comprehensive environmental feature vector. are the feature values of each dimension of the initial comprehensive environmental feature vector, and each represents the corresponding feature value of the device in the initial deployment state, corresponding one by one to the feature dimensions in . where, represents the state input of the deep reinforcement learning model. It is a vector concatenated by the current comprehensive environmental feature vector and the initial comprehensive environmental feature vector .

[0108] This concatenation method in this embodiment integrates the current and initial environmental features together to form a complete state representation for reflecting the dynamic changes in the operating environment of power grid equipment. Defining the update operation of the initial safety measure rule base as an action, including adding rules, deleting rules, modifying rule parameters, etc. Each action can be represented as a vector.

[0109] For example, the action of adding a rule can be represented as: where represents the type of the added rule, Represents the specific parameters of the new rule. Build a deep reinforcement learning model, such as a Deep Q - Network (DQN). The model mainly consists of a neural network. The input layer receives the state vector, the hidden layer extracts features through non - linear activation functions, and the output layer outputs the Q - values of each possible action, representing the expected cumulative reward for taking that action in the current state. Build a power grid equipment operation environment simulator for simulating different operation environment changes and safety risk scenarios. The model is trained through interaction with the simulator. In each training step, the model selects an action based on the current state. After executing the action, the simulator returns a new state and a reward signal. Design a reasonable reward function for evaluating the effectiveness of the action. For example, when the action taken can effectively reduce the safety risk of power grid equipment, a positive reward is given; when the action leads to an increase in safety risk or introduces new risks, a negative reward is given.

[0110] The reward function can be defined as: ; where, represents the change in the safety risk value, represents the impact of the rule - base update operation on the system operation efficiency (such as equipment operation delay caused by rule update, etc.), and are weight coefficients.

[0111] Use the experience replay technique to store each state - action - reward - new - state sample in the experience replay pool. During training, randomly sample a small batch of samples from the experience replay pool for gradient - descent training, update the network parameters, and optimize the Q - value estimation. The target network periodically copies parameters from the main network to stabilize the training process.

[0112] In practical applications, when it is detected that the operation environment of power grid equipment has changed, the current comprehensive environment features and the initial comprehensive environment features are input into the trained deep reinforcement model. The model outputs the Q - values of each possible action according to the current state, and selects the action with the maximum Q - value as the current optimal action. Update the initial safety measure rule - base according to the selected action. For example, if the optimal action is to add an access control rule, the corresponding rule is added to the rule - base. The updated rule - base is used as the current safety measure rule - base. By defining the conditions for the update to be completed, such as the action output by the model remaining stable for multiple consecutive time steps, or the updated rule - base being verified effective in the simulation environment, to determine whether the update of the action is completed. When the update - completion condition is met, stop updating the action, and apply the finally updated rule - base as the current safety measure rule - base to the safety management of actual power grid equipment.

[0113] In this alternative embodiment, the deep reinforcement learning model automatically learns the optimal update actions based on the current and initial comprehensive environmental features, achieving the intelligent update of the initial safety measure rule base. It eliminates the need for manual full participation in the maintenance and update of the rule base, improving efficiency and reducing human errors. The model optimizes the rule base based on the differences in real-time comprehensive environmental features, ensuring that the updated rule base is accurately adapted to the current operating environment and effectively enhancing the safety of power grid equipment in a dynamically changing environment. By judging whether the action update is completed, the model can dynamically adapt to the changes in the operating environment of power grid equipment, timely adjust the safety measure rule base, ensure that the rule base is always in the optimal state, and enhance the system's response ability to environmental changes. The cumulative reward mechanism during model training prompts the rule base update direction to always be conducive to improving the safety protection ability of power grid equipment, ensuring that each update can enhance the effectiveness of the rule base in coping with safety risks. By judging whether the action update is completed to decide whether to apply the update operation, it avoids system instability caused by incomplete updates or frequent updates, ensuring the stability and reliability of the update process. The model continuously learns and optimizes strategies during each update process, continuously improving the accuracy and adaptability of the rule base update, which contributes to the continuous evolution of system performance.

[0114] The present invention provides a system for constructing an automatic generation rule base for equipment safety measures. The system is applied to a power grid, and the power grid includes a plurality of power grid devices, each of which is respectively deployed at each node of the power grid. The system includes: An acquisition unit for acquiring the initial deployment state of the power grid and the initial deployment state of the power grid device corresponding to each node of the power grid. An initial setting unit for generating the initial comprehensive environmental features of the power grid device according to the initial deployment state of the power grid and the initial deployment state of the power grid device. The initial setting unit is further configured to generate an initial safety measure rule base for the power grid device according to the initial comprehensive environmental features. A monitoring unit for monitoring the power grid and the power grid device to obtain the current operation data of the power grid and the current operation data of the power grid device, and fusing the current operation data of the power grid and the current operation data of the power grid device to obtain the multi-source data of the power grid device. A feature extraction unit for extracting features from the multi-source data to obtain the current comprehensive environmental features of the power grid device. A judgment unit for judging whether the operating environment of the power grid device has changed according to the current comprehensive environmental features and the initial comprehensive environmental features. An optimization unit is configured to update the initial safety measure rule base of the grid equipment to obtain the current safety measure rule base of the grid equipment according to the current comprehensive environment feature and the initial comprehensive environment feature through a deep reinforcement model when the operating environment changes.

[0115] The device safety measure automatic generation rule base construction system of the present invention has the same advantages over the prior art as those of the above-mentioned device safety measure automatic generation rule base construction method over the prior art, and will not be elaborated here.

[0116] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will all fall within the protection scope of the present invention.

Claims

1. A method for constructing a rule base for automatically generating device security measures, characterized in that, The method is applied to a power grid, which includes multiple power grid devices, and each of the power grid devices is respectively deployed at each node of the power grid. The method includes: Obtain the initial deployment state of the power grid and the initial deployment state of the power grid device corresponding to each node of the power grid; Generate the initial comprehensive environment characteristics of the power grid device according to the initial deployment state of the power grid and the initial deployment state of the power grid device; Generate the initial safety measure rule library of the power grid device according to the initial comprehensive environment characteristics; Monitor the power grid and the power grid devices to obtain the current operation data of the power grid and the current operation data of the power grid devices, and fuse the current operation data of the power grid and the current operation data of the power grid devices to obtain the multi-source data of the power grid devices; Extract features from the multi-source data to obtain the current comprehensive environment characteristics of the power grid device; Judge whether the operation environment of the power grid device has changed according to the current comprehensive environment characteristics and the initial comprehensive environment characteristics; When the operation environment changes, update the initial safety measure rule library according to the current comprehensive environment characteristics and the initial comprehensive environment characteristics through a deep reinforcement model to obtain the current safety measure rule library of the power grid device.

2. The method for constructing a rule base for automatically generating device security measures according to claim 1, wherein, The generating the initial comprehensive environment characteristics of the power grid device according to the initial deployment state of the power grid and the initial deployment state of the power grid device includes: Determine the initial operation data of the power grid and the initial operation data of the power grid device according to the initial deployment state of the power grid and the initial deployment state of the power grid device; Extract features from the initial operation data of the power grid and the initial operation data of the power grid device respectively to obtain the device state characteristics of the power grid device and the power grid operation characteristics of the power grid; Fuse the device state characteristics and the power grid operation characteristics to obtain a fusion feature, and use the fusion feature as the initial comprehensive environment characteristics.

3. The method for constructing a rule base for automatically generating device security measures according to claim 2, characterized in that, The generating the initial safety measure rule library of the power grid device according to the initial comprehensive environment characteristics includes: Decompose the initial comprehensive environment characteristics into multiple key feature dimensions, and establish a relationship model between the feature dimensions and the safety risks of the power grid device; Determine the weight value of each key feature dimension according to the device parameters of the power grid device; Determine the safety risk value of the power grid device according to the relationship model and the weight value; Set the initial safety measure rule library according to the safety risk value.

4. The method for constructing a rule library for automatically generating device security measures according to claim 3, characterized in that, The monitoring the power grid and the power grid devices to obtain the current operation data of the power grid and the current operation data of the power grid devices includes: Obtain the monitoring frequency for monitoring the power grid and the power grid devices by mapping the safety risk value to a preset mapping table; Monitor the power grid and the power grid devices according to the monitoring frequency to obtain the current operation data of the power grid and the power grid devices at the current time point.

5. The method for constructing a rule base for automatically generating device security measures according to claim 4, characterized in that Fusing the current operation data of the power grid and the current operation data of the power grid equipment to obtain the multi-source data of the power grid equipment includes: Performing format conversion on the current operation data of the power grid and the current operation data of the power grid equipment to obtain the current operation data with the same timestamp and data format; Fusing the current operation data with the same timestamp and data format through the Kalman filtering algorithm to obtain the multi-source data of the power grid equipment.

6. The method for constructing a rule base for automatically generating device security measures according to claim 1, wherein, Performing feature extraction on the multi-source data to obtain the current comprehensive environment features of the power grid equipment includes: Dividing the multi-source data into data windows with the same time period, and calculating the data analysis parameters within each data window, where the data analysis parameters include the data average value, variance, standard deviation, peak value, root mean square value, kurtosis, skewness, zero crossing rate, and absolute average value of the data within the data window; Integrating the data analysis parameters to obtain the time-domain features of the multi-source data; Converting the multi-source data from the time domain to the frequency domain through Fourier transform to obtain the frequency-domain features of the multi-source data; Obtaining the current comprehensive environment features based on the time-domain features and the frequency-domain features.

7. The method for constructing a rule base for automatically generating device security measures according to claim 1, characterized in that, Judging whether the operation environment of the power grid equipment has changed according to the current comprehensive environment features and the initial comprehensive environment features includes: Performing comparison calculation on the current comprehensive environment features and the initial comprehensive environment features to obtain the feature difference degree between the current comprehensive environment features and the initial comprehensive environment features; Judging whether the operation environment of the power grid equipment has changed according to the relationship between the feature difference degree and the preset difference degree threshold; Wherein, when the feature difference degree is greater than or equal to the preset difference degree threshold, it is determined that the operation environment of the power grid equipment has changed; When the feature difference degree is less than the preset difference degree threshold, it is determined that the operation environment of the power grid equipment has not changed.

8. The method for constructing a rule base for automatically generating device security measures according to claim 7, wherein Performing comparison calculation on the current comprehensive environment features and the initial comprehensive environment features to obtain the feature difference degree between the current comprehensive environment features and the initial comprehensive environment features includes: Respectively decomposing the current comprehensive environment features and the initial comprehensive environment features into multiple corresponding dimensions, and assigning corresponding weight values to each dimension, where each dimension of the current comprehensive environment features and the initial comprehensive environment features corresponds to each other; Calculating the absolute difference corresponding to each dimension according to the difference calculation method corresponding to each dimension; Performing weighted summation according to the absolute differences and the weight values of all the dimensions to obtain the feature difference degree.

9. The method for constructing a rule base for automatically generating device security measures according to claim 1, characterized in that, Updating the initial safety measure rule base according to the current comprehensive environment features and the initial comprehensive environment features through a deep reinforcement model to obtain the current safety measure rule base of the power grid equipment includes: Input the current comprehensive environment feature and the initial comprehensive environment feature into the deep reinforcement model, use the operating environment feature of the grid device as the state, and use the update operation on the initial safety measure rule base as the action; Iteratively update the action through the deep reinforcement model, then optimize the initial safety measure rule base according to the action, and determine whether to complete the update of the action through the state; After the action update is completed, update the initial safety measure rule base according to the update operation corresponding to the action to obtain the current safety measure rule base.

10. An automatic generation rule library construction system for device security measures, characterized in that, The system is applied to a power grid, the power grid includes multiple grid devices, and each grid device is respectively deployed at each node of the power grid. The system includes: An acquisition unit for acquiring the initial deployment state of the power grid and the initial deployment state of each grid device corresponding to each node of the power grid; An initial setting unit for generating the initial comprehensive environment feature of the grid device according to the initial deployment state of the power grid and the initial deployment state of the grid device; The initial setting unit is further configured to generate an initial safety measure rule base for the grid device according to the initial comprehensive environment feature; A monitoring unit for monitoring the power grid and grid devices to obtain the current operation data of the power grid and the current operation data of the grid devices, and fusing the current operation data of the power grid and the current operation data of the grid devices to obtain the multi-source data of the grid devices; A feature extraction unit for extracting features from the multi-source data to obtain the current comprehensive environment feature of the grid device; A judgment unit for judging whether the operating environment of the grid device has changed according to the current comprehensive environment feature and the initial comprehensive environment feature; An optimization unit for, when the operating environment changes, updating the initial safety measure rule base according to the current comprehensive environment feature and the initial comprehensive environment feature through a deep reinforcement model to obtain the current safety measure rule base of the grid device.

Images