Multi-channel substation integrated automation system

Abstract

The invention discloses a multi-channel substation integrated automation system which comprises an equipment layer, a communication layer and a management layer. A microcomputer line protection measurement and control device of the equipment layer encodes collected original data into redundant data copies and adds camouflage information in data frames, the redundant data copies are transmitted to the communication layer in parallel through four physical links, and four Ethernet switches of the communication layer form a double-ring interconnection topological structure. A telecontrol communication management machine is connected with two different switches in a double-loop network through double network ports, the management machine simulates a protocol interface through a multi-camouflage module, a load balancer distributes data according to priorities, loads and link states, a core processing module verifies the data and then uploads the data to a management layer, and the core processing module processes the data. And the server dynamically adjusts a data transmission strategy according to a link failure rate based on a link state prediction model of a Markov process and a data fusion engine of a Bayesian network, and performs weighted fusion on a plurality of redundant data copies. According to the invention, the reliability of data transmission is improved, and the network security protection capability is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of power system automation, and particularly relates to a multi-path substation integrated automation system. Background Art

[0002] With the continuous advancement of the construction of smart grids, the substation integrated automation system, as a key hub of the power system, undertakes the core tasks of real-time data acquisition, transmission, and processing. Through the coordinated operation of the device layer, communication layer, and management layer, this system realizes functions such as power parameter monitoring, equipment status control, and fault early warning. However, in practical applications, traditional substation integrated automation systems still have problems such as low data transmission reliability and high network security risks, and it is difficult to meet the requirements of smart grids for the stability and intelligence of power systems.

[0003] Problem of data transmission reliability. Traditional substation integrated automation systems mostly adopt a single-path data transmission architecture. When the main channel fails, manual intervention is required to switch to the standby channel, and the switching time is relatively long, which cannot meet the real-time requirements of smart grids; there are also systems that adopt a dual-link redundancy design, but lack a dynamic evaluation mechanism. When one of the links is damaged, since the system cannot perceive the change in the link state in real time and still distributes data according to the original ratio, the undamaged link has an excessive load and the data transmission delay increases.

[0004] Hidden network security problems. Traditional data frames adopt a fixed format and lack effective security protection. For example, the header of Modbus protocol data frames contains clear function codes and address information. Attackers can easily identify control commands by analyzing traffic characteristics; traditional telecontrol communication management machines, as single receiving nodes, are easily targeted by attacks and lead to paralysis, resulting in the inability to upload the entire station's monitoring data; the passive defense mechanism is lagging. Existing firewalls and intrusion detection systems rely on signature library matching and are difficult to cope with new types of attacks.

[0005] Therefore, there is an urgent need for a multi-path substation integrated automation system that can effectively improve data transmission reliability and security. Summary of the Invention

[0006] The purpose of the present invention is to provide a multi-path substation integrated automation system to improve data transmission reliability and enhance network security protection capabilities.

[0007] To solve the above technical problems, the technical solution of the present invention is as follows:

[0008] A multi-channel substation integrated automation system, including an equipment layer, a communication layer and a management layer; the equipment layer includes a microcomputer line protection and measurement control device, and the microcomputer line protection and measurement control device is configured with four independent network interfaces, and each network interface is connected to a physical link; the microcomputer line protection and measurement control device is used to collect original data and encode it into multiple redundant data copies, generate a data frame header including camouflage information for each data copy, and then according to the optimal data allocation ratio issued by the server, transmit the redundant data copies through four independent network interfaces in parallel to four physical links; the communication layer includes four Ethernet switches and a remote communication management machine, and the four Ethernet switches form a dual-ring interconnected topology through four interconnection links, and the remote communication management machine is respectively connected to two different switches in the dual-ring network through dual network interfaces; the remote communication management machine is configured with: multiple camouflage receiving modules, simulating service interfaces of different protocol types, for receiving and recording data frames including camouflage information; a load balancer, for distributing the received data frames to the core processing module according to a preset policy; a core processing module, for verifying and protocol-converting the data frames and transmitting the processed data frames to the server; the management layer includes a server, and the server is configured to: construct a link state prediction model based on a Markov process, output the failure rate prediction of each physical link, and according to the failure rate prediction, combined with the load and attack situation of the physical link, calculate the optimal data allocation ratio through a linear programming model and issue it to the microcomputer line protection and measurement control device; through a Bayesian network data fusion engine, combined with a consistency matrix and a Bayesian weight factor, perform weighted fusion on each data copy.

[0009] Further, the camouflage information in the data frame header is used to confuse potential network attacks, including: at least two virtual receiving target identifiers, a randomly generated protocol type identifier, and a forged priority identifier; the camouflage information and the payload part and check part of the data frame together constitute a complete data frame structure.

[0010] Further, the virtual receiving target identifier is randomly selected from the list of camouflage receiving modules of the remote communication management machine, and the virtual receiving target identifier corresponds to the service interface type of the camouflage receiving module.

[0011] Further, the camouflage receiving module supports simulating service interfaces of at least three protocol types, including IEC60870-5-104, Modbus, and DNP3, and each camouflage receiving module independently records the source device ID and receiving time of the received data frame.

[0012] Further, the load balancer distributes data frames to the core processing module according to the priority of the data frames, the load status of the spoofing receiving module, and the predicted result of the link failure rate; after receiving the data frame, the spoofing receiving module first determines whether the source device ID of the data frame is in the preset trusted device list. If not, it marks the data frame as a suspected attack data frame and stores it in isolation.

[0013] Further, the verification of the data frame by the core processing module includes: verifying the CRC check code and digital signature of the data frame, and judging the authenticity of the data frame by comparing the virtual receiving target identifier in the spoofing information with the preset target library.

[0014] Further, the telecontrol communication management machine is also configured with a security monitoring module. The security monitoring module identifies attack patterns based on the attack data recorded by the spoofing receiving module and dynamically adjusts the type and quantity of the simulated service interfaces of the spoofing receiving module according to the machine learning algorithm.

[0015] Further, the calculation process of the optimal data allocation ratio is as follows: classify the physical link status into three categories: normal, warning, and failure. Obtain the state transition matrix through training with historical data, and use this to predict the probability of the physical link being in different states at a future moment. Then, calculate the failure rate weight of the physical link through weighted calculation; comprehensively consider the failure rate weight, real-time load rate, and attack count of the physical link to calculate the risk value of the physical link; with the goal of minimizing the comprehensive risk, establish an objective function including the failure rate weight, load rate, and attack count, and solve the data allocation ratio of each physical link through linear programming.

[0016] Further, the fusion steps of the Bayesian network data fusion engine include: receiving multiple redundant data copies from the core processing module; obtaining the predicted results of the failure rates of each transmission path based on the Markov chain prediction model; combining the attack count recorded by the spoofing receiving module to calculate the Bayesian weight factor of each data copy; determining the credibility of each data copy according to the Bayesian weight factor, and selecting the data copy with the highest credibility as the main data source.

[0017] Further, the server is also configured to: verify the main data source in combination with the consistency matrix. If the verification passes, the data is adopted; otherwise, the retransmission mechanism is triggered. When the retransmission mechanism is triggered, the server recalculates the optimal data allocation ratio according to the current load and the predicted result of the failure rate of each physical link, and issues it to the microcomputer line protection and measurement and control device at the device layer for retransmission.

[0018] The beneficial effects of the present invention are:

[0019] (1)High reliability of data transmission: The present invention adopts different transmission media and redundant geographical routing design through four physical links to avoid data transmission interruption caused by single link failure or regional disasters. At the same time, the double-ring interconnected Ethernet switch topology can dynamically adjust the data distribution ratio in cooperation with the link state prediction model, ensuring the continuity and stability of data transmission and significantly improving the reliability of the substation integrated automation system.

[0020] (2)Enhanced network security protection performance: The data frame adopts a camouflage information design, and multiple camouflage receiving modules are deployed on the telecontrol communication management machine to simulate different protocol service interfaces, which can effectively confuse potential network attacks and transfer the attack target from the core device to the camouflage module. At the same time, through multiple verifications such as digital signature and CRC check of the data frame, combined with the machine learning recognition of the attack mode by the security monitoring module, active defense is realized, and the network security performance of the system is greatly improved.

[0021] (3)Efficient data processing and fusion: The link state prediction model based on the Markov process and the data fusion engine of the Bayesian network can dynamically adjust the data transmission strategy according to the link failure rate, and perform weighted fusion on multiple redundant data copies to remove incorrect or unreliable data, improving the data accuracy. In addition, the coordinated work of the load balancer and the core processing module can achieve fast distribution and processing of data, reduce the data processing delay, and improve the overall efficiency of the system. Description of the Drawings

[0022] Figure 1 is the system architecture diagram of the present invention;

[0023] Figure 2 is the data processing flow chart of the present invention. Detailed Embodiments

[0024] To facilitate the understanding of the present invention, the present invention will be further described in detail below in conjunction with the drawings and specific embodiments. Those skilled in the art should understand that the embodiments are only for helping to understand the present invention and should not be regarded as specific limitations of the present invention.

[0025] In the description of the following embodiments, specific details such as specific system structures and technologies are presented for the purpose of illustration rather than limitation, so as to thoroughly understand the embodiments of the present application. However, those skilled in the art should clearly understand that the present application can also be implemented in other embodiments without these specific details. In other cases, the detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from interfering with the description of the present application.

[0026] It should be understood that when used in the specification of this application and the appended claims, the term "comprising" indicates the presence of the described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their combinations. It should also be understood that the term "and / or" used in the specification of this application and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0027] As used in the specification of this application and the appended claims, the term "if" can be interpreted as "when" or "once" or "in response to determining" or "in response to detecting" depending on the context. Similarly, the phrase "if determined" or "if [the described condition or event] is detected" can be interpreted as meaning "once determined" or "in response to determining" or "once [the described condition or event] is detected" or "in response to detecting [the described condition or event]" depending on the context.

[0028] In addition, in the description of the specification of this application and the appended claims, the terms "first", "second", "third", etc. are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance. The reference to "one embodiment" or "some embodiments" etc. described in the specification of this application means that a specific feature, structure or characteristic described in connection with that embodiment is included in one or more embodiments of this application. Thus, statements such as "in one embodiment", "in some embodiments", "in other some embodiments", "in still other embodiments", etc. that appear in different places in this specification do not necessarily all refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "comprising", "including", "having" and their variants all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0029] As Figure 1 、 2As shown in the figure, the present invention provides a multi-channel substation integrated automation system, which includes an equipment layer, a communication layer, and a management layer; the equipment layer includes a microcomputer line protection and measurement control device, and the microcomputer line protection and measurement control device is configured with four independent network interfaces, and each network interface is connected to a physical link; the transmission media used for the physical link include at least two of optical fiber, shielded twisted pair, and wireless microwave; the microcomputer line protection and measurement control device is used to collect raw data and encode it into multiple redundant data copies, generate a data frame header including camouflage information for each data copy, and then parallelly transmit the redundant data copies to four physical links through four independent network interfaces according to the optimal data allocation ratio issued by the server; the communication layer includes four Ethernet switches and a remote communication management machine, and the four Ethernet switches form a dual-ring interconnected topology through four interconnection links, and the remote communication management machine is respectively connected to two different switches in the dual-ring network through dual network interfaces; the remote communication management machine is configured with: multiple camouflage receiving modules, simulating service interfaces of different protocol types, for receiving and recording data frames including camouflage information; a load balancer, for distributing the received data frames to the core processing module according to a preset policy; a core processing module, for verifying and protocol-converting the data frames, and transmitting the processed data frames to the server; the management layer includes a server, and the server is configured to: construct a link state prediction model based on the Markov process, output the failure rate prediction of each physical link, and according to the failure rate prediction, combined with the load and attack situation of the physical link, calculate the optimal data allocation ratio through a linear programming model and issue it to the microcomputer line protection and measurement control device; through a Bayesian network data fusion engine, combined with a consistency matrix and a Bayesian weight factor, perform weighted fusion on each data copy.

[0030] The present invention realizes the multi-channel reliable transmission of substation data. The four physical links and the dual-ring topology greatly reduce the risk of data interruption caused by a single link failure. The data redundancy coding of the equipment layer and the load balancing design of the communication layer ensure the efficient transmission of data; the link state prediction and dynamic data allocation of the management layer further optimize the transmission efficiency. At the same time, the camouflage design of the data frame and the security protection mechanism of the communication layer enhance the network security of the system and effectively resist network attacks. The data fusion processing of the server ensures the accuracy and integrity of the data, providing strong support for the stable operation and intelligent regulation of the substation.

[0031] The camouflage information in the data frame header refers to information such as false target identifiers and protocol types contained in the data frame header, which is used to confuse potential network attacks and prevent attackers from accurately identifying the transmission path and target of real data. The camouflage information includes: at least two virtual receiving target identifiers, a randomly generated protocol type identifier, and a forged priority identifier; the camouflage information, together with the payload part and the check part of the data frame, constitutes a complete data frame structure. By setting complex camouflage information in the data frame header, potential network attackers can be effectively confused, making it difficult for them to distinguish the real data transmission target and protocol type. Therefore, the attack target can be transferred from the core device to the virtual target, reducing the risk of the core device being attacked. At the same time, the complete data frame structure design ensures the integrity and verifiability of data during transmission, further enhancing the security and reliability of the system.

[0032] The virtual receiving target identifier is part of the camouflage information and is used to simulate the ID of a real receiving device, inducing attackers to transfer the attack target to the virtual target. The virtual receiving target identifier is randomly selected from the list of camouflage receiving modules of the telecontrol communication management machine, and the virtual receiving target identifier corresponds to the service interface type of the camouflage receiving module. Making the virtual receiving target identifier correspond to the service interface type of the camouflage receiving module enhances the authenticity and confusion of the camouflage. It is more difficult for attackers to judge the real data flow through information such as the protocol type, further improving the system's ability to resist network attacks and ensuring the security of substation data transmission.

[0033] The camouflage receiving module supports simulating service interfaces of at least three protocol types, including IEC 60870-5-104, Modbus, and DNP3. Each camouflage receiving module independently records the source device ID and receiving time of the received data frame. The simulation of multiple protocol types enables the system to cope with the detection and attacks of different types of attackers, expanding the system's protection scope. Each camouflage receiving module independently records the source device ID and receiving time, facilitating the tracing and analysis of attack behaviors. By statistically analyzing these records, attack patterns can be identified, and then the security protection strategy can be adjusted in a timely manner to enhance the system's security protection ability.

[0034] The load balancer distributes data frames to the core processing module based on the priority of the data frames, the load status of the spoofing reception module, and the predicted result of the link failure rate. By distributing data frames according to multiple factors, the load balancer achieves the efficiency and rationality of data processing at the communication layer, avoiding the impact on system performance caused by excessive load on certain links or modules. After receiving the data frame, the spoofing reception module first determines whether the source device ID of the data frame is in the preset trusted device list. If not, it marks the data frame as a suspected attack data frame and isolates and stores it. The verification of the source device ID and the isolation and storage of suspected attack data frames by the spoofing reception module can timely detect and block potential network attacks, prevent malicious data from entering the core processing process, and ensure the safe and stable operation of the system.

[0035] The verification of data frames by the core processing module includes: verifying the CRC check code and digital signature of the data frame, and judging the authenticity of the data frame by comparing the virtual reception target identifier in the spoofing information with the preset target library. This multiple verification mechanism can strictly verify data frames from multiple dimensions such as data integrity, source legality, and spoofing rationality, effectively preventing incorrect data processing caused by data transmission errors, malicious tampering, or illegal forgery. Only data frames that pass all verifications can enter the subsequent processing process, ensuring that the data entering the server is true and reliable, providing an accurate data basis for subsequent data fusion and the correct regulation of the substation.

[0036] The telecontrol communication management machine is also equipped with a security monitoring module. The security monitoring module identifies attack patterns based on machine learning algorithms according to the attack data recorded by the spoofing reception module, and dynamically adjusts the type and quantity of the simulated service interfaces of the spoofing reception module. By combining machine learning algorithms, the security monitoring module can automatically identify new and unknown attack patterns, breaking through the limitations of traditional rule-based security protection systems. Dynamically adjusting the settings of the spoofing reception module enables the system to have an active defense ability, being able to flexibly change the protection strategy according to the attack situation, effectively resisting changing network attacks, and continuously improving the network security protection level of the system.

[0037] The calculation process of the optimal data allocation ratio is as follows: The physical link status is divided into three categories: normal, warning, and failure. The state transition matrix is obtained through training with historical data to predict the probability of the physical link being in different states at future moments, and then the failure rate weight of the physical link is calculated by weighted calculation; comprehensively considering the failure rate weight, real-time load rate, and attack count of the physical link to calculate the risk value of the physical link; aiming at minimizing the comprehensive risk, an objective function including the failure rate weight, load rate, and attack count is established, and the data allocation ratio of each physical link is solved through linear programming.

[0038] The Bayesian network data fusion engine of the server uses the transmission path of the data frame, the attack count of the spoofing reception module, and the predicted result of the link failure rate as input variables when calculating the posterior probability of each data copy. By comprehensively considering various factors such as the transmission path of the data frame, the attack situation, and the link status, the posterior probability is calculated, enabling the Bayesian network data fusion engine to more accurately evaluate the credibility and reliability of each data copy. Based on more accurate probability calculations for data fusion, the accuracy and reliability of the fused data are improved, providing more powerful data support for the operation monitoring and decision-making of the substation.

[0039] The fusion steps of the Bayesian network data fusion engine include: receiving multiple redundant data copies from the core processing module; obtaining the predicted results of the failure rates of each transmission path based on the Markov link prediction model; calculating the Bayesian weight factor of each data copy in combination with the attack count recorded by the spoofing reception module; determining the credibility of each data copy according to the Bayesian weight factor, and selecting the data copy with the highest credibility as the main data source. The Bayesian weight factor is a weight coefficient used in the Bayesian network data fusion engine to measure the reliability of each data source, and it is dynamically adjusted according to historical data and the real-time link status. By determining the main data source through a scientific calculation process, the influence of the link status and the attack situation on the data credibility is fully considered, avoiding incorrect selections caused by single-factor judgments. Selecting the data copy with the highest credibility as the main data source improves the quality and accuracy of data fusion, ensures the reliability of the data finally used for substation monitoring, and reduces the risk of decision-making errors caused by inaccurate data.

[0040] The server is also configured to: verify the main data source in combination with the consistency matrix. If the verification passes, the data is adopted; otherwise, the retransmission mechanism is triggered. When the retransmission mechanism is triggered, the server recalculates the optimal data allocation ratio according to the current load of each physical link and the predicted result of the failure rate, and issues it to the microcomputer line protection and measurement and control device at the device layer for retransmission. Through the consistency matrix verification and the retransmission mechanism, it is ensured that the finally used data is accurate and reliable, and possible data errors or inconsistencies can be detected and corrected in a timely manner. By dynamically adjusting the allocation ratio of the retransmitted data according to the link load and the failure rate, the link load imbalance and the decline in transmission efficiency caused by retransmission are avoided, maintaining the high efficiency and stability of the system data transmission while ensuring the data accuracy.

[0041] In a 35 kV intelligent substation, the device layer adopts the BHE-316 microcomputer line protection and measurement control device, which has four independent network ports, respectively connecting four physical links: Physical link 1 uses single-mode optical fiber and is laid along the cable trench on the east side of the substation; Physical link 2 uses multi-mode optical fiber and runs along the cable trench on the south side; Physical link 3 is a shielded twisted pair wire and is transmitted through the overhead line on the west side; Physical link 4 is wireless microwave and is relayed by the iron tower on the north side. Redundant geographic routing is adopted, and multiple physical links are deployed with different geographic paths to reduce the risk of multiple physical links failing simultaneously due to regional events such as natural disasters and human sabotage. The microcomputer line protection and measurement control device real-time collects original data such as bus voltage and current, encodes it into 3 redundant data copies, and generates a camouflage information data frame header containing virtual receiving target identification, random protocol type identification, and forged priority identification for each copy. After the server calculates the optimal data allocation ratio of each link according to the Markov link prediction model and issues it, the microcomputer line protection and measurement control device parallelly transmits the redundant data copies to the four physical links through the four network ports.

[0042] Four Huawei S5720-52P Ethernet switches and a BHE-352 remote communication management machine are deployed in the communication layer. The four Ethernet switches form a dual-ring interconnected topology structure through four interconnection links. The main ring consists of Switch 1 - Switch 2 - Switch 3 - Switch 1 and adopts the STP protocol; the standby ring consists of Switch 2 - Switch 4 - Switch 3 - Switch 2 and adopts the ERPS protocol. The remote communication management machine is respectively connected to Switch 2 and Switch 3 in the dual-ring network through dual network ports. The remote communication management machine is configured with 10 camouflage receiving modules, among which 5 simulate the IEC 60870-5-104 protocol service interface, 3 simulate the Modbus TCP service interface, and 2 simulate the DNP3 service interface; the load balancer distributes the data frames to the core processing module according to the data frame priority, the load status of the camouflage receiving module, and the predicted result of the link failure rate; the core processing module verifies the CRC check code and digital signature of the data frame, and at the same time compares the virtual receiving target identification in the camouflage information. After the verification, the data frame is converted from protocols such as Modbus and DNP3 to the IEC61850 standard protocol and transmitted to the server.

[0043] The BHE-316 microcomputer line protection device is applicable to line protection with a voltage level of 66 kV and below, can be centrally grouped into a screen or dispersedly installed in the switch cabinet, and has its own AC / DC operation circuit.

[0044] Electrical parameters: The rated power supply supports DC / AC 220V / 110V, the rated AC current is 5A / 1A, the voltage is 100V, and the power consumption is low (the power supply circuit ≤ 10W, the AC circuit ≤ 0.5VA / phase), adapting to the conventional electrical environment of the substation.

[0045] Accuracy and reliability: The current / voltage protection error ≤ ±2%, the action time error ≤ ±20 ms, the telemetry event resolution ≤ 2 ms, and the remote control accuracy rate ≥ 99.99%, meeting the requirements of "data accuracy and real-time performance".

[0046] Its core functions are as follows:

[0047] (1) Multi-channel data acquisition and transmission:

[0048] It has 4 independent network interfaces, can collect original data such as bus voltage and current in real time, and communicate with the BHE-352 communication management unit through the CAN bus and network, upload telemetry and telecommand data and receive remote control commands.

[0049] (2) Data processing and protection logic:

[0050] It supports functions such as three-stage directional overcurrent protection, zero-sequence current protection, three-phase primary reclosing (checking no voltage / checking synchronization), and under-frequency load shedding, meeting the requirements of "data reliability verification and fault protection". Its sudden change start fault recording function (the first 8 cycles + the next 56 cycles, 32 points sampling per cycle) can assist in data integrity verification.

[0051] (3) Safety and anti-interference design:

[0052] It has functions such as PT disconnection detection and blocking protection, CT disconnection monitoring, etc., and its anti-interference performance meets the test requirements of level III high-frequency pulses, level IV electrostatic discharge, etc.

[0053] (4) Function scalability:

[0054] Through secondary development, the function of "generating data frame camouflage information" (such as adding virtual target identifiers, forging priorities) can be integrated. Its existing protection logic and communication protocol (supporting IEC60870-5-104, etc.) can cooperate with the camouflage receiving module of BHE-352 to achieve attack confusion and security protection.

[0055] As the core device of the substation communication layer, the BHE-352 microcomputer communication management unit device can cooperate with protection devices such as BHE-316 to achieve multi-protocol data interaction, load balancing and security protection, and is applicable to the substation integrated automation system of 110 kV and below.

[0056] Hardware interface configuration: It has multiple network interfaces and CAN communication terminals, can access the dual-ring network topology, and supports forming a redundant network with four switches.

[0057] Data processing ability: The telemetry event resolution ≤ 2 ms, the remote control accuracy rate ≥ 99.99%, supports CRC check and digital signature verification of data frames to ensure transmission reliability.

[0058] Its core functions are as follows:

[0059] (1) Multi-protocol communication and data interaction:

[0060] It supports CAN bus and network communication, can perform telemetry, tele-signaling, and upload and download of power consumption data with devices such as BHE-316, and is compatible with protocols such as IEC60870-5-104, Modbus, and DNP3.

[0061] (2) Disguised reception and attack confusion:

[0062] It has 10 built-in disguised reception modules (5 simulating IEC60870-5-104, 3 simulating Modbus, and 2 simulating DNP3), can generate virtual reception target identifiers (such as "decoy_01"), confuse attackers, and record the source IP and time of the attack.

[0063] (3) Load balancing and data scheduling:

[0064] It monitors the priority of data frames in real time (such as the highest level 255), the load status of modules (reception frequency / processing time), and the predicted results of link failure rates, and dynamically allocates data to the core processing module.

[0065] The server in the management layer uses Lenovo ThinkServer T100C. The server constructs a link state prediction model based on the Markov process and outputs the predicted failure rate of each physical link every 5 minutes; according to the prediction results, combined with the load and attack conditions of the physical links, it calculates the optimal data allocation ratio through a linear programming model and issues it to the microcomputer line protection and measurement control device. The Bayesian network data fusion engine of the server receives multiple data copies from the communication layer, and performs weighted fusion processing on the data copies by combining the consistency matrix and the Bayesian weight factor.

[0066] In a data transmission, in the data frame header generated by the microcomputer line protection and measurement control device, the virtual reception target identifiers are set to "decoy_01" and "decoy_03", corresponding to the disguised reception modules simulating the IEC 60870-5-104 protocol and the Modbus protocol in the remote communication management machine respectively; the randomly generated protocol type identifier is "05" (simulating a non-existent protocol type); the forged priority identifier is set to the highest level "255" to confuse attackers. The disguised information, together with the payload part (including the collected current and voltage data) and the verification part (CRC check code, digital signature) of the data frame, constitutes a complete data frame structure and is transmitted in four physical links along with the redundant data copies.

[0067] The list of spoofing receiving modules of the remote communication management machine records 10 module information, including module ID, simulated protocol type, etc. When the microcomputer line protection and measurement control device generates spoofing information for the data frame header, a virtual receiving target identifier is randomly selected from this list. If "GRASS-05" is selected as the virtual receiving target identifier, and the spoofing receiving module corresponding to this identifier simulates the DNP3 protocol service interface, then during the transmission of the data frame, it is spoofed as data to be sent to this DNP3 protocol interface to attract the attention of attackers, while the true receiving target of the actual data is hidden therein.

[0068] Among the 10 spoofing receiving modules of the remote communication management machine, 5 simulate the IEC 60870-5-104 protocol service interface and listen on port 2404; 3 simulate the Modbus TCP service interface and listen on port 502; 2 simulate the DNP3 service interface and listen on port 20000. After each spoofing receiving module receives a data frame, it immediately records the source device ID and receiving time of the data frame. For example, when the spoofing receiving module simulating the Modbus TCP protocol receives a data frame from the source device ID "192.168.1.100", it records this ID and the receiving time "2025-02-20 10:30:05", providing data support for subsequent attack analysis and adjustment of security protection strategies.

[0069] The load balancer monitors in real time the priority field of each data frame (such as the remote control command data frame set to the highest priority), the load status of the spoofing receiving module (judged by calculating the frequency and processing time of the module receiving the data frame), and the predicted result of the link failure rate issued by the server. When the predicted failure rate of physical link 1 increases and a spoofing receiving module simulating the IEC60870-5-104 protocol has a low load, the load balancer distributes some data frames that were originally to be allocated to other physical links to the core processing module path corresponding to this module. After the spoofing receiving module receives a data frame, it first compares the source device ID of the data frame with the preset list of trusted devices. If the source device ID is not in the list, such as detecting a data frame from the strange IP "10.10.10.10", it immediately marks this data frame as a suspected attack data frame and isolates and stores it in a dedicated secure storage area to prevent the spread of the attack.

[0070] After receiving the data frame, the core processing module first verifies the CRC checksum of the data frame. By recalculating the CRC value of the data frame payload part and comparing it with the checksum carried in the header, it determines whether an error occurred during data transmission. Then it verifies the digital signature, decrypts the signature using the public key of the sender to ensure that the data has not been tampered with and indeed comes from a legitimate sender. Finally, it compares the virtual receiving target identifier in the spoofing information with the preset target library to check the spoofing rationality of the data frame. If the virtual receiving target identifier is "decoy_02", but there is no legitimate configuration corresponding to this identifier in the preset target library, it is determined that the authenticity of the data frame is in doubt and the data frame is rejected for processing.

[0071] The security monitoring module of the telecontrol communication management machine continuously collects the attack data recorded by the spoofing receiving module, including the attack source IP, attack time, and attack type (such as port scanning, data tampering attempt, etc.). Based on machine learning algorithms such as support vector machine (SVM), it analyzes and trains the attack data to identify attack patterns. When detecting a new attack pattern, such as an attack exploiting a protocol vulnerability that has never occurred before, the security monitoring module dynamically adjusts the type and quantity of the simulated service interfaces of the spoofing receiving module according to the analysis results. It can increase the number of spoofing interfaces that simulate protocols with similar vulnerabilities, inducing the attacker to expose more information while strengthening the protection of the real service interfaces.

[0072] Calculation of the optimal data allocation ratio:

[0073] First, calculate the failure rate weight of the physical link. The physical link status is divided into three categories: normal, warning, and failure. The Markov model predicts the probability of the physical link being in each state at a future moment (such as 10 minutes) based on historical data and state transition rules. For example, it is predicted that the probability of physical link 1 being in the warning state is 20%, the probability of being in the failure state is 5%, and the probability of being in the normal state is 75%. Weight coefficients affecting the failure rate are assigned to different states: the warning state has a relatively small impact on the failure rate, with a coefficient set to 0.3; the failure state has a relatively large impact on the failure rate, with a coefficient set to 0.7; the impact of the normal state on the failure rate is considered 0 (because the failure rate is already very low). The failure rate weight is calculated by weighting: failure rate weight = 0.3 × warning state probability + 0.7 × failure state probability. If the warning probability of physical link 1 is 20% and the failure probability is 5%, then the failure rate weight = 0.3 × 20% + 0.7 × 5% = 0.095. The failure rate weight is used to measure the reliability risk of the physical link. The higher the weight, the more likely the physical link is to fail.

[0074] Next, comprehensively consider the failure rate weight, real-time load rate, and attack count to calculate the risk value of the physical link. For example, if the current load rate of physical link 1 is 60% and the attack count is 2 times (0.4 after normalization), then its risk value is 0.095 + 0.6 + 0.4 = 1.095. Similarly, the risk values of physical link 2, physical link 3, and physical link 4 are calculated to be 0.73, 1.3, and 0.3 respectively.

[0075] Finally, with the goal of minimizing the comprehensive risk, establish an objective function that includes the failure rate weight, load rate, and attack count, and solve for the data allocation ratio of each physical link through linear programming. The physical link 4 with the lowest risk can be allocated a higher proportion (such as 40%), physical link 2 is allocated 30%, and physical links 1 and 3 are allocated 20% and 10% respectively due to their higher risks, ensuring that data is preferentially transmitted through more reliable physical links to achieve dynamic load balancing and risk optimization.

[0076] When the Bayesian network data fusion engine of the server calculates the posterior probability of each data copy, it takes the transmission path of the data frame (such as physical link 1 is fiber optic and physical link 2 is wireless microwave), the attack count of the spoofing reception module (such as a certain module has been attacked 5 times in the past 1 hour), and the predicted result of the link failure rate (such as the predicted failure rate of physical link 3 in the next 10 minutes is 10%) as input variables. Calculate the posterior probability of each data copy through the Bayesian formula. For example, for the data copy from physical link 1, combine the stability of its transmission path, the attack situation of the corresponding spoofing reception module, and the link failure rate to calculate the posterior probability of this copy to be 0.8 for subsequent data fusion decisions.

[0077] The Bayesian network data fusion engine of the server receives multiple redundant data copies from the core processing module and obtains the predicted results of the failure rates of each transmission path based on the Markov link prediction model. The Markov link prediction model is a link state prediction model constructed based on the Markov process, which predicts the future link state by analyzing historical failure rate data. For example, if 3 voltage data copies from different physical links are received, assuming the failure rate of physical link 1 is 5%, the failure rate of physical link 2 is 8%, and the failure rate of physical link 3 is 3%, combined with the attack count recorded by the spoofing reception module, such as the attack count of the spoofing reception module corresponding to physical link 1 is 2 times, physical link 2 is 0 times, and physical link 3 is 1 time. According to this information, calculate the Bayesian weight factor of each data copy, and then determine the credibility of each data copy based on the weight factors of physical links 1, 2, and 3 obtained through the algorithm, and select the data copy corresponding to the physical link with the highest credibility as the main data source for subsequent data processing and analysis.

[0078] The server validates the selected primary data source in combination with the consistency matrix, which records the association and consistency relationships between different data replicas. If the difference between the primary data source and other data replicas in key data fields exceeds a preset threshold, for example, the primary data source of voltage data is 10.5 kV, while other replicas are all between 10.2 - 10.3 kV, and the difference exceeds 0.2 kV, it is determined that the validation fails and the retransmission mechanism is triggered. When the retransmission mechanism is triggered, the server recalculates the optimal data allocation ratio according to the current load of each physical link (such as the load of physical link 1 is 70% and the load of physical link 2 is 30%) and the failure rate prediction result (such as the failure rate of physical link 3 is relatively high), and adjusts the allocation of some data originally assigned to physical link 3 to physical link 2; then the new allocation ratio is sent to the microcomputer line protection and measurement control device at the device layer, and the microcomputer line protection and measurement control device retransmits the data according to the new ratio.

[0079] In the above embodiments, the descriptions of the respective embodiments have their own emphases. For parts not detailed or recorded in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0080] In each embodiment, the hardware implementation of the technology can directly adopt existing intelligent devices, including but not limited to industrial control computers, PC machines, smart phones, handheld single machines, floor-standing single machines, etc. Its input device preferably adopts a screen keyboard, its data storage and calculation module adopts existing memories, calculators, and controllers, its internal communication module adopts existing communication ports and protocols, and its remote communication adopts existing GPRS networks, the World Wide Web, etc.

[0081] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the above division of each functional unit and module is used as an example. In actual applications, the above functions can be allocated to different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. In addition, the specific names of the functional units and modules are only for the convenience of mutual distinction and do not limit the protection scope of the present application. The specific working processes of the units and modules in the above system can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0082] In the embodiments provided by the present invention, it should be understood that the disclosed device / terminal device and method can be implemented in other ways. For example, the device / terminal device embodiments described above are merely illustrative. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect coupling or communication connection of devices or units can be in electrical, mechanical or other forms. The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0083] In each embodiment of the present invention, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units. If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, to implement all or part of the processes in the above embodiment methods of the present invention, it can also be completed by a computer program instructing relevant hardware. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, the steps of the above various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0084] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principle and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A multi-channel substation integrated automation system, comprising an equipment layer, a communication layer and a management layer; characterized in that, The equipment layer includes a microcomputer line protection and measurement control device, which is configured with four independent network interfaces, and each network interface is connected to a physical link; the microcomputer line protection and measurement control device is used to collect original data and encode it into multiple redundant data copies, generate a data frame header including camouflage information for each data copy, and then according to the optimal data allocation ratio issued by the server, transmit the redundant data copies to four physical links in parallel through four independent network interfaces; The communication layer includes four Ethernet switches and a remote communication management machine. The four Ethernet switches form a dual-ring interconnected topology through four interconnection links. The remote communication management machine is respectively connected to two different switches in the dual-ring network through dual network interfaces; the remote communication management machine is configured with: a plurality of camouflage receiving modules, simulating service interfaces of different protocol types, for receiving and recording data frames including camouflage information; A load balancer, configured to distribute the received data frames to the core processing module according to a preset policy; A core processing module, configured to perform checksum and protocol conversion on the data frames, and transmit the processed data frames to the server; The management layer includes a server, which is configured to: construct a link state prediction model based on a Markov process, output the failure rate prediction of each physical link, and according to the failure rate prediction, combined with the load and attack situation of the physical link, calculate the optimal data allocation ratio through a linear programming model and issue it to the microcomputer line protection and measurement control device; Through a Bayesian network data fusion engine, combined with a consistency matrix and a Bayesian weight factor, perform weighted fusion on each data copy.

2. The multi-channel substation integrated automation system according to claim 1, wherein, The camouflage information in the data frame header is used to confuse potential network attacks, including: at least two virtual receiving target identifiers, a randomly generated protocol type identifier, and a forged priority identifier; the camouflage information, together with the payload part and checksum part of the data frame, constitutes a complete data frame structure.

3. The multi-channel substation integrated automation system according to claim 2, characterized in that The virtual receiving target identifier is randomly selected from the list of camouflage receiving modules of the remote communication management machine, and the virtual receiving target identifier corresponds to the service interface type of the camouflage receiving module.

4. The multi-channel substation integrated automation system according to claim 2, characterized in that, The camouflage receiving module supports simulating service interfaces of at least three protocol types, including IEC 60870-5-104, Modbus, and DNP3. Each camouflage receiving module independently records the source device ID and receiving time of the received data frame.

5. The multi-channel substation integrated automation system according to claim 4, wherein The load balancer distributes the data frames to the core processing module according to the priority of the data frames, the load status of the camouflage receiving modules, and the link failure rate prediction result; After receiving the data frame, the camouflage receiving module first determines whether the source device ID of the data frame is in a preset trusted device list. If not, it marks it as a suspected attack data frame and stores it in isolation.

6. The multi-channel substation integrated automation system according to claim 5, characterized in that, The checksum of the data frame by the core processing module includes: verifying the CRC checksum and digital signature of the data frame, and judging the authenticity of the data frame by comparing the virtual receiving target identifier in the camouflage information with a preset target library.

7. The multi-channel substation integrated automation system according to claim 6, characterized in that, The remote communication management machine is also equipped with a security monitoring module. The security monitoring module identifies attack patterns based on machine learning algorithms according to the attack data recorded by the camouflage reception module, and dynamically adjusts the type and quantity of the simulated service interfaces of the camouflage reception module.

8. The multi-channel substation integrated automation system according to claim 1, characterized in that The calculation process of the optimal data allocation ratio is as follows: The physical link status is divided into three categories: normal, warning, and fault. A state transition matrix is obtained through training with historical data to predict the probabilities of the physical link being in different states at future moments, and then the failure rate weight of the physical link is calculated through weighted calculation. Comprehensively consider the failure rate weight, real-time load rate, and attack count of the physical link to calculate the risk value of the physical link. With the goal of minimizing the comprehensive risk, establish an objective function that includes the failure rate weight, load rate, and attack count, and solve the data allocation ratio of each physical link through linear programming.

9. The integrated automation system for multi-channel substation according to claim 1, characterized in that The fusion steps of the Bayesian network data fusion engine include: receiving multiple redundant data copies from the core processing module; obtaining the failure rate prediction results of each transmission path based on the Markov link prediction model; calculating the Bayesian weight factors of each data copy in combination with the attack count recorded by the camouflage reception module; determining the credibility of each data copy according to the Bayesian weight factors, and selecting the data copy with the highest credibility as the main data source.

10. The multi-channel substation integrated automation system according to claim 9, characterized in that The server is also configured to: verify the main data source in combination with the consistency matrix. If the verification passes, the data is adopted; otherwise, the retransmission mechanism is triggered. When the retransmission mechanism is triggered, the server recalculates the optimal data allocation ratio according to the current load and failure rate prediction results of each physical link, and sends it to the microcomputer line protection and measurement and control device at the device layer for retransmission.

Images