104 message analysis method, system and equipment based on neural network and medium

Abstract

The invention discloses a 104 message analysis method, system and device based on a neural network, and a medium. The method comprises the following steps: obtaining a message data stream through a switch mirror image port; the telecontrol channel abnormity alarm device is connected to a mirror image port of a switch in a physical connection mode, and a data transmission path is established; and based on the data transmission path, monitoring and analyzing the message data of the whole local area network by using a deep learning model, automatically identifying and classifying abnormal conditions in the message data, and obtaining an automatic diagnosis result of the message data. The 104 message data are automatically analyzed through the convolutional neural network algorithm, the labor cost can be reduced, and the defect processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of power communication technology, and in particular to a 104 message parsing method, system, device and medium based on a neural network. Background Art

[0002] Existing message parsing software has relatively simple functions. During operation, it captures the transmitted data packets and compresses them into a corresponding folder. The captured messages are then put into the parsing tool for parsing. The entire process is inefficient and the parsing operation is prone to errors due to the large amount of data. Summary of the Invention

[0003] In view of the above existing problems, the present invention is proposed.

[0004] Therefore, the present invention provides a 104 message parsing method, system, device and medium based on a neural network to solve the problems of low defect processing efficiency and high error rate of existing message analysis methods.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides a 104 message parsing method based on a neural network, comprising:

[0007] Obtain packet data streams through the switch mirror port;

[0008] Connect the remote control channel abnormal alarm device to the switch mirror port through physical connection to establish a data transmission path;

[0009] Based on the data transmission path, a deep learning model is used to monitor and analyze the message data of the entire local area network, automatically identify and classify abnormal situations in the message data, and obtain automatic diagnosis results of the message data.

[0010] As a preferred solution of the neural network-based 104 message parsing method of the present invention, wherein:

[0011] The use of a deep learning model to monitor and analyze message data of the entire local area network includes the following steps:

[0012] Message data capture and preliminary processing;

[0013] Build and train deep learning models;

[0014] Use the trained deep learning model to perform real-time fault diagnosis on the input data.

[0015] The beneficial effect of this preferred technical solution is that it significantly improves the efficiency and accuracy of network monitoring by automatically capturing and processing communication data packets and using trained deep learning models for real-time fault diagnosis, while reducing the need for manual intervention, effectively reducing operation and maintenance costs and improving system reliability and response speed.

[0016] As a preferred solution of the neural network-based 104 message parsing method of the present invention, wherein:

[0017] The message data capture and preliminary processing includes the following steps:

[0018] Use a packet capture tool to obtain packet data from the switch mirror port;

[0019] The obtained message data is stored in the database;

[0020] Standardize and normalize the acquired message data.

[0021] The beneficial effect of this preferred technical solution is that by using packet capture tools to capture, parse and decompose all communication data packets copied by the switch mirror port and store them in the database, efficient collection and management of network communication data is achieved, providing reliable data support for subsequent real-time monitoring and fault diagnosis.

[0022] As a preferred solution of the neural network-based 104 message parsing method of the present invention, wherein:

[0023] The deep learning model comprises an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer;

[0024] The construction of the deep learning model includes the following steps:

[0025] The input layer receives the characteristic sequence of the IEC 104 message as an input vector;

[0026] Perform convolution operations on the input data through the convolution layer to extract local features in the message;

[0027] Apply the first activation function to the output of the first convolutional layer to enhance the ability to express complex features;

[0028] Perform a max pooling operation through the pooling layer to downsample the output of the first convolutional layer;

[0029] The final feature map is converted into a probability distribution of multiple categories through the second activation function.

[0030] As a preferred solution of the neural network-based 104 message parsing method of the present invention, wherein:

[0031] The method of using the trained deep learning model to perform real-time fault diagnosis on input data includes the following steps:

[0032] Monitor new input data streams in real time and automatically diagnose new incoming data using trained models;

[0033] If the deep learning model identifies a message as abnormal, it triggers an alarm mechanism and notifies the corresponding operation and maintenance personnel;

[0034] The diagnostic results are displayed through a visual interface.

[0035] As a preferred solution of the neural network-based 104 message parsing method of the present invention, wherein:

[0036] The probability distribution of the multiple categories includes five different types of message states;

[0037] The five different types of message status include:

[0038] If the message meets the expected standards, the current message is determined to be in a normal state;

[0039] If a field in the message does not conform to the format requirements specified by the protocol, the current message is considered to be in an abnormal state;

[0040] If the message length exceeds 6 to 255 bytes, the current message is considered abnormal.

[0041] If an error occurs during data transmission, the current message is considered to be in an abnormal state.

[0042] If an unknown error occurs in the message, the current message is determined to be in an abnormal state.

[0043] As a preferred solution of the neural network-based 104 message parsing method of the present invention, wherein:

[0044] The method of displaying the diagnosis results through a visual interface includes the following steps:

[0045] If the deep learning model diagnoses that an abnormal message exists, the visual interface responds for a first set time using a first color mark and simultaneously sends relevant information about the error message;

[0046] If the alarm information is sent successfully, the visual interface responds with a second set time through a second color mark;

[0047] If the test result is received, the visual interface responds with a third set time through a third color mark;

[0048] Visualize the fault types of message data.

[0049] In a second aspect, the present invention provides a 104 message parsing system based on a neural network, comprising:

[0050] A data acquisition module is used to acquire message data streams through the switch mirror port;

[0051] The data transmission interface module is used to connect the remote control channel abnormal alarm device to the switch mirror port through a physical connection to establish a data transmission path;

[0052] The deep learning analysis module is used to monitor and analyze the message data of the entire local area network based on the data transmission path using a deep learning model, automatically identify and classify abnormalities in the message data, and obtain automatic diagnosis results of the message data.

[0053] In a third aspect, the present invention provides an electronic device, comprising:

[0054] Memory, used to store programs;

[0055] A processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the neural network-based message parsing method 104.

[0056] In a fourth aspect, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, the steps of implementing the neural network-based 104 message parsing method are implemented.

[0057] The beneficial effects of the present invention are as follows: the present invention adopts the switch mirror port monitoring method, which does not interfere with the operation of the current network. By designing a neural network model, it is able to analyze the message feature bytes and judge the flow size threshold, etc. After determining the fault, the SMS module automatically alerts the corresponding staff, which can not only improve the efficiency and accuracy of 104 message analysis, but also reduce the dependence on technical personnel to save human resource costs, and promote the intelligent development of the power grid to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort. Among them:

[0059] Figure 1 A schematic diagram of the basic flow of a 104 message parsing method based on a neural network according to an embodiment of the present invention;

[0060] Figure 2This is a task block diagram of a message parsing method 104 based on a neural network according to an embodiment of the present invention;

[0061] Figure 3 A CNN structure diagram of a message parsing method based on a neural network 104 according to an embodiment of the present invention;

[0062] Figure 4 This is a working principle diagram of a message analysis device in a power grid communication network according to a message parsing method 104 based on a neural network according to an embodiment of the present invention;

[0063] Figure 5 Schematic diagram of the data transmission interface of the packet capture software (left) on the master side and (right) on the slave side of the neural network-based 104 message parsing method according to one embodiment of the present invention;

[0064] Figure 6 A PostgresSQL database storing the message graph received by the master station in real time according to the message parsing method 104 based on the neural network according to an embodiment of the present invention;

[0065] Figure 7 This is a diagram of the operating interface of the fault diagnosis system of the 104 message parsing method based on the neural network according to an embodiment of the present invention;

[0066] Figure 8 This is a diagram of the communication module of the master station side of the neural network-based 104 message parsing method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0067] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0068] Example 1

[0069] Reference Figure 1 , as an embodiment of the present invention, provides a 104 message parsing method based on a neural network, comprising:

[0070] S100: obtains the packet data flow through the switch mirror port;

[0071] S200: Connecting the remote control channel abnormal alarm device to the mirror port of the switch through a physical connection to establish a data transmission path;

[0072] S300: Based on the data transmission path, a deep learning model is used to monitor and analyze the message data of the entire local area network to obtain automatic diagnosis results of the message data.

[0073] It should be noted that automatic fault diagnosis faces numerous operational challenges, including the need to process massive amounts of data in real time, accurately identify complex and changing abnormal patterns, and ensure high accuracy with a low false alarm rate. These challenges require the system to not only rapidly respond to various emergencies but also adapt to the ever-changing network environment and message characteristics. By effectively addressing these challenges, automatic fault diagnosis significantly improves the speed and accuracy of message parsing, reduces reliance on manual intervention, thereby ensuring the stability and security of power grid communication systems and promoting the development of smart grids. Furthermore, it can promptly detect and warn of potential risks, helping to take proactive measures to avoid more serious system failures.

[0074] Therefore, in order to address the above-mentioned problems of low defect handling efficiency and high error rate, through steps S100-S300, a neural network model is built to enable it to analyze message feature bytes and determine traffic size, etc. If a fault is detected, it will automatically alarm and inform the relevant staff via text message, reducing the cost of manual troubleshooting and greatly improving fault handling efficiency.

[0075] Example 2, reference Figure 2-Figure 8 , which is an embodiment of the present invention, provides a 104 message parsing method based on a neural network based on the previous embodiment, including:

[0076] In the embodiments of this application, Figure 2 The flowchart of the network monitoring and fault diagnosis system based on the IEC 104 protocol is divided into three main parts. The first part shows the message structure in the TCP / IP protocol stack, including the TCP header, TCP data portion, IP header, and IP data portion. The second part is Task 1, which captures network traffic through the switch mirroring function. Multiple terminals (Terminal 1 to Terminal 4) are connected to the monitoring software, indicating that the data from these terminals is captured by the monitoring software. The third part is Task 2, which collects all communication data packets copied from the switch mirroring port, parses and decomposes the collected data packets, uses the parsed data to detect traffic anomalies, and trains a model based on the detection results to improve the accuracy of subsequent fault diagnosis.

[0077] In this embodiment of the present application, obtaining the message data stream through the switch mirror port in step S100 includes enabling the mirror port function on the switch corresponding to the station control layer telecontrol channel, thereby obtaining real-time access to the message data stream within the entire local area network. Enabling the mirror port function on the switch is to monitor and collect message data streams within the entire local area network without interfering with the current network operation, which is crucial for monitoring the status of the power grid communication network and ensuring its normal operation. This data is then transmitted to a specialized analysis device (such as a telecontrol channel abnormality alarm device) for further processing and analysis.

[0078] In an embodiment of the present application, physically connecting the remote channel abnormality alarm device to the mirror port of the switch in step S200 includes connecting a specially designed remote channel abnormality alarm device to the mirror port of the switch through an RJ45 network cable, so that the copied data can be directly transmitted to the alarm device to prepare for subsequent in-depth analysis.

[0079] In the embodiment of the present application, step S300 uses a deep learning model to monitor and analyze the message data of the entire local area network, including:

[0080] Message data capture and preliminary processing;

[0081] Build and train deep learning models;

[0082] Use the trained deep learning model to perform real-time fault diagnosis on the input data.

[0083] In an embodiment of the present application, a deep learning model is used in step S300 to monitor and analyze the message data of the entire LAN, and it also includes developing a new automatic packet capture software, which is stored in the database PostgreSQL at the same time; a TCP\IP debugging assistant is developed based on Visual Studio using C# language, which can capture and unpack the data packets transmitted from the switch mirror port, and store the received data in the database PostgreSQL, and the database is designed using Navicat Premium software. A diagnostic system based on a neural network model is trained, and the abnormal message diagnostic software uses different layers of the convolutional neural network to extract features of different dimensions from the collected sample data; the parameters of the training model are continuously adjusted; after an abnormal message is found, an instruction is sent to the 4G SMS module and the next step is performed, replacing the work of the main station staff in discovering abnormal messages, and monitoring the messages in real time; after integrating the two functions, such as Figure 4As shown, a 104-bit message parsing device based on a neural network has been developed. During message transmission, the device automatically detects messages to monitor the channel operation status in real time. When a fault is found, the diagnostic results are automatically sent to the master station and the operation and maintenance personnel. This solves the problems of wasted human resources and inefficient troubleshooting.

[0084] In the embodiment of the present application, the message data capture and preliminary processing in step S300 includes using a specially developed packet capture tool to monitor and capture data packets transmitted through the mirror port in real time. The captured data packets are disassembled (unpacked) to extract the valid information therein (such as IEC 104 messages). The extracted message data is standardized and normalized so that it can be subsequently input into the neural network model for analysis. The processed data is stored in a database (such as PostgreSQL), such as Figure 6 As shown, it provides data support for subsequent in-depth analysis.

[0085] In the embodiment of the present application, the packet capture tool specially developed in step S300 can capture and display the data content transmitted from the plant station in real time, calculate the data transmission time, and also has an automatic reconnection function, which can automatically try to re-establish the connection after the network connection is interrupted, ensuring the continuity of communication and the stability of the system. Figure 5 As shown, the software also supports the ability to schedule automatic transmissions. Users can configure scheduled tasks to periodically send test packets to monitor the health of communication links. The software interface displays the current packet capture software connection status in real time, including successful connections, disconnections, and reconnections, providing users with intuitive feedback on system operation status. These features not only lay the foundation for efficient subsequent diagnosis of communication faults, but also significantly improve system reliability and maintenance efficiency.

[0086] In an optional embodiment, the deep learning model in step S300 may be a convolutional neural network (CNN) model, a recurrent neural network (RNN) model, or a Transformer model;

[0087] In an optional embodiment, the recurrent neural network (RNN) model includes adding timestamp information, each time step corresponds to a message segment, selecting LSTM or GRU units according to specific needs, adjusting the number of RNN layers and the number of units in each layer, connecting the fully connected layer or directly using the softmax layer for classification tasks.

[0088] In an optional embodiment, the Transformer model includes converting the message into a vector representation, adding a position code to each message segment, calculating the attention scores between different positions through a multi-head attention mechanism, and following each attention layer with a fully connected feedforward network to further process the extracted information and stack multiple encoder layers for classification tasks.

[0089] It should be noted that although there are multiple models that can be selected for message data analysis, CNN is selected as the core algorithm in this invention due to its excellent feature extraction ability and flexibility to achieve intelligent analysis and fault diagnosis of IEC 104 messages.

[0090] In the embodiment of the present application, the basic structure of the convolutional neural network (CNN) in step S300 is composed of a multi-layer neural network, such as Figure 3 As shown in the figure, it mainly includes input layer, convolution layer, pooling layer, fully connected layer and output layer. Each layer has different functions, aiming to extract and process features at different levels.

[0091] (1) Convolutional layer: Its main function is to extract local features from the input data through convolution operation. The convolution operation convolves the convolution kernel with the input data in a sliding window manner and calculates the weighted sum of each local area. The output of the convolutional layer is usually processed by a nonlinear activation function to enable the network to learn more complex features. The ReLU function is usually used. The ReLU function formula is as follows:

[0092] f(x)=max(0,x)

[0093] (2) Pooling layer: The pooling layer is used to reduce dimensionality and computational complexity. Common pooling operations include maximum pooling and average pooling. The pooling layer reduces the size of the feature map by taking the maximum value or average value in the local area while retaining important feature information. The formula for the maximum pooling operation is as follows:

[0094] y=max(x1,x2,...,x n )

[0095] Among them, x1,x2,...,x n Represents the input value in the pooling window.

[0096] (3) Fully connected layer: The fully connected layer is the last layer of CNN, which maps the extracted high-level features to the final output space. Each neuron is connected to all neurons in the previous layer to output classification results or regression values.

[0097] (4) Output layer: The output layer usually uses the softmax function for probability prediction of multi-classification tasks, or uses a linear function for regression tasks.

[0098] In the embodiment of the present application, the deep learning model constructed in step S300 includes an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer;

[0099] In the embodiment of the present application, building a deep learning model in step S300 includes the following steps:

[0100] The input layer receives the characteristic sequence of the IEC 104 message as an input vector;

[0101] Perform convolution operations on the input data through the convolution layer to extract local features in the message;

[0102] Apply the first activation function to the output of the first convolutional layer to enhance the ability to express complex features;

[0103] Perform a max pooling operation through the pooling layer to downsample the output of the first convolutional layer;

[0104] The final feature map is converted into a probability distribution of multiple categories through the second activation function.

[0105] In an optional implementation, the first activation function in step S300 may be a ReLU activation function, a Leaky ReLU activation function, or an ELU activation function;

[0106] In an optional embodiment, the Leaky ReLU activation function includes, for each convolution kernel output, remaining unchanged when the input is greater than 0, and multiplying it by a small positive number (such as 0.01) when the input is less than or equal to 0.

[0107] In an optional embodiment, the ELU activation function includes, for each convolution kernel output, keeping it unchanged when the input is greater than 0, and applying the exponential linear unit formula f(x)=α(e x -1), where α is a hyperparameter (usually set to 1).

[0108] It should be noted that although activation functions such as Leaky ReLU and ELU can also be used to optimize model performance, in many cases, especially for large-scale data sets and complex neural network structures, ReLU is still a very suitable choice due to its efficient computing performance, good sparsity and effective mitigation of the gradient vanishing problem. Therefore, the first activation function in the present invention uses the ReLU activation function.

[0109] In an embodiment of the present application, the second activation function in step S300 uses the Softmax function, mainly to meet the needs of multi-classification tasks, provide a clear probability distribution, work well with the cross-entropy loss function, enhance the interpretability of the model, and adapt to diverse message data.

[0110] In this embodiment of the present application, the construction and training of a convolutional neural network (CNN) in step S300 includes the input layer receiving a 512x1 input vector representing a feature sequence of an IEC 104 message. Convolutional layer 1 uses four 5x1 convolution kernels to perform a convolution operation on the input data to extract local features from the message. After the convolution operation, the ReLU activation function is applied to the output of convolutional layer 1 to introduce nonlinearity and enhance the model's ability to represent complex features. Max pooling layer 1 downsamples the output of convolutional layer 1 using a 2x1 window to reduce feature dimensionality while retaining important information and reducing computational complexity. Dropout layer 1 randomly drops neurons with a probability of 0.6 to prevent overfitting during training. Convolutional layer 2 uses eight 3x1 convolution kernels to further extract higher-level features. The ReLU activation function is again applied to the output of convolutional layer 2 to maintain nonlinear characteristics. Max pooling layer 2 downsamples the output of convolutional layer 2 using a 2x1 window to further compress feature dimensionality and enhance model performance. The Softmax layer converts the final feature map into a probability distribution across five categories for IEC 104 message classification. Fully connected layer 1, consisting of five neurons, maps the output of pooling layer 2 to a lower-dimensional space for better fault classification. Dropout layer 2 randomly drops neurons with a probability of 0.6 to further enhance the model's generalization capabilities, especially when processing diverse message data. A ReLU activation function is applied to the output of fully connected layer 1 to preserve nonlinear characteristics. Fully connected layer 2, consisting of eight neurons, further fuses and processes features.

[0111] In the embodiment of the present application, the five different types of message states in step S300 include:

[0112] If the message meets the expected standards, the current message is determined to be in a normal state;

[0113] If a field in the message does not conform to the format requirements specified by the protocol, the current message is considered to be in an abnormal state;

[0114] If the message length exceeds the first threshold range (less than 6 bytes or greater than 255 bytes), the current message is determined to be in an abnormal state, which may be caused by a network attack or other reasons.

[0115] If an error occurs during the data transmission process, such as a lost or duplicated data packet, the current message is determined to be in an abnormal state;

[0116] If an unknown error occurs in the message and cannot be classified into any of the above four categories of abnormal conditions, the current message is determined to be in an abnormal state.

[0117] It should be noted that the traffic size is mainly based on the normal message length between 6 and 255 bytes. However, the power grid communication system network may suffer a sudden change in message length due to network attacks or network congestion. If the message length is detected to be outside this range, it can be determined that the message is in an abnormal state, thereby achieving the purpose of monitoring whether the channel's operating status is normal. The 104 message analysis device performs automatic fault diagnosis, a function that traditional message processing does not have. This device can not only improve the efficiency and accuracy of 104 message analysis, but also reduce dependence on technical personnel to save human resource costs, and to a certain extent promote the intelligent development of the power grid. The 104 message analysis device based on the neural network of the present invention determines whether the message is normal by analyzing the characteristic bytes of the data and judging the flow size of the message. It can realize autonomous packet capture and real-time storage of data packets in the telecontrol channel, and automatically parse the 104 message data in combination with the convolutional neural network algorithm.

[0118] In an embodiment of the present application, in step S300, real-time fault diagnosis of input data using a trained deep learning model includes real-time monitoring of the input data stream and automatic diagnosis of the newly entered data using the trained model. If the model identifies an abnormality in the message (such as the flow rate is not within the normal range), an alarm mechanism is triggered. The alarm information is sent to the corresponding operation and maintenance personnel via SMS or other means to ensure timely response and handling of potential problems. The diagnostic results are displayed in a visual interface to facilitate the dispatching personnel at the master station to quickly understand the system status and take corresponding measures.

[0119] In the embodiment of the present application, constructing and training a convolutional neural network (CNN) is a core component of the 104 message analysis device, which also includes a remote control channel abnormality alarm device, a fault diagnosis system, and a master station communication module;

[0120] In the embodiment of the present application, the design of the fault diagnosis system is based on the neural network abnormality diagnosis model, but it is necessary to increase human-computer interactivity, so a diagnostic system visual interface diagram is designed, such as Figure 7As shown, after the system is configured, click the start button, and wait until the slave device is online and can display the online slave. The fault diagnosis system can read the message data transmitted between the master and slave ends in the database. If the back-end neural network algorithm diagnoses an error message, the first color mark is set to red, and the response is performed for the first set time (set to 5s for easy observation), and the information of the error message is sent to the corresponding hardware self-loop device through the 4G module. When the transmission is successful, the second color mark is set to yellow, and the response is performed for the second set time (set to 5s for easy observation), and then wait for the test result. When the test result SMS is received, the third color mark is set to green, and the response is performed for the third set time (set to 5s for easy observation), and the judgment result is displayed on the fault type display screen, so that the dispatcher at the master station can understand the situation.

[0121] In the embodiment of the present application, the master station communication module includes a reliable communication link in order to accurately send the captured data to the diagnostic system for analysis. Selecting the Air780E 4G module as the communication module can ensure that data can be transmitted stably and quickly even when the dispatching end is far away from the plant end. Once the diagnostic software finds an error message, it can send information to the operation and inspection personnel by controlling the 4G module on the PC, which relies on the efficient and stable communication module built previously. Figure 8 As shown, the Air780E 4G module not only supports high-speed data transmission but also ensures rapid and accurate transmission of alarm information even under poor network conditions. Its USB-to-340TTL hardware connection to the host simplifies connectivity and provides high compatibility, enhancing the module's versatility and flexibility. Furthermore, the antenna module provides stable, high-quality 4G signals, further enhancing the reliability of the communication link.

[0122] Example 3 is an embodiment of the present invention. This embodiment is different from the first embodiment in that it provides a 104 message parsing system based on a neural network.

[0123] It should be noted that the technical solution of the neural network-based 104 message parsing system and the technical solution of the above-mentioned neural network-based 104 message parsing method belong to the same concept. For details not described in detail in the technical solution of the neural network-based 104 message parsing system in this embodiment, please refer to the description of the technical solution of the above-mentioned neural network-based 104 message parsing method.

[0124] The neural network-based message parsing system 104 in this embodiment includes:

[0125] A data acquisition module is used to acquire message data streams through the switch mirror port;

[0126] The data transmission interface module is used to connect the remote control channel abnormal alarm device to the switch mirror port through a physical connection to establish a data transmission path;

[0127] The deep learning analysis module is used to monitor and analyze the message data of the entire local area network based on the data transmission path using a deep learning model, automatically identify and classify abnormalities in the message data, and obtain automatic diagnosis results of the message data.

[0128] This embodiment further provides an electronic device applicable to the 104 message parsing method based on a neural network, including:

[0129] Memory and processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the 104 message parsing method based on neural network proposed in the above embodiment.

[0130] This embodiment further provides a storage medium having a computer program stored thereon. When the program is executed by a processor, the message parsing method 104 based on a neural network as proposed in the above embodiment is implemented.

[0131] The storage medium proposed in this embodiment and the method for implementing the 104 message parsing based on a neural network proposed in the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0132] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as a computer's floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0133] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A 104 message parsing method based on a neural network, characterized in that: include: Obtain packet data streams through the switch mirror port; Connect the remote control channel abnormal alarm device to the switch mirror port through physical connection to establish a data transmission path; Based on the data transmission path, a deep learning model is used to monitor and analyze the message data of the entire local area network, automatically identify and classify abnormal situations in the message data, and obtain automatic diagnosis results of the message data.

2. The neural network-based 104 message parsing method according to claim 1, characterized in that: The use of a deep learning model to monitor and analyze message data of the entire local area network includes the following steps: Message data capture and preliminary processing; Build and train deep learning models; Use the trained deep learning model to perform real-time fault diagnosis on the input data.

3. The neural network-based 104 message parsing method according to claim 1 or 2, characterized in that: The message data capture and preliminary processing includes the following steps: Use a packet capture tool to obtain packet data from the switch mirror port; The obtained message data is stored in the database; Standardize and normalize the acquired message data.

4. The neural network-based 104 message parsing method according to claim 3, characterized in that: The deep learning model comprises an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer; The construction of the deep learning model includes the following steps: The input layer receives the characteristic sequence of the IEC 104 message as an input vector; Perform convolution operations on the input data through the convolution layer to extract local features in the message; Apply the first activation function to the output of the first convolutional layer to enhance the ability to express complex features; Perform a max pooling operation through the pooling layer to downsample the output of the first convolutional layer; The final feature map is converted into a probability distribution of multiple categories through the second activation function.

5. The neural network-based 104 message parsing method according to claim 4, characterized in that: The method of using the trained deep learning model to perform real-time fault diagnosis on input data includes the following steps: Monitor new input data streams in real time and automatically diagnose new incoming data using trained models; If the deep learning model identifies a message as abnormal, it triggers an alarm mechanism and notifies the corresponding operation and maintenance personnel; The diagnostic results are displayed through a visual interface.

6. The neural network-based 104 message parsing method according to claim 5, characterized in that: The probability distribution of the multiple categories includes five different types of message states; The five different types of message status include: If the message meets the expected standards, the current message is determined to be in a normal state; If a field in the message does not conform to the format requirements specified by the protocol, the current message is considered to be in an abnormal state; If the message length exceeds the first threshold range, the current message is determined to be in an abnormal state; If an error occurs during data transmission, the current message is considered to be in an abnormal state. If an unknown error occurs in the message, the current message is determined to be in an abnormal state.

7. The neural network-based 104 message parsing method according to claim 6, characterized in that: The method of displaying the diagnosis results through a visual interface includes the following steps: If the deep learning model diagnoses that an abnormal message exists, the visual interface responds for a first set time using a first color mark and simultaneously sends relevant information about the error message; If the alarm information is sent successfully, the visual interface responds with a second set time through a second color mark; If the test result is received, the visual interface responds with a third set time through a third color mark; Visualize the fault types of message data.

8. A system using the neural network-based 104 message parsing method according to any one of claims 1 to 7, characterized in that: include: A data acquisition module is used to acquire message data streams through the switch mirror port; The data transmission interface module is used to connect the remote control channel abnormal alarm device to the switch mirror port through a physical connection to establish a data transmission path; The deep learning analysis module is used to monitor and analyze the message data of the entire local area network based on the data transmission path using a deep learning model, automatically identify and classify abnormalities in the message data, and obtain automatic diagnosis results of the message data.

9. An electronic device, characterized in that: include: Memory, used to store programs; A processor, configured to load the program to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images