An edge computing security optimization method, system, device and medium of a smart grid

Abstract

The application provides an edge computing security optimization method, system, device and medium of a smart power grid, belonging to the technical field of power grid security. The method comprises the following steps: a terminal monitoring device performs real-time prediction on collected power grid data through an LSTM model to determine whether there is a terminal anomaly, triggers local model incremental training when there is a terminal anomaly, and reports the gradient change in the training after compression and encryption; a substation server responds to the terminal anomaly, distributes the compressed and encrypted gradient change reported by each terminal monitoring device to the substation server, and reports to a power grid data center at the same time; and the power grid data center responds to the received aggregated parameters, identifies the fault type through a main fault analysis model, determines the model to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and the model level. The application improves the fault detection and response efficiency and security of the smart power grid through dynamic perception, encryption protection and lightweight architecture.

Description

Technical Field

[0001] This application belongs to the field of power grid security technology, specifically relating to a method, system, device and medium for edge computing security optimization of smart grids. Background Technology

[0002] Power grid fault detection plays a crucial role in ensuring power supply. Traditional power grid fault detection methods mainly rely on centralized fault analysis models, which have the following problems: First, edge-layer terminal monitoring devices are typically limited by hardware computing power and power supply capabilities, making it difficult to support the real-time operation of complex models. In existing solutions, directly deploying the full deep learning model can easily lead to excessive power consumption or response delays, while lightweight models suffer from insufficient prediction accuracy. Simultaneously, the power grid data collected by edge devices involves sensitive information about power grid operation. Traditional data reporting methods do not encrypt intermediate results such as gradient updates, posing a risk of privacy leaks. For example, unencrypted gradient changes could be used by attackers to infer the power grid topology or fault modes, threatening system security. Second, traditional fault analysis models employ fixed training strategies, which cannot adapt to dynamic fluctuations in device resources. For example, insufficient device power or bandwidth can lead to a decrease in training focus or model performance, and they cannot fully utilize the computing power of edge devices, nor can they perform limited model training under resource constraints. In power grid anomaly detection scenarios, traditional federated learning frameworks require sending raw data from terminal devices to a central node, resulting in high communication overhead and low aggregation efficiency. Especially when multiple terminals report anomalies simultaneously, massive amounts of unprocessed data can cause computational congestion on the fog layer server, delaying fault response. Summary of the Invention

[0003] In a first aspect, embodiments of this application provide an edge computing security optimization method for a smart grid, wherein the smart grid includes terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and a grid data center deployed at the grid cloud layer; The method includes the following steps: S1. The terminal monitoring equipment is equipped with an LSTM model. The LSTM model is used to make real-time predictions on the collected power grid data and to determine whether there are terminal anomalies based on the prediction results. When a terminal anomaly is found, the local model is triggered to perform incremental training, and the gradient changes during training are compressed, encrypted, and then reported. S2. When the substation server responds to the terminal anomaly, it performs federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device, and reports the aggregated gradient changes to the power grid data center. S3. The power grid data center responds to the received aggregated parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level.

[0004] Furthermore, the specific steps of step S1 are as follows: S11. Initialize the LSTM model for the terminal monitoring device; S12. The terminal monitoring equipment collects the power grid dataset and its own status in real time, and inputs the power grid data into the LSTM model to predict the power grid parameters for a set time period; S13. The terminal monitoring equipment analyzes the predicted values ​​of power grid parameters and determines whether the fluctuation range exceeds the set threshold. If so, locate the power grid fault based on the type of fluctuating power grid parameters and proceed to step S14; If not, return to step S12; S14. Start the local incremental training of the LSTM model, and encrypt and compress the gradient changes during the training process before reporting them to the substation server.

[0005] Furthermore, the specific steps of step S11 are as follows: The S111.LSTM model terminal monitoring device registers hardware parameters with the substation server; S112. The power grid data center receives the hardware parameters of the terminal monitoring equipment reported by the substation server; If the hardware parameters do not meet the computing power threshold, a lightweight LSTM model is sent to the corresponding terminal monitoring device. If the hardware parameters meet the computing power threshold, the full LSTM model is sent to the corresponding terminal monitoring device. The specific steps for starting local incremental training of the LSTM model in step S14 are as follows: Determine whether an emergency response needs to be triggered based on the type and magnitude of the fluctuating power grid parameters; If so, only the weights of the last layer are updated during the LSTM model training process; If not, only the last two layers are updated during LSTM model training; The specific steps for encrypting and compressing the gradient changes during the training process in step S14 are as follows: The terminal monitoring device determines the compression rate based on its own status; Encryption strategies are determined for different parameter parts in the gradient change, and the gradient changes of each parameter part are encrypted according to the determined encryption strategies. Then the results are merged to obtain the encrypted gradient change. The encrypted gradient changes are compressed using a defined compression ratio.

[0006] Furthermore, the specific steps of step S2 are as follows: S21. The substation server receives encrypted and compressed gradient changes reported by each terminal monitoring device, responds to terminal anomalies, and locates power grid faults based on the terminal monitoring device to which the corresponding gradient change belongs. S22. The substation server determines whether the number of abnormal response terminals exceeds a set threshold within a set time period; If so, proceed to step S23; If not, return to step S21; S23. The substation server performs spatiotemporal alignment and anomaly processing on the encrypted and compressed gradient changes reported by each terminal monitoring device, and then aggregates them using a homomorphic summation method. S24. The substation server adds the substation code to the grid data center after aggregating the gradient changes.

[0007] Furthermore, the specific steps of step S3 are as follows: S31. Pre-build and train fault analysis models in the power grid data center; S32. The aggregated gradient changes of the power grid data are input into the fault analysis model to obtain a fault feature vector; the fault feature vector includes fault type, fault probability, and fault response substation code; S33. The power grid data center generates a heat map of fault probability distribution based on fault feature vectors and power grid GIS topology data; S34. The power grid data center selects the model that needs to be updated from the pre-set fault model library and determines the distribution path according to the substation code; the model that needs to be updated includes fog-specific components and edge general components; S35. The power grid data center will distribute the required updated model verification path to the corresponding power plant server; S36. The substation server uses a fog-specific component for local updates, while distributing the edge general component to each terminal monitoring device.

[0008] Furthermore, the specific steps for training the fault analysis model in step S31 are as follows: Collect gradient change data of each terminal monitoring device within a set time period before and after historical fault events, label the fault type and occurrence time, and form a set of gradient samples; Using a three-dimensional convolutional neural network to process the spatiotemporal features of gradient samples; The fault analysis model is trained with the goal of minimizing fault classification loss and fault location loss.

[0009] Furthermore, the following steps are included between steps S34 and S35: The power grid data center determines whether the following emergency update conditions are met: The model that needs updating only includes edge-common components; The size of the model that needs to be updated is less than the set threshold; The fault type is emergency; If not, proceed to step S35; If so, the power grid data center will directly send the model that needs to be updated to all terminal monitoring devices under the substation server according to the distribution path.

[0010] Secondly, this application also provides an edge computing security optimization system for a smart grid, the smart grid including terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and a grid data center deployed at the grid cloud layer; The terminal anomaly identification module uses an LSTM model to make real-time predictions on the collected power grid data and determines whether there are terminal anomalies based on the prediction results. When a terminal anomaly is found, it triggers incremental training of the local model and reports the gradient changes during training after compression and encryption. The fog layer anomaly identification module responds to terminal anomalies by performing federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device and then reporting the aggregated gradient changes to the power grid data center. The cloud global model update module responds to the received aggregate parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level.

[0011] Thirdly, embodiments of this application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the edge computing security optimization method for smart grids as described in the first aspect.

[0012] Fourthly, embodiments of this application also provide a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the edge computing security optimization method for smart grids as described in the first aspect.

[0013] As can be seen from the above technical solutions, this application has the following advantages: The edge computing security optimization method, system, device, and medium for smart grids provided in this application utilize a dynamic resource awareness mechanism. Edge devices can dynamically adjust their training strategies based on their own state, ensuring effective model training even under resource constraints and fully utilizing their computing power. Differential privacy and homomorphic encryption are used to encrypt intermediate results such as gradient changes, effectively preventing privacy leaks and protecting sensitive information about grid operation. Lightweight architecture search and multi-level privacy security optimize the model structure, improving inference speed and accuracy on different devices and enabling rapid adaptation to new fault modes, enhancing system adaptability. Federated aggregation and spatiotemporal alignment reduce data transmission from the edge layer to the cloud, improving aggregation efficiency, avoiding computational congestion on fog servers, and ensuring real-time fault response. A master fault analysis model and fault probability distribution heatmap quickly and accurately identify fault types and locations, and combined with hierarchical distribution, timely model updates improve the overall efficiency and accuracy of grid fault detection and response. Attached Figure Description

[0014] To more clearly illustrate the technical solution of this application, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart illustrating the edge computing security optimization method for smart grids according to the present invention.

[0016] Figure 2 This is a schematic diagram of the edge computing security optimization system for smart grids according to the present invention. Detailed Implementation

[0017] The various embodiments of this disclosure will be described more fully in the following detailed description of the specific steps of the edge computing security optimization method for smart grids. This disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of this disclosure to the specific embodiments disclosed herein, but rather this disclosure should be understood to cover all adjustments, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of this disclosure.

[0018] For example, power grid fault detection is a crucial link in ensuring the stable operation of the power system. Traditional power grid fault detection methods mainly rely on centralized fault analysis models, but these methods have many limitations in practical applications. First, there are resource limitations of edge-layer terminal monitoring devices. Edge-layer terminal monitoring devices are usually limited by hardware computing power and power supply capacity, making it difficult to support the real-time operation of complex models. Directly deploying the full deep learning model will lead to excessive power consumption or response delays; while lightweight models can reduce power consumption, their prediction accuracy is often insufficient. In addition, the power grid data collected by edge devices contains sensitive information about power grid operation. Traditional data reporting methods do not encrypt intermediate results such as gradient updates, posing a risk of privacy leakage. For example, unencrypted gradient changes may be used by attackers to reverse-engineer the power grid topology or fault modes, thereby threatening system security. Second, there are limitations of fixed training strategies. Traditional fault analysis models use fixed training strategies, which cannot adapt to the dynamic fluctuations of device resources. For example, insufficient device power or bandwidth may lead to training interruptions or model performance degradation. This static configuration cannot fully utilize the computing power of edge devices, nor can it perform effective model training under resource constraints. Third, there are issues with communication overhead and aggregation efficiency. In power grid anomaly detection scenarios, traditional federated learning frameworks require uploading raw data from terminal devices to a central node, resulting in high communication overhead and low aggregation efficiency. Especially when multiple terminals report anomalies simultaneously, the massive amount of unprocessed data may cause computational congestion on the fog layer server, delaying fault response and affecting the real-time performance and reliability of the power grid.

[0019] To address the aforementioned issues, this invention proposes a security optimization method and system for edge computing in smart grids. By employing a dynamic resource awareness mechanism, a multi-level privacy protection architecture, and lightweight model optimization technology, it solves the problems of insufficient dynamic resource adaptation, conflict between privacy protection and model accuracy, poor compatibility with heterogeneous devices, and excessive communication overhead in existing technologies, significantly improving the efficiency and security of fault detection in smart grids.

[0020] To address the aforementioned issues, this embodiment provides a security optimization method for edge computing in smart grids. By employing a dynamic resource awareness mechanism, a multi-level privacy protection architecture, and lightweight model optimization technology, it solves the problems of insufficient dynamic resource adaptation, conflict between privacy protection and model accuracy, poor compatibility of heterogeneous devices, and excessive communication overhead in existing technologies.

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see Figure 1 The diagram shows a flowchart of a smart grid edge computing security optimization method in a specific embodiment. The smart grid includes terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and a grid data center deployed at the grid cloud layer. The method includes the following steps: S1. The terminal monitoring equipment is equipped with an LSTM model. The LSTM model is used to make real-time predictions on the collected power grid data and to determine whether there are terminal anomalies based on the prediction results. When a terminal anomaly is found, the local model is triggered to perform incremental training, and the gradient changes during training are compressed, encrypted, and then reported. It should be noted that by deploying LSTM models at the edge layer, it is possible to predict power grid data in real time, quickly detect terminal anomalies, and provide preliminary judgment for fault detection; to achieve real-time monitoring of the power grid's operating status, promptly identify potential faults, and improve the reliability of power grid operation; to quickly locate abnormal situations by analyzing prediction results, providing data support for subsequent fault handling; to promptly start local incremental training when an anomaly is detected, update the model to adapt to new fault modes, and enhance the model's adaptability and accuracy; and to reduce data transmission volume and protect privacy by employing compression and encryption algorithms, while ensuring data security and integrity. S2. When the substation server responds to the terminal anomaly, it performs federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device, and reports the aggregated gradient changes to the power grid data center. It should be noted that timely response to anomalies reported by terminal monitoring devices is crucial to ensure timely fault handling; federated aggregation integrates gradient changes from multiple terminals, reducing data transmission volume and improving aggregation efficiency; and the aggregated gradient changes are reported to the cloud to provide data support for global model updates and optimize the data transmission process. S3. The power grid data center responds to the received aggregated parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level; It should be noted that the pre-trained fault analysis model can quickly and accurately identify fault types, providing data support for fault handling; by analyzing the gradient changes after aggregation through the global model, the fault type and location can be accurately identified, improving the accuracy of fault detection; based on the fault type and substation code, an appropriate model is selected for updating, and the distribution path is determined, optimizing the model update process; a hierarchical distribution mechanism is adopted to ensure the efficiency and accuracy of model updates, improving overall performance.

[0023] This embodiment enables local intelligent preprocessing of power grid data, reducing the communication load caused by uploading raw data; through gradient encryption and federated aggregation, it completes distributed model collaboration while protecting data privacy, meeting power grid security requirements; and layered distribution avoids using only one model for updates, reducing the computational pressure on edge devices and fog servers.

[0024] Furthermore, as a refinement and extension of the specific implementation of the above embodiments, in order to fully illustrate the specific implementation process in this embodiment, another edge computing security optimization method for smart grids is provided. The smart grid includes terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and grid data centers deployed at the grid cloud layer. The method includes the following steps: S1. The terminal monitoring equipment is equipped with an LSTM model. The LSTM model performs real-time predictions on the collected power grid data and uses the prediction results to determine if there are any terminal anomalies. If an anomaly is detected, incremental training of the local model is triggered, and the gradient changes during training are compressed, encrypted, and then reported. The specific steps of step S1 are as follows: S11. The terminal monitoring device initializes the LSTM model; the specific steps of step S11 are as follows: The S111.LSTM model terminal monitoring device registers hardware parameters with the substation server; the hardware parameters may include CPU performance, internal capacity, or power consumption. S112. The power grid data center receives the hardware parameters of the terminal monitoring equipment reported by the substation server; If the hardware parameters do not meet the computing power threshold, a lightweight LSTM model is sent to the corresponding terminal monitoring device. If the hardware parameters meet the computing power threshold, the full LSTM model is sent to the corresponding terminal monitoring device. It should be noted that full / lightweight LSTM models are distributed according to hardware parameters. Lightweight models are adapted for low-computing-power devices, while full models are used for high-performance terminals, enabling flexible model deployment. For example, taking the hardware parameters of the terminal monitoring device as CPU performance of 1.5GHz, memory of 512MB, and battery level of 80%, the power grid data center determines that the device does not meet the operating conditions of the full model based on the preset computing power threshold, such as CPU performance of 2GHz and memory of 1GB, and therefore issues a lightweight LSTM model. For example, a terminal monitoring device for smart meters (CPU 800MHz / 128MB memory) receives a lightweight LSTM model (0.8M parameters), while a terminal monitoring device for substation RTU equipment (CPU 2.4GHz / 2GB memory) acquires a full model (3.2M parameters). S12. The terminal monitoring equipment collects the power grid dataset and its own status in real time, and inputs the power grid data into the LSTM model to predict the power grid parameters for a set time period; S13. The terminal monitoring equipment analyzes the predicted values ​​of power grid parameters and determines whether the fluctuation range exceeds the set threshold. If so, locate the power grid fault based on the type of fluctuating power grid parameters and proceed to step S14; If not, return to step S12; S14. Start the local incremental training of the LSTM model, and report the gradient changes during the training process to the substation server after encryption and compression. It should be noted that the fault type is determined by the predicted value fluctuation threshold, and local incremental training is triggered to predict power grid parameters in real time, so as to realize the early warning and rapid location of faults and shorten the fault detection time. Model training is only triggered when an anomaly is detected to avoid the surge in device power consumption caused by training at all times and to extend the battery life of edge devices. The specific steps for starting local incremental training of the LSTM model in step S14 are as follows: Determine whether an emergency response needs to be triggered based on the type and magnitude of the fluctuating power grid parameters; If so, only the weights of the last layer are updated during the LSTM model training process; If not, only the last two layers are updated during LSTM model training; It should be noted that through tiered training, only the weights of the last layer are updated in emergency scenarios, while the last two layers are updated in normal scenarios. This reduces the amount of parameter updates in emergency scenarios, shortens the training time, and meets the requirements for real-time response. For example, if the voltage fluctuation is greater than 15% or the frequency fluctuation is greater than 1Hz, it is identified as an emergency response, and only the output layer is updated and trained for one iteration cycle. If the voltage fluctuation is less than or greater than 5% and less than 15%, it is identified as a normal response, and the last two layers are updated and trained for three iteration cycles. The specific steps for encrypting and compressing the gradient changes during the training process in step S14 are as follows: The terminal monitoring device determines the compression rate based on its own status; Encryption strategies are determined for different parameter parts in the gradient change, and the gradient changes of each parameter part are encrypted according to the determined encryption strategies. Then the results are merged to obtain the encrypted gradient change. For example, the gradient changes of the core parameters are encrypted using Paillier, while the gradient changes of the parameters of the LSTM hidden layer are encrypted using an adaptive noise function with differential noise injection, and the gradient changes of the auxiliary parameters are encrypted by performing XOR in groups. The encrypted gradient changes are compressed using a defined compression ratio. For example, if the device has sufficient power, a low compression ratio is used to retain as many complete gradient change features as possible, while if the device has insufficient power, a high compression ratio is used to meet the requirements of short transmission time and low power consumption. It should be noted that by encrypting parameters according to their importance and adjusting the compression ratio according to the device status, core parameters are encrypted with high strength to prevent privacy leaks, while non-sensitive parameters are encrypted with lightweight encryption to reduce computational overhead; when the power is low, the high compression ratio reduces transmission time and avoids device power outages. S2. When the substation server responds to a terminal anomaly, it performs federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device, and then reports the aggregated gradient changes to the power grid data center. The specific steps of step S2 are as follows: S21. The substation server receives encrypted and compressed gradient changes reported by each terminal monitoring device, responds to terminal anomalies, and locates power grid faults based on the terminal monitoring device to which the corresponding gradient change belongs. S22. The substation server determines whether the number of abnormal response terminals exceeds a set threshold within a set time period; If so, proceed to step S23; If not, return to step S21; S23. The substation server performs spatiotemporal alignment and anomaly processing on the encrypted and compressed gradient changes reported by each terminal monitoring device, and then aggregates them using a homomorphic summation method. The gradient change data reported by the terminal monitoring device is ΔW i The timestamp is t i The device location is p i For example, by using spatiotemporal alignment, data from different devices are aligned to the same time window and spatial location, and then homomorphic summation is used for aggregation:

[0025] S24. The substation server adds the substation code to the grid data center after aggregating the gradient changes; It should be noted that by introducing spatiotemporal alignment, the timestamp deviation and spatial topology difference of data from different terminals are eliminated, thereby improving the accuracy of the aggregation results. Homomorphic summation is used to directly aggregate gradients in the encrypted state, avoiding the security risks caused by data decryption. The batch processing process is triggered by judging the number of anomalies, preventing the fog server from preempting resources due to single terminal anomalies. S3. The power grid data center responds to the received aggregated parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level; the specific steps of step S3 are as follows: S31. Pre-build and train a fault analysis model in the power grid data center; the specific steps for training the fault analysis model in step S31 are as follows: Collect gradient change data of each terminal monitoring device within a set time period before and after historical fault events, label the fault type and occurrence time, and form a set of gradient samples;

[0026] in, For gradient tensors, For fault category labels, For timestamps; Using a three-dimensional convolutional neural network to process the spatiotemporal features of gradient samples; In the spatial dimension, gradient channels are arranged according to the device topology; In the time dimension, gradient change trends are extracted using a sliding window, for example, with a window size of T = 10 sampling periods; In terms of parameters, the gradient patterns of different network layers are distinguished; The fault analysis model is trained with the goal of minimizing fault classification loss and fault location loss.

[0027] in, L cls is the cross-entropy loss for fault classification. L loc represents the mean square error of fault location; It should be noted that by arranging gradient channels according to device topology in the spatial dimension, capturing trends through a sliding window in the time dimension, and distinguishing network layer modes in the parameter dimension, comprehensive capture of fault characteristics is achieved; by simultaneously minimizing classification loss and localization loss, the limitations of the model caused by single-index optimization are avoided. S32. The aggregated gradient changes of the power grid data are input into the fault analysis model to obtain a fault feature vector; the fault feature vector includes fault type, fault probability, and fault response substation code; S33. The power grid data center generates a heat map of fault probability distribution based on fault feature vectors and power grid GIS topology data; S34. The power grid data center selects the model that needs to be updated from the pre-set fault model library and determines the distribution path according to the substation code; the model that needs to be updated includes fog-specific components and edge general components; S35. The power grid data center will distribute the required updated model verification path to the corresponding power plant server; S36. The substation server uses a fog-specific component for local updates, while distributing the edge general component to each terminal monitoring device; It should be noted that 3D-CNN is used to capture the spatiotemporal features of gradient data to improve the accuracy of fault classification and location; heatmaps are used to visually display the fault probability distribution to help maintenance personnel quickly formulate repair plans; and local aggregation logic is optimized through fog layer-specific components, while basic detection capabilities are unified through edge general components to improve compatibility.

[0028] In one embodiment of the present invention, based on steps S34 and S35, a possible embodiment will be given below, and its specific implementation will be described in a non-limiting manner.

[0029] The following steps are also included between steps S34 and S35: The power grid data center determines whether the following emergency update conditions are met: The model that needs updating only includes edge-common components; The size of the model that needs to be updated is less than the set threshold; The fault type is emergency; If not, proceed to step S35; If so, the power grid data center directly sends the model that needs to be updated to all terminal monitoring devices under the substation server according to the distribution path; It should be noted that by setting emergency update conditions, the model can be directly sent to the terminal device. In emergency fault scenarios, the fog layer relay can be skipped and the terminal model can be updated directly, shortening the response time. It can also transmit only lightweight edge components, avoiding the impact of large model transmission on the power grid communication network.

[0030] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0031] like Figure 2 As shown, the following are embodiments of the edge computing security optimization system for smart grids provided in this disclosure. This system and the edge computing security optimization method for smart grids in the above embodiments belong to the same inventive concept. For details not described in detail in the embodiments of the edge computing security optimization system for smart grids, please refer to the embodiments of the edge computing security optimization method for smart grids described above.

[0032] Smart grids include terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and grid data centers deployed at the grid cloud layer. The terminal anomaly identification module uses an LSTM model to make real-time predictions on the collected power grid data and determines whether there are terminal anomalies based on the prediction results. When a terminal anomaly is found, it triggers incremental training of the local model and reports the gradient changes during training after compression and encryption. The fog layer anomaly identification module responds to terminal anomalies by performing federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device, and then sends the aggregated gradient changes to the terminal monitoring devices under the substation server, while simultaneously reporting to the power grid data center. The cloud global model update module responds to the received aggregate parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level.

[0033] This embodiment achieves decoupling of physical deployment and logical functions through the interactive collaboration of the terminal anomaly identification module, the fog anomaly identification module, and the cloud global model update module. Each module can be upgraded independently, reducing system iteration costs. The layered architecture limits the scope of anomaly impact and prevents a single node failure from spreading globally.

[0034] The edge computing security optimization method for smart grids provided in this application can be applied to electronic devices. Those skilled in the art will understand that the electronic device structure involved in the embodiments of this invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of this invention, the electronic device includes, but is not limited to, laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.

[0035] Electronic devices may include processors, external memory interfaces, internal memory, universal serial bus (USB) interfaces, charging management modules, power management modules, batteries, wireless communication modules, audio modules, speakers, microphones, sensor modules, buttons, cameras, displays, and SIM card interfaces, etc.

[0036] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device. In other embodiments of this application, the electronic device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0037] A processor may include one or more processing units, such as a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0038] The processor can serve as the nerve center and command center of an electronic device. The controller can generate operation control signals based on the instruction opcode and timing signals to control the fetching and execution of instructions.

[0039] The processor may also include memory for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can store instructions or data that the processor has just used or that are used repeatedly. If the processor needs to use the instruction or data again, it can retrieve it directly from this memory. This avoids repeated accesses, reduces processor latency, and thus improves system efficiency.

[0040] The aforementioned electronic devices implement the edge computing security optimization method for smart grids proposed in this application. The terminal monitoring devices are equipped with LSTM models, which perform real-time predictions on the collected power grid data. The prediction results are used to determine if any terminal anomalies exist. If an anomaly is detected, incremental training of the local model is triggered, and the gradient changes during training are compressed, encrypted, and reported. In response to the terminal anomaly, the substation server performs federated aggregation of the compressed and encrypted gradient changes reported by each terminal monitoring device, distributes the aggregated gradient changes to the terminal monitoring devices under the substation server, and simultaneously reports them to the power grid data center. The power grid data center responds to the received aggregation parameters through the main fault analysis module... This system identifies fault types, determines the models that need updating and the distribution paths, and executes a hierarchical distribution strategy based on the distribution paths and model levels. This achieves several advantages: a dynamic resource awareness mechanism enables edge devices to efficiently train models under resource constraints; differential privacy and homomorphic encryption ensure data privacy and security, including gradient protection; lightweight architecture search and multi-level privacy security improve model inference speed, accuracy, and adaptability; federated aggregation and spatiotemporal alignment reduce data transmission volume and improve aggregation efficiency to ensure real-time fault response; and a master fault analysis model and heatmap quickly locate faults, combined with hierarchical model updates, comprehensively improving the efficiency and accuracy of power grid fault detection and response.

[0041] The storage medium provided in this application stores a program product capable of implementing a security optimization method for edge computing in smart grids.

[0042] The edge computing security optimization method for smart grids includes: Terminal monitoring devices are equipped with LSTM models, which perform real-time predictions on collected grid data and determine the presence of terminal anomalies based on the prediction results. When an anomaly is detected, incremental training of the local model is triggered, and the gradient changes during training are compressed, encrypted, and reported. In response to terminal anomalies, the substation server performs federated aggregation of the compressed and encrypted gradient changes reported by each terminal monitoring device, distributes the aggregated gradient changes to the terminal monitoring devices under the substation server, and simultaneously reports to the grid data center. The grid data center responds to the received aggregation parameters, identifies the fault type using a master fault analysis model, determines the model to be updated and the distribution path, and performs hierarchical distribution based on the distribution path and model level.

[0043] In some possible implementations, the edge computing security optimization method for smart grids of this disclosure can be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0044] The storage medium disclosed herein may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0045] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security optimization method for edge computing in smart grids, characterized in that, The smart grid includes terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and grid data centers deployed at the grid cloud layer. The method includes the following steps: S1. The terminal monitoring equipment is equipped with an LSTM model. The LSTM model is used to make real-time predictions on the collected power grid data and to determine whether there are terminal anomalies based on the prediction results. When a terminal anomaly is found, the local model is triggered to perform incremental training, and the gradient changes during training are compressed, encrypted, and then reported. The specific steps of step S1 are as follows: S11. Initialize the LSTM model for the terminal monitoring device; The specific steps of step S11 are as follows: The S111.LSTM model terminal monitoring device registers hardware parameters with the substation server; S112. The power grid data center receives the hardware parameters of the terminal monitoring equipment reported by the substation server; If the hardware parameters do not meet the computing power threshold, a lightweight LSTM model is sent to the corresponding terminal monitoring device. If the hardware parameters meet the computing power threshold, the full LSTM model is sent to the corresponding terminal monitoring device. The specific steps for starting local incremental training of the LSTM model in step S14 are as follows: Determine whether an emergency response needs to be triggered based on the type and magnitude of the fluctuating power grid parameters; If so, only the weights of the last layer are updated during the LSTM model training process; If not, only the last two layers are updated during LSTM model training; The specific steps for encrypting and compressing the gradient changes during the training process in step S14 are as follows: The terminal monitoring device determines the compression rate based on its own status; Encryption strategies are determined for different parameter parts in the gradient change, and the gradient changes of each parameter part are encrypted according to the determined encryption strategies. Then the results are merged to obtain the encrypted gradient change. The encrypted gradient changes are compressed using a defined compression ratio. S12. The terminal monitoring equipment collects the power grid dataset and its own status in real time, and inputs the power grid data into the LSTM model to predict the power grid parameters for a set time period; S13. The terminal monitoring equipment analyzes the predicted values ​​of power grid parameters and determines whether the fluctuation range exceeds the set threshold. If so, locate the power grid fault based on the type of fluctuating power grid parameters and proceed to step S14; If not, return to step S12; S14. Start the local incremental training of the LSTM model, and encrypt and compress the gradient changes during the training process before reporting them to the substation server. S2. When the substation server responds to the terminal anomaly, it performs federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device, and reports the aggregated gradient changes to the power grid data center. S3. The power grid data center responds to the received aggregated parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level; The specific steps of step S3 are as follows: S31. Pre-build and train fault analysis models in the power grid data center; S32. The aggregated gradient changes of the power grid data are input into the fault analysis model to obtain a fault feature vector; the fault feature vector includes fault type, fault probability, and fault response substation code; S33. The power grid data center generates a heat map of fault probability distribution based on fault feature vectors and power grid GIS topology data; S34. The power grid data center selects the model that needs to be updated from the pre-set fault model library and determines the distribution path according to the substation code; the model that needs to be updated includes fog-specific components and edge general components; S35. The power grid data center will distribute the required updated model verification path to the corresponding power plant server; S36. The substation server uses fog-specific components for local updates, while distributing edge-general components to various terminal monitoring devices.

2. The edge computing security optimization method for smart grids according to claim 1, characterized in that, The specific steps of step S2 are as follows: S21. The substation server receives encrypted and compressed gradient changes reported by each terminal monitoring device, responds to terminal anomalies, and locates power grid faults based on the terminal monitoring device to which the corresponding gradient change belongs. S22. The substation server determines whether the number of abnormal response terminals exceeds a set threshold within a set time period; If so, proceed to step S23; If not, return to step S21; S23. The substation server performs spatiotemporal alignment and anomaly handling on the encrypted and compressed gradient changes reported by each terminal monitoring device, and then aggregates them using a homomorphic summation method. S24. The substation server adds the substation code to the grid data center after aggregating the gradient changes.

3. The edge computing security optimization method for smart grids according to claim 2, characterized in that, The specific steps for training the fault analysis model in step S31 are as follows: Collect gradient change data of each terminal monitoring device within a set time period before and after historical fault events, label the fault type and occurrence time, and form a set of gradient samples; Using a 3D convolutional neural network to process the spatiotemporal features of gradient samples; The fault analysis model is trained with the goal of minimizing fault classification loss and fault location loss.

4. The edge computing security optimization method for smart grids according to claim 2, characterized in that, The following steps are also included between steps S34 and S35: The power grid data center determines whether the following emergency update conditions are met: The model that needs updating only includes edge-common components; The size of the model that needs to be updated is less than the set threshold; The fault type is emergency; If not, proceed to step S35; If so, the power grid data center will directly send the model that needs to be updated to all terminal monitoring devices under the substation server according to the distribution path.

5. An edge computing security optimization system for a smart grid, employing the method described in claims 1-4, characterized in that, Smart grids include terminal monitoring equipment deployed at the grid edge layer, substation servers deployed at the grid fog computing layer, and grid data centers deployed at the grid cloud layer. The terminal anomaly identification module uses an LSTM model to make real-time predictions on the collected power grid data and determines whether there are terminal anomalies based on the prediction results. When a terminal anomaly is found, it triggers incremental training of the local model and reports the gradient changes during training after compression and encryption. The fog layer anomaly identification module responds to terminal anomalies by performing federated aggregation on the compressed and encrypted gradient changes reported by each terminal monitoring device and then reporting the aggregated gradient changes to the power grid data center. The cloud global model update module responds to the received aggregate parameters, identifies the fault type through the main fault analysis model, determines the model that needs to be updated and the distribution path, and performs hierarchical distribution according to the distribution path and model level.

6. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the edge computing security optimization method for a smart grid as described in any one of claims 1 to 4.

7. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the edge computing security optimization method for smart grids as described in any one of claims 1 to 4.

Images