Intelligent maintenance power supply box remote monitoring method and system

Abstract

The present application belongs to the technical field of power supply box power supply, and discloses an intelligent maintenance power supply box remote monitoring method and system; the method comprises the following steps: collecting equipment operation data of N power supply boxes during power supply in a unit time; extracting features from the equipment operation data to obtain equipment operation feature data corresponding to the N power supply boxes; performing abnormal diagnosis on the power supply boxes based on the equipment operation feature data of the N power supply boxes to obtain an operation abnormal message queue; collecting equipment network data of the N power supply boxes during power supply in a unit time; extracting features from the equipment network data to obtain equipment network feature data corresponding to the N power supply boxes; performing abnormal diagnosis on the power supply boxes based on the equipment network feature data of the N power supply boxes to obtain a network abnormal message queue; performing comprehensive diagnosis on the power supply boxes based on the operation abnormal message queue and the network abnormal message queue to identify the power supply boxes subjected to network attacks, and generating an early warning instruction by the power supply system to maintain power supply stability.

Description

Technical Field

[0001] The present invention relates to the technical field of power supply technology for power supply boxes, and more particularly to a remote monitoring method and system for intelligent maintenance power supply boxes. Background Art

[0002] Smart maintenance power boxes are essential components of power systems. However, with the widespread adoption of IoT technology, these boxes face increasingly severe cybersecurity threats. Because they exchange data with external systems over the internet, their openness makes them vulnerable to cyber attackers. Once a power box is compromised, attackers can tamper with its control commands, causing abnormal operation and even power failures, impacting the stability of the entire power system and causing inconvenience and losses to production and daily life.

[0003] Currently, existing remote monitoring systems for intelligent maintenance power boxes have numerous deficiencies in terms of network security. Existing technologies primarily focus on monitoring power box operating parameters, but lack the ability to identify and prevent cyberattacks. These technologies fail to fully consider anomalies caused by cyberattacks, making it difficult to accurately identify device anomalies caused by cyberattacks. This can lead to false alarms or missed alarms, impacting the normal operation and maintenance of intelligent maintenance power boxes.

[0004] Therefore, how to achieve effective security monitoring of intelligent maintenance power boxes, quickly distinguish between equipment failures and anomalies caused by network attacks, and provide timely response strategies has become an urgent problem to be solved. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a remote monitoring method for an intelligent maintenance power box, comprising:

[0006] Collect equipment operation data of N power boxes during power supply per unit time;

[0007] Extract features from the equipment operation data to obtain the equipment operation feature data corresponding to N power boxes;

[0008] Based on the equipment operation characteristic data of N power boxes, abnormal diagnosis of the power boxes is performed to obtain an operation abnormality message queue;

[0009] Collect device network data of N power boxes during power supply per unit time;

[0010] Extract features from the device network data to obtain device network feature data corresponding to N power boxes;

[0011] Based on the network characteristic data of N power boxes, the power boxes are diagnosed for abnormality and a network abnormality message queue is obtained;

[0012] Based on the operation abnormality message queue and network abnormality message queue, the power box is comprehensively diagnosed to identify the power box that has been attacked by the network. The power supply system generates early warning instructions to maintain stable power supply.

[0013] Furthermore, a method for performing comprehensive diagnosis on the power box based on the operation abnormality message queue and the network abnormality message queue to identify the power box that has been attacked by the network includes:

[0014] Mark H power boxes that exist in both the operation abnormality message queue and the network abnormality message queue as the first power boxes to be processed, where H is an integer greater than 0, construct the device operation characteristic data and device network characteristic data corresponding to each of the H first power boxes to be processed into the first data to be processed, and construct the H first data to be processed into the first data set to be processed;

[0015] Identifying a power box that has been attacked by a network attack based on the first set of data to be processed;

[0016] Mark G different power boxes that exist in the network abnormality message queue but not in the operation abnormality message queue as second power boxes to be processed, where G is an integer greater than 0, construct the G second power boxes to be processed and their corresponding device network feature data into second data to be processed, and construct the G second data to be processed into a second data set to be processed;

[0017] A power box that has been attacked by a network is identified based on the second set of data to be processed.

[0018] Furthermore, the method for identifying a power box that has been attacked by a network attack based on the first set of data to be processed includes:

[0019] S51: Preset the initial value of h to 1, and the value range of h is 1 to H;

[0020] S52: Obtain the hth first data to be processed from the first set of data to be processed. If the timestamp of the first addition of the power box to the operation abnormality message queue in the hth first data to be processed is earlier than the timestamp of the first addition to the network abnormality message queue, mark the corresponding power box as a power box fault.

[0021] If the timestamp of the first power box to be processed in the hth first data being added to the operation exception message queue for the first time is later than the timestamp of the first addition to the network exception message queue, and the number of network exception messages of the power box in the network exception message queue is greater than the preset network exception message number threshold, then the corresponding power box is marked as a power box that has suffered a network attack;

[0022] S53: Let h=h+1. If h is less than or equal to H, continue to execute S52. If h is greater than H, end the current process.

[0023] Furthermore, the method for identifying a power box that has been attacked by a network based on the second set of data to be processed includes:

[0024] S61: Preset the initial value of g to 1, and the value range of g is 1 to G;

[0025] S62: Obtain the g-th second data to be processed from the second set of data to be processed, and if the number of network abnormality messages of the power box in the network abnormality message queue in the g-th second data to be processed is greater than a preset network abnormality message number threshold, mark the corresponding power box as a power box that has suffered a network attack;

[0026] S63: Let g=g+1. If g is less than or equal to G, continue to execute S62. If g is greater than G, end the current process.

[0027] Furthermore, the method for obtaining the operation abnormality message queue includes:

[0028] Input the equipment operation characteristic data of N power boxes into the equipment operation diagnosis model respectively to obtain the operation abnormality diagnosis scores of the N power boxes;

[0029] The power boxes whose operation abnormality diagnosis scores are greater than the preset operation abnormality diagnosis score threshold, the equipment operation characteristic data corresponding to the power boxes and the real-time timestamp are constructed into operation abnormality messages, and the operation abnormality messages are added to the operation abnormality message queue in real time. If the operation abnormality message queue contains the same power box and the power box continues to be in an abnormal state, the power box will continue to be added to the operation abnormality message queue.

[0030] Furthermore, the equipment operation data includes a power supply box voltage signal, a power supply box current signal, a power supply box power factor, a power supply box active power and a power supply box reactive power;

[0031] The method for obtaining the equipment operation characteristic data corresponding to N power boxes includes:

[0032] Divide the unit time into T time points, where T is an integer greater than 0;

[0033] Analyze and process the voltage signals and current signals of N power boxes at T time points according to a preset method to obtain the voltage harmonic distortion rate and current harmonic distortion rate corresponding to the N power boxes;

[0034] According to the preset method, the power factor, active power and reactive power of N power boxes at T time points are analyzed and processed to obtain the power factor fluctuation index, the phase lag angle set of reactive power and power factor, and the consistency index of active power and power factor corresponding to the N power boxes;

[0035] The voltage harmonic distortion rate, current harmonic distortion rate, power factor fluctuation index, phase lag angle set of reactive power and power factor, and consistency index of active power and power factor corresponding to N power boxes are constructed into the equipment operation characteristic data corresponding to the N power boxes.

[0036] Furthermore, the method for obtaining the network abnormal message queue includes:

[0037] Input the device network characteristic data of N power boxes into the device network diagnosis model respectively to obtain the network anomaly diagnosis scores of the N power boxes;

[0038] The power boxes whose network anomaly diagnosis scores are greater than the preset network anomaly diagnosis score threshold, the device network feature data and real-time timestamp corresponding to the power boxes are constructed into network anomaly messages, and the network anomaly messages are added to the network anomaly message queue. If the network anomaly message queue contains the same power box and the power box continues to be in an abnormal state, the power box will continue to be added to the network anomaly message queue.

[0039] Furthermore, the device network data includes the power box heartbeat signal, the connection and disconnection log between the power box and the remote server, the power box network traffic, the power box network delay and the power box network jitter;

[0040] The method for obtaining device network characteristic data corresponding to N power boxes includes:

[0041] According to a preset method, feature extraction is performed on the heartbeat signals of N power boxes per unit time to obtain the heartbeat signal loss rate and heartbeat signal delay rate corresponding to the N power boxes;

[0042] Obtain the connection and disconnection logs between the power box and the remote server from the device network data. Count the interruption durations between the power box and the remote server for each of the N power boxes per unit time. Divide the interruption duration by the unit time to calculate the server interruption probability for each of the N power boxes.

[0043] According to the preset method, the network traffic, network delay and network jitter of N power boxes at T time points are extracted to obtain the discrete degree values ​​of network delay and network jitter corresponding to the N power boxes;

[0044] The heartbeat signal loss rate, heartbeat signal delay rate, server interruption probability, network delay dispersion value and network jitter dispersion value corresponding to the N power boxes are constructed into the device network feature data corresponding to the N power boxes.

[0045] Furthermore, the training method of the device running the diagnostic model includes:

[0046] Pre-constructing a device operation diagnostic dataset, wherein the device operation diagnostic dataset includes Y groups of device operation diagnostic data and operation abnormality diagnostic scores corresponding to the Y groups of device operation diagnostic data, where Y is a positive integer greater than 0, and the device operation diagnostic data includes device operation feature data; dividing the device operation diagnostic dataset into a device operation diagnostic data training set and a device operation diagnostic data validation set, wherein the device operation diagnostic data training set is used for parameter learning of the device operation diagnostic model, and the device operation diagnostic data validation set is used for real-time evaluation of the generalization ability of the device operation diagnostic model;

[0047] During the training process of the equipment operation diagnosis model, a deep neural network structure based on a multi-layer perceptron is used to convert the equipment operation diagnosis data into feature vectors as input. Nonlinear features in the data are extracted through multiple hidden layers. Finally, a softmax activation function is used in the output layer to generate a probability distribution of the operation anomaly diagnosis score. The operation anomaly diagnosis score corresponding to the maximum probability is output as the final prediction result. The training process aims to minimize the cross-entropy loss function. At the same time, an early stopping strategy is introduced to monitor the performance of the equipment operation diagnosis data validation set. When the prediction accuracy on the equipment operation diagnosis data validation set reaches the preset threshold, the equipment operation diagnosis model is determined to have converged and training stops immediately.

[0048] The device network diagnosis model is obtained by using the training method of the device operation diagnosis model.

[0049] The intelligent maintenance power box remote monitoring system implements the intelligent maintenance power box remote monitoring method, including:

[0050] The first acquisition module is used to collect equipment operation data of N power boxes during power supply per unit time;

[0051] The first processing module is used to extract features from the equipment operation data to obtain equipment operation feature data corresponding to N power boxes;

[0052] The first diagnostic module performs abnormal diagnosis on the power supply box based on the device operation characteristic data of N power supply boxes, and obtains an operation abnormality message queue;

[0053] The second acquisition module is used to collect device network data of N power boxes during power supply per unit time;

[0054] The second processing module is used to extract features from the device network data to obtain device network feature data corresponding to N power boxes;

[0055] The second diagnosis module diagnoses abnormalities of the power boxes based on the device network characteristic data of the N power boxes and obtains a network abnormality message queue;

[0056] The comprehensive diagnosis module performs comprehensive diagnosis on the power box based on the operation abnormality message queue and the network abnormality message queue, identifies the power box that has been attacked by the network, and generates early warning instructions for the power supply system to maintain stable power supply.

[0057] Compared with the existing technology, the technical effects and advantages of the intelligent maintenance power box remote monitoring method and system of the present invention are as follows:

[0058] By comprehensively collecting the power box's equipment operation data and equipment network data, feature extraction is performed to obtain equipment operation feature data and equipment network feature data. This dual feature extraction method can not only identify anomalies in the equipment's own operating status, but also capture anomalies in network behavior, providing comprehensive data support for subsequent comprehensive diagnosis. Based on the equipment operation feature data and equipment network feature data, in-depth anomaly diagnosis is performed to generate an operation anomaly message queue and a network anomaly message queue. The operation anomaly message queue and the network anomaly message queue are integrated and analyzed to effectively distinguish between abnormal states caused by power box failures and external network attacks, determine the root cause of the power box's abnormal state, and identify power boxes that have been attacked by the network. This avoids incorrect maintenance measures caused by misjudgment, improves the accuracy of power box anomaly diagnosis, and solves problems that cannot be solved by existing technologies.

[0059] Through multi-level data collection, multi-dimensional feature extraction, diagnostic analysis of deep learning models, and abnormality identification of power boxes, the present invention significantly improves the operation monitoring, safety protection, and abnormality handling capabilities of intelligent maintenance power boxes. It has significant practical value and broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 Schematic diagram of the remote monitoring system for intelligent maintenance power boxes according to embodiment 1 of the present invention;

[0061] Figure 2 This is a flow chart of a remote monitoring method for an intelligent maintenance power box according to embodiment 3 of the present invention;

[0062] Figure 3 This is a schematic diagram of a remote monitoring system for an intelligent maintenance power box according to embodiment 2 of the present invention;

[0063] Figure 4 A flow chart of a method for identifying a power box that has been attacked by a cyber attack;

[0064] Figure 5 A flow chart of a method for identifying a power box that has been attacked by a network based on a first set of data to be processed;

[0065] Figure 6 This is a flow chart of a method for identifying a power box that has been attacked by a network based on a second set of data to be processed. DETAILED DESCRIPTION

[0066] The technical solutions in the embodiments of the present invention will be described in detail, clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. It should be noted that the specific embodiments described below are only used to better illustrate and describe the technical solutions of the present invention, and are intended to enable those skilled in the art to better understand and implement the present invention, and should not be construed as limiting the scope of protection of the present invention. Without departing from the spirit and essence of the present invention, those skilled in the art may modify, adjust or make equivalent replacements based on the contents disclosed in the present invention, and these should all be regarded as the scope of protection of the present invention.

[0067] Example 1:

[0068] See also Figure 1 As shown, the intelligent maintenance power box remote monitoring system described in this embodiment includes a first acquisition module, a first processing module, a first diagnostic module, a second acquisition module, a second processing module, a second diagnostic module and a comprehensive diagnostic module. Each module realizes data transmission through wired and / or wireless connections.

[0069] The first acquisition module is configured to collect device operation data from N power supply boxes during power supply per unit time. The device operation data includes power supply box voltage signals, power supply box current signals, power supply box power factor, power supply box active power, and power supply box reactive power. The power supply box voltage signals and power supply box current signals are acquired via corresponding sensors, while the power supply box power factor, power supply box active power, and power supply box reactive power are acquired via a smart energy meter.

[0070] The first processing module is used to extract features from the equipment operation data to obtain equipment operation feature data corresponding to N power boxes; the equipment operation feature data includes voltage harmonic distortion rate, current harmonic distortion rate, power factor fluctuation index, phase lag angle set of reactive power and power factor, and consistency index of active power and power factor.

[0071] The method for obtaining the equipment operation characteristic data corresponding to N power boxes includes:

[0072] Divide the unit time into T time points, where T is an integer greater than 0;

[0073] Analyze and process the voltage signals and current signals of N power boxes at T time points according to a preset method to obtain the voltage harmonic distortion rate and current harmonic distortion rate corresponding to the N power boxes;

[0074] According to the preset method, the power factor, active power and reactive power of N power boxes at T time points are analyzed and processed to obtain the power factor fluctuation index, the phase lag angle set of reactive power and power factor, and the consistency index of active power and power factor corresponding to the N power boxes;

[0075] The voltage harmonic distortion rate, current harmonic distortion rate, power factor fluctuation index, phase lag angle set of reactive power and power factor, and consistency index of active power and power factor corresponding to N power boxes are constructed into the equipment operation characteristic data corresponding to the N power boxes.

[0076] The method for obtaining the voltage harmonic distortion rate and the current harmonic distortion rate corresponding to the N power supply boxes includes:

[0077] S10: Preset the initial value of n to 1, and the value range of n is 1 to N; preset the initial value of t to 1, and the value range of t is 1 to T;

[0078] S11: Obtain the power box voltage signal of the nth power box at the tth time point, and add the power box voltage signal at the tth time point to the power box voltage signal set corresponding to the nth power box; obtain the power box current signal of the nth power box at the tth time point, and add the power box current signal at the tth time point to the power box current signal set corresponding to the nth power box;

[0079] S12: Let t = t + 1. If t is less than or equal to T, continue to execute S11. If t is greater than T, execute S13.

[0080] S13: constructing the power box voltage signal set corresponding to the nth power box into a discrete voltage signal equation corresponding to the nth power box; constructing the power box current signal set corresponding to the nth power box into a discrete current signal equation corresponding to the nth power box; calculating the voltage harmonic distortion rate of the nth power box based on the discrete voltage signal equation of the nth power box, and calculating the current harmonic distortion rate of the nth power box based on the discrete current signal equation of the nth power box;

[0081] S14: Set n=n+1. If n is less than or equal to N, set t=1 and execute S11. If n is greater than N, end the current process.

[0082] It should be noted that the T time points represent a uniformly defined global sampling time series, applicable to each of the N power supply boxes. This means that the operating data for each power supply box is collected using a unified time base, ensuring complete alignment of the time series. Extracting the voltage and current harmonic distortion rates for the N power supply boxes also relies on the operating data from this unified time series.

[0083] The method for obtaining the discrete voltage signal equation corresponding to the nth power supply box includes:

[0084] ;

[0085] in, is the discrete voltage signal equation of the nth power box, is the fundamental voltage amplitude, is a constant, is the voltage fundamental frequency, is the sampling rate, is the fundamental voltage phase angle, is the highest harmonic order, is the dth harmonic voltage amplitude, is the voltage phase angle of the dth harmonic.

[0086] The method for obtaining the discrete current signal equation corresponding to the nth power supply box includes:

[0087] ;

[0088] in, is the discrete current signal equation of the nth power box, is the fundamental current amplitude, is the fundamental frequency of the current, is the fundamental current phase angle, is the dth harmonic current amplitude, is the current phase angle of the dth harmonic.

[0089] The method for obtaining the voltage harmonic distortion rate of the nth power supply box includes:

[0090] ;

[0091] in, is the voltage harmonic distortion rate of the nth power box, is the harmonic amplitude corresponding to the first harmonic of the discrete voltage signal equation, is the harmonic amplitude corresponding to the dth harmonic of the discrete voltage signal equation. The higher the value, the greater the proportion of non-fundamental components, the more serious the voltage waveform distortion, and the worse the power quality.

[0092] The method for obtaining the current harmonic distortion rate of the nth power supply box includes:

[0093] ;

[0094] in, is the current harmonic distortion rate of the nth power box, is the harmonic amplitude corresponding to the first harmonic of the discrete current signal equation, is the harmonic amplitude corresponding to the dth harmonic of the discrete current signal equation. The higher the value, the greater the proportion of non-fundamental components, the more serious the current waveform distortion, and the worse the power quality.

[0095] Methods for obtaining the power factor fluctuation index corresponding to N power boxes include:

[0096] S21: Preset the initial value of n to 1, and the value range of n is 1 to N;

[0097] S22: Constructing the power factors of the nth power box at T time points into a first power factor set of the nth power box; and calculating the power factor fluctuation index corresponding to the nth power box based on the first power factor set of the nth power box;

[0098] S23: Let n=n+1. If n is less than or equal to N, execute S22. If n is greater than N, end the current process.

[0099] Methods for obtaining the power factor fluctuation index corresponding to the nth power supply box include:

[0100] ;

[0101] in, is the power factor fluctuation index corresponding to the nth power box, is the power factor corresponding to the nth power box at the tth time point.

[0102] The method for obtaining the phase lag angle set of reactive power and power factor corresponding to N power boxes includes:

[0103] S31: Preset the initial value of n to 1, and the value range of n is 1 to N; preset the initial value of t to 1, and the value range of t is 1 to T;

[0104] S32: Obtain the reactive power and power factor of the nth power box at the tth time point, and calculate the phase lag angle of the reactive power and power factor of the nth power box at the tth time point based on the reactive power and power factor of the power box; add the phase lag angle of the reactive power and power factor to the phase lag angle set of the reactive power and power factor corresponding to the nth power box;

[0105] S33: Let t=t+1. If t is less than or equal to T, continue to execute S32. If t is greater than T, let n=n+1. If n is less than or equal to N, let t=1 and execute S32. If n is greater than N, end the current process.

[0106] The method for obtaining the phase lag angle between the reactive power and the power factor of the nth power box at the tth time point includes:

[0107] ;

[0108] in, is the phase lag angle between the reactive power and power factor of the nth power box at the tth time point, is the reactive power of the nth power box at the tth time point, is the power factor of the nth power box at the tth time point, is the inverse tangent function.

[0109] The method for obtaining the consistency index of active power and power factor corresponding to N power boxes includes:

[0110] S41: Preset the initial value of n to 1, and the value range of n is 1 to N;

[0111] S42: Constructing the power factors of the nth power box at T time points into a second power factor set of the nth power box; constructing the active powers of the nth power box at T time points into an active power set of the nth power box;

[0112] S43: Calculating a consistency index between the active power and the power factor of the nth power box based on the active power set and the second power factor set of the nth power box;

[0113] S44: Let n=n+1. If n is less than or equal to N, execute S42 to S43; if n is greater than N, end the current process.

[0114] The method for obtaining the consistency index of the active power and power factor of the nth power box includes:

[0115] ;

[0116] ;

[0117] ;

[0118] in, is the consistency index of the active power and power factor of the nth power box, is the active power of the nth power box at the tth time point, is the power factor of the nth power box at the tth time point, is the standard deviation of the active power per unit time of the nth power box, reflecting the degree of fluctuation of the active power. is the standard deviation of the power factor per unit time for the nth power box, reflecting the degree of power factor fluctuation. The consistency index of active power and power factor uses the standardized form of covariance to measure the degree of synchronous change between active power and power factor, that is, the coordinated change trend between the time series difference of active power and the time series difference of power factor.

[0119] It should be noted that the voltage harmonic distortion rate and the current harmonic distortion rate are closely related to nonlinear load failures inside the power box (such as capacitor aging and inductor saturation), poor component contact (such as switch contact oxidation), and rectifier circuit failure. However, at the same time, attackers injecting high-frequency interference signals (such as electromagnetic interference attacks) or maliciously tampering with control parameters can also cause distortion of these two indicators. The power factor fluctuation index is not only associated with the failure of the power box's reactive compensation device (such as capacitor bank breakdown) and sudden load changes (such as abnormal motor start and stop), but also when attackers use malicious commands to force the load state to switch or falsify power factor data, this indicator will also undergo abnormal changes.

[0120] The phase lag angle set of reactive power and power factor usually reflects faults such as insufficient capacitor compensation capacity in the power box or magnetic saturation of the transformer. However, when an attacker tampers with the reactive compensation controller or exploits protocol vulnerabilities to modify phase parameters, this set will also become abnormally distorted. The consistency index of active power and power factor is related to faults such as sensor calibration failure, decreased power transmission efficiency, and mismatch between dynamic load and compensation response. At the same time, data tampering attacks can also cause this index to be abnormal.

[0121] In summary, relying solely on the operating characteristic data of the power supply box equipment makes it difficult to fully distinguish between anomalies caused by equipment failures themselves and those caused by external network attacks. There is a risk of misdiagnosis, which can lead to misjudgment of the abnormal status of the power supply box and inappropriate subsequent maintenance measures, ultimately having an adverse impact on the stable power supply and overall safe operation of the power system.

[0122] The first diagnosis module performs abnormal diagnosis on the power supply box based on the equipment operation characteristic data of N power supply boxes to obtain an operation abnormality message queue.

[0123] The method for obtaining the abnormal operation message queue includes:

[0124] Input the equipment operation characteristic data of N power boxes into the equipment operation diagnosis model respectively to obtain the operation abnormality diagnosis scores of the N power boxes;

[0125] The power boxes whose operation abnormality diagnosis scores are greater than the preset operation abnormality diagnosis score threshold, the equipment operation characteristic data corresponding to the power boxes and the real-time timestamp are constructed into operation abnormality messages, and the operation abnormality messages are added to the operation abnormality message queue in real time. If the operation abnormality message queue contains the same power box and the power box continues to be in an abnormal state, the power box will continue to be added to the operation abnormality message queue.

[0126] The training method of the device running the diagnostic model includes:

[0127] Pre-constructing a device operation diagnostic dataset, wherein the device operation diagnostic dataset includes Y groups of device operation diagnostic data and operation abnormality diagnostic scores corresponding to the Y groups of device operation diagnostic data, where Y is a positive integer greater than 0, and the device operation diagnostic data includes device operation feature data; dividing the device operation diagnostic dataset into a device operation diagnostic data training set and a device operation diagnostic data validation set, wherein the device operation diagnostic data training set is used for parameter learning of the device operation diagnostic model, and the device operation diagnostic data validation set is used for real-time evaluation of the generalization ability of the device operation diagnostic model;

[0128] During the training process of the equipment operation diagnosis model, a deep neural network structure based on multi-layer perceptron is used to convert the equipment operation diagnosis data into feature vectors as input, and the nonlinear features in the data are extracted through multiple hidden layers. Finally, the softmax activation function is used in the output layer to generate the probability distribution of the operation abnormality diagnosis score, and the operation abnormality diagnosis score corresponding to the maximum probability is output as the final prediction result; the training process aims to minimize the cross-entropy loss function, and at the same time introduces an early stopping strategy to monitor the performance of the equipment operation diagnosis data verification set. When the prediction accuracy on the equipment operation diagnosis data verification set reaches the preset threshold, the equipment operation diagnosis model is judged to have converged and the training stops immediately.

[0129] The second acquisition module is used to collect device network data of N power boxes during power supply per unit time; the device network data includes the power box heartbeat signal, the connection and disconnection log between the power box and the remote server, the power box network traffic, the power box network delay and the power box network jitter.

[0130] The power box heartbeat signal is generated by deploying a heartbeat module on the power box device, sending a heartbeat packet to a preset remote server at a preset time interval (for example, every second or every 5 seconds). After receiving the heartbeat packet, the remote server stores the data in a log system or database, and records the timestamp and status information of each heartbeat. The connection and disconnection logs between the power box and the remote server are obtained from the device operation log; the power box network traffic, power box network delay, and power box network jitter are obtained through network monitoring equipment. The power box network traffic refers to the total amount of data uploaded or downloaded through the network interface per unit time during the process of the power box communicating with the remote server through the network interface. Abnormal changes in the power box network traffic (such as a sudden increase or decrease in traffic or a long period of no communication) can serve as an important basis for identifying network anomalies.

[0131] It should be noted that the power box heartbeat signal refers to a lightweight message sent periodically by the power box device to check whether the connection between the server and the client is normal, ensure status synchronization between cluster nodes, and monitor the operating status of the power box device.

[0132] The second processing module is used to extract features from the device network data to obtain device network feature data corresponding to N power boxes; the device network feature data includes heartbeat signal loss rate, heartbeat signal delay rate, server interruption probability, network delay discrete degree value and network jitter discrete degree value.

[0133] The method for obtaining device network characteristic data corresponding to N power boxes includes:

[0134] According to a preset method, feature extraction is performed on the heartbeat signals of N power boxes per unit time to obtain the heartbeat signal loss rate and heartbeat signal delay rate corresponding to the N power boxes;

[0135] Obtain the connection and disconnection logs between the power box and the remote server from the device network data. Count the interruption durations between the power box and the remote server for each of the N power boxes per unit time. Divide the interruption duration by the unit time to calculate the server interruption probability for each of the N power boxes.

[0136] According to the preset method, the network traffic, network delay and network jitter of N power boxes at T time points are extracted to obtain the discrete degree values ​​of network delay and network jitter corresponding to the N power boxes;

[0137] The heartbeat signal loss rate, heartbeat signal delay rate, server interruption probability, network delay dispersion value and network jitter dispersion value corresponding to the N power boxes are constructed into the device network feature data corresponding to the N power boxes.

[0138] Methods for obtaining the heartbeat signal loss rate and heartbeat signal delay rate corresponding to N power boxes include:

[0139] Obtain the heartbeat signal transmission time interval of each of the N power boxes, divide the unit time length by the transmission time interval, and calculate the expected number of transmissions of the N power boxes per unit time; obtain the actual number of heartbeat signals received by each of the N power boxes from the remote server; subtract the actual number of heartbeat signals received from the expected number of transmissions to obtain the number of heartbeat signal losses, and divide the number of heartbeat signal losses by the expected number of transmissions to calculate the heartbeat signal loss rate of each of the N power boxes;

[0140] A heartbeat signal delay threshold is preset, and the sending time and receiving time of the heartbeat signals of the power boxes corresponding to N power boxes are obtained from the remote server. The transmission time of the heartbeat signal of each power box is calculated by subtracting the sending time from the receiving time. The heartbeat signal of the power box with a transmission time greater than or equal to the heartbeat signal delay threshold is marked as a delayed heartbeat signal. The number of delayed heartbeat signals corresponding to the N power boxes is counted, and the heartbeat signal delay rate of each of the N power boxes is calculated by dividing the number of delayed heartbeat signals by the actual number of received heartbeat signals.

[0141] The method for obtaining the network delay dispersion value and the network jitter dispersion value corresponding to N power boxes includes:

[0142] ;

[0143] in, is the network delay discrete value corresponding to the nth power box, is the network delay of the nth power box at time point t.

[0144] ;

[0145] in, is the network jitter discrete value corresponding to the nth power box, The network jitter of the nth power box at time point t.

[0146] The second diagnosis module performs abnormal diagnosis on the power boxes based on the device network characteristic data of the N power boxes to obtain a network abnormality message queue.

[0147] The method for obtaining the network abnormal message queue includes:

[0148] Input the device network characteristic data of N power boxes into the device network diagnosis model respectively to obtain the network anomaly diagnosis scores of the N power boxes;

[0149] The power boxes whose network anomaly diagnosis scores are greater than the preset network anomaly diagnosis score threshold, the device network feature data and real-time timestamp corresponding to the power boxes are constructed into network anomaly messages, and the network anomaly messages are added to the network anomaly message queue. If the network anomaly message queue contains the same power box and the power box continues to be in an abnormal state, the power box will continue to be added to the network anomaly message queue.

[0150] The training method of the device network diagnosis model includes:

[0151] Pre-constructing a device network diagnostic dataset, the device network diagnostic dataset comprising Q groups of device network diagnostic data and network anomaly diagnostic scores corresponding to the Q groups of device network diagnostic data, where Q is a positive integer greater than 0, and the device network diagnostic data comprising device network feature data; dividing the device network diagnostic dataset into a device network diagnostic data training set and a device network diagnostic data validation set, wherein the device network diagnostic data training set is used for parameter learning of a device network diagnostic model, and the device network diagnostic data validation set is used for real-time evaluation of the generalization ability of the device network diagnostic model;

[0152] During the training process of the device network diagnosis model, a deep neural network structure based on multi-layer perceptron is adopted to convert the device network diagnosis data into feature vectors as input, extract nonlinear features in the data through multiple hidden layers, and finally use the softmax activation function in the output layer to generate the probability distribution of the network anomaly diagnosis score, and output the network anomaly diagnosis score corresponding to the maximum probability as the final prediction result; the training process aims to minimize the cross-entropy loss function, and at the same time introduces an early stopping strategy to monitor the performance of the device network diagnosis data validation set. When the prediction accuracy on the device network diagnosis data validation set reaches the preset threshold, the device network diagnosis model is judged to have converged and the training stops immediately.

[0153] It should be noted that network congestion, link jitter, or attacker interference (such as DDoS attacks) can lead to a high heartbeat signal loss rate. An increased heartbeat signal delay rate may also be caused by network latency, decreased server processing power, network congestion, or attackers artificially increasing communication delays (such as man-in-the-middle attacks and signal interference). A high server interruption probability indicates network instability, server overload, or malicious attacks (such as DoS attacks). A high network delay dispersion value indicates large fluctuations in network delay, which is a sign of network congestion, channel interference, or deteriorating link quality. A high network jitter dispersion value indicates an unstable device network environment, data link congestion, or attackers injecting interference signals.

[0154] There are close correlations within the device network feature data, which influence each other and jointly determine the calculation of the network anomaly diagnosis score. An example of a close correlation within the device network feature data is shown in Table 1:

[0155] Table 1 Internal correlation table of device network characteristic data

[0156]

[0157] The comprehensive diagnosis module performs comprehensive diagnosis on the power box based on the operation abnormality message queue and the network abnormality message queue, identifies the power box that has been attacked by the network, and generates early warning instructions for the power supply system to maintain stable power supply.

[0158] like Figure 4 As shown, the method for performing comprehensive diagnosis on the power box based on the operation abnormality message queue and the network abnormality message queue and identifying the power box that has been attacked by the network includes:

[0159] Mark H power boxes that exist in both the operation abnormality message queue and the network abnormality message queue as the first power boxes to be processed, where H is an integer greater than 0, construct the device operation characteristic data and device network characteristic data corresponding to each of the H first power boxes to be processed into the first data to be processed, and construct the H first data to be processed into the first data set to be processed;

[0160] Identifying a power box that has been attacked by a network attack based on the first set of data to be processed;

[0161] Mark G different power boxes that exist in the network abnormality message queue but not in the operation abnormality message queue as second power boxes to be processed, where G is an integer greater than 0, construct the G second power boxes to be processed and their corresponding device network feature data into second data to be processed, and construct the G second data to be processed into a second data set to be processed;

[0162] A power box that has been attacked by a network is identified based on the second set of data to be processed.

[0163] like Figure 5 As shown, the method for identifying a power box that has suffered a network attack based on the first set of data to be processed includes:

[0164] S51: Preset the initial value of h to 1, and the value range of h is 1 to H;

[0165] S52: Obtain the hth first data to be processed from the first set of data to be processed. If the timestamp of the first addition of the power box to the operation abnormality message queue in the hth first data to be processed is earlier than the timestamp of the first addition to the network abnormality message queue, mark the corresponding power box as a power box fault.

[0166] If the timestamp of the first power box to be processed in the hth first data being added to the operation exception message queue for the first time is later than the timestamp of the first addition to the network exception message queue, and the number of network exception messages of the power box in the network exception message queue is greater than the preset network exception message number threshold, then the corresponding power box is marked as a power box that has suffered a network attack;

[0167] S53: Let h=h+1. If h is less than or equal to H, continue to execute S52. If h is greater than H, end the current process.

[0168] like Figure 6 As shown, the method for identifying a power box that has suffered a network attack based on the second set of data to be processed includes:

[0169] S61: Preset the initial value of g to 1, and the value range of g is 1 to G;

[0170] S62: Obtain the g-th second data to be processed from the second set of data to be processed, and if the number of network abnormality messages of the power box in the network abnormality message queue in the g-th second data to be processed is greater than a preset network abnormality message number threshold, mark the corresponding power box as a power box that has suffered a network attack;

[0171] S63: Let g=g+1. If g is less than or equal to G, continue to execute S62. If g is greater than G, end the current process.

[0172] It's important to note that when implementing an IoT-based remote monitoring solution for intelligent maintenance power boxes, the first step is to connect the power cord to the internal terminals of the intelligent maintenance power box, ensuring that the input voltage matches the nameplate requirements and that the device casing is reliably grounded. Furthermore, depending on the site environment and requirements, choose 4G Cat1 network communication mode, wireless Wi-Fi networking, or wireless AP to complete the device communication connection.

[0173] After completing the hardware connection, data collection begins. According to this solution, the first and second acquisition modules collect device operating data (such as voltage and current signals, power factor, active and reactive power) and device network data (such as heartbeat signals, connection and disconnection logs with remote servers, network traffic, network latency, and network jitter) from N power boxes per unit time.

[0174] The collected data is then processed and diagnosed. Specifically, the collected device operation data is processed by the first processing module to generate device operation characteristic data. This data is then fed into the first diagnostic module and combined with the device operation diagnostic model (trained using a pre-built device operation diagnostic dataset) to generate an operation anomaly message queue. Similarly, the device network data is processed by the second processing module to generate device network characteristic data. This data is then fed into the second diagnostic module and combined with the device network diagnostic model (trained using the same training method as the device operation diagnostic model) to generate a network anomaly message queue.

[0175] The comprehensive diagnosis module then performs a comprehensive diagnosis of the power supply boxes based on the operational anomaly message queue and the network anomaly message queue. It marks power supply boxes that are in both queues as the first pending power supply box, and power supply boxes that are in the network anomaly message queue but not in the operational anomaly message queue as the second pending power supply box. A first pending data set and a second pending data set are constructed, respectively. Based on these first and second pending data sets, a predetermined method is used to identify power supply boxes that have been attacked by a network.

[0176] During the comprehensive diagnosis of power boxes, if a power box is identified as being under cyber attack, the attack diagnosis module in Example 2 can be used to input relevant data into an attack diagnosis model (also trained using a dataset) to determine the specific type of cyber attack. Simultaneously, users can operate and manage the intelligent maintenance power box through the management and control system. For example, through the intelligent maintenance power box management and control platform, users can view the device status of the intelligent maintenance power box, perform authorized operations, view power consumption, set permissions, and authorize and disable devices. This allows for comprehensive monitoring and management of the intelligent maintenance power box, ensuring stable power supply to the power system.

[0177] Example 2:

[0178] See also Figure 3 As shown, this embodiment provides an intelligent maintenance power box remote monitoring system, which also includes:

[0179] The attack diagnosis module is used to input the device operation characteristic data and device network characteristic data of the power box that has suffered a network attack into the attack diagnosis model to obtain the specific power box network attack type, which includes malicious load attack, DoS attack, remote tampering instruction, network hijacking attack and denial of service attack.

[0180] The training method of the attack diagnosis model includes:

[0181] Pre-collect an attack diagnosis dataset, wherein the attack diagnosis dataset includes R groups of attack diagnosis data and power box network attack types corresponding to the R groups of attack diagnosis data, where R is a positive integer greater than 0, and the attack diagnosis data includes device operation feature data and device network feature data; divide the attack diagnosis dataset into an attack diagnosis data training set and an attack diagnosis data validation set, wherein the attack diagnosis data training set is used to train an attack diagnosis model, and the attack diagnosis data validation set is used to evaluate the generalization performance of the attack diagnosis model;

[0182] During the attack diagnosis model training process, minimizing the cross-entropy loss function is used as the optimization goal. An early stopping strategy is used to monitor the performance of the attack diagnosis data validation set. The model performance is optimized by continuously adjusting the network parameters. When the prediction accuracy on the attack diagnosis data validation set reaches the expected accuracy, the attack diagnosis model is determined to have converged and training is stopped. The attack diagnosis model is trained using a deep neural network based on a multilayer perceptron.

[0183] The attack diagnosis data is converted into high-dimensional feature vectors. The input layer of the attack diagnosis model receives the high-dimensional feature vectors and extracts nonlinear relationships in the data through multiple hidden layers. Finally, the output layer of the attack diagnosis model calculates the probability distribution of the power box network attack type through the softmax activation function and outputs the power box network attack type corresponding to the maximum probability as the final prediction result.

[0184] Example 3:

[0185] See also Figure 2 As shown, this embodiment provides a remote monitoring method for an intelligent maintenance power box, further comprising:

[0186] Collect equipment operation data of N power boxes during power supply per unit time;

[0187] Extract features from the equipment operation data to obtain the equipment operation feature data corresponding to N power boxes;

[0188] Based on the equipment operation characteristic data of N power boxes, abnormal diagnosis of the power boxes is performed to obtain an operation abnormality message queue;

[0189] Collect device network data of N power boxes during power supply per unit time;

[0190] Extract features from the device network data to obtain device network feature data corresponding to N power boxes;

[0191] Based on the network characteristic data of N power boxes, the power boxes are diagnosed for abnormality and a network abnormality message queue is obtained;

[0192] Based on the operation abnormality message queue and network abnormality message queue, the power box is comprehensively diagnosed to identify the power box that has been attacked by the network. The power supply system generates early warning instructions to maintain stable power supply.

Claims

1. Intelligent maintenance power box remote monitoring method, characterized in that: include: Collect equipment operation data of N power boxes during power supply per unit time; The equipment operation data includes the power box voltage signal, the power box current signal, the power box power factor, the power box active power and the power box reactive power; Extract features from the equipment operation data to obtain the equipment operation feature data corresponding to N power boxes; Based on the equipment operation characteristic data of N power boxes, abnormal diagnosis of the power boxes is performed to obtain an operation abnormality message queue; Collect device network data of N power boxes during power supply per unit time; the device network data includes power box heartbeat signals, connection and disconnection logs between the power box and the remote server, power box network traffic, power box network delay, and power box network jitter; Extract features from the device network data to obtain device network feature data corresponding to N power boxes; Based on the network characteristic data of N power boxes, the power boxes are diagnosed for abnormality and a network abnormality message queue is obtained; Comprehensively diagnose power boxes based on the operation anomaly message queue and network anomaly message queue to identify power boxes that have been attacked by the network. The power supply system generates early warning instructions to maintain stable power supply. Methods for comprehensively diagnosing power boxes based on the abnormal operation message queue and the abnormal network message queue and identifying power boxes that have been attacked by the network include: Mark H power boxes that exist in both the operation abnormality message queue and the network abnormality message queue as the first power boxes to be processed, where H is an integer greater than 0, construct the device operation characteristic data and device network characteristic data corresponding to each of the H first power boxes to be processed into the first data to be processed, and construct the H first data to be processed into the first data set to be processed; Identifying a power box that has been attacked by a network attack based on the first set of data to be processed; Mark G different power boxes that exist in the network abnormality message queue but not in the operation abnormality message queue as second power boxes to be processed, where G is an integer greater than 0, construct the G second power boxes to be processed and their corresponding device network feature data into second data to be processed, and construct the G second data to be processed into a second data set to be processed; A power box that has been attacked by a network is identified based on the second set of data to be processed.

2. The remote monitoring method for an intelligent maintenance power box according to claim 1 is characterized in that: The method for identifying a power box that has been attacked by a network based on a first set of data to be processed includes: S51: Preset the initial value of h to 1, and the value range of h is 1 to H; S52: Obtain the hth first data to be processed from the first set of data to be processed. If the timestamp of the first addition of the power box to the operation abnormality message queue in the hth first data to be processed is earlier than the timestamp of the first addition to the network abnormality message queue, mark the corresponding power box as a power box fault. If the timestamp of the first power box to be processed in the hth first data being added to the operation exception message queue for the first time is later than the timestamp of the first addition to the network exception message queue, and the number of network exception messages of the power box in the network exception message queue is greater than the preset network exception message number threshold, then the corresponding power box is marked as a power box that has suffered a network attack; S53: Let h=h+1. If h is less than or equal to H, continue to execute S52. If h is greater than H, end the current process.

3. The remote monitoring method for an intelligent maintenance power box according to claim 1, characterized in that: The method for identifying a power box that has been attacked by a network based on the second set of data to be processed includes: S61: Preset the initial value of g to 1, and the value range of g is 1 to G; S62: Obtain the g-th second data to be processed from the second set of data to be processed, and if the number of network abnormality messages of the power box in the network abnormality message queue in the g-th second data to be processed is greater than a preset network abnormality message number threshold, mark the corresponding power box as a power box that has suffered a network attack; S63: Let g=g+1. If g is less than or equal to G, continue to execute S62. If g is greater than G, end the current process.

4. The remote monitoring method for an intelligent maintenance power box according to claim 1, characterized in that: The method for obtaining the abnormal operation message queue includes: Input the equipment operation characteristic data of N power boxes into the equipment operation diagnosis model respectively to obtain the operation abnormality diagnosis scores of the N power boxes; The power boxes whose operation abnormality diagnosis scores are greater than the preset operation abnormality diagnosis score threshold, the equipment operation characteristic data corresponding to the power boxes and the real-time timestamp are constructed into operation abnormality messages, and the operation abnormality messages are added to the operation abnormality message queue in real time. If the operation abnormality message queue contains the same power box and the power box continues to be in an abnormal state, the power box will continue to be added to the operation abnormality message queue.

5. The remote monitoring method for an intelligent maintenance power box according to claim 1, characterized in that: The method for obtaining the equipment operation characteristic data corresponding to N power boxes includes: Divide the unit time into T time points, where T is an integer greater than 0; Analyze and process the voltage signals and current signals of N power boxes at T time points according to a preset method to obtain the voltage harmonic distortion rate and current harmonic distortion rate corresponding to the N power boxes; According to the preset method, the power factor, active power and reactive power of N power boxes at T time points are analyzed and processed to obtain the power factor fluctuation index, the phase lag angle set of reactive power and power factor, and the consistency index of active power and power factor corresponding to the N power boxes; The voltage harmonic distortion rate, current harmonic distortion rate, power factor fluctuation index, phase lag angle set of reactive power and power factor, and consistency index of active power and power factor corresponding to N power boxes are constructed into the equipment operation characteristic data corresponding to the N power boxes.

6. The remote monitoring method for an intelligent maintenance power box according to claim 1, characterized in that: The method for obtaining the network abnormal message queue includes: Input the device network characteristic data of N power boxes into the device network diagnosis model respectively to obtain the network anomaly diagnosis scores of the N power boxes; The power boxes whose network anomaly diagnosis scores are greater than the preset network anomaly diagnosis score threshold, the device network feature data and real-time timestamp corresponding to the power boxes are constructed into network anomaly messages, and the network anomaly messages are added to the network anomaly message queue. If the network anomaly message queue contains the same power box and the power box continues to be in an abnormal state, the power box will continue to be added to the network anomaly message queue.

7. The remote monitoring method for an intelligent maintenance power box according to claim 1, characterized in that: The method for obtaining device network characteristic data corresponding to N power boxes includes: According to a preset method, feature extraction is performed on the heartbeat signals of N power boxes per unit time to obtain the heartbeat signal loss rate and heartbeat signal delay rate corresponding to the N power boxes; Obtain the connection and disconnection logs between the power box and the remote server from the device network data. Count the interruption durations between the power box and the remote server for each of the N power boxes per unit time. Divide the interruption duration by the unit time to calculate the server interruption probability for each of the N power boxes. According to the preset method, the network traffic, network delay and network jitter of N power boxes at T time points are extracted to obtain the discrete degree values ​​of network delay and network jitter corresponding to the N power boxes; The heartbeat signal loss rate, heartbeat signal delay rate, server interruption probability, network delay dispersion value and network jitter dispersion value corresponding to the N power boxes are constructed into the device network feature data corresponding to the N power boxes.

8. The remote monitoring method for an intelligent maintenance power box according to claim 4, characterized in that: The training method of the device running the diagnostic model includes: Pre-constructing a device operation diagnostic dataset, wherein the device operation diagnostic dataset includes Y groups of device operation diagnostic data and operation abnormality diagnostic scores corresponding to the Y groups of device operation diagnostic data, where Y is a positive integer greater than 0, and the device operation diagnostic data includes device operation feature data; dividing the device operation diagnostic dataset into a device operation diagnostic data training set and a device operation diagnostic data validation set, wherein the device operation diagnostic data training set is used for parameter learning of the device operation diagnostic model, and the device operation diagnostic data validation set is used for real-time evaluation of the generalization ability of the device operation diagnostic model; During the training process of the equipment operation diagnosis model, a deep neural network structure based on a multi-layer perceptron is used to convert the equipment operation diagnosis data into feature vectors as input. Nonlinear features in the data are extracted through multiple hidden layers. Finally, a softmax activation function is used in the output layer to generate a probability distribution of the operation anomaly diagnosis score. The operation anomaly diagnosis score corresponding to the maximum probability is output as the final prediction result. The training process aims to minimize the cross-entropy loss function. At the same time, an early stopping strategy is introduced to monitor the performance of the equipment operation diagnosis data validation set. When the prediction accuracy on the equipment operation diagnosis data validation set reaches the preset threshold, the equipment operation diagnosis model is determined to have converged and training stops immediately. The device network diagnosis model is obtained by using the training method of the device operation diagnosis model.

9. A remote monitoring system for an intelligent maintenance power box, implementing the remote monitoring method for an intelligent maintenance power box according to any one of claims 1 to 8, characterized in that: include: The first acquisition module is used to collect equipment operation data of N power boxes during power supply per unit time; The first processing module is used to extract features from the equipment operation data to obtain equipment operation feature data corresponding to N power boxes; The first diagnostic module performs abnormal diagnosis on the power supply box based on the device operation characteristic data of N power supply boxes, and obtains an operation abnormality message queue; The second acquisition module is used to collect device network data of N power boxes during power supply per unit time; The second processing module is used to extract features from the device network data to obtain device network feature data corresponding to N power boxes; The second diagnosis module diagnoses abnormalities of the power boxes based on the device network characteristic data of the N power boxes and obtains a network abnormality message queue; The comprehensive diagnosis module performs comprehensive diagnosis on the power box based on the operation abnormality message queue and the network abnormality message queue, identifies the power box that has been attacked by the network, and generates early warning instructions for the power supply system to maintain stable power supply.

Images