Information blocking management method and device based on semantic analysis and electronic equipment

Abstract

The invention is suitable for the technical field of power system equipment maintenance, and provides an information blocking management method and device based on semantic analysis and electronic equipment. According to the method, the corresponding relation between the equipment identification information and the network identification information can be obtained by performing semantic analysis on the equipment ledger file of the transformer substation, and then the equipment list operation interface is provided for the user, so that when the user selects the first equipment in the equipment list operation interface to trigger the information blocking management request, the first equipment can be used for blocking the management request. And inputting first network identification information corresponding to the first equipment identification information into an information blocking management template corresponding to the information blocking management type according to the first equipment identification information and the information blocking management type corresponding to the information blocking management request, and generating and executing an information blocking management instruction. According to the invention, standardized information blocking operation and information unlocking operation can be rapidly completed, and rapid and accurate information blocking and information unlocking are realized.

Description

Technical Field

[0001] The present application belongs to the technical field of power system equipment maintenance, and in particular relates to a method, device and electronic equipment for information blocking management based on semantic analysis. Background Art

[0002] Maintenance of secondary equipment in power system substations is a crucial task in operating power grid equipment. This maintenance work can be categorized into preventive maintenance, troubleshooting, and technical upgrades, depending on the specific needs. Before performing maintenance on secondary equipment, manual information blocking is required to ensure that the information and data generated during the maintenance process does not interfere with the normal operation and monitoring of the power grid. Secondary equipment refers to the supporting equipment in the power system used to monitor, protect, and control primary equipment (such as generators and transformers).

[0003] Under current conditions, information blocking operations are performed manually by operations and maintenance personnel. Information blocking is performed manually at the substation and control master station. The secondary equipment that requires information blocking is manually set on the monitoring system and control master station before maintenance work begins that day. Data and related information related to secondary equipment set to information blocking will not enter the monitoring system or control master station system via network communication, and will not affect the normal operation and monitoring of the power system. Information blocking operations can also be referred to as data blocking operations. After operations and maintenance personnel complete their on-site maintenance operations for the day, they must notify the operation and control master station to jointly remove the information blockade and resume data monitoring. To ensure the accuracy of operations monitoring and related handling operations by operations and maintenance personnel, in addition to job-specific training, corresponding management measures are also implemented. During information blocking and unblocking operations, operators are accompanied by supervisors to monitor the operation process to reduce the risk of manual errors.

[0004] However, while traditional manual operation methods reduce the risk of human error through the use of supervisory management, they still cannot completely eliminate it. Beyond the risk, the current approach's greatest drawbacks are high costs and low efficiency. The data blocking operations before and after daily maintenance work not only create a significant workload, but also compress daily maintenance work schedules due to procedural constraints, effectively extending the maintenance period and inefficiently impacting efficiency. Summary of the Invention

[0005] The embodiments of the present application provide a method, device, and electronic device for information blocking management based on semantic analysis, which can solve the technical problems in the prior art of manual operation methods that are prone to error risks, high costs, and low efficiency.

[0006] In a first aspect, an embodiment of the present application provides a method for information blocking management based on semantic analysis, comprising:

[0007] Perform semantic analysis on the substation's equipment ledger files to obtain the correspondence between equipment identification information and network identification information;

[0008] When the user selects a first device in the device list operation interface to trigger an information blocking management request, obtaining the first device identification information and the information blocking management type corresponding to the information blocking management request, wherein the information blocking management type includes an information blocking operation and an information unblocking operation;

[0009] querying, based on the first device identification information, a correspondence between the device identification information and the network identification information to obtain first network identification information corresponding to the first device identification information;

[0010] inputting the first network identification information into an information blocking management template corresponding to the information blocking management type to generate an information blocking management instruction, wherein the information blocking management template includes an information blocking template and an information unblocking template, the information blocking operation corresponds to the information blocking template, the information unblocking operation corresponds to the information unblocking template, and the information blocking management instruction includes an information blocking instruction and an information unblocking instruction;

[0011] The information blocking management instruction is executed to implement information blocking management, and the information blocking management includes information blocking and information unblocking.

[0012] In a possible implementation of the first aspect, the device identification information includes an interval name and a device name, the network identification information includes a network configuration and an IP address, and the performing semantic analysis on the substation equipment ledger file to obtain a correspondence between the device identification information and the network identification information includes:

[0013] Perform semantic analysis on substation configuration description files to obtain the correspondence between device names, network configurations, and IP addresses;

[0014] Perform semantic analysis on the intelligent electronic device information to obtain the correspondence between the interval name and the device name;

[0015] According to the correspondence between the device name, network configuration, and IP address and the correspondence between the interval name and the device name, the correspondence between the interval name, the device name, the network configuration, and the IP address is obtained.

[0016] In a possible implementation of the first aspect, performing semantic analysis on the substation configuration description file to obtain a correspondence between a device name, a network configuration, and an IP address includes:

[0017] Parse the substation configuration description file based on regular expressions to obtain the correspondence between device name, network configuration, and IP address;

[0018] The performing semantic analysis on the intelligent electronic device information to obtain the corresponding relationship between the interval name and the device name includes:

[0019] Perform semantic analysis on the intelligent electronic device information to obtain the correspondence between the interval information field and the device name;

[0020] The interval information field is parsed based on a regular expression to obtain the interval name and the corresponding relationship between the interval name and the device name.

[0021] In a possible implementation manner of the first aspect, the information blocking management template includes network transmission protocol information and port number information.

[0022] In a possible implementation manner of the first aspect, the method is applied to a substation monitoring system and a motion gateway.

[0023] In a possible implementation of the first aspect, the method further includes:

[0024] Parsing the IP table file to obtain an information blocking management record corresponding to the second network identification information, wherein the information blocking management record includes an information blocking record and an information unblocking record;

[0025] querying the correspondence between the device identification information and the network identification information according to the second network identification information to obtain the second device identification information corresponding to the second network identification information, where the second device identification information corresponds to the information blocking management record;

[0026] The second device identification information and the corresponding information blocking management record are displayed in the monitoring interface.

[0027] In a second aspect, an embodiment of the present application provides an apparatus for information blocking management based on semantic analysis, comprising:

[0028] The first acquisition module is used to perform semantic analysis on the equipment ledger file of the substation to obtain the correspondence between the equipment identification information and the network identification information;

[0029] A second obtaining module is configured to obtain, when a user selects a first device in the device list operation interface to trigger an information blocking management request, first device identification information and an information blocking management type corresponding to the information blocking management request, wherein the information blocking management type includes an information blocking operation and an information unblocking operation;

[0030] a third query module, configured to query, based on the first device identification information, a correspondence between the device identification information and the network identification information, and obtain first network identification information corresponding to the first device identification information;

[0031] a fourth generating module, configured to input the first network identification information into an information blocking management template corresponding to the information blocking management type, and generate an information blocking management instruction, wherein the information blocking management template includes an information blocking template and an information unblocking template, the information blocking operation corresponds to the information blocking template, the information unblocking operation corresponds to the information unblocking template, and the information blocking management instruction includes an information blocking instruction and an information unblocking instruction;

[0032] The fifth execution module is used to execute the information blocking management instruction to implement information blocking management, where the information blocking management includes information blocking and information unblocking.

[0033] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device implements a method as described in any one of the above-mentioned first aspects.

[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method as described in any one of the above-mentioned first aspects is implemented.

[0035] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when run, enables the method described in any one of the above-mentioned first aspects to be executed.

[0036] Compared with the prior art, the embodiments of the first aspect of the present application have the following beneficial effects:

[0037] The embodiment of the present application can obtain the correspondence between the device identification information and the network identification information by performing semantic analysis on the equipment ledger file of the substation, and then provide the user with a device list operation interface, so that when the user selects the first device in the device list operation interface to trigger the information blocking management request, the first network identification information corresponding to the first device identification information is input into the information blocking management template corresponding to the information blocking management type according to the first device identification information and the information blocking management type corresponding to the information blocking management request, and the information blocking management instruction is generated and executed. By presetting the information blocking management template and filling in the corresponding first network identification information in the information blocking management template, the standardized information blocking operation and information unblocking operation can be quickly completed, and fast and accurate information blocking and information unblocking can be achieved, which not only reduces the risk of manual operation errors in the prior art, but also reduces the cost of equipment operation and maintenance, improves efficiency, and helps maintenance personnel increase maintenance work time. In addition, the unified standardized operation layer also provides good modularity and convenience for subsequent integration in other applications.

[0038] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0040] Figure 1 This is a flowchart of a method for information blocking management based on semantic analysis provided by an embodiment of the present application;

[0041] Figure 2 This is a schematic diagram of an application of a method for information blocking management based on semantic analysis provided by an embodiment of the present application;

[0042] Figure 3 1 is a schematic diagram of the structure of an apparatus for information blocking management based on semantic analysis provided in one embodiment of the present application;

[0043] Figure 4 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0045] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0046] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0047] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0048] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0049] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0050] Figure 1 This is a flowchart of a method for information blocking management based on semantic analysis provided by an embodiment of the present application.

[0051] S11, performing semantic analysis on the equipment ledger file of the substation to obtain the correspondence between the equipment identification information and the network identification information.

[0052] The equipment inventory files of the substation include but are not limited to the substation configuration file (Substation Configuration Description, referred to as SCD file for short). Equipment identification information includes but is not limited to the device name, interval name, device description, etc. Network identification information includes but is not limited to network configuration, IP address, network link information, etc. By performing semantic analysis on the SCD file, the correspondence between the equipment identification information and the network identification information can be obtained, such as the network configuration and IP address corresponding to device 1, and the network configuration and IP address corresponding to interval 1. The substation bay is an electrical component in the substation used to isolate and interconnect various electrical equipment, including high and low voltage switchgear, control consoles, protection devices, relays, metering instruments, etc. Its main function is to achieve the isolation and interconnection of electrical equipment to ensure the normal operation and maintenance of electrical equipment.

[0053] In current smart substation construction, the substation secondary equipment inventory typically uses the substation's SCD file directly. Semantic analysis of the smart substation SCD file extracts the correspondence between secondary device descriptions and device names, and between device names and network connection information. Secondary device descriptions and corresponding network connection information are obtained by matching device names. Secondary device descriptions are parsed to adaptively group secondary devices into bays. This approach allows for the acquisition of bay secondary device groups and their corresponding network connection information from the substation SCD equipment inventory.

[0054] Optionally, when the correspondence between all device identification information and network identification information is not obtained, an alarm may be output.

[0055] S12, when the user selects the first device in the device list operation interface to trigger the information blocking management request, obtain the first device identification information and information blocking management type corresponding to the information blocking management request, and the information blocking management type includes information blocking operation and information unblocking operation.

[0056] After obtaining the correspondence between device identification information and network identification information, a device list operation interface can be designed as a basic one-click operation interface. The device list interface can include intervals and device information. Users can select devices that need to be blocked in the device list interface and can choose to block or unblock information on the device. For example, if a user chooses to block the first device in the device list interface to trigger a block management request, the block management request can include the identification information of the first device, the information block management type selected by the user, and the block operation.

[0057] S13: According to the first device identification information, query the correspondence between the device identification information and the network identification information to obtain first network identification information corresponding to the first device identification information.

[0058] After obtaining the first device identification information corresponding to the information blocking management request, you can query the correspondence between the device identification information and the network identification information based on the first device identification information to obtain the first network identification information corresponding to the first device identification information, such as the IP address and network configuration corresponding to the first device identification information.

[0059] Optionally, after obtaining the first network identification information, the network information obtained by the dual network configuration and SCD analysis can be matched according to the selected first device identification information. If the corresponding network information is successfully matched, the match is considered successful; if no match is found or the match is incomplete, the match is considered unsuccessful and an alarm is output.

[0060] S14, input the first network identification information into the information blocking management template corresponding to the information blocking management type, and generate an information blocking management instruction, wherein the information blocking management template includes an information blocking template and an information unblocking template, the information blocking operation corresponds to the information blocking template, the information unblocking operation corresponds to the information unblocking template, and the information blocking management instruction includes an information blocking instruction and an information unblocking instruction.

[0061] An information blocking template and an information unblocking template can be designed. If a user performs an information blocking operation on a device and the information blocking management type included in the information blocking management request is an information blocking operation, the first network identification information is input into the information blocking template and an information blocking instruction is generated. If a user performs an information unblocking operation on a device and the information blocking management type included in the information blocking management request is an information unblocking operation, the first network identification information is input into the information unblocking template and an information unblocking instruction is generated.

[0062] S15, executing the information blocking management instruction to implement information blocking management, wherein the information blocking management includes information blocking and information unblocking.

[0063] After the information blocking management instruction is generated, the information blocking management instruction can be executed. Based on the secondary device information blocking template and the information unblocking template, the device IP address is used as a parameter and encapsulated into an independent one-key information blocking command operation interface and an information unblocking command operation interface. Information blocking management can be achieved by loading the aforementioned command operation interface and executing the information blocking management instruction. Continuing with the above example, taking the example of the user choosing to block the first device in the device list interface to trigger a blocking management request, information blocking of the first device can be achieved by executing the information blocking management instruction. The relevant data and related information of the secondary device set to the information blocking state will not enter the monitoring system or the control master station system through network communication, and will not affect the normal operation monitoring of the power system.

[0064] The embodiment of the present application can obtain the correspondence between the device identification information and the network identification information by performing semantic analysis on the equipment ledger file of the substation, and then provide the user with a device list operation interface, so that when the user selects the first device in the device list operation interface to trigger the information blocking management request, the first network identification information corresponding to the first device identification information is input into the information blocking management template corresponding to the information blocking management type according to the first device identification information and the information blocking management type corresponding to the information blocking management request, and the information blocking management instruction is generated and executed. By presetting the information blocking management template and filling in the corresponding first network identification information in the information blocking management template, the standardized information blocking operation and information unblocking operation can be quickly completed, and fast and accurate information blocking and information unblocking can be achieved, which not only reduces the risk of manual operation errors in the prior art, but also reduces the cost of equipment operation and maintenance, improves efficiency, and helps maintenance personnel increase maintenance work time. In addition, the unified standardized operation layer also provides good modularity and convenience for subsequent integration in other applications.

[0065] The beneficial effects of the embodiments of the present application include but are not limited to the following three points.

[0066] 1. Good operation timeliness. The embodiment of the present application can extract substation equipment interval information by performing semantic analysis on the substation equipment ledger file. The operation of blocking or unblocking information for a certain secondary device or multiple secondary devices in a certain interval can be realized with one click, which reduces the manual operation time of information blocking or unblocking from tens of minutes to less than one minute, significantly improving the operation timeliness, and the operation time will no longer affect the maintenance work.

[0067] 2. Automatically generate operational policies. Corresponding information blocking and unblocking templates are built for different communication protocols. During execution, the network identification information corresponding to the secondary device is automatically entered into the template to form the corresponding information blocking management instruction. Automatically generating information blocking management instructions avoids operational errors and risks that may arise from manual operation.

[0068] 3. High operational accuracy. The embodiment of the present application reads the substation equipment ledger file and, in combination with the information blocking management template, can automatically generate information blocking management instructions and operation strategies for corresponding secondary equipment, providing a one-click execution method. This can effectively avoid the selection and modification operation links in manual operation, greatly improving the operational accuracy of information blocking or information unblocking operations.

[0069] In one embodiment, the device identification information includes the interval name and the device name, and the network identification information includes the network configuration and the IP address. Performing semantic analysis on the equipment ledger file of the substation to obtain the correspondence between the device identification information and the network identification information (step S11 in the above embodiment) includes the following steps S111 to S113.

[0070] S111, performing semantic analysis on the substation configuration description file to obtain the corresponding relationship between the device name, network configuration, and IP address.

[0071] In a smart substation, the equipment inventory is an SCD file. From the SCD equipment inventory file, the subnetwork information section is read to obtain the specific network information of the IEDs (Intelligent Electronic Devices, abbreviated as IEDs) in different subnetworks. The IED information section is then read to obtain the standardized description of the IEDs. The network information of each IED subnet is associated with its standardized description via the device name (IEDname). The standardized description of the IED is then broken down into the "interval + device type + serial number" format, and the resulting "interval" information list is used to obtain the substation interval information and its corresponding relationship with the IEDs. Furthermore, by performing semantic analysis on the substation configuration description file, the corresponding relationship between the device name (IEDname), network configuration (subnet name), and IP address can also be obtained.

[0072] S112: Perform semantic analysis on the intelligent electronic device information to obtain a correspondence between the interval name and the device name.

[0073] IED information includes bay (desc, substation bay) information and the device name corresponding to each bay. Bay information includes bay name, device type, and serial number. Semantic analysis of IED information reveals the correspondence between bay names and device names. This correspondence between bay names and device names reflects the relationship between the bay and one or more corresponding devices.

[0074] S113 , obtaining a correspondence between the interval name, device name, network configuration, and IP address according to the correspondence between the device name, network configuration, and IP address and the correspondence between the interval name and device name.

[0075] Using the device name as an intermediate bridge for correspondence, the correspondence between the device name, network configuration, and IP address, as well as the correspondence between the interval name and the device name, can be obtained.

[0076] By performing semantic analysis on substation configuration description files and intelligent electronic device information, the correspondence between interval names, device names, network configurations, and IP addresses can be obtained, which can provide a reliable information basis for information blocking management and improve the reliability and accuracy of information blocking management.

[0077] In one embodiment, the semantic analysis of the substation configuration description file to obtain the correspondence between the device name, network configuration, and IP address (step S111 of the above embodiment) includes S1111.

[0078] In S1111, the substation configuration description file is parsed based on regular expressions to obtain the corresponding relationship between the device name, network configuration, and IP address.

[0079] For example, the substation configuration description file can be parsed based on the following regular expression to obtain the correspondence between the device name, network configuration, and IP address.

[0080] <communication>\s* <subnetwork> (.*？)< / subnetwork> \s*< / communicati on> <name> (.*？)< / name> \s* <iedname> (.*？)< / iedname> \s* <ip> (.*？)< / ip>

[0081] <ied>\s* <desc> (.*？)< / desc> \s* <name> (.*？)< / name> \s*< / ied>

[0082] The iedname field is used to parse and obtain the device name, the subnetwork field is used to parse and obtain the network configuration, and the IP field is used to parse and obtain the IP address.

[0083] The semantic analysis of the intelligent electronic device information to obtain the corresponding relationship between the interval name and the device name (step S112 of the above embodiment) includes S1121 and S1122.

[0084] S1121: Perform semantic analysis on the intelligent electronic device information to obtain a correspondence between the interval information field and the device name.

[0085] By performing semantic analysis on intelligent electronic device information (IED information), the correspondence between the interval information field (desc) and the device name (iedname) can be obtained.

[0086] S1122 , parsing the interval information field based on a regular expression to obtain an interval name and a correspondence between the interval name and the device name.

[0087] The interval information field (desc field) is parsed based on the following regular expression in the form of "interval name + device type + serial number". After parsing, the interval name of the device can be obtained.

[0088] ^([^-\s]+)[-\s]+(%IED_TYPE%)[-\s]+(\d+)$ / / where %IED_TYPE% is the set of all device types.

[0089] Since the correspondence between the interval information field and the device name is already known, and the interval information field corresponds to the interval name, a correspondence between the interval name and the device name can be established. After parsing the desc field, the complete association information between "interval name - device name (iedname) - network configuration (subnet) - IP address (multiple subnets)" is finally obtained.

[0090] By parsing the substation configuration description file and intelligent electronic device information based on regular expressions, the correspondence between the interval name, device name, network configuration, and IP address can be obtained, which can provide a reliable information basis for information blocking management and improve the reliability and accuracy of information blocking management.

[0091] In one embodiment, the information blocking management template includes network transmission protocol information and port number information.

[0092] It can be based on bash syntax, involving information blocking templates and information unblocking templates.

[0093] The information blocking template may be as follows, for example.

[0094] if !iptables -C INPUT -p %PROTOCOL %-dport %PORT %-s %IP % -j LOG --log-prefix "%LOG_PREFIX %:" > / dev / null 2>&1; then iptables -A INPUT -p %PROTOCOL %-dport %PORT %-s %IP % -j LOG --log-prefix "%LOG_PREFIX %:"; iptables -A INPUT -p %PROTOCOL %-dport %PORT %-s %IP % -j DROP; The fi information unblocking template can be, for example, as shown below.

[0095] if iptables -C INPUT -p%PROTOCOL% -dport%PORT% -s%IP% -j LOG --log-prefix "%LOG_PREFIX%:"> / dev / null 2>&1; then iptables -D INPUT -p%PROTOCOL% -dport%PORT% -s%IP% -j DROP; fi

[0096] In the above information blocking and unblocking templates, %PROTOCOL% represents the network transmission protocol, which can be either TCP or UDP depending on the specific situation. %PORT% represents the port number used, which is 102 for MMS transmission under the IEC61850 protocol. %IP% represents the IP address of the specific device. %LOG_PREFIX% represents the characteristic prefix of the output log.

[0097] The above information blocking templates and information unblocking templates can be used to quickly complete the rapid information blocking and unblocking of specific network transmission protocols, port numbers, and IP addresses, thereby improving the efficiency of information blocking management and reducing the possibility of errors.

[0098] In one embodiment, a method for information blocking management based on semantic analysis is applied to a substation monitoring system and a motion gateway.

[0099] The information blocking management method based on semantic analysis can be performed on the monitoring system and telecontrol gateway device of the Linux system at the substation control layer. By operating the Linux system firewall component iptables (IP table file), the blocking and recovery of specific network communication links can be achieved, that is, information blocking and information contact blocking.

[0100] Figure 2 This is a schematic diagram of the application of the information blocking management method based on semantic analysis provided by one embodiment of the present application.

[0101] like Figure 2 As shown, current substation monitoring systems and telecontrol gateways generally utilize the Linux operating system. This system utilizes the Linux iptables tool and its string module to rapidly block and unblock information for measurement and control devices, protection devices, capacitors and reactance devices, and other equipment. For the MMS protocol and GMS of the IEC61850 specification, information blocking and unblocking templates are constructed based on network communication characteristics. This embodiment of the present application implements standardized information blocking and unblocking commands by entering network identification information into the operation templates. Executing the standardized operation command entries enables rapid information blocking and unblocking.

[0102] The semantic analysis-based information blocking management method provided in embodiments of the present application can implement efficient information blocking and unblocking operations in the monitoring system and telecontrol gateway of a substation Linux system. This semantic analysis-based information blocking management method can obtain the security measure execution status and logs in the monitoring system and telecontrol gateway, and can also transmit security measures, such as information blocking management instructions. The security measure execution status refers to the measures used to perform information blocking and unblocking operations and the corresponding execution status.

[0103] The method provided in the embodiment of the present application realizes the acquisition and classification of secondary equipment interval information by reading the substation equipment ledger file, and generates information blocking management instructions based on the information blocking management template, thereby realizing the overall rapid information blocking and information unblocking of the secondary equipment selected by the user or the entire interval equipment, effectively improving the accuracy and operation efficiency of the substation information blocking and information unblocking operations.

[0104] In one embodiment, the method for information blocking management based on semantic analysis further includes the following steps S16 to S18.

[0105] S16, parsing the IP table file to obtain the information blocking management record corresponding to the second network identification information, wherein the information blocking management record includes an information blocking record and an information unblocking record.

[0106] The IP table file (iptables rule base) stores various communication information, such as pkts, bytes, target, prot, opt, in, out, source, destination, and supplementary fields. pkts and bytes represent the corresponding data volume, target is the operation instruction, prot is the protocol type, opt is the corresponding parameter, in and out tables identify input and output, source is the source IP address, and destination is the destination IP address.

[0107] The IP table file may be parsed based on the following regular expression to obtain the information blocking management record corresponding to the second network identification information.

[0108] ^\s*\d+\s+\d+\s+(?P <target>\S+)\s+\S+\s+\S+\s+\S+\s+(?P <source> \S+)\s+\S+$

[0109] Among them, <target>To match the target action, for example, LOG or DROP is used. source is the captured source IP address information, which is directly named source for easy subsequent processing.

[0110] Using the regular expression above, messages matching the target fields LOG, DROP, and MARK are retrieved, and the source IP address is stored as the source field, which is the second network identification information. LOG corresponds to system log messages. DROP indicates iptables link blocking instructions, including information blocking records and information unblocking records.

[0111] S17: According to the second network identification information, query the correspondence between the device identification information and the network identification information to obtain the second device identification information corresponding to the second network identification information, where the second device identification information corresponds to the information blocking management record.

[0112] After obtaining the rules from iptables, the corresponding second network identification information is used as the key index to match the information with the IP address in the substation device network information, and the correspondence between the device identification information and the network identification information is queried to obtain the second device identification information corresponding to the second network identification information. The second device identification information corresponds to the information blocking management record.

[0113] S18: Display the second device identification information and the corresponding information blocking management record in the monitoring interface.

[0114] After the information blocking management record corresponding to the second device identification information is obtained, it can be displayed in the monitoring interface to facilitate the administrator user to view and understand the information blocking management status.

[0115] Based on the correspondence between device identification information and network identification information obtained from equipment inventory files, a real-time monitoring interface for substation intervals and device network blocking status was designed. By obtaining and parsing the IP table files of the monitoring backend and telecontrol gateway devices, and obtaining relevant rule information for the corresponding device IP addresses, this rule information is displayed as device network blocking information, allowing administrators to monitor the status of information blocking management in real time, improving the efficiency and effectiveness of information blocking management.

[0116] The present embodiment of the present invention establishes a link status monitoring function for the target link of an information blocking operation and records the relevant information. By setting system log (syslog) rules on the Linux system monitoring system and telecontrol gateway device, corresponding independent system log files are established to record the corresponding operation content. The corresponding rule base can also be queried through iptables to monitor the current link status. Through these measures, the status monitoring and operation recording of the target link of the information blocking operation can be achieved.

[0117] This embodiment of the application targets a Linux-based substation monitoring system and telecontrol gateway device. It uses custom rules to capture network events and iptables operation events and outputs them as system log information (syslog). Subscribing to the corresponding log information through the system syslog process allows real-time access to relevant information about iptables operation events and network events. Furthermore, this embodiment of the application can use regular expressions to perform IP address and protocol matching operations, obtain network link status information, and classify and archive relevant information records.

[0118] The embodiment of the present application obtains the relevant status of the operation object in real time by subscribing to the syslog log and performing information parsing and processing, and realizes the operation status monitoring and recording of the operation object. Not only does it confirm the status of the operation process by monitoring the operation status, but it also provides a data basis for recording and tracing the operation process.

[0119] The embodiments of the present application can be applied to power system substation automation scenarios and industrial control system scenarios.

[0120] When applied to the power system substation automation scenario, the embodiments of the present application can be applied to the power communication information system and the substation automation system. In the existing system, it is transparently deployed on the monitoring system or the telecontrol gateway device to achieve fast and effective targeted information blocking and information unblocking operations. Alternatively, it can also be independently deployed on another computer device in the substation control layer network outside the monitoring system and the telecontrol gateway device, and realize fast and effective information blocking and information unblocking operations for the monitoring system, the telecontrol gateway device, or both in a network transmission control manner.

[0121] When applied to industrial control systems, the embodiments of the present application can be applied to monitoring and data acquisition systems and distributed control and monitoring systems. The embodiments of the present application can be used to accurately screen and control network communication protocols, achieve rapid and accurate network blocking during equipment maintenance and network security incidents, and subsequently recover from blocking, achieve reliable uploading of blocking and repair information, effectively prevent malicious network attacks or vulnerability exploitation, and ensure system security and stable operation.

[0122] Figure 3 1 is a schematic diagram of the structure of an apparatus for information blocking management based on semantic analysis provided in one embodiment of the present application.

[0123] like Figure 3 As shown, the information blocking management device 3 based on semantic analysis includes:

[0124] The first obtaining module 31 is used to perform semantic analysis on the equipment ledger file of the substation to obtain the correspondence between the equipment identification information and the network identification information;

[0125] A second obtaining module 32 is configured to obtain, when a user selects a first device in the device list operation interface to trigger an information blocking management request, first device identification information and an information blocking management type corresponding to the information blocking management request, wherein the information blocking management type includes an information blocking operation and an information unblocking operation;

[0126] A third query module 33 is configured to query the correspondence between the device identification information and the network identification information based on the first device identification information, and obtain the first network identification information corresponding to the first device identification information;

[0127] a fourth generating module 34, configured to input the first network identification information into an information blocking management template corresponding to the information blocking management type, and generate an information blocking management instruction, wherein the information blocking management template includes an information blocking template and an information unblocking template, the information blocking operation corresponds to the information blocking template, the information unblocking operation corresponds to the information unblocking template, and the information blocking management instruction includes an information blocking instruction and an information unblocking instruction;

[0128] The fifth execution module 35 is used to execute the information blocking management instruction to implement information blocking management, where the information blocking management includes information blocking and information unblocking.

[0129] Another embodiment of the present invention discloses an information blocking management device 3 based on semantic analysis. Figure 3 Based on the corresponding embodiment, the device identification information includes an interval name and a device name, the network identification information includes a network configuration and an IP address, and the first obtaining module includes:

[0130] The sixth acquisition module is used to perform semantic analysis on the substation configuration description file to obtain the correspondence between the device name, network configuration, and IP address;

[0131] a seventh obtaining module, configured to perform semantic analysis on the intelligent electronic device information and obtain a correspondence between the interval name and the device name;

[0132] The eighth obtaining module is used to obtain the corresponding relationship between the interval name, device name, network configuration, and IP address according to the corresponding relationship between the device name, network configuration, and IP address and the corresponding relationship between the interval name and device name.

[0133] Another embodiment of the present invention discloses an information blocking management device 3 based on semantic analysis. Figure 3 Based on the corresponding embodiment, the sixth obtaining module is used to:

[0134] Parse the substation configuration description file based on regular expressions to obtain the correspondence between device name, network configuration, and IP address;

[0135] The seventh obtaining module is used for:

[0136] Perform semantic analysis on the intelligent electronic device information to obtain the correspondence between the interval information field and the device name;

[0137] The interval information field is parsed based on a regular expression to obtain the interval name and the corresponding relationship between the interval name and the device name.

[0138] Another embodiment of the present invention discloses an information blocking management device 3 based on semantic analysis. Figure 3 Based on the corresponding embodiment, the information blocking management template includes network transmission protocol information and port number information.

[0139] Another embodiment of the present invention discloses an information blocking management device 3 based on semantic analysis. Figure 3 On the basis of the corresponding embodiment, the device is applied to a substation monitoring system and a motion gateway.

[0140] Another embodiment of the present invention discloses an information blocking management device 3 based on semantic analysis. Figure 3 On the basis of the corresponding embodiment, the device 3 further includes:

[0141] a ninth obtaining module, configured to parse the IP table file to obtain an information blocking management record corresponding to the second network identification information, wherein the information blocking management record includes an information blocking record and an information unblocking record;

[0142] a tenth query module, configured to query, based on the second network identification information, a correspondence between the device identification information and the network identification information, and obtain second device identification information corresponding to the second network identification information, where the second device identification information corresponds to the information blocking management record;

[0143] An eleventh display module is used to display the second device identification information and the corresponding information blocking management record in a monitoring interface.

[0144] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0145] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0146] The present application also provides an electronic device, such as Figure 4 As shown, the electronic device 4 includes: at least one processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the at least one processor 40. When the processor 40 executes the computer program 42, the steps in any of the above-mentioned method embodiments are implemented.

[0147] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0148] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed, the steps in the above-mentioned various method embodiments are executed.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process in the above-mentioned embodiment method by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / electronic device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0150] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0151] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0152] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0153] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0154] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.< / target> < / target> < / communication>

Claims

1. A method for information blocking management based on semantic analysis, characterized in that: include: Perform semantic analysis on the substation's equipment ledger files to obtain the correspondence between equipment identification information and network identification information; When the user selects a first device in the device list operation interface to trigger an information blocking management request, obtaining the first device identification information and the information blocking management type corresponding to the information blocking management request, wherein the information blocking management type includes an information blocking operation and an information unblocking operation; querying, based on the first device identification information, a correspondence between the device identification information and the network identification information to obtain first network identification information corresponding to the first device identification information; inputting the first network identification information into an information blocking management template corresponding to the information blocking management type to generate an information blocking management instruction, wherein the information blocking management template includes an information blocking template and an information unblocking template, the information blocking operation corresponds to the information blocking template, the information unblocking operation corresponds to the information unblocking template, and the information blocking management instruction includes an information blocking instruction and an information unblocking instruction; The information blocking management instruction is executed to implement information blocking management, and the information blocking management includes information blocking and information unblocking.

2. The method according to claim 1, wherein The device identification information includes the interval name and the device name, and the network identification information includes the network configuration and the IP address. The semantic analysis of the substation equipment ledger file is performed to obtain the correspondence between the device identification information and the network identification information, including: Perform semantic analysis on substation configuration description files to obtain the correspondence between device names, network configurations, and IP addresses; Perform semantic analysis on the intelligent electronic device information to obtain the correspondence between the interval name and the device name; According to the correspondence between the device name, network configuration, and IP address and the correspondence between the interval name and the device name, the correspondence between the interval name, the device name, the network configuration, and the IP address is obtained.

3. The method according to claim 2, wherein The semantic analysis of the substation configuration description file is performed to obtain the corresponding relationship between the device name, network configuration, and IP address, including: Parse the substation configuration description file based on regular expressions to obtain the correspondence between device name, network configuration, and IP address; The performing semantic analysis on the intelligent electronic device information to obtain the corresponding relationship between the interval name and the device name includes: Perform semantic analysis on the intelligent electronic device information to obtain the correspondence between the interval information field and the device name; The interval information field is parsed based on a regular expression to obtain the interval name and the corresponding relationship between the interval name and the device name.

4. The method according to claim 1, wherein The information blocking management template includes network transmission protocol information and port number information.

5. The method according to claim 1, wherein The method is applied to a substation monitoring system and a motion gateway.

6. The method according to claim 5, wherein The method further comprises: Parsing the IP table file to obtain an information blocking management record corresponding to the second network identification information, wherein the information blocking management record includes an information blocking record and an information unblocking record; querying the correspondence between the device identification information and the network identification information according to the second network identification information to obtain the second device identification information corresponding to the second network identification information, where the second device identification information corresponds to the information blocking management record; The second device identification information and the corresponding information blocking management record are displayed in the monitoring interface.

7. A device for information blocking management based on semantic analysis, characterized in that: include: The first acquisition module is used to perform semantic analysis on the equipment ledger file of the substation to obtain the correspondence between the equipment identification information and the network identification information; A second obtaining module is configured to obtain, when a user selects a first device in the device list operation interface to trigger an information blocking management request, first device identification information and an information blocking management type corresponding to the information blocking management request, wherein the information blocking management type includes an information blocking operation and an information unblocking operation; a third query module, configured to query, based on the first device identification information, a correspondence between the device identification information and the network identification information, and obtain first network identification information corresponding to the first device identification information; a fourth generating module, configured to input the first network identification information into an information blocking management template corresponding to the information blocking management type, and generate an information blocking management instruction, wherein the information blocking management template includes an information blocking template and an information unblocking template, the information blocking operation corresponds to the information blocking template, the information unblocking operation corresponds to the information unblocking template, and the information blocking management instruction includes an information blocking instruction and an information unblocking instruction; The fifth execution module is used to execute the information blocking management instruction to implement information blocking management, where the information blocking management includes information blocking and information unblocking.

8. The device according to claim 7, wherein The device identification information includes an interval name and a device name, and the network identification information includes a network configuration and an IP address. The first obtaining module includes: The sixth acquisition module is used to perform semantic analysis on the substation configuration description file to obtain the correspondence between the device name, network configuration, and IP address; a seventh obtaining module, configured to perform semantic analysis on the intelligent electronic device information and obtain a correspondence between the interval name and the device name; The eighth obtaining module is used to obtain the corresponding relationship between the interval name, device name, network configuration, and IP address according to the corresponding relationship between the device name, network configuration, and IP address and the corresponding relationship between the interval name and device name.

9. The device according to claim 8, wherein The sixth obtaining module is used for: Parse the substation configuration description file based on regular expressions to obtain the correspondence between device name, network configuration, and IP address; The seventh obtaining module is used for: Perform semantic analysis on the intelligent electronic device information to obtain the correspondence between the interval information field and the device name; The interval information field is parsed based on a regular expression to obtain the interval name and the corresponding relationship between the interval name and the device name.

10. An electronic device, characterized in that: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method according to any one of claims 1 to 6.

Images