Identification and processing method and system for digital power grid assets

Abstract

The invention relates to the technical field of digital power grid asset identification and processing, and provides a digital power grid asset identification and processing method and system, and the method comprises the steps: collecting the communication time sequence data of power equipment through edge monitoring equipment, extracting the features of message interval, response time delay, heartbeat cycle and the like, and constructing a multi-dimensional feature vector; and forming a dynamically updated device fingerprint database. Equipment behavior evolution is quantized by using a three-dimensional scoring system of communication activeness, load state and health degree, and intelligent diagnosis is realized through real-time comparison with a preset baseline: when an abnormal message interval and a sudden change point in stable heartbeat are detected, hidden scanning alarm is triggered, and non-critical communication is automatically isolated; and when the response time delay continuously deteriorates along with the reduction of the communication frequency, resource exhaustion early warning is started, and the service load is automatically migrated. And hidden scanning detection and resource exhaustion early warning are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of identification and processing of digital power grid assets, in particular to an identification and processing method and system of digital power grid assets. BACKGROUND

[0002] The content of this part only provides background information related to the present application, which may not constitute prior art.

[0003] With the acceleration of the construction of new power systems, power grid equipment presents a trend of large-scale and heterogeneous access. The traditional asset management mode based on manual inspection and static account is difficult to meet the real-time state perception demand of massive equipment. The communication behavior characteristics (such as message interaction law, service response rhythm, etc.) of edge devices in power communication network often imply key information of equipment operation state, but existing technologies are mostly limited to discrete log analysis, lacking dynamic modeling capability for time sequence characteristics.

[0004] In the prior art, a Chinese patent with the authorization announcement number CN119622458A discloses a non-intrusive digital power grid asset identification method and system based on deep learning, relating to the technical field of asset safety control, including collecting network flow data, and performing data preprocessing on the original data; building a first model based on network flow data; and making asset decisions for the equipment through the first method. The non-intrusive digital power grid asset identification method based on deep learning provided by the present application avoids additional burden and safety risks on power grid operation by passively listening to network flow instead of actively sending packets, selects recurrent neural network (RNN) as the core model, effectively captures the time dependence and periodic changes in network flow, provides strong technical support for asset identification, adopts One-Hot encoding feature engineering technology, improves the generalization ability of the model, introduces a Moore voting mechanism for final asset decision, improves convenience and flexibility, and achieves better results in safety, generalization ability and flexibility.

[0005] Although this patent emphasizes passive listening to network flow to complete asset identification, its core is still limited to shallow information extraction and single time sequence modeling of flow messages, and the overall idea is still limited to encoding and matching of static features such as protocol type, IP address and message length of discrete data packets, lacking in-depth description of the evolution of device communication behavior over a long period of time, resulting in difficulty in forming an effective dynamic evaluation mechanism when facing complex scenarios such as device load fluctuation, heartbeat anomaly or hidden scanning. SUMMARY

[0006] In order to solve the above technical problems, the purpose of the present application is to provide a kind of digital power grid asset identification and processing method and system, adopt multi-dimensional time sequence feature calculation to construct dynamic fingerprint library, realize the quantitative description of equipment communication behavior evolution;Through the three-dimensional scoring mechanism of fusing communication activity, load state and health degree, combined with preset baseline threshold and automatic response strategy, hidden scanning detection and resource exhaustion early warning are realized.

[0007] The purpose of the present application is realized by the following technical solutions:

[0008] In the first aspect, the present application provides a kind of digital power grid asset identification and processing method, comprising:

[0009] Through the monitoring device deployed at the edge of power communication network, the original time sequence data generated at the communication protocol port of the monitored power equipment is continuously collected, and the original time sequence data includes the message interaction interval data between devices, service request response delay data and device heartbeat message period data;

[0010] Multi-dimensional feature calculation is carried out on the original time sequence data to generate device feature vector;Feature vector includes statistical mean and variance value of message interaction interval, percentile distribution and continuous delay trend of service request response time delay, standard deviation feature and abnormal jump point of heartbeat message period;

[0011] Device feature vector is associated with device unique identifier and stored to form a fingerprint library containing device type identification field and real-time feature vector;

[0012] The mean value of message interaction interval is used to evaluate the communication activity level of the device, the percentile distribution of service request response time delay is used to determine the load state of the device, and the standard deviation of heartbeat message period is used to diagnose the running health degree of the device, and the dynamic asset score containing communication activity, load state and health degree in three dimensions is output through weighted algorithm fusion;

[0013] The dynamic asset score is updated every fixed period, and the message interaction interval, continuous delay trend and abnormal jump point in the current feature vector are compared with the preset baseline threshold;When it is detected that the variance value of message interaction interval exceeds the set multiple of preset baseline threshold, and heartbeat period remains stable but there is abnormal jump point, generate hidden scanning type security alarm;When it is detected that service request response time delay presents continuous rising trend and message interaction interval synchronously decreases, generate resource exhaustion type operation alarm;

[0014] For hidden scanning type alarm, according to the device unique identifier corresponding to the fingerprint library, automatic trigger non-heartbeat message isolation measures and shorten active detection period for target device;For resource exhaustion type alarm, according to the device unique identifier corresponding to the fingerprint library, automatically execute service request load balancing migration operation for target device.

[0015] Further, the service request response time delay percentile distribution calculation adopts a dynamic baseline adjustment algorithm, specifically including:

[0016] According to the automatic switching calculation model of the service period of the power equipment, the moving percentile baseline of the first twenty-four period data is used in the power consumption peak period, and the static percentile baseline of the first seventy-two period data is used in the regular period.

[0017] Further, the detection of abnormal jump points adopts a sliding time window difference algorithm, specifically including:

[0018] Taking the current heartbeat packet period data as the baseline, the standard deviation of the continuous five period data in the sliding window is calculated;

[0019] When it is detected that the current period value exceeds the preset range, it is marked as a suspected abnormal point;

[0020] If the same device appears three or more suspected abnormal points within a preset time, it is determined as an effective abnormal jump point.

[0021] Further, the calculation formula of the dynamic asset score is:

[0022]

[0023] In the formula, n is the number of packet interactions in the sampling window, t i is the arrival timestamp of the i-th packet, i is the packet index; P 95 is the 95th percentile of the service request response time delay percentile; p is the heartbeat period sampling point number, h q is the q-th heartbeat period length, q is the index of the heartbeat period, μ hb is the heartbeat period mean; S is the comprehensive score, w1 is the weight of the packet interaction interval statistical mean, w2 is the weight of the service request response time delay percentile, and w3 is the weight of the heartbeat packet period standard deviation.

[0024] Further, the steps of automatically triggering non-heartbeat packet isolation measures and shortening the active probe period include:

[0025] Upon receiving a hidden scan type alarm, extract the communication protocol type of the current session, and implement temporary blocking of all communication data packets other than the heartbeat packets that do not maintain the basic connection state of the power equipment; at the same time, compress the original detection interval to a set proportion of the original period.

[0026] Further, the steps of load balancing migration operation include:

[0027] For the power device node marked with core business, the non-critical services of the power device are preferentially migrated to the standby device of the same type, and the active detection frequency of the power device node is simultaneously increased to three times of the regular value.

[0028] Further, after automatically performing the service request load balancing migration operation, the method further comprises:

[0029] The handling effect evaluation of the resource exhaustion type operation alarm includes a load migration success rate indicator and a service response time delay back-off degree indicator, and when the expected effect is not achieved for two consecutive times, the device redundancy configuration deficiency alarm is automatically upgraded and the operation and maintenance work order system is pushed.

[0030] In a second aspect, the present application provides a digital power grid asset identification and processing system, comprising:

[0031] The data acquisition module is configured to continuously collect original time series data generated by the monitored power device at the communication protocol port through the monitoring device deployed at the edge of the power communication network, and the original time series data includes message interaction interval data, service request response time delay data and device heartbeat message period data of inter-device communication;

[0032] The feature extraction module is configured to perform multi-dimensional feature calculation on the original time series data to generate a device feature vector; the feature vector includes statistical mean and variance values of message interaction interval, percentile distribution and continuous delay trend of service request response time delay, standard deviation feature and abnormal jump point of heartbeat message period;

[0033] The fingerprint library module is configured to store the device feature vector in association with the device unique identifier to form a fingerprint library containing a device type identification field and a real-time feature vector;

[0034] The asset scoring module is configured to evaluate the device communication activity level based on the mean value of the message interaction interval, determine the device load state based on the percentile distribution of the service request response time delay, diagnose the device operation health degree based on the standard deviation of the heartbeat message period, and output a dynamic asset score containing three dimensions of communication activity, load state and health degree through a weighted algorithm fusion;

[0035] The alarm module is configured to update the dynamic asset score every fixed period, compare the message interaction interval, continuous delay trend and abnormal jump point in the current feature vector with the preset baseline threshold; when it is detected that the variance value of the message interaction interval exceeds the set multiple of the preset baseline threshold, and the heartbeat period remains stable but there is an abnormal jump point, a hidden scanning type security alarm is generated; when it is detected that the service request response time delay presents a continuous rising trend and the message interaction interval decreases synchronously, a resource exhaustion type operation alarm is generated.

[0036] The treatment module is configured to, for a stealth scanning type alarm, automatically trigger a non-heartbeat message isolation measure and shorten an active detection period for a target device according to a device unique identifier corresponding to a fingerprint library; and for a resource exhaustion type alarm, automatically perform a service request load balancing migration operation for the target device according to the device unique identifier corresponding to the fingerprint library.

[0037] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps corresponding to the method of the first aspect when executing the computer program.

[0038] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps corresponding to the method of the first aspect.

[0039] In summary, the technical scheme of the embodiments of the present application has at least the following advantages and beneficial effects:

[0040] The present application continuously collects original timing data such as message interaction intervals, service request response time delays, and heartbeat message periods generated by power device communication ports by deploying monitoring devices at the edge of the power communication network. The data is calculated in multiple dimensions to generate a device feature vector containing the statistical mean and variance of the message interaction intervals, the distribution characteristics and delay trend of the service response time delays, and the standard deviation of the heartbeat period and its abnormal jump points. The feature vector is associated with the device unique identifier to form a dynamic fingerprint library, which quantitatively describes the evolution of the device communication behavior. The system calculates a dynamic asset score by fusing three-dimensional indicators of communication activity (based on message interval mean), load state (based on response time delay distribution), and health (based on heartbeat period standard deviation). The current features (such as message interval variance, delay trend, and heartbeat jump point) are compared with the preset baseline threshold at regular intervals: when the message interval variance abnormally increases and the heartbeat is stable but there is an abnormal jump, a stealth scanning alarm is triggered, and the system automatically isolates the non-heartbeat messages of the target device and enhances the detection; when the response time delay continuously rises and the message interaction interval decreases, a resource exhaustion alarm is triggered, and the system automatically migrates the service load of the target device. By constructing a dynamic fingerprint library based on multi-dimensional timing features to quantitatively describe the behavior evolution, and based on a fusion three-dimensional scoring mechanism combined with baseline thresholds and automatic response strategies, stealth scanning detection and resource exhaustion early warning are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 A flowchart of a digital power grid asset identification and processing method provided by the present application;

[0042] Figure 2 A structural schematic diagram of a digital power grid asset identification and processing system provided by the present application;

[0043] Figure 3 A structural schematic diagram of an electronic device is provided. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations.

[0045] As Figure 1 shown, the method for identifying and processing a digital power grid asset provided by the embodiments of the present application comprises the following steps.

[0046] S101, continuously collecting original time sequence data generated by a monitored power device at a communication protocol port through a monitoring device deployed at the edge of a power communication network, wherein the original time sequence data comprises message interaction interval data of communication between devices, service request response delay data and device heartbeat message period data.

[0047] Specifically, three types of key time sequence data are continuously collected by using inherent communication interaction characteristics of the power device: the message interaction interval data of communication between devices reflects the device communication frequency characteristics, the time difference between adjacent message arrival times is recorded to quantify the device collaborative work rhythm; the service request response delay data records the timeliness of device processing external requests, the data contains the time span from service request sending to complete response receiving, and can effectively represent the device computing resource scheduling efficiency; the device heartbeat message period data establishes a time sequence observation benchmark for device running stability by periodically collecting device survival state announcement signals. The technical advantages of this multi-dimensional data collection mechanism are reflected in three aspects: first, the edge deployment mode avoids the time delay loss of the central node collection, ensuring the timeliness of the original data; second, the protocol port level monitoring can penetrate the network layer abstraction to directly obtain the real interaction characteristics of the device, which has higher precision than the traditional in-band monitoring means such as SNMP; finally, the combination of the three types of time sequence data forms a panoramic observation dimension of device communication behavior, service capability and running state, providing complete original data support for subsequent feature calculation.

[0048] S102, performing multi-dimensional feature calculation on the original time sequence data to generate a device feature vector; the feature vector comprises statistical mean and variance values of message interaction interval, percentile distribution and continuous delay trend of service request response delay, standard deviation feature and abnormal jump point of heartbeat message period;

[0049] Specifically, the system builds a feature vector system that can comprehensively depict the operation characteristics of power equipment by performing multi-dimensional feature calculation on the original time series data. The process first extracts two feature indicators, statistical mean and variance, from the message interaction interval data. The statistical mean reflects the average time interval of communication interaction between devices, and the variance represents the fluctuation degree of communication rhythm. The coordinated calculation of these two indicators enables the system to grasp the overall law of device communication and sensitively capture abnormal communication behavior.

[0050] For the processing of service request response time delay data, the system adopts a combination of dynamic percentile distribution calculation and continuous delay trend analysis, that is, a dynamic baseline adjustment algorithm that automatically switches the calculation model according to the business period of the power equipment. In other words, the percentile distribution calculation implements differentiated processing according to the characteristics of power business: in the peak load period, the moving percentile benchmark of the previous 24 periods is used. This dynamic adjustment mechanism can adapt to the changes in time delay characteristics caused by business volume fluctuations; in the regular period, the static percentile benchmark of the previous 72 periods is used, which improves the stability of the benchmark through a longer observation window. Continuous delay trend analysis identifies the continuous deterioration of response time delay through a sliding window algorithm.

[0051] The processing of heartbeat message period data focuses on extracting standard deviation features and abnormal jump points. The detection of abnormal jump points uses a sliding time window difference algorithm to calculate the dispersion of five consecutive period data based on the current period. When the value exceeds the historical fluctuation range of the device, it is marked as a suspected abnormal point. Through a three-time repeated occurrence verification mechanism, transient interference is excluded (i.e., if the same device has three or more suspected abnormal points within a predetermined time), and the final abnormal jump point record accurately reflects the mutation events of device operation stability.

[0052] S103, associate and store the device feature vector with the device unique identifier to form a fingerprint library containing the device type identification field and real-time feature vector.

[0053] Specifically, after completing the multi-dimensional feature calculation, the system needs to bind and store the feature vector representing the device running state (including message interaction interval statistical mean, variance value, service request response time delay percentile distribution, continuous delay trend, heartbeat message cycle standard deviation / abnormal jump point, etc.) with the device unique identifier (such as device MAC address, IP+port combination or device digital certificate serial number). This association is not simply data stacking, but uses a hierarchical index structure to achieve fast retrieval - taking the device type identification field as a first-level classification index (such as relay protection device, smart meter, substation monitoring host, etc.), the device unique identifier as a second-level precise positioning index, and the real-time feature vector as a dynamic attribute data layer. Further, the storage process uses time series database technology to realize version management of historical feature vectors, so that a sequence of feature vectors containing timestamps is formed under each device identifier, for example, a set of feature vector snapshots is stored every hour, thereby constructing the longitudinal evolution trajectory of device running state.

[0054] S104, evaluate the device communication activity level with the mean of message interaction interval, determine the device load state with the percentile distribution of service request response time delay, diagnose the device running health degree with the standard deviation of heartbeat message cycle, output the dynamic asset score containing three dimensions of communication activity, load state and health degree through weighted algorithm fusion.

[0055] Specifically, the system first quantifies the device communication activity level using the statistical mean of message interaction interval: the statistical mean reflects the frequency reference value of device communication interaction in unit time, for example, when the message interaction mean of relay protection device and monitoring host shortens from the reference value 15 milliseconds to 5 milliseconds, it indicates that the device communication frequency has significantly improved, and the system automatically labels the current active state of the device according to the pre-set activity classification threshold (such as 0-10ms for high activity, 10-20ms for medium activity). The advantage of this method is that it replaces subjective experience judgment with objective statistical quantity, avoiding misjudgment caused by network bandwidth fluctuations, and the low complexity characteristics of mean calculation adapt to the limited edge computing resources environment.

[0056] For the determination of the device load state, the system adopts the percentile distribution of service request response time as the core basis. Unlike the limitations of traditional average time delay indicators, the percentile distribution (especially the P95 / P99 high percentile value) can capture extreme delay scenarios. For example, when the P95 time delay of the service request of the smart meter rises from the benchmark value of 20 milliseconds to 80 milliseconds, it indicates that 5% of the request processing is severely timed out, at which time the system determines that the device enters a high load state in combination with the dynamic baseline of the business period (such as using the mobile percentile baseline during the peak electricity consumption period). The technical benefits of this design are reflected in two aspects: first, the percentile distribution eliminates transient peak interference and accurately reflects the sustained service capability of the device; second, the dynamic baseline mechanism avoids the failure of the fixed threshold in the business fluctuation scenario, so that the load evaluation result strictly corresponds to the real business pressure.

[0057] In the aspect of device health diagnosis, the system constructs a stability evaluation model based on the standard deviation characteristics of the heartbeat packet period. The standard deviation calculates the dispersion degree of the heartbeat period from the mean value. For example, when the standard deviation of the heartbeat of the substation monitoring host increases from 0.5 milliseconds to 3.2 milliseconds (the preset health threshold is 2.0 milliseconds), it indicates that the internal process scheduling of the device appears abnormal fluctuation. Compared with traditional methods such as heartbeat detection, the advantage of the standard deviation characteristics is that it can identify the internal state degradation of the device (such as CPU resource competition, memory leakage, etc.) early, and provide a warning window before the device is completely down. It is worth noting that this indicator needs to exclude the influence of abnormal jump points - jump points represent sudden failures (such as hardware instantaneous failure), while the standard deviation reflects the continuous deterioration trend, and the two form a complementary relationship in health evaluation.

[0058] Finally, the system integrates the above three-dimensional evaluation into a dynamic asset score through a weighted fusion algorithm. The specific calculation is as follows:

[0059] The mean value of the packet interaction interval statistics is calculated as:

[0060]

[0061] In the formula, μ is the mean value of the packet interaction interval statistics, n is the number of packet interactions in the sampling window, t i is the arrival timestamp of the i-th packet, and i is the packet index.

[0062] The service request response time percentile is the 95th percentile, that is, P 95 .

[0063] The standard deviation of the heartbeat packet period is calculated as:

[0064]

[0065] In the formula, σ is the standard deviation of the heartbeat period, p is the number of heartbeat period sampling points, h qis the length of the qth heartbeat period, q is the index of the heartbeat period, μ hb is the mean of the heartbeat period.

[0066] The dynamic asset score weighted fusion formula is:

[0067] S = w1 μ + w2 P + w3 σ (3) 95

[0068] In the formula, S is the comprehensive score, w1 is the weight of the statistical mean of the message interaction interval, w2 is the weight of the service request response delay percentile, and w3 is the weight of the heartbeat message period standard deviation.

[0069] Substitute formulas (1) and (2) into formula (3) to obtain:

[0070]

[0071] S105, update the dynamic asset score every fixed period, compare the message interaction interval, continuous delay trend, and abnormal jump point in the current feature vector with the preset baseline threshold; when it is detected that the message interaction interval variance value exceeds the preset baseline threshold by a set multiple, and the heartbeat period remains stable but there is an abnormal jump point, a hidden scanning type security alarm is generated; when it is detected that the service request response delay presents a continuous rising trend and the message interaction interval decreases synchronously, a resource depletion type operation alarm is generated.

[0072] Specifically, when it is detected that the message interaction interval variance value exceeds the historical baseline threshold by a set multiple (for example, 3 times the standard deviation range), and the heartbeat message period standard deviation is maintained in a stable interval but there is an abnormal jump point record, the system determines that there is a hidden scanning type security threat - the technical principle is based on the fact that when an attacker performs port scanning, it will inevitably cause the communication rhythm of the device to be chaotic (manifested as a dramatic fluctuation in message arrival interval, and a sharp increase in variance value), while the device itself has not collapsed (the heartbeat standard deviation is not over-standard), but the scanning behavior will cause occasional communication conflicts (generate heartbeat abnormal jump points). For example, the message interaction interval variance value of a certain relay protection device increases from the baseline 0.8ms 2 to 15ms 2 (exceeding 3 times the baseline threshold of 5ms 2 ), its heartbeat period standard deviation remains 1.1ms (lower than the healthy threshold of 2.0ms), but there are 3 heartbeat abnormal jump points recorded in the feature vector, at which time the system generates a hidden scanning alarm. The beneficial effect of this detection mechanism is that it accurately distinguishes between network attack behavior and device itself failure through the combination of variance anomaly and heartbeat jump, avoiding the high false alarm rate problem of traditional single flow threshold detection.

[0073] ​On the other hand, when the system detects that the service request response delay presents a continuous rising trend (identified by the continuous delay trend analysis that the slope is greater than 0) and the packet interaction interval statistics mean value is synchronously decreased, it is determined that a resource depletion type operation failure occurs. The principle is that device computing resource overload will cause service processing speed to decrease (delay continuously rising), and at the same time, the device will frequently send status requests to relieve the pressure (which is manifested as the shortening of packet interaction interval). For example, the smart meter under continuous high load, its service request P95 delay trend line presents an upward slope of +0.3ms / cycle, and the packet interaction interval mean value decreases from 12ms to 8ms, both of which form a significant negative correlation feature, at this time the system generates a resource depletion alarm. The reverse change characteristics of communication frequency and service capacity are used to identify the risk of resource depletion before the device is completely down, which is more reflective of the chain reaction under real business pressure than the traditional method of simply monitoring CPU utilization.

[0074] S106, for the covert scanning type alarm, according to the device unique identifier corresponding to the fingerprint library, the target device is automatically triggered to take non-heartbeat message isolation measures and shorten the active detection period; for the resource depletion type alarm, according to the device unique identifier corresponding to the fingerprint library, the target device is automatically executed to take service request load balancing migration operation.

[0075] Specifically, this step executes targeted closed-loop treatment strategies according to the alarm type generated in step S105 and the device unique identifier bound in the fingerprint library, thereby improving the active defense capability and operation reliability of digital power grid asset management. When the system determines a covert scanning type security alarm, the unique identifier of the target device is located according to the fingerprint library index, and then non-heartbeat message isolation measures are automatically triggered and the active detection period is simultaneously compressed.

[0076] The essence of the isolation measure is based on deep analysis of the power communication protocol, and accurately distinguishes the heartbeat message that maintains the basic connection state of the device from other service messages. Its characteristics are that only the heartbeat data stream directly related to the survival state of the device is released, and all non-heartbeat messages (including service instructions, data synchronization, service requests, etc.) are temporarily blocked. That is, when receiving a hidden scanning type alarm, the communication protocol type of the current session is extracted, and all communication data packets other than the heartbeat message that does not maintain the basic connection state of the power device are temporarily blocked. This can effectively interrupt the data transmission channel of the attack chain and force malicious behaviors such as port scanning and vulnerability detection to fail. At the same time, the system will compress the active detection period (for example, the original 60-second survival detection interval) for the target device to a set proportion of the original period (such as shortening to 20 seconds, which is one-third of the original period), and densely monitor the device state change by increasing the detection frequency. The principle is to shorten the attacker's stealth time window, providing higher time resolution for capturing instantaneous attack behavior. For example, when the device identified as "relay protection device-01" (device unique identifier: MAC 00:1A:C2:7B:00:47) in the fingerprint library triggers a hidden scanning alarm, the system immediately blocks all TCP 502 port (IEC 60870-5-104 protocol port) communications except heartbeat messages, and adjusts the active detection interval for the device survival state from 60 seconds to 20 seconds. This combination of treatment cuts off the scanning data return path at the early stage of the attack, and high-frequency detection provides real-time situation data for security analysis. Its beneficial effects are reflected in three aspects: first, the accurate isolation of non-heartbeat messages avoids the business interruption caused by traditional whole-machine network interruption, and maintains the basic running state of the device; second, the compression of the detection period realizes the near-real-time capture of threat behavior, and reduces the attack detection delay; and third, the accurate positioning based on the unique identifier ensures that the treatment measure only acts on the infected device, avoiding the expansion of the scope of the security protection.

[0077] For resource exhaustion type operation alarm, the system also automatically performs service request load balancing migration operation according to the device unique identifier associated with the fingerprint library; the key of the operation is to introduce a service priority layering mechanism, which is characterized in that for the power device node marked with core service (such as the substation monitoring host bearing the relay protection function), the non-critical service (such as data archiving, log uploading and other background tasks) of the power device is preferentially migrated to the standby device of the same type, rather than interrupting the core service flow, thereby ensuring the continuity of high-priority services such as power control commands; during the migration execution process, the system synchronously increases the active probe frequency of the target device to three times the regular value (such as from 1 time per minute to 3 times per minute), and the technical principle is to timely perceive the dynamic changes of the device load state through intensive monitoring, and to provide real-time data support for migration effect evaluation. For example, when the device identified as "smart meter cluster-05" (device unique identifier: IP192.168.5.201:2404) continuously triggers the memory resource exhaustion alarm, the system automatically migrates the batch uploading service of the meter reading data of the device to the standby meter in the same subnet (identifier: IP192.168.5.215:2404), and simultaneously increases the running index collection frequency of the main meter from 30 seconds / time to 10 seconds / time. The beneficial effects of this treatment are as follows: first, the hierarchical migration strategy based on service criticality ensures that the core function is not affected by resource allocation, improving the availability of the power grid service; second, automated migration reduces manual intervention delay and shortens the fault disposal time window.

[0078] Further, to quantitatively evaluate the effectiveness of the load balancing migration operation, the application adds a disposal effect evaluation module for resource exhaustion type operation alarm, which defines two core quantitative indicators: load migration success rate indicator (calculation formula: successful migration service request number / total migration request number x 100%) and service response time delay rollback degree indicator (calculation formula: (P95 time delay before migration-P95 time delay after migration) / P95 time delay before migration x 100%); the system continuously tracks these two indicators after the migration operation is completed, and if the load migration success rate is less than 95% or the time delay rollback degree does not reach the 30% threshold within two consecutive evaluation periods (for example, 10 minutes apart), a device redundancy configuration deficiency alarm is automatically generated and pushed to the operation and maintenance work order system. The double-indicator evaluation mechanism overcomes the one-sidedness of single success rate statistics, and verifies the disposal effect from two dimensions of service transfer efficiency and actual performance improvement. In addition, the continuous evaluation mechanism avoids false escalation caused by instantaneous network jitter, improving the accuracy of operation and maintenance decisions.

[0079] Based on the same inventive concept, as shown in Figure 2 The application provides a digital power grid asset identification and processing system, which comprises:

[0080] The data acquisition module 201 is configured to continuously collect original time sequence data generated by a monitored power equipment at a communication protocol port through a monitoring device deployed at an edge of a power communication network, and the original time sequence data includes message interaction interval data, service request response time delay data and device heartbeat message period data of inter-equipment communication.

[0081] The feature extraction module 202 is configured to perform multi-dimensional feature calculation on the original time sequence data to generate a device feature vector, and the feature vector includes statistical mean and variance values of the message interaction interval, percentile distribution and continuous delay trend of the service request response time delay, standard deviation feature and abnormal jump point of the heartbeat message period.

[0082] The fingerprint library module 203 is configured to store the device feature vector in association with a device unique identifier to form a fingerprint library containing a device type identification field and a real-time feature vector.

[0083] The asset scoring module 204 is configured to evaluate a device communication activity level by using the mean value of the message interaction interval, determine a device load state by using the percentile distribution of the service request response time delay, diagnose a device running health degree by using the standard deviation of the heartbeat message period, and output a dynamic asset score containing three dimensions of communication activity, load state and health degree through a weighted algorithm fusion.

[0084] The alarm module 205 is configured to update the dynamic asset score every fixed period, compare the message interaction interval, continuous delay trend and abnormal jump point in the current feature vector with preset baseline thresholds, generate a hidden scanning type security alarm when it is detected that the variance value of the message interaction interval exceeds a preset baseline threshold by a set multiple and the heartbeat period remains stable but has an abnormal jump point, and generate a resource depletion type operation alarm when it is detected that the service request response time delay presents a continuous rising trend and the message interaction interval synchronously decreases.

[0085] The disposal module 206 is configured to automatically trigger a non-heartbeat message isolation measure and shorten an active detection period for a target device according to a device unique identifier corresponding to the fingerprint library in response to a hidden scanning type alarm, and automatically perform a service request load balancing migration operation for the target device according to the device unique identifier corresponding to the fingerprint library in response to a resource depletion type alarm.

[0086] Based on the same inventive concept, as shown in Figure 3 The present application provides an electronic device, which comprises a memory 302, a processor 301 and a computer program stored in the memory 302 and capable of running on the processor 301, and the processor 301 implements a digital power grid asset identification and processing method when executing the computer program.

[0087] Based on the same inventive concept, the application provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the identification and processing method of the digital power grid asset.

[0088] The above only is the preferred embodiment of the present application, and is not used to limit the present application, and the present application can have various changes and changes for the person skilled in the art. Any modification, equivalent replacement, improvement and the like within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for identifying and processing digital power grid assets, characterized in that, include: By deploying monitoring equipment at the edge of the power communication network, raw time-series data generated by the monitored power equipment at the communication protocol port is continuously collected. The raw time-series data includes message interaction interval data between devices, service request response delay data, and device heartbeat message cycle data. Multidimensional feature calculations are performed on the original time-series data to generate device feature vectors; The feature vector includes the statistical mean and variance of the message interaction interval, the percentile distribution and continuous delay trend of the service request response latency, the standard deviation of the heartbeat message cycle and abnormal jump points. The device feature vector is associated with and stored with the device unique identifier to form a fingerprint database containing a device type identifier field and a real-time feature vector; The device communication activity level is assessed by the mean of the message interaction interval, the device load status is determined by the percentile distribution of the service request response latency, and the device health is diagnosed by the standard deviation of the heartbeat message cycle. Through weighted algorithm fusion, a dynamic asset score containing three dimensions of communication activity, load status, and health is output. The dynamic asset score is updated at fixed intervals, and the message interaction interval, continuous delay trend, and abnormal jump point in the current feature vector are compared with a preset baseline threshold. When the variance of the message interaction interval is detected to exceed a set multiple of the preset baseline threshold, and the heartbeat cycle remains stable but there is an abnormal jump point, a covert scanning security alarm is generated. When the service request response latency shows a continuous upward trend and the message interaction interval decreases synchronously, a resource exhaustion operation alarm is generated. For covert scanning alarms, based on the unique device identifier corresponding to the fingerprint database, non-heartbeat packet isolation measures are automatically triggered for the target device, and the active detection cycle is shortened; for resource exhaustion alarms, based on the unique device identifier corresponding to the fingerprint database, service request load balancing migration operation is automatically performed for the target device.

2. The method for identifying and processing digital power grid assets according to claim 1, characterized in that, The percentile distribution of the service request response latency is calculated using a dynamic baseline adjustment algorithm, specifically including: Based on the automatic switching calculation model of the operating period of the power equipment, the moving percentile benchmark of the previous 24 periods of data is used during peak electricity consumption periods, and the static percentile benchmark of the previous 72 periods of data is used during normal periods.

3. The method for identifying and processing digital power grid assets according to claim 1, characterized in that, The detection of abnormal transition points employs a sliding time window difference algorithm, specifically including: Based on the current heartbeat message cycle data, calculate the standard deviation of five consecutive cycles within the sliding window; When the current period value is detected to be outside the preset range, it is marked as a suspected anomaly. If the same device shows three or more suspected abnormal points within a preset time period, it is determined to be a valid abnormal transition point.

4. The method for identifying and processing digital power grid assets according to claim 1, characterized in that, The formula for calculating the dynamic asset score is as follows: In the formula, n represents the number of message exchanges within the sampling window, and t represents the number of messages exchanged. i P is the arrival timestamp of the i-th message, where i is the message index; 95 The 95th percentile is used for the service request response latency; p is the number of heartbeat cycle sampling points, h q Let μ be the duration of the q-th heartbeat cycle, where q is the index of the heartbeat cycle. hb This represents the average heart rate over a single heartbeat cycle. S represents the overall score, w1 represents the weight of the statistical mean of message interaction intervals, w2 represents the weight of the percentile of service request response latency, and w3 represents the weight of the standard deviation of the heartbeat message cycle.

5. The method for identifying and processing digital power grid assets according to claim 1, characterized in that, The steps for automatically triggering non-heartbeat packet isolation measures and shortening the active probe cycle specifically include: When a covert scanning alarm is received, the communication protocol type of the current session is extracted, and all communication data packets except for heartbeat messages that do not maintain the basic connection status of power equipment are temporarily blocked; at the same time, the original detection interval is compressed to the set ratio of the original cycle.

6. The method for identifying and processing digital power grid assets according to claim 1, characterized in that, The load balancing migration operation specifically includes the following steps: For power equipment nodes marked with core business, prioritize migrating the non-critical services of the power equipment to the same type of backup equipment, and simultaneously increase the active detection frequency of the power equipment nodes to three times the normal value.

7. The method for identifying and processing digital power grid assets according to claim 1, characterized in that, After automatically performing the service request load balancing migration operation, it also includes: The evaluation of the handling effect of the resource exhaustion type operation alarm includes load migration success rate index and service response latency fallback index. When the expected effect is not achieved in two consecutive evaluations, it is automatically upgraded to a device redundancy configuration missing alarm and pushed to the operation and maintenance work order system.

8. A system for identifying and processing digital power grid assets, characterized in that, include: The data acquisition module is used to continuously collect raw time-series data generated by the monitored power equipment at the communication protocol port through monitoring equipment deployed at the edge of the power communication network. The raw time-series data includes message interaction interval data between devices, service request response delay data, and device heartbeat message cycle data. The feature extraction module is used to perform multi-dimensional feature calculations on the original time-series data to generate device feature vectors; The feature vector includes the statistical mean and variance of the message interaction interval, the percentile distribution and continuous delay trend of the service request response latency, the standard deviation of the heartbeat message cycle and abnormal jump points. The fingerprint database module is used to associate and store the device feature vector with the device unique identifier to form a fingerprint database containing a device type identifier field and a real-time feature vector. The asset scoring module is used to evaluate the device's communication activity level by the mean of the message interaction interval, determine the device's load status by the percentile distribution of the service request response latency, and diagnose the device's operational health by the standard deviation of the heartbeat message cycle. Through weighted algorithm fusion, it outputs a dynamic asset score that includes three dimensions: communication activity, load status, and health. The alarm module is used to update the dynamic asset score at fixed intervals, comparing the message interaction interval, continuous delay trend, and abnormal jump points in the current feature vector with a preset baseline threshold. When the variance of the message interaction interval is detected to exceed a set multiple of the preset baseline threshold, and the heartbeat cycle remains stable but there are abnormal jump points, a covert scanning security alarm is generated. When the service request response latency shows a continuous upward trend and the message interaction interval decreases synchronously, a resource exhaustion operation alarm is generated. The processing module is used to automatically trigger non-heartbeat message isolation measures and shorten the active detection cycle for the target device in response to covert scanning alarms, based on the unique device identifier corresponding to the fingerprint database; and to automatically perform service request load balancing migration operations for the target device in response to resource exhaustion alarms, based on the unique device identifier corresponding to the fingerprint database.

9. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a method for identifying and processing digital power grid assets as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements a method for identifying and processing digital power grid assets as described in any one of claims 1 to 7.

Images