A risk identification method for a wind power system

Abstract

The application provides a risk identification method for a wind power system, relates to the technical field of electric power safety supervision data processing, and comprises the following steps: collecting control instruction sending and receiving timestamp data from a wind power system network communication link, identifying the transmission time consumption value of each control instruction, and establishing a communication performance dataset; based on the communication performance dataset, obtaining device response and adjustment completion timestamp records from an execution module, calculating the time difference value between instruction issuance and device adjustment completion, and forming a system response efficiency index library; based on a network security abnormal mode library, an attack risk classification model is established, the data mode of wind turbine power set value offset and control instruction change frequency is analyzed through the attack risk classification model, different types of network security threats are identified, and a security risk classification archive is generated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power safety supervision data processing, and particularly relates to a risk identification method for a wind power system. BACKGROUND

[0002] Wind power systems adjust subsystem operating parameters to adapt to environmental changes through data analysis and predictive management, ensuring the accuracy of system operation data and the reliability of management decisions. However, as the degree of digital operation of wind power systems increases, network security risk identification and operation supervision problems become increasingly prominent, becoming a key factor affecting the integrity of operation data and the intelligent management of the system. In particular, during data-intensive operations, malicious attackers can interfere with operation monitoring by disrupting the overall network communication architecture, including but not limited to control instruction tampering, communication link disruption, and monitoring protocol interference at multiple levels, thereby causing inaccurate data analysis and ineffective predictive management. In this comprehensive network threat environment, each control link of the wind power system as a key operation data collection and execution node, its data transmission process is vulnerable to operation risks, becoming a typical manifestation of network security management risks, leading to a decline in operation data quality. This not only threatens the accuracy of operation data analysis, but also may cause prediction management model bias or supervision mechanism failure, affecting the intelligent operation management level of the overall system. Existing methods have significant limitations in ensuring wind power system network security risk management identification. Traditional operation management mechanisms focus on data encryption or anomaly detection, but these methods often overlook the dynamic operation supervision characteristics of system response data synchronization during control instruction data transmission. For example, conventional management monitoring methods may not be able to timely detect the disconnection of control instruction data and system response data caused by data delay or tampering, especially when subjected to network man-in-the-middle attacks, the disconnection of control instruction data and execution feedback data is particularly evident. This limitation makes it difficult for wind power systems to maintain close operational management association between control data and actual system response data in a dynamic network environment. The core management difficulty lies in how to ensure efficient synchronization of operation supervision between wind power system control data and actual system response data. In the operation data processing process, after the control instruction data is issued from the system, the response data of each subsystem needs to be collected and managed within a certain time window to ensure the timeliness of network security risk identification. However, network attacks or transmission delays may cause the synchronization time of operation data to be extended, disrupting the synchronization operation supervision relationship between instruction data and system adjustment data collection. The lack of operation data synchronization supervision directly affects the system's ability to analyze and predict the management of environmental data changes. For example, when the running environment data suddenly changes, the control system requires each subsystem data to be updated quickly to match the current environmental data, but if the data is delayed or tampered with, the system response data may not be able to be fed back to the operation management system in time, causing the data analysis model to no longer match the actual environmental data, and thus causing prediction accuracy to decline or the operation supervision mechanism to fail. Therefore, how to supervise and ensure the synchronization processing between control data and system response data in a complex network environment has become a key operational problem for wind power system network security risk management identification. SUMMARY

[0003] The application provides a risk identification method for a wind power system, comprising:

[0004] Collecting control instruction timestamp data, constructing a communication performance dataset and a system response efficiency index library;

[0005] Evaluating the matching degree of communication transmission and system response, and generating an operation abnormal event record table;

[0006] Combining the operation abnormal event record table to construct a network security abnormal mode library;

[0007] Based on the network security abnormal mode library, training an attack risk classification model to generate a security risk classification archive;

[0008] Collecting equipment execution state data, calculating the deviation degree of actual execution state and expected setting state, and generating a comprehensive risk level;

[0009] Based on the comprehensive risk level, identifying an operation interruption risk, generating risk prediction data containing risk types and occurrence probability, and providing risk prediction information for operation management decision.

[0010] Further, the collecting control instruction timestamp data, constructing a communication performance dataset and a system response efficiency index library specifically comprises:

[0011] Collecting sending and receiving timestamp data of control instructions from a wind power system network communication link, calculating the time consumption value of each instruction transmission, and constructing a communication performance dataset;

[0012] Identifying equipment response and adjustment completion timestamp through the communication performance dataset, calculating the time difference value between instruction issuance and equipment adjustment completion, and forming a system response efficiency index library.

[0013] Further, the constructing a communication performance dataset comprises:

[0014] Collecting instruction sending logs from a control center, obtaining sending timestamp and instruction serial number, obtaining receiving timestamp of the corresponding serial number from a field device port, calculating the difference value between receiving timestamp and sending timestamp, and obtaining transmission delay value;

[0015] For the transmission delay value, obtaining network load rate and data retransmission times, eliminating abnormal values with excessive retransmission times, summarizing normal transmission delay values and network load rates, and generating a communication performance dataset.

[0016] Further, the identifying equipment response and adjustment completion timestamp through the communication performance dataset, calculating the time difference value between instruction issuance and equipment adjustment completion, and forming a system response efficiency index library comprises:

[0017] The query device calculates a time difference value between the adjustment completion timestamp and the sending timestamp by querying the device response confirmation timestamp and the adjustment completion timestamp through the communication performance data set instruction sequence number and sending timestamp, and obtains total device execution time;

[0018] The total device execution time is classified and summarized according to fan pitch, yaw and power regulation, and the total device execution time exceeding the standard is recorded as a response timeout event, the execution time and timeout frequency of each type of control are counted, and a system response efficiency index library is generated.

[0019] Further, the generation of the security risk classification archive includes:

[0020] The offset of the wind turbine power set value and the control instruction change frequency are analyzed by the attack risk classification model to identify the type of network security threat, and a security risk classification archive is generated according to the type of network security threat.

[0021] Further, the evaluation of the matching degree of communication transmission and system response to generate an operation abnormal event record table includes:

[0022] The matching degree of communication transmission time consumption and system execution response time delay in the monitoring time period is evaluated by the system response efficiency index library, the average execution time of each control type in the system response efficiency index library is extracted, the correlation deviation between transmission efficiency and response efficiency is identified, the average transmission delay value of the corresponding period in the communication performance data set is obtained, the difference value between the execution time and the transmission delay is calculated, and the difference value exceeding the standard is determined as a mismatch event;

[0023] For the mismatch event, the time sequence before and after the event is extracted, the correlation coefficient of transmission delay and execution response is calculated, the network load rate and device operating state below the threshold value are recorded, and an operation abnormal event record table is generated.

[0024] Further, the construction of the network security anomaly pattern library in combination with the operation abnormal event record table includes:

[0025] The wind turbine speed, power and blade angle set value time sequence is extracted from the historical communication log, and the change rule of control instruction sending frequency and the set value jump amplitude feature are extracted in combination with the operation abnormal event record table;

[0026] The set value change rate is calculated according to the change rule of control instruction sending frequency and the set value jump amplitude feature, the abnormal change point is recorded as the change rate exceeding the standard, and an abnormal fluctuation feature set is generated;

[0027] For the abnormal fluctuation feature set, the instruction sending frequency is counted, the moving average and standard deviation of the frequency sequence are calculated, the sending source IP address, target wind turbine number and operation type of the frequency exceeding the standard are extracted, and an abnormal access behavior record is constructed.

[0028] An isolated forest algorithm is used to detect abnormal access behavior, output an abnormal score, cluster to generate data tampering type, frequent operation type and unauthorized access type abnormal mode, and construct a network security abnormal mode library.

[0029] Further, the set value change rate is calculated according to the change rule of the control instruction sending frequency and the set value jump amplitude feature, the abnormal change rate is recorded as an abnormal jump point, and an abnormal fluctuation feature set is generated, including:

[0030] The speed and power set value time series are obtained from the historical database, the change rate is calculated, the abnormal change rate is marked as a jump event, the operation permission is verified, and an abnormal event set is generated;

[0031] The instruction sending frequency is compared with the standard operation frequency, the abnormal frequency and the set value deviation percentage are extracted, and an abnormal feature group is generated;

[0032] The blade angle, speed and power deviation values are extracted from the device data, the abnormal control events of the abnormal deviation are recorded, the dynamic time warping algorithm is used to identify the abnormal time sequence correlation, and a tampering trace library is constructed.

[0033] Further, the execution state data of the collection device is collected, the deviation degree of the actual execution state and the expected set state is calculated, and a comprehensive risk level is generated, including:

[0034] The actual values of the fan speed, power output and blade angle are collected, the deviation from the set value is calculated, and a real-time deviation data set is generated;

[0035] The threat level in the security risk classification file is queried, the parameter allowable deviation range is obtained, the abnormal deviation is recorded as a state anomaly, the execution response time delay is calculated, and a comprehensive risk level is generated.

[0036] Further, the threat level in the security risk classification file is queried, the parameter allowable deviation range is obtained, the abnormal deviation is recorded as a state anomaly, the execution response time delay is calculated, and a comprehensive risk level is generated, including:

[0037] The attack type identifier is extracted from the security risk classification file, the deviation rate of the actual value from the set value is calculated, the instruction execution time delay is recorded, and state evaluation data is generated;

[0038] The speed and power safety margin is calculated, the influence of power fluctuation on the power grid is evaluated, and the stability risk is determined;

[0039] According to the attack type severity weighted deviation rate, a comprehensive risk score is generated, which is mapped to a warning level to generate a graded warning signal.

[0040] The technical scheme provided by the embodiment of the application can include the following beneficial effects:

[0041] The application discloses a wind power system network security risk identification method, which solves the correlation analysis problem among communication performance, system response efficiency and network security threat. By collecting the sending and receiving time stamps of control instructions, calculating the transmission time consumption, establishing a communication performance data set, and combining with the device response time stamp, a system response efficiency index library is generated to evaluate the matching degree of communication and execution response, and identify abnormal events below the management threshold. The application further extracts the instruction frequency change and set value jump characteristics from the historical communication log and abnormal event record, establishes a network security abnormal pattern library, constructs an attack risk classification model, analyzes the power set value offset and instruction frequency pattern, and identifies potential data tampering and unauthorized access risk. Based on the current device state and security profile, the actual and expected state deviation is calculated, and the comprehensive risk level is generated in combination with the response time delay to predict the operation interruption risk caused by network delay and security threat. The application provides accurate risk prediction and supervision information by fusing communication performance, response efficiency and security analysis, and improves the stability and security of wind power system network operation. BRIEF DESCRIPTION OF DRAWINGS

[0042] Fig. 1 A flowchart of a risk identification method for a wind power system according to the present application.

[0043] Fig. 2 A schematic diagram of a risk identification method for a wind power system according to the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be described in detail below with reference to the drawings and specific embodiments.

[0045] The technical scheme in the embodiments of the present application will be described below with reference to the drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " represents the meaning of or, for example, A / B can represent A or B; "and / or" in this paper only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0046] Hereinafter, the terms "first" and "second" are used only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first" and "second" can explicitly or implicitly include one or more features. In the description of the embodiments, unless otherwise specified, the meaning of "multiple" is two or more than two.

[0047] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0048] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner to facilitate understanding.

[0049] It should be understood that in this application, "at least one (item)" means one or more. "More than one" means two or more. "At least two (items)" means two or three or more. "And / or" is used to describe the relationship between related objects, indicating that there can be three relationships. For example, "A and / or B" can mean: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural.

[0050] The character " / " generally indicates that the preceding and following objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any single or multiple items. For example, "at least one of a, b, or c" can be expressed as: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0051] Both "...when" and "if" indicate that a corresponding action will be taken under certain objective circumstances. They are not time limits, nor do they require a judgment action to be taken when the action is taken, nor do they imply any other limitations.

[0052] The method provided in this application embodiment can be executed by a risk identification device for wind power systems. This risk identification device for wind power systems can be an electronic device or a device applied within an electronic device, such as a risk identification module for wind power systems. The electronic device can refer to devices such as mobile phones or servers; this application embodiment does not limit this.

[0053] The technical solutions of the present invention will be clearly and thoroughly described below with reference to the accompanying drawings of the embodiments. The described embodiments are merely some embodiments of the present invention.

[0054] likeFigs. 1-2 The risk identification method for a wind power system according to the embodiment can specifically include the following steps.

[0055] In step S101, the sending timestamp data and the receiving timestamp data of the control instructions are collected from the wind power system network communication link, the transmission time consumption value of each control instruction is identified, and the communication performance data set is established.

[0056] The control instruction sending log is collected from the wind power system control center, the sending timestamp and the instruction sequence number of each instruction are read, the receiving timestamp of the corresponding sequence number is obtained from the field execution device port, and the transmission delay value is calculated by the difference between the receiving timestamp and the sending timestamp. For the transmission delay value, the current network load rate and the data retransmission number are obtained from the communication link monitoring module. If the retransmission number exceeds the preset threshold, the transmission delay value in this period is marked as an abnormal value and is excluded. The transmission delay values of the normal period and the corresponding network load rate are summarized to form the communication performance data set containing the delay distribution characteristics and the load correlation.

[0057] Specifically, in an embodiment, the data collection server of the wind power system control center scans the control instruction sending log file every 100 milliseconds, extracts the sending time data in the UNIX timestamp format and the 16-bit hexadecimal instruction sequence number contained therein. At the same time, the PLC controller of the field execution device returns an acknowledgement message to the control center immediately after receiving the control instruction, and the message carries the same instruction sequence number and the receiving time timestamp. By matching the sending and receiving records of the same sequence number, the transmission delay value of a single instruction is calculated by the difference between the two timestamps.

[0058] Specifically, the abnormal identification of the transmission delay value is realized based on a statistical method. The system maintains a sliding time window, and the window size is 5 minutes. The delay data statistical characteristics in the window are updated every minute. When the transmission delay value of a certain instruction exceeds 3 times the standard deviation of the delay mean value in the window, the value is determined as an abnormal value.

[0059] It should be noted that the communication performance data set is stored in a key-value pair structure, and the time period is used as the key. The corresponding value contains the average delay, delay standard deviation, network load rate mean value, and delay and load correlation coefficient in the period. These data provide a basis for subsequent network security risk assessment.

[0060] In step S102, based on the communication performance data set, the timestamp records of the device response and adjustment completion are obtained from the execution module, the time difference value between the instruction issuance and the device adjustment completion is calculated, and the system response efficiency index library is formed.

[0061] According to the sequence number of the instruction and the sending time stamp recorded in the communication performance data set, the device response confirmation time stamp and the parameter adjustment completion time stamp of the corresponding sequence number are inquired from the execution log of the wind turbine controller, the time difference value between the adjustment completion time stamp and the sending time stamp is calculated, and the total device execution time is obtained. According to the total device execution time, the three control types of wind turbine pitch, yaw and power adjustment are classified and summarized, if the total execution time of a certain type of control exceeds the preset multiple of the historical average value of this type, it is recorded as a response timeout event, the standard execution time and the timeout frequency of each type of control are counted, and the system response efficiency index library including the response time distribution and the execution completion rate is formed.

[0062] Specifically, in an embodiment, the wind turbine controller maintains three independent execution log files corresponding to pitch control, yaw control and power regulation control respectively. Each log file records the reception confirmation and execution completion events of the control instruction in chronological order. Specifically, in an embodiment, the wind turbine controller maintains an execution log of different types of control. Pitch control involves mechanical action, and the execution time is relatively long; yaw control needs to rotate the entire nacelle, and the execution time is the longest; power regulation is mainly achieved through electrical control, and the response speed is the fastest. The whole process of the wind power control system from receiving the control instruction to completing the parameter adjustment includes four stages of instruction analysis, safety check, execution action and state feedback. The start and end time of each stage is recorded in the execution log, and the total execution time is obtained by accumulating the time consumption of each stage. When the total execution time of a certain type of control exceeds 1.5 times of its standard time length, the system determines that it is a response timeout event. This timeout usually indicates that the mechanical parts are worn out or the communication link is congested.

[0063] It should be noted that the system response efficiency index library adopts a hierarchical storage structure, the top layer is divided according to the control type, and each control type contains four key indicators of average response time, time length standard deviation, timeout frequency and execution success rate, which provides quantitative basis for subsequent risk assessment.

[0064] Step S103, using the system response efficiency index library to evaluate the matching degree of the communication transmission time consumption and the system execution response time delay in the preset monitoring period, to identify the relevance deviation of transmission efficiency and response efficiency, and to generate an operation abnormal event record table when the matching degree is lower than the management benchmark threshold.

[0065] The average execution time data of each control type in the monitoring time period is extracted from the system response efficiency index library, and the average transmission delay value in the corresponding period is obtained from the communication performance data set, the difference between the execution time and the transmission delay is calculated, and if the difference exceeds the preset allowable deviation threshold, it is determined that there is a transmission and execution mismatch event. For the mismatch event, the transmission delay time series and the execution response time series 30 seconds before and after the event occurrence time are extracted, the linear correlation degree of the two series is calculated, and when the correlation coefficient is lower than the preset management reference threshold, the network load rate and the device running state parameters of the period are recorded to form the abnormal feature data containing the deviation value and the environment parameters. According to the deviation value size and the occurrence frequency in the abnormal feature data, hierarchical processing is carried out, the continuously occurring abnormal features are aggregated according to the time window, the number of abnormalities and the cumulative deviation value in each window are counted, and an operation abnormal event record table containing the abnormal occurrence time, the deviation level, the influence range and the duration is generated.

[0066] Specifically, in an embodiment, the determination of the transmission and execution mismatch event is based on the statistical analysis of the time difference value. In the normal operation state of the wind power system, there is a stable time relationship between the transmission delay of the control command and the device execution response, and usually the execution time should be 1.5 to 2 times greater than the transmission delay. When this proportional relationship is destroyed, it means that the network communication or device execution link appears abnormal.

[0067] Specifically, the matching degree of transmission delay and execution response is realized by correlation analysis. The system extracts the transmission delay time series and the execution response time series before and after the event occurrence time, and calculates the correlation coefficient of the two series. Under normal circumstances, the transmission delay and the execution response are positively correlated, and the correlation coefficient should remain above 0.7. When the correlation coefficient drops below 0.5, it indicates that the transmission layer and the execution layer are decoupled, which may indicate the occurrence of attack or failure. The system extracts the packet retransmission rate of the network layer, the route hop count change and the motor temperature, vibration amplitude of the execution layer as environment parameters, which together constitute the abnormal feature data.

[0068] It should be noted that the hierarchical processing of abnormal features adopts a three-level division standard. The deviation value less than the mean value plus one standard deviation is a slight abnormality, between one standard deviation and two standard deviations is a moderate abnormality, and more than two standard deviations is a serious abnormality.

[0069] Preferably, the aggregation period of the time window is set to 5 minutes, and the number of abnormal occurrences, the maximum deviation value and the cumulative duration in each window are counted. When moderate or severe abnormality occurs in three consecutive windows, the system determines that it is a persistent operation risk event.

[0070] Exemplarily, the operation abnormal event record table adopts a structured storage format, and contains seven fields of event number, start time, end time, abnormal level, deviation peak, affected fan number, and possible cause classification, wherein the possible cause classification includes three types of network delay, equipment aging, and malicious attack.

[0071] In a possible implementation, the system further records wind speed, wind direction, and power grid frequency data at the time of occurrence of the abnormal event, for subsequent analysis of the correlation between the abnormal event and environmental factors, and identification of high-risk periods under specific environmental conditions.

[0072] In step S104, historical communication log records are collected, and abnormal fluctuation patterns in the historical change trajectory of the set value of the wind power system are identified in combination with the operation abnormal event record table, the change in the sending frequency of the control instruction and the jump amplitude of the set value are extracted, and a network security abnormal pattern library is established for identifying potential data tampering and unauthorized access behavior.

[0073] The set value time series of the fan speed, power, and blade angle are extracted from the historical communication log, and the change rate of each set value at adjacent sampling time points is calculated by dividing the difference by the time interval in combination with the time period mark of the operation abnormal event record table. If the change rate exceeds a preset multiple of the average historical change rate of the set value type, an abnormal jump point is recorded, and an abnormal fluctuation feature set containing the jump time, jump amplitude, and set value type is formed. For the abnormal period in the abnormal fluctuation feature set, the hourly sending frequency of the control instruction in the corresponding period is counted, the moving average and the standard deviation of the frequency sequence are calculated, and when the frequency of a period deviates from the average value by more than a preset multiple of the standard deviation, the sending source IP address, target fan number, and control operation type of all instructions in the period are extracted from the communication log to construct an abnormal access behavior record. According to the abnormal access behavior record, an isolation forest algorithm is used to detect the abnormality of the multi-dimensional features of the access behavior, the set value jump amplitude, the instruction sending frequency, and the access source address change are taken as input features, and the abnormal score of each record is output. The records with an abnormal score exceeding a threshold value are clustered according to the feature similarity to identify three types of abnormal patterns of data tampering, frequent operation, and unauthorized access. Based on the three types of abnormal patterns, the typical feature vector, trigger threshold condition, and historical occurrence case of each type of pattern are extracted, the identification rules of the abnormal patterns, the risk level assessment standards, and the feature matching methods are associated and stored, and a network security abnormal pattern library for real-time detection of potential data tampering and unauthorized access behavior is established.

[0074] Specifically, in one embodiment, the data extraction of the historical communication log adopts a time-series database storage structure, and each log record contains five core fields, i.e. a timestamp, a control instruction type, a set value parameter, a sending source information and an execution result. The normal variation range of the fan rotating speed set value is an adjustment amplitude of 0.1-0.3 revolutions per second, the normal adjustment amplitude of the power set value is not more than 5% of the rated power each time, and the normal adjustment range of the blade angle is 1-3 degrees each time.

[0075] Specifically, the calculation of the change rate is implemented by using a difference method. The system extracts the set value sequence according to a sampling interval of 100 milliseconds, and for the set value Vi of the i-th sampling point and the set value Vi+1 of the i+1-th sampling point, the change rate is calculated as (Vi+1-Vi) / 0.1 seconds. When the fan is normally running, the change rate of the rotating speed set value should be kept within 3 revolutions per second. If a mutation of more than 10 revolutions occurs within 1 second, or the power set value changes by more than 20% of the rated power within 100 milliseconds, the system determines that it is an abnormal jump. Such abnormal jump is usually caused by malicious tampering or equipment failure. The record of the abnormal jump point not only contains the numerical information of the jump, but also includes the set value sequence of each 5 seconds before and after the jump, for analyzing the time sequence characteristics of the abnormal mode.

[0076] It should be noted that the statistics of the control instruction sending frequency is implemented based on a sliding time window, and the window size is 1 hour and the sliding step is 10 minutes. Under the normal running state, the control instruction sending frequency of the wind turbine generator is 20-50 per hour, which is mainly concentrated in the period with large wind speed change.

[0077] Preferably, in the construction process of the abnormal access behavior record, the system focuses on three types of key information: the geographical location attribute of the sending source IP address, the distribution law of the target fan number and the time sequence mode of the control operation type. When the same IP address sends the same control instruction to multiple fans within a short time, or an unauthorized IP address attempts to modify a key running parameter, these behaviors are marked as high-risk access.

[0078] In one possible implementation, the application of the Isolation Forest algorithm involves the construction of a multi-dimensional feature space. Each access behavior record is mapped to an eight-dimensional feature vector, including the set value jump amplitude, jump frequency, instruction sending frequency, frequency change rate, source IP change frequency, target device dispersion, operation type diversity, and time distribution uniformity. Isolation Forest builds isolated trees by recursively randomly selecting features and splitting values. Anomaly points can be isolated after a small number of splits due to their extreme feature values. The output anomaly score ranges from 0 to 1, and the closer the score is to 1, the higher the degree of abnormality. When the anomaly score exceeds 0.6, the access behavior is determined to be abnormal. Through feature analysis of a large number of abnormal behaviors, the system identifies three typical abnormal patterns: data tampering type, which is characterized by a large mutation of the set value and repeated modification within a short period of time; frequent operation type, which is characterized by an abnormal increase in the sending frequency of control instructions, exceeding 3 times the normal frequency; and unauthorized access type, which is characterized by access from unregistered IP addresses or abnormal operation during non-working hours.

[0079] Typically, the typical features of the data tampering type of abnormal pattern include: the speed set value changes by more than 50% of the rated speed within 1 second, the power set value appears negative or exceeds 1.5 times the rated power, and the blade angle set value exceeds the physical limit range. This type of anomaly is often accompanied by illegal acquisition of control authority. Further, the frequent operation type of abnormal pattern is mainly characterized by the abnormal intensive sending of control instructions, with more than 100 instructions per minute, which can cause the control system to overload and affect normal regulation response. The unauthorized access type of anomaly is identified through IP address whitelist mechanism and access time window restriction.

[0080] It can be understood that the network security anomaly pattern library is organized in a hierarchical index structure, with the top layer classified according to the three types of abnormal patterns, and each type of pattern containing multiple specific abnormal cases. Each case record includes feature vector values, environmental parameters at the time of triggering, impact range, and disposal measures. The pattern library supports fast retrieval based on feature similarity. When a new abnormal behavior occurs, the system calculates the Euclidean distance between its feature vector and each pattern in the library, and the pattern with the smallest distance is considered to be the most likely abnormal type.

[0081] Typically, in a network attack event, the attacker uniformly modifies the power set value of multiple wind turbines to an abnormal value during non-working hours, causing abnormal output of the wind farm. The system successfully identifies the unauthorized access type of abnormal pattern by analyzing the access time, operation mode, and set value change characteristics, providing an important reference for subsequent real-time detection.

[0082] The jump event of the setting value exceeding the normal change range in a short time and the time node of unauthorized modification are analyzed, the abnormal event of the control instruction sending frequency exceeding the standard operation frequency and the tampering trace of the setting value deviating from the original value are evaluated, the jump amplitude of the blade angle, the deviation value of the generator speed and the power are extracted, and the tampering trace library of abnormal amplitude is obtained.

[0083] The time sequence of the speed setting value and the power setting value in the wind power system historical database is obtained, the numerical difference of adjacent sampling points is divided by the sampling time interval to obtain the change rate, if the change rate exceeds the threshold multiple of the average historical normal change rate, it is marked as a jump event, and the user login record and operation permission level at this time are inquired to verify whether the parameter modification permission is possessed, and an abnormal event set containing the jump time, change amplitude and authorized state is obtained. According to the abnormal event set, the number of control instruction sending times in each hour is counted, and compared with the standard operation frequency specified in the wind power plant operation regulation, when the sending frequency exceeds the threshold multiple of the standard value, all setting value modification records in this period are extracted, the deviation percentage of the current setting value from the initial operation value is calculated, and an abnormal feature group containing the frequency exceeding the standard number of times and the value deviation degree is formed. For the abnormal period in the abnormal feature group, the measurement values of the blade angle, the generator speed and the output power are extracted from the real-time monitoring data of the equipment, the measurement values are subtracted from the corresponding setting values to obtain the deviation values, if the blade angle deviation, the speed deviation or the power deviation exceeds the respective allowed deviation range, it is determined as an abnormal control event, and the maximum value of each parameter deviation and the abnormal duration are recorded. Based on the abnormal control event record, the time sequence correlation between different parameter abnormalities is identified, the abnormalities with the same time characteristics are classified into a category, the features of each category are extracted, including the maximum value of parameter jump amplitude, the cumulative total amount of deviation and the total duration of abnormality, and a tampering trace library containing tampering type classification, abnormal severity quantization value and time sequence evolution feature is constructed.

[0084] Specifically, in an embodiment, the wind power system historical database adopts a distributed time sequence data storage architecture, and all setting value change records are stored with millisecond level timestamps as indexes. The sampling frequency of the speed setting value is 10 times per second, and the sampling frequency of the power setting value is 5 times per second, which ensures that instantaneous parameter changes can be captured.

[0085] Specifically, the calculation of the rate of change is based on the principle of discrete differentiation. For the sequence of speed set values, the system extracts the values Vi and Vi+1 of the two consecutive sampling points Ti and Ti+1, and the rate of change is calculated as (Vi+1-Vi) / (Ti+1-Ti), where the time difference is usually 100 milliseconds. Under normal conditions, the adjustment of the fan speed is gradual, and the adjustment amplitude is not more than 2% of the rated speed each time. When it is detected that the rate of change of a certain sampling point exceeds 3 times the average of the historical normal rate of change, the system marks this point as a potential jump event. The determination of the jump event not only considers the single-point anomaly, but also combines the change trend of the previous and subsequent 10 sampling points for comprehensive analysis. If more than 3 consecutive high-rate points appear within 500 milliseconds, it is confirmed as a jump event. Such a jump usually indicates that the set value is maliciously tampered with or that the control logic has a serious fault.

[0086] It should be noted that the user login record and operation permission verification are implemented through a multi-level authentication mechanism. The wind farm operation and maintenance personnel are divided into three permission levels: monitor, operator and administrator. Only the operator and the administrator have the parameter modification permission, and the modification range is strictly limited.

[0087] Preferably, the standard operation frequency defined in the wind farm operation procedure differs according to different time periods. The standard frequency during the daytime normal operation period is 30-50 operations per hour, and at night it is reduced to 10-20 operations per hour. When it is detected that the number of operations in a certain hour exceeds 2 times the standard value, the system enters a high-frequency operation warning state.

[0088] In one possible implementation, the deviation calculation involves a comprehensive evaluation of multiple parameters. The allowed deviation range of the blade angle is ±2 degrees, and a deviation beyond this range indicates that the actuator may be stuck or the control signal is abnormal. The allowed deviation of the generator speed is ±3% of the rated speed, and the allowed deviation of the power output is ±5% of the rated power. The system compares the set value with the actual measured value every 100 milliseconds, and when the deviation exceeds the allowed range for more than 5 seconds, it is determined to be an abnormal control event. The maximum value of the deviation is recorded for evaluating the severity of the abnormality, and the duration reflects the response capability of the system to return to normal. The similarity between two time series is measured by constructing a distance matrix, even if the two sequences are stretched or shifted on the time axis, the inherent correlation pattern can still be identified. First, the speed abnormal sequence, the power abnormal sequence, and the blade angle abnormal sequence are taken as inputs to construct the cumulative distance matrix between the three sequences. The minimum cumulative distance path is found by dynamic programming method, which reflects the time sequence correspondence between different parameter abnormalities. When the abnormal sequences of two parameters are highly consistent in time, that is, the regular path is close to the diagonal line, it indicates that the abnormalities of the two parameters have strong correlation, and are likely to come from the same tampering event or fault source. The correlation coefficient ranges from 0 to 1, and a coefficient greater than 0.7 is considered to have a significant association. Further, the classification of abnormal features is realized based on cluster analysis. The system projects the feature vectors of all abnormal events into a multi-dimensional space, and the feature vectors include mutation amplitude, frequency abnormality degree, duration, and affected parameter type dimensions. By calculating the Euclidean distance between the feature vectors, the abnormalities with similar distances are classified into the same class.

[0089] It can be understood that the structure design of the tampering trace library adopts a three-layer architecture. The top layer is divided into three categories according to the tampering type, namely parameter mutation type, frequent operation type and permission abnormality type. The middle layer records the typical feature mode of each type of tampering, including time sequence feature, amplitude feature and correlation feature. The bottom layer stores specific historical case data, each case including complete abnormal parameter sequence, environmental context information and disposal result.

[0090] For example, in a typical parameter mutation type tampering case, the attacker modifies the set value of the speed of 5 wind turbines from 1500 to 0 in an instant at 3 am, causing the wind turbine to brake urgently and the mechanical parts to bear a huge impact. The characteristics of this case include: a change rate of 15000 revolutions per second, no permission verification record, and multiple units abnormal at the same time. These characteristics are extracted and stored in the tampering trace library, serving as an important reference for identifying similar attacks.

[0091] In step S105, an attack risk classification model is established based on the network security anomaly mode library, and the data mode of the wind turbine power set value deviation and the control instruction change frequency is analyzed by the attack risk classification model to identify different types of network security threats and generate a security risk classification file.

[0092] The feature data of historical attack cases is extracted from the network security anomaly pattern library, including power setting value offset amplitude, offset duration, control command sending interval and frequency statistical value, the mapping relationship between the feature data and threat type label is trained by using a random forest algorithm, and an attack risk classifier containing multiple decision trees and feature weights is obtained. The attack risk classifier is used to process the real-time collected wind turbine operation data, the difference between the power setting value and the rated power is calculated, the offset percentage is obtained by dividing the rated power, the number of control command sending in a unit time is counted, if the offset percentage shows step change or the command frequency shows periodic fluctuation, the peak value, mean value and standard deviation are extracted as the attack behavior feature vector. The attack behavior feature vector is input into the classifier for matching calculation, and the threat type prediction result and confidence score are output. When the confidence exceeds a preset threshold, the threat is determined to be a service interference type, a parameter tampering type or a command replay type, and the threat occurrence time, the number of affected wind turbines and the abnormality degree score are recorded. Based on the threat type determination result, multi-dimensional classification coding is performed according to the attack source address, attack means feature and harm level, the continuous attack events of the same source are associated in time sequence, the attack frequency change trend and the intensity increasing rule are extracted, and a security risk classification file containing threat type identification code, risk level value and feature description text is constructed.

[0093] Specifically, in an embodiment, the historical attack cases of the network security anomaly pattern library are stored in index according to attack occurrence time, duration, and influence range. Each case record contains original power setting value sequence, control command log, network traffic data, and final threat qualitative result. The feature extraction process calculates the percentage value of the power offset amplitude relative to the rated power, records the offset duration in seconds, and counts the minimum value, average value, and standard deviation of the control command sending interval.

[0094] Specifically, the training process of the random forest algorithm involves ensemble learning of decision trees. A sample subset is randomly extracted from the historical cases, and each subset is used to train a decision tree. The construction of a single decision tree uses information gain or Gini coefficient as the node splitting criterion, and randomly selects part of the features for splitting decision at each node. The splitting threshold of the power offset amplitude feature is determined by calculating the information gain of different segmentation points, and the segmentation value that maximizes the purity improvement is usually selected. The training process generates 100 to 500 decision trees, and the depth of each tree is limited to 10 to 20 layers to prevent overfitting. The final classifier integrates the prediction results of all decision trees through a voting mechanism, each tree independently predicts the input sample, and the threat type with the most votes is output as the final classification result. The feature weight is obtained by calculating the average impurity reduction of each feature in all decision trees, and the greater the weight value, the greater the contribution of the feature to the classification.

[0095] It should be noted that the calculation of the power offset percentage adopts a sliding window method, and the window size is 10 seconds, which is slid once per second. In each window, the system extracts the maximum value, the minimum value and the average value of the power setting value, and calculates the ratio of the maximum offset to the rated power.

[0096] Preferably, the extraction of the attack behavior feature vector focuses on the timing pattern features. The step change pattern is manifested as multiple equal-amplitude jumps of the power setting value within a short time, and the interval between each jump is equal. This pattern is often found in automated attack scripts. The periodic fluctuation pattern is manifested as the control instruction sending frequency showing regular high-low alternation, with fixed cycle length and stable amplitude.

[0097] In one possible implementation, the identification of the threat type is realized based on feature pattern matching. The typical features of service disruption type threats include: the control instruction sending frequency exceeds the normal value by more than 10 times, and the duration is more than 30 seconds, the purpose is to overload the control system and make it unable to respond to normal operation. This type of attack does not directly modify the setting value, but consumes system resources through a large number of invalid instructions. The parameter tampering type threat is manifested as the power setting value or the speed setting value being modified to an abnormal value, such as the power setting being negative or exceeding 150% of the rated power. This modification may cause damage to the equipment. The instruction replay type threat is to intercept and repeatedly send historical control instructions, so that the fan performs outdated control actions under inappropriate environmental conditions. The system identifies such threats by analyzing the continuity of the instruction sequence timestamp and the repeatability of the content. The confidence score is calculated based on the degree of feature matching, and the confidence is 1.0 when the typical feature pattern is completely matched, and the confidence is calculated according to the proportion of the number of matched features when partially matched.

[0098] Illustratively, the record of the threat occurrence time is accurate to the millisecond level, and the number of affected fans is obtained by counting the number of fans that appear abnormal in the same time period. The abnormality degree score adopts a quantitative standard of 0 to 10, where 0-3 is low risk, 4-6 is medium risk, and 7-10 is high risk. The score is based on the degree of deviation, the duration and the potential loss. Further, the design of the multi-dimensional classification coding system takes into account the attack tracing and pattern recognition requirements. The attack source address coding contains the geographical location information and network home information of the IP address, which is used to identify the regional distribution of the attack. The attack means feature coding uses binary bits to represent the combination of different attack technologies. The system sets a time threshold of 5 minutes, and when the time interval between two attack events is less than the threshold and the source IP address is the same, it is determined as continuous attack. The attack frequency change trend is obtained by calculating the change rate of the number of attacks per unit time, and the intensity increasing law is identified by comparing the abnormality degree scores of the continuous attacks.

[0099] For example, in a real attack case, the attacker first sent query instructions at a frequency of 100 per second to interfere with the service, after the system response slowed down, the power setting value was modified to 0 to try to stop the fan, and finally the historical start instruction was replayed to try to restart the fan under improper conditions. The entire attack process lasted 15 minutes, involved 20 fans, and was coded as a composite high-risk threat event.

[0100] Step S106, collect current device execution state data, identify the deviation degree of actual execution state and expected set state in combination with the security risk classification archive, and generate a comprehensive risk level when the actual state deviation exceeds the operation management allowed range and the system execution response time delay exceeds the management threshold.

[0101] The current actual values of fan speed, power output and blade angle are collected from the device real-time monitoring interface, and the set values at the corresponding time are extracted from the control center database. The difference between the actual value and the set value is calculated to obtain the deviation value of each parameter, and a real-time deviation data set containing the deviation value and the collection time is formed. In analyzing the device state deviation, the current abnormal pattern is classified in real time by using the attack risk classifier, and the weight parameters of risk assessment are dynamically adjusted according to the threat type and confidence score output by the classifier. According to the real-time deviation data set, the threat level of the corresponding period in the security risk classification archive is queried, the allowed deviation range of each parameter is obtained from the wind farm operation standard, and if the speed deviation or power deviation exceeds the allowed range, it is recorded as a state anomaly. At the same time, the time interval from the instruction issuance to the device response completion is calculated as the execution response time delay. For the state anomaly and the execution response time delay, when the deviation lasts more than a preset length of time and the time delay exceeds the management threshold, the risk score is obtained by dividing the deviation amplitude by the upper limit of the allowed range and multiplying the time delay exceeding proportion. According to the interval where the score falls, the low, medium and high risk levels are determined, and a comprehensive risk level containing the abnormal parameter name, risk score and level identifier is constructed.

[0102] Specifically, in an embodiment, the device real-time monitoring interface uses OPCUA protocol to realize data collection, and the fan running parameters are updated every 100 milliseconds. The real-time values of the speed sensor, power transmitter and blade angle encoder in the SCADA system are read by the monitoring interface at the same time. These values are filtered and processed as the current actual values.

[0103] Specifically, the allowable deviation range defined in the wind farm operation standard is dynamically adjusted according to different operating conditions. When operating below the rated wind speed, the rotational speed allowable deviation is ±5% of the rated rotational speed, the power allowable deviation is ±8% of the rated power, and the blade angle allowable deviation is ±3 degrees. When operating above the rated wind speed, since the wind turbine needs to be power limited and load controlled, the allowable deviation range is correspondingly narrowed, the rotational speed deviation is reduced to ±3%, and the power deviation is reduced to ±5%. This dynamic adjustment mechanism ensures accurate identification of abnormal states under different operating conditions.

[0104] It should be noted that the calculation of the response delay is performed from the moment the control instruction is generated at the SCADA master station to the moment the wind turbine field controller returns the execution completion confirmation signal, including network transmission delay, instruction parsing delay, and mechanical execution delay.

[0105] Preferably, the risk score is calculated using a weighted scoring method. The ratio of the deviation amplitude to the upper limit of the allowable range is used as the deviation factor, with a value range of 1 to 3. The over-proportion is calculated as the ratio of the actual delay to the management threshold value, and when the delay is 1.5 times the management threshold value, the over-proportion is 1.5. The risk score is equal to the product of the deviation factor and the over-proportion multiplied by the basic weight coefficient 10, resulting in a score in the range of 0 to 100. For example, a score of 0-30 corresponds to low risk, 30-70 corresponds to medium risk, and 70-100 corresponds to high risk. This quantitative method allows different types of abnormalities to be compared and rated under a unified standard.

[0106] For example, when the wind turbine rotational speed deviation reaches 1.2 times the upper limit of the allowable range, and the execution response delay reaches 1.8 times the management threshold value, the risk score is calculated as 1.2 x 1.8 x 10 = 21.6, which is determined as a low risk level, and the system records the abnormality but does not trigger emergency disposal.

[0107] In one possible implementation, the comprehensive risk level not only includes the risk score and the level identifier, but also records the duration of the abnormality, the trend of the abnormal parameter change, and the status of the associated equipment, providing a comprehensive risk assessment basis for the operation and maintenance personnel.

[0108] By identifying the types of numerical tampering attacks and interference attacks through the security risk classification archive, analyzing the deviation degree of the actual operating state of the wind turbine from the expected control state and the system response delay duration, evaluating the equipment safety margin and the risk degree of grid stability under the influence of the attack, and combining the severity of the attack type and the system deviation degree to generate a graded warning signal including wind turbine emergency shutdown, power limitation, and equipment maintenance.

[0109] The attack type identifier is extracted from the security risk classification archive, the numerical tampering attack is identified according to the abnormal change of the power setting value, the interference attack is identified according to the abnormal increase of the instruction frequency, the actual operation parameters of the fan are obtained, the deviation rate is calculated by dividing the difference between the actual value and the setting value by the setting value, the time delay from the issuance of the instruction to the completion of execution is recorded, and the state evaluation data including the attack type, the deviation rate and the delay duration are formed. Based on the state evaluation data, the difference between the current rotating speed and the overspeed protection value is calculated as the rotating speed safety margin, the difference between the rated power and the current power is calculated as the power safety margin, the influence degree of the power fluctuation amplitude on the power grid frequency is evaluated, and if the fluctuation exceeds the preset threshold, it is determined as a high stability risk, and the device safety margin value and the power grid stability risk level are obtained. According to the safety margin value and the risk level, the attack type severity is assigned a weight coefficient, the numerical tampering attack weight is 0.8, the interference attack weight is 0.5, and the comprehensive risk score is obtained by multiplying the system deviation rate and accumulating. The score is mapped to the warning level interval. For the comprehensive risk score, if the score exceeds the high-risk threshold, an emergency shutdown signal is triggered, if it is in the medium-risk interval, a power limiting instruction is issued, and if it is in the low-risk interval, a maintenance reminder is issued, and a hierarchical warning signal including the warning level, the trigger condition and the execution action is constructed.

[0110] Specifically, in an embodiment, the security risk classification archive is stored in a structured database, and each record includes an attack type identification code, an attack feature vector, a historical occurrence frequency and a hazard level score. The identification basis of the numerical tampering attack includes that the power setting value suddenly becomes negative or exceeds 150% of the rated power, the rotating speed setting value instantaneously returns to zero or exceeds the overspeed protection value, and the blade angle setting value exceeds the physical limit range. The identification feature of the interference attack mainly reflects the abnormal increase of the control instruction sending frequency, which is normally 3-5 control instructions per minute, and the frequency of the interference attack can reach more than 100 per minute.

[0111] Specifically, the deviation rate is calculated by the relative deviation method, that is, the difference between the actual running value and the setting value is divided by the setting value, and then multiplied by 100% to obtain the deviation rate in percentage form. For the rotating speed parameter, the deviation rate calculation formula is (actual rotating speed - set rotating speed) / set rotating speed x 100%. When the deviation rate is positive, it means that the actual value is higher than the setting value, and when the deviation rate is negative, it means that the actual value is lower than the setting value. The absolute value of the deviation rate reflects the size of the deviation, which is an important indicator for evaluating the degree of system running abnormality.

[0112] It should be noted that the concept of safety margin comes from the device protection theory, which represents the safety distance between the current running parameter and the device protection action value. The rotating speed safety margin is calculated as the difference between the overspeed protection value and the current actual rotating speed. The smaller the difference, the closer the device is to the protection action boundary, and the higher the security risk. The power safety margin is considered from the perspective of overload protection, and the difference between the rated power and the current output power is calculated.

[0113] Preferably, the grid stability risk assessment focuses on the impact of power fluctuation on grid frequency. Sudden changes in wind turbine power can cause fluctuations in grid frequency, and when multiple wind turbines simultaneously experience power abnormalities, the cumulative effect can exceed the adjustment capacity of the grid. In the assessment process, the system calculates the proportion of power fluctuation amplitude to the total installed capacity of the wind farm. When this proportion exceeds 10%, it is determined to be a moderate stability risk, and when it exceeds 20%, it is determined to be a high stability risk. This assessment method takes into account the matching relationship between the scale of the wind farm and the bearing capacity of the grid.

[0114] In one possible implementation, the calculation of the comprehensive risk score uses a weighted accumulation method. The attack type severity weight is determined according to the damage degree of historical cases. Numerical tampering attacks are given a high weight of 0.8 because they can cause equipment damage. Interference attacks mainly affect system response efficiency and are given a medium weight of 0.5. The system deviation degree is reflected by the absolute value of the deviation rate. For every 10% increase in the deviation rate, the risk contribution value increases by 1 point. The delay duration is counted into the risk score at a rate of 0.5 points per second. The comprehensive risk score is equal to the attack type weight x 10 plus the deviation rate contribution value plus the delay contribution value. For example, the score range is set to 0-20 points. For example, 0-6 points correspond to low risk, 7-13 points correspond to medium risk, and 14-20 points correspond to high risk. This quantitative scoring mechanism enables comprehensive assessment of risk factors in different dimensions under a unified framework, providing clear criteria for graded early warning.

[0115] For example, when a numerical tampering attack is detected, the power deviation rate is 30%, and the response delay is 3 seconds, the comprehensive risk score is calculated as 0.8 x 10 + 3 + 1.5 = 12.5 points, falling into the medium risk interval, and the system triggers a power limiting instruction. Further, the execution actions of the graded early warning signals have clear priority and mutual exclusion relationship. The emergency shutdown signal has the highest priority, and once triggered, it immediately executes the wind turbine braking program, including blade pitch, generator off-grid and mechanical brake actions. The power limiting instruction reduces the wind turbine output power to below 50% of the rated power while maintaining the wind turbine on-grid operation. The equipment maintenance reminder sends an alarm message to the operation and maintenance personnel through the SCADA system, prompting to arrange inspection within 24 hours.

[0116] It can be understood that the early warning signal also contains detailed records of abnormal events, including the time of attack, duration, affected parameter type, peak deviation value, etc. These records are stored in a historical database, providing data support for subsequent accident analysis and defense strategy optimization.

[0117] For example, when a certain wind farm is subjected to a network attack, the system identifies that the numerical tampering attack causes the power setting values of 5 wind turbines to be modified to 0, the deviation rate reaches 100%, the safety margin decreases to a critical value, the comprehensive risk score is 18 points, the emergency shutdown warning is triggered, and the 5 wind turbines complete safe shutdown within 30 seconds, avoiding equipment damage and power grid accidents.

[0118] In step S107, the network delay and security threat are evaluated based on the comprehensive risk level, the interruption risk of operation management is identified, the potential security risk type and risk occurrence probability in the operation of the wind power system network are analyzed, and risk prediction and security supervision information are provided for operation management decision-making.

[0119] According to the score and level of the comprehensive risk level, the number of times and duration of network transmission delay exceeding the standard are extracted, the type and severity of security threats are identified, the frequency of control failure caused by delay is calculated, and if the frequency exceeds the preset threshold and the threat level is high, it is determined that there is an operation interruption risk, and a risk assessment set containing delay characteristics, threat type and interruption probability is obtained. Based on the risk assessment set, the trigger conditions and duration of historical interruption events are counted, three types of risks including data transmission interruption, control response failure and device communication offline are identified, and the conditional probability values and trigger thresholds of each type of risk are output. According to the conditional probability value, combined with the current network state parameters and threat event occurrence frequency, the occurrence probability of each type of risk in the future preset period is calculated, and if the probability exceeds the management threshold, the key inducement and propagation path of the risk are extracted to form risk prediction data and evolution trend. For the risk prediction data, integrate the risk type name, occurrence probability value and potential impact range, prioritize according to the probability and impact degree, and construct risk prediction information and security supervision guidance containing risk description, probability value and supervision focus.

[0120] Specifically, in one embodiment, the network delay data contained in the comprehensive risk level is processed by a time window statistical method. The system counts the number of delay abnormal events every 5 minutes, and records an abnormal delay event when the delay exceeds the normal value of 200 milliseconds for more than 3 times in the window. The judgment standard of control failure caused by delay is that the execution confirmation is not received within the specified time after sending the control command, or the deviation between the execution result and the expectation exceeds the allowed range.

[0121] Specifically, the construction of the Bayesian network is based on the historical interruption event database. The network nodes include four parent nodes of delay frequency, threat level, device state and network load, and one child node of operation interruption. Each node has a discrete state space, the delay frequency is divided into low, medium and high states, and the threat level is divided into no threat, low risk, medium risk and high risk. The conditional probability table is obtained by counting the occurrence frequency of interruption events under various combined conditions in the historical data.

[0122] For example, when the delay frequency is high, the threat level is high-risk, the device state is abnormal, and the network load is overloaded, the conditional probability of the operation interruption reaches 0.85. According to the current observed parent node state, the posterior probability of the child node is calculated. This probability inference method can handle uncertain information, and even if part of the node state is unknown, it can still give a reasonable risk assessment result.

[0123] It should be noted that the identification of the three types of risks is based on different feature patterns. The data transmission interruption risk is manifested as continuous multiple data packet loss, communication link state showing disconnection, and real-time data update stopping. The characteristic of the control response failure risk is that the control instruction is sent successfully but the device does not execute, or the execution result does not match the instruction requirement. The device communication offline risk is manifested as the loss of device heartbeat signal and the inability to obtain device state information.

[0124] Preferably, the calculation of the risk occurrence probability adopts a time series prediction method. The system constructs a time interval model of risk occurrence based on the time distribution law of historical risk events. By analyzing the occurrence frequency and time interval of each type of risk in the last 30 days, the average occurrence rate λ is calculated. Under the assumption of Poisson process, the probability of k times of risk occurrence in the future time period t is P(k) = (λt) k ×e (-λt) / k!. Wherein, P(k) represents the probability of k times of risk occurrence in the time period t, λ represents the average rate of event occurrence per unit time (or unit space), t represents the time length, k represents the number of event occurrences, e is the natural constant, and! is the factorial symbol. When the calculated single occurrence probability exceeds 0.3, it is considered that the risk is likely to occur in the prediction period.

[0125] In one possible implementation, the formation of risk prediction data involves the integration of multi-dimensional information. The system extracts the key causes of each type of risk, including external attack strength, internal system load, environmental factor change, etc. The propagation path analysis is realized by constructing a risk propagation graph, where nodes represent system components and edges represent risk propagation relationships. When a certain component has a risk, the downstream components that may be affected are identified by traversing the risk propagation graph. The evolution trend is obtained by time series analysis, and the system records the change curve of the risk index over time, smooths the noise by using the moving average method, and extracts the trend component. An upward trend indicates that the risk is intensifying and the monitoring level needs to be improved; a downward trend indicates that the risk is easing and the alert state can be appropriately reduced.

[0126] Exemplarily, when the network delay is frequently over-standard and there is a high-risk threat event, the system calculates that the probability of data transmission interruption is 0.42, the probability of control response failure is 0.38, and the probability of device communication offline is 0.25. The risk prediction shows that the comprehensive probability of operation interruption in the next 2 hours reaches 0.65. Further, the risk priority ranking adopts the risk matrix method. The horizontal axis represents the occurrence probability, which is divided into five levels of extremely low, low, medium, high, and extremely high; the vertical axis represents the impact degree, which is divided into five levels of slight, small, medium, serious, and catastrophic. The high-probability high-impact risk in the upper right corner of the matrix obtains the highest priority.

[0127] It can be understood that the content of safety supervision guidance includes key monitoring objects, monitoring frequency suggestions, abnormality determination thresholds, and emergency response plans. The system dynamically adjusts the supervision strategy according to the current risk situation, increases the monitoring frequency during high-risk periods, and reduces the abnormality determination threshold, so as to ensure timely discovery and disposal of risk events.

[0128] For example, in the typhoon season, the system predicts that the risk probability of network communication affected by weather in a certain wind farm is increased to 0.7, and suggests that the data acquisition frequency is increased from 1 time per minute to 1 time per 10 seconds, the delay threshold is reduced from 500 milliseconds to 300 milliseconds, and the typhoon emergency plan is preset, including local control mode switching and key data backup measures, which effectively reduces the risk of operation interruption caused by extreme weather.

[0129] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the embodiments should be regarded as exemplary and non-limiting, and the scope of the present application is defined by the appended claims rather than the above description, and all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present application. Any reference signs in the claims should not be regarded as limiting the claims involved.

Claims

1. A risk identification method for wind power systems, characterized in that, include: The system collects the sending and receiving timestamp data of control commands from the network communication link of the wind power system. It obtains the sending timestamp and command sequence number of the command from the command sending log and obtains the receiving timestamp corresponding to the command sequence number from the field device port. It calculates the difference between the receiving timestamp and the sending timestamp to obtain the transmission delay value. For the transmission delay value, it obtains the network load rate and the number of data retransmissions. It removes abnormal values ​​with excessive retransmissions and summarizes the normal transmission delay value and the network load rate to generate a communication performance dataset. By centralizing the instruction sequence number and sending timestamp in the communication performance data set, query the device response confirmation timestamp and adjustment completion timestamp, calculate the time difference between the adjustment completion timestamp and the sending timestamp, obtain the total execution time of the device, summarize the total execution time of the device according to the categories of wind turbine pitch, yaw and power regulation, record the total execution time exceeding the standard as a response timeout event, and statistically analyze the execution duration and timeout frequency of various types of control to generate a system response efficiency index library; Assess the matching degree between communication transmission and system response, and generate an operational anomaly event log table; Extract time series of wind turbine speed, power, and blade angle setpoints from historical communication logs. Combined with the operation anomaly event record table, extract the variation pattern of control command sending frequency and the characteristics of setpoint jump amplitude. Calculate the setpoint change rate based on the variation pattern of control command sending frequency and the characteristics of setpoint jump amplitude. Record the abnormal jump point as the rate of change exceeding the standard. Generate an abnormal fluctuation feature set. For the abnormal fluctuation feature set, count the command sending frequency, calculate the moving average and standard deviation of the frequency sequence, extract the source IP address, target wind turbine number, and operation type of the exceeding frequency, construct an abnormal access behavior record, use the isolated forest algorithm to detect abnormal access behavior, output anomaly scores, and cluster to generate data tampering, frequent operation, and unauthorized access anomaly patterns. Construct a network security anomaly pattern library. Based on the aforementioned network security anomaly pattern library, an attack risk classification model is trained to generate a security risk classification profile. Based on the equipment's execution status data, the degree of deviation between the actual execution status and the expected set status is calculated, and a comprehensive risk level is generated; Based on the comprehensive risk level, operational interruption risks are identified, and risk prediction data containing risk types and probabilities of occurrence is generated. This risk prediction data is used to provide risk prediction information for operation and maintenance management decisions.

2. The risk identification method for wind power systems according to claim 1, characterized in that, The generation of the security risk classification file includes: By analyzing the offset of wind turbine power setpoints and the frequency of control command changes using an attack risk classification model, network security threat types are identified, and a security risk classification profile is generated based on these network security threat types.

3. The risk identification method for wind power systems according to claim 1, characterized in that, The assessment of the matching degree between communication transmission and system response, and the generation of an operational anomaly event record table, includes: Using the system response efficiency index library, the matching degree between communication transmission time and system execution response delay within the monitoring period is evaluated. The average execution time of each control type in the system response efficiency index library is extracted, the correlation deviation between transmission efficiency and response efficiency is identified, the average transmission delay value of the corresponding period in the communication performance data is obtained, the difference between execution time and transmission delay is calculated, and the difference exceeding the standard is determined to be a mismatch event. For the mismatch event, extract the time series before and after the event, calculate the correlation coefficient between transmission delay and execution response, record the network load rate and device operating status below the threshold, and generate an operational anomaly event record table.

4. The risk identification method for wind power systems according to claim 1, characterized in that, The process involves calculating the setpoint change rate based on the frequency of control command transmissions and the characteristics of setpoint jump amplitudes, recording the rate of excessive change as an abnormal jump point, and generating an abnormal fluctuation feature set, including: Obtain the time series of speed and power setpoints from the historical database, calculate the rate of change, mark the rate of change exceeding the standard as a jump event, verify operation permissions, and generate an abnormal event set; The frequency of statistical command transmissions is compared with the standard operating frequency to extract the frequency of exceeding the standard and the percentage of deviation from the set value, and an abnormal feature group is generated. The blade angle, speed, and power deviation values ​​are extracted from the equipment data. Abnormal control events with deviations exceeding the standard are recorded. The dynamic time warping algorithm is used to identify the correlation of abnormal time sequences and to build a tampering trace database.

5. The risk identification method for wind power systems according to claim 1, characterized in that, The step of calculating the deviation between the actual execution state and the expected set state based on the equipment execution status data, and generating a comprehensive risk level, includes: Collect actual values ​​of fan speed, power output and blade angle, calculate the deviation from the set values, and generate a real-time deviation dataset. Query the threat level in the security risk classification file, obtain the allowable deviation range of parameters, record the deviation exceeding the standard as an abnormal state, calculate the execution response delay, and generate a comprehensive risk level.

6. A risk identification method for wind power systems according to claim 5, characterized in that, The system queries the threat level in the security risk classification file, obtains the allowable deviation range of parameters, records deviations exceeding the limit as abnormal states, calculates the execution response latency, and generates a comprehensive risk level, including: The attack type identifier is extracted from the security risk classification file, the deviation rate between the actual value and the set value is calculated, the instruction execution delay is recorded, and status assessment data is generated. Calculate the speed and power safety margins, assess the impact of power fluctuations on the power grid, and determine stability risks; A comprehensive risk score is generated based on the weighted deviation rate of attack type severity, which is then mapped to the warning level to generate a graded warning signal.

Images