Electric power communication analysis system and method based on big data

Abstract

The invention discloses an electric power communication analysis system and method based on big data, and the method comprises the steps: collecting multi-source heterogeneous data, carrying out the sensitivity grading, and generating labels; gathering the data to a big data platform, and completing storage, partitioning and index construction; an asynchronous main control chain mechanism is constructed, high-optimal data is dispatched for rapid anomaly judgment, and other data is processed in parallel; performing desensitization mapping on the high-sensitivity data to generate a short-time mapping bill and performing desensitization analysis; issuing a local task for the low-confidence exception, collecting backflow data, and verifying and determining a high-risk event; restoring the sensitive data in the authorization window, and destroying the bill and the secret key after abnormity analysis is completed; and triggering network regulation based on an analysis result, and recording the whole process to an audit log. By introducing an asynchronous scheduling and reversible desensitization mechanism, high-efficiency anomaly analysis and whole-process traceability of the electric power communication big data on the premise of ensuring safety and compliance are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric power communication and big data analysis, and particularly relates to an electric power communication analysis system and method based on big data. BACKGROUND

[0002] With the development of the electric power system towards intelligence, distribution and high digitization, the electric power communication network has become the core support for the operation and dispatch, safety control and remote monitoring of the power grid. The existing electric power communication analysis method depends on a centralized data processing architecture and a static rule engine, and it is difficult to effectively deal with large-scale heterogeneous data from different communication links and device nodes. The processes of data collection, abnormality determination and event tracing generally adopt linear sequential execution, resulting in large response delay and poor robustness when facing sudden events, link failures or high sensitivity data processing, which seriously restricts the real-time and stability of the electric power communication network.

[0003] In actual application, the traditional method often uses fixed desensitization rules to process sensitive data, but lacks a dynamic reversible control mechanism, resulting in limited analysis accuracy, and the original information cannot be restored in the tracing stage, making it difficult to realize the dual requirements of controllable use and security compliance of data. The identification of data anomalies relies on rule presetting or static models, lacks flexible data scheduling mechanism and on-site feedback capability, and is prone to misjudgment or omission, which cannot meet the requirements of high timeliness and high reliability in the current complex electric power communication scene.

[0004] Therefore, how to provide an electric power communication analysis system and method based on big data is a problem that those skilled in the art need to solve. SUMMARY

[0005] One object of the present application is to provide an electric power communication analysis system and method based on big data. The present application comprehensively utilizes an asynchronous master control chain scheduling mechanism, a dynamic reversible desensitization mapping technology and a local confirmation and data backflow verification mechanism, and describes in detail the whole process of realizing rapid abnormality determination of high-priority data and end-to-end traceable processing under the premise of guaranteeing the security and compliance of sensitive data. The present application has the advantages of flexible analysis process, high response timeliness, safe data use, accurate abnormality identification and full-link traceability, and is particularly suitable for real-time monitoring and intelligent disposal of complex events in large-scale heterogeneous electric power communication networks.

[0006] According to an electric power communication analysis method based on big data according to an embodiment of the present application, comprising:

[0007] Collecting multi-source heterogeneous data at each node of the electric power communication network, classifying the sensitivity of the multi-source heterogeneous data, and generating data records containing sensitivity labels;

[0008] The data records are aggregated and stored through a big data platform, partitioned, and multi-dimensionally indexed;

[0009] Based on the data records, an asynchronous master chain scheduling mechanism is constructed, high-priority data records enter a rapid exception determination process, and the rest of the data records are processed in parallel in the master chain and shadow channel, and the master chain scheduling process remains weakly coupled and asynchronously advances;

[0010] For data records with sensitivity labels higher than a set threshold, a dynamic reversible desensitization mapping technology is used to generate a one-time short-term valid mapping ticket, and the analysis process is performed in a desensitized state.

[0011] In the rapid exception determination process, for suspected exceptions with low confidence or cannot be confirmed, a local confirmation task is automatically issued to the on-site device, the on-site device collects data and returns, and the analysis platform performs consistency checking on the return flow data and the master chain results to determine high-risk events and mark high-risk events that need to be traced.

[0012] For high-risk events that need to be traced, based on the generated mapping ticket within the authorized window, sensitive data is reversibly restored end-to-end, and the restored sensitive data is analyzed and determined for exceptions, and after the trace window is closed, the mapping ticket and the key are destroyed.

[0013] Based on the exception analysis results, automatically trigger bandwidth adjustment, route switching, flow limiting, traffic splitting or redundant link activation, and write exception data, analysis path, return flow data and trace record to an unalterable audit log.

[0014] Optionally, the multi-source heterogeneous data specifically includes link quality data, device operating state data, alarm log data and traffic indicator data in a power communication network.

[0015] Optionally, the sensitivity classification of multi-source heterogeneous data to generate data records containing sensitivity labels specifically refers to dividing multi-source heterogeneous data into high, medium and low sensitivity levels according to the node importance, link security level and business impact range involved in the data content, and adding a sensitivity label corresponding to the sensitivity level in the corresponding data record.

[0016] Optionally, the data records are aggregated and stored through the big data platform, partitioned, and multi-dimensionally indexed, specifically, the data records are divided into a plurality of fixed time windows according to time stamps of the data records to form corresponding time partitions, node sub-partitions are established in each time partition according to node identifiers, link sub-partitions are formed in each node sub-partition by performing consistent hash bucketing on link identifiers, and label sub-partitions are established in each link sub-partition according to combinations of delay levels, risk levels, and sensitivity labels, each label sub-partition is written into a corresponding partition path of distributed storage and a primary key index and a secondary index are generated, the primary key sequence is, and the secondary indexes are established on the link identifier, risk level, and sensitivity label fields to support fast retrieval and permission domain isolation.

[0017] Optionally, based on the data records, an asynchronous master chain scheduling mechanism is constructed, high-priority data records enter a fast exception judgment process, and the rest of the data records are processed in parallel in the master chain and the shadow channel, the master chain scheduling process is weakly coupled and asynchronously advanced, and includes:

[0018] A master chain is established, the master chain is composed of a priority queue, a fast exception judgment process processing unit, a merging unit, and a rollback queue; a shadow channel is established, the shadow channel is composed of a shadow processing queue, a feature completion unit, and a rule review unit, and the master chain and the shadow channel run in independent threads or processes respectively;

[0019] Data records are obtained, and a scheduling descriptor is generated for each data record;

[0020] The scheduling descriptors are routed and determined according to preset priority rules, high-priority data records are written into the priority queue, and other data records are written into the shadow processing queue;

[0021] Data records are taken out from the priority queue and sent to the fast exception judgment process processing unit, a mirror image of the data records is generated, and the mirror image is written into the shadow processing queue, the shadow channel performs feature completion and rule review on the mirror image, and only desensitization content and mapping ticket references are transmitted;

[0022] The master chain conclusion of the fast exception judgment process processing unit and the shadow conclusion of the shadow channel are verified for consistency in the merging unit, and when consistent, the conclusion is output and the data record processing is completed, and when inconsistent, the data record is written into the rollback queue and redistributed or a local confirmation task is triggered according to a rollback strategy;

[0023] The queue length and average processing delay of the priority queue and the shadow processing queue are periodically collected, and the threshold, batch size, and distribution ratio in the priority rule are adjusted according to the collection results;

[0024] Each routing, processing and merging action is written into a scheduling log, and a recoverable routing graph is generated.

[0025] Optionally, for the data record with a sensitivity label higher than a set threshold, a dynamic reversible desensitization mapping technology is used to generate a one-time short-time valid mapping ticket, and the analysis process is performed in a desensitized state, including:

[0026] From the data record entering the processing, the desensitization object is determined according to the sensitivity label threshold, and the corresponding data record sensitive field list is generated according to the sensitive field rule library;

[0027] For each sensitive field in the data record sensitive field list, a field-level reversible desensitization mapping is performed to generate a field-level mapping reference identifier, a reversible encoding with format preservation is used to generate a desensitization token with a field scope key, and a one-to-one mapping relationship is established with the original value of the sensitive field to form a mapping entry;

[0028] In the data record, the corresponding sensitive field is replaced with the desensitization token, the original value of the non-sensitive field is kept unchanged, and the field-level mapping reference identifier and the mapping ticket placeholder identifier are written in the data record metadata;

[0029] A mapping ticket is generated for the data record;

[0030] The mapping entry and the mapping ticket are written into the mapping ticket and key management unit, the ticket reference is obtained, and the ticket reference is written into the data record metadata and the scheduling descriptor;

[0031] The data record carrying the ticket reference is subjected to permission verification, and those not meeting the permission verification are not restored. When the ticket expires or is revoked, the mapping ticket, the corresponding mapping entry and the key material are deleted by the mapping ticket and key management unit, and the ticket identifier, the data record identifier and the deletion time are written into the tamper-proof audit log.

[0032] Optionally, in the rapid abnormality determination process, for suspected abnormalities with low confidence or unable to be confirmed, a local confirmation task is automatically issued to the on-site device, the on-site device collects data and returns, the analysis platform performs consistency check on the backflow data and the master control chain result, determines high-risk events and marks high-risk events that need to be traced, including:

[0033] The suspected abnormal event record is received, the data record identifier, the scheduling descriptor and the mapping ticket reference associated with the suspected abnormal event record are read, and the time window involved in the event is locked;

[0034] Based on the node identifier and the link identifier in the scheduling descriptor, candidate target devices and candidate sampling interfaces are retrieved from the topology library and the device capability library, and the target device set and the sampling interface set are filtered according to the risk level, the time delay level and the sensitivity label;

[0035] According to the rule base, a task generation process is performed on the target device set and the sampling interface set, a sampling frequency and a duration are determined according to a risk level and a time delay level, a sampling index and an execution action sequence are determined according to a link type and a device capability, and a local confirmation task draft is formed;

[0036] The local confirmation task draft is subjected to permission verification and compliance verification, a short-time access authorization is applied to a mapping ticket and a key management unit according to a sensitivity label, an authorized reference and a timeout policy are bound to the task draft, and the task draft is subjected to integrity signature, and a local confirmation task is generated;

[0037] The local confirmation task is issued to the target device through a control plane interface, a task issuance time stamp and a response state are recorded, and the target device that has not responded is subjected to re-issuance or switching to a standby target device according to a preset retry number and a fallback strategy;

[0038] The backflow data returned by the target device is subjected to time synchronization and alignment according to an event time window and a device time stamp, repeated and missing records are removed, and a backflow data set is generated;

[0039] The backflow data set and the output of the quick exception judgment process and the shadow channel processing result are subjected to consistency comparison, a consistency conclusion is output, the consistency conclusion is used to confirm or upgrade the risk level of the event, and the confirmed high-risk event is marked as a high-risk event that needs to be traced.

[0040] Optionally, for the high-risk event that needs to be traced, sensitive data is reversibly restored end to end within an authorized window based on the generated mapping ticket, the restored sensitive data is subjected to exception analysis and judgment, and the mapping ticket and the key are destroyed after the tracing window is closed, comprising:

[0041] The high-risk event that needs to be traced is received, an authorized window is applied, and an event time window, a data record identifier and a processing path are bound;

[0042] Within the authorized window, the mapping ticket and the key management unit are called to retrieve the corresponding field-level mapping entry, the end-to-end reversible restoration is performed on the desensitized field by using the mapping relationship contained in the mapping ticket and the session key, a restored data set is generated and subjected to integrity check and time alignment;

[0043] Based on the restored data set, the quick exception judgment process output and the backflow data are combined to perform exception feature comparison and association verification, and an exception analysis and judgment result is formed;

[0044] The mapping ticket, the mapping entry and the session key are destroyed at the end of the authorized window, and a tracing session identifier, a ticket identifier, a data record identifier and a processing path digest are written into an unalterable audit log.

[0045] According to an embodiment of the present application, a power communication analysis system based on big data comprises the following modules:

[0046] A data collection and classification module is configured to collect multi-source heterogeneous data, perform classification, and generate data records.

[0047] A data aggregation and indexing module is configured to aggregate and partition the data records and establish multi-dimensional indexes.

[0048] A master chain scheduling module is configured to construct an asynchronous master chain scheduling mechanism, and to distribute the data records to a fast decision-making process or a shadow channel according to priorities.

[0049] A reversible desensitization processing module is configured to perform field-level desensitization on high-sensitive data, and to generate a short-time valid mapping ticket.

[0050] A local confirmation and verification module is configured to generate a local confirmation task, collect device backflow data, and compare the data with master chain results, identify high-risk events, and mark traceability requirements.

[0051] A restoration and abnormality analysis module is configured to restore sensitive data by calling a mapping ticket within an authorized window, complete abnormality analysis and positioning, and destroy related tickets and keys after the window is closed.

[0052] A disposal and audit module is configured to execute abnormality disposal strategies, and to write abnormality data, analysis paths, backflow data, and traceability records into an unalterable audit log.

[0053] The present application has the following advantages:

[0054] (1) The present application proposes a power communication analysis method based on big data to solve the problems of fixed process, rigid scheduling, and data processing delay in existing power communication analysis methods. After data aggregation and partitioning, an asynchronous scheduling mechanism composed of a master chain and a shadow channel is introduced, so that the data processing flow can be dynamically distributed according to priorities. High-risk and high-timeliness data can be directly entered into a fast abnormality decision-making process, and the remaining data can be processed in parallel in the shadow channel. This avoids the global blocking and bottleneck failure problems of traditional linear processing mode in high-concurrency scenarios, and improves the flexibility of the processing flow and the robustness of the overall network.

[0055] (2) The application generates a one-time short mapping ticket for high sensitivity data through a dynamic reversible desensitization mapping technology, maintains the data desensitization state in the analysis process, and prevents unauthorized sensitive information leakage. When there is a traceability requirement, end-to-end reversible restoration can be performed based on the mapping ticket and the key within the authorized window, ensuring data integrity and authenticity. After the authorized window is closed, the ticket and the key are immediately destroyed to prevent secondary leakage, taking into account security compliance and business availability, and solving the technical contradiction between insufficient analysis and inability to trace under the traditional static desensitization mechanism.

[0056] (3) In the abnormality determination link, the application introduces a local confirmation and data backflow verification mechanism. For suspected abnormalities with low confidence or unable to be confirmed, the platform automatically generates a local confirmation task and issues it to the field equipment. The supplementary data collected in the field is backflowed to the platform and the main control chain result for consistency comparison, and finally determines the event level and marks the traceability requirement, realizing the closed-loop cooperation of platform-side rapid determination and field real-time sensing, effectively reducing the false positive rate and the false negative rate, ensuring the accuracy and traceability of abnormal analysis, and comprehensively improving the security protection capability and intelligent analysis level of the power communication network. BRIEF DESCRIPTION OF DRAWINGS

[0057] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and serve to explain the principles of the application, and do not constitute a limitation of the application. In the drawings:

[0058] Figure 1 A flowchart of a power communication analysis method based on big data is proposed for the application;

[0059] Figure 2 A structural schematic diagram of a power communication analysis system based on big data is proposed for the application. DETAILED DESCRIPTION

[0060] The application will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams that only schematically illustrate the basic structure of the application, and therefore only show the components related to the application.

[0061] REFERENCE Figure 1 A power communication analysis method based on big data, comprising:

[0062] Collecting multi-source heterogeneous data at each node of the power communication network, classifying the sensitivity of the multi-source heterogeneous data, and generating data records containing sensitivity labels;

[0063] Converging and storing the data records through a big data platform, partitioning the data records, and establishing multi-dimensional indexes;

[0064] Based on the data records, an asynchronous master chain scheduling mechanism is constructed, high-priority data records enter the rapid exception determination process, and the remaining data records are processed in parallel in the master chain and shadow channel. The master chain scheduling process maintains weak coupling and asynchronous advancement.

[0065] For data records with sensitivity labels higher than the set threshold, a dynamic reversible desensitization mapping technology is used to generate a one-time short-term valid mapping ticket, and the analysis process is performed in a desensitized state.

[0066] In the rapid exception determination process, for suspected abnormalities with low confidence or unconfirmed, local confirmation tasks are automatically issued to on-site devices, the on-site devices collect data and return, and the analysis platform performs consistency checking on the return flow data and the master chain results to determine high-risk events and mark high-risk events that need to be traced.

[0067] For high-risk events that need to be traced, based on the generated mapping ticket within the authorized window, sensitive data is reversibly restored end-to-end, and the restored sensitive data is subjected to abnormal analysis and determination. After the traceability window is closed, the mapping ticket and the key are destroyed.

[0068] Based on the abnormal analysis results, bandwidth adjustment, route switching, flow limiting, traffic splitting or redundant link activation are automatically triggered, and abnormal data, analysis path, return flow data and traceability records are written into an unalterable audit log.

[0069] In this embodiment, the multi-source heterogeneous data specifically includes link quality data, device operating state data, alarm log data and traffic indicator data in the power communication network.

[0070] In this embodiment, the sensitivity classification of multi-source heterogeneous data and the generation of data records containing sensitivity labels specifically refer to dividing multi-source heterogeneous data into high-sensitivity, medium-sensitivity and low-sensitivity levels according to the node importance, link security level and business impact range involved in the data content, and adding sensitivity labels corresponding to the sensitivity levels in the corresponding data records.

[0071] In this embodiment, the data records are aggregated and stored through the big data platform, partitioned, and multi-dimensional indexes are established. Specifically, the data is divided into several fixed time windows according to the timestamps of the data records, forming corresponding time partitions, node sub-partitions are established in each time partition according to node identifiers, link sub-partitions are formed by consistent hash bucketing of link identifiers in each node sub-partition, and label sub-partitions are established in each link sub-partition according to the combination of delay levels, risk levels, and sensitivity labels. The label sub-partitions are written to the corresponding partition paths of the distributed storage and primary key indexes and secondary indexes are generated. The primary key sequence is 〈time partition, node identifier, link bucket, delay level, risk level, sensitivity label〉. Secondary indexes are established on link identifiers, risk levels, and sensitivity labels to support fast retrieval and permission domain isolation.

[0072] In this embodiment, based on the data records, an asynchronous master chain scheduling mechanism is constructed, high-priority data records enter the fast exception judgment process, and the remaining data records are processed in parallel in the master chain and shadow channel. The master chain scheduling process maintains weak coupling and asynchronous advancement, including:

[0073] A master chain is established, which is composed of a priority queue, a fast exception judgment process processing unit, a merging unit, and a rollback queue. A shadow channel is established, which is composed of a shadow processing queue, a feature completion unit, and a rule review unit. The master chain and the shadow channel run in independent threads or processes respectively;

[0074] Data records are obtained, and a scheduling descriptor is generated for each data record. The scheduling descriptor includes a timestamp, a node identifier, a link identifier, a sensitivity label, a delay level and a risk level that can be obtained by partition index, a valid time window, and a processing version number;

[0075] The scheduling descriptor is routed according to a preset priority rule. High-priority data records are written to the priority queue, and other data records are written to the shadow processing queue. The priority rule takes the sensitivity label, delay level, risk level, and valid time window as the criterion and supports online updating. The priority rule includes:

[0076] When the sensitivity label of a data record is high, it is directly assigned to the priority queue for fast processing;

[0077] When the estimated processing delay of a data record is lower than the set delay threshold, it is preferentially entered into the priority queue to ensure real-time performance;

[0078] When the risk level of a data record reaches or is higher than the warning level, it is preferentially entered into the priority queue for exception judgment;

[0079] When the remaining time of a data record to the end of its business effective time window is less than a set time limit, the data record is preferentially entered into a priority queue to prevent data expiration;

[0080] When the sensitivity, time delay and risk level of a data record are at an intermediate level, a comprehensive priority value is calculated by preset weights, and data records with a priority value higher than a threshold are entered into a priority queue, and data records with a priority value lower than the threshold are entered into a shadow processing queue;

[0081] Data records are taken out of the priority queue and sent to a fast exception judgment process processing unit, a mirror image of the data record is generated, and the mirror image is written into the shadow processing queue. The shadow channel performs feature completion and rule review on the mirror image, and only passes on the de-sensitized content and the mapping ticket reference;

[0082] The main link conclusion of the fast exception judgment process processing unit and the shadow conclusion of the shadow channel are subjected to consistency verification in a merging unit. When consistent, the conclusion is output and the data record processing is completed. When inconsistent, the data record is written into a rollback queue and redistributed or triggers a local confirmation task according to a rollback strategy. The main link conclusion refers to the exception analysis result generated after high-priority data records are processed in the fast exception judgment process by an asynchronous master chain scheduling mechanism, including exception type, risk level, timestamp and associated link. The shadow conclusion refers to the result generated after the same data records as the master chain are independently analyzed in a parallel processing path by the shadow channel, including exception type, risk level, timestamp and associated link.

[0083] The queue length and average processing time delay of the priority queue and the shadow processing queue are periodically collected, and the threshold, batch size and distribution ratio in the priority rule are adjusted according to the collection results. The queue length and average processing time delay refer to the real-time number of data records to be processed in the priority queue and the shadow processing queue within a scheduling period, and the average time experienced from the data record entering the queue to the output result of the corresponding processing unit.

[0084] Each routing, processing and merging action is written into a scheduling log, and a recoverable routing graph is generated. The scheduling log records the timestamp, data record identifier, source queue, target processing unit, processing version number, conclusion abstract and mapping ticket reference. The recoverable routing graph is generated based on the timestamp, data identifier, source and target processing unit information recorded in the scheduling log, and a directed graph composed of nodes and edges is generated in the order of flow and stored in a parseable format.

[0085] The asynchronous master chain scheduling mechanism of the application realizes rapid abnormality determination of high-priority data and delayed processing of low-priority data through the double-channel parallel architecture of the master chain and the shadow channel, improves the overall processing real-time performance and system stability. The master chain processes high-sensitivity, high-risk and time-sensitive data first to ensure the immediate response of critical events. The shadow channel performs feature completion and rule review on the mirror data to form an independent shadow conclusion, which is verified for consistency with the master chain conclusion to effectively reduce the probability of false positives and false negatives. Through the dynamic adjustment mechanism of the priority rule, the system can adaptively optimize resource allocation according to the real-time queue length and processing delay to avoid global congestion. The introduction of scheduling logs and recoverable routing graphs ensures the traceability and compliance of abnormal events by retaining the processing path, determination basis and trace evidence of each data record. Compared with the prior art, the application takes into account the safety of sensitive data, the real-time performance of abnormality determination and the verifiability of analysis results, providing an efficient, reliable and auditable technical path for security analysis in the large-scale data environment of power communication.

[0086] In this embodiment, for data records with sensitivity labels higher than a set threshold, a dynamic reversible desensitization mapping technology is used to generate a one-time short-time valid mapping ticket, and the analysis process is performed in a desensitized state, including:

[0087] From the data records entering the processing, determine the desensitization object according to the sensitivity label threshold, and generate the corresponding data record sensitive field list according to the sensitive field rule library, wherein the sensitive field rule library specifically refers to a set of field-level security control rules that are pre-established and continuously maintained, which defines and identifies information fields that may involve privacy, confidentiality or critical business according to data type, business category and security level, including field name, data format, value range, sensitivity level and corresponding desensitization strategy, which is used to accurately match and extract target fields that need to perform desensitization operation in the processing process;

[0088] Perform field-level reversible desensitization mapping on each sensitive field in the data record sensitive field list to generate a field-level mapping reference identifier, generate a desensitization token using reversible encoding with format preservation and field scope key, and establish a one-to-one mapping relationship with the original value of the sensitive field to form a mapping entry, which contains field identifier, original value digest, desensitization token, valid time window, permission domain and version number. The field-level reversible desensitization mapping for each sensitive field in the sensitive field list is specifically:

[0089] Read the original value of the sensitive field from the data record, parse the data type, length, character set and format characteristics, establish field scope information, and provide constraint conditions for desensitization processing without changing the original structure and format of the field;

[0090] The original field value is reversibly encoded by a field scope key, including preserving the number of value bits, date format and string pattern, and generating a de-identification token combined with a unique field identifier and a timestamp, so that the same field can be correctly restored in the same permission domain;

[0091] The field identifier, original value digest, de-identification token, valid time window, permission domain and version number are combined to form a mapping entry, which is stored in a controlled mapping management table to realize a one-to-one reversible mapping relationship between the original value and the de-identification token, and to ensure that the mapping entry can only be accessed and restored within the authorized range;

[0092] In the data record, the corresponding sensitive field is replaced with the de-identification token, and the original value of the non-sensitive field is kept unchanged, and the field-level mapping reference identifier and the mapping ticket placeholder identifier are written in the data record metadata;

[0093] A mapping ticket is generated for the data record, which includes a ticket identifier, a data record identifier, a sensitive field list, a field-level mapping reference identifier set, a permission domain, a valid time window, a revocation flag and an audit serial number, wherein the mapping ticket is generated for the data record, specifically:

[0094] Based on the data record identifier, a global unique ticket identifier is generated based on a timestamp and a random number, and a one-to-one correspondence is established between the ticket identifier and the data record identifier;

[0095] The sensitive field list and the field-level mapping reference identifier set corresponding to the data record are obtained from the field-level reversible de-identification mapping step, and are written in the ticket structure in the order of the fields to ensure that each de-identification token is bound to the corresponding field one by one;

[0096] According to the business scenario and the security policy, the authorized access range, the start and end time are written in the ticket, and the revocation flag is initialized to the unrevoked state, and the audit serial number is generated for the non-tamperable log record;

[0097] The generated mapping ticket is stored in the mapping ticket management table, and a primary key index is established according to the ticket identifier, and a secondary index is established according to the data record identifier, to support authorized access and fast retrieval, and to ensure that the ticket is automatically invalidated or destroyed after the end of the valid time window;

[0098] The mapping entry and the mapping ticket are written into the mapping ticket and key management unit, the ticket reference is obtained, and the ticket reference is written into the data record metadata and the scheduling descriptor, wherein the mapping ticket and the key management unit are an independent security module for securely storing the mapping ticket, the field-level mapping entry and the key, and providing authorized access and audit, which is based on distributed key-value storage using Raft consensus protocol, database transparent encryption, hardware security module (HSM) key management, RBAC-based permission control, two-factor authentication and WORM non-tamperable audit log construction;

[0099] The data record carrying the ticket reference is subjected to permission verification, and is not restored if the permission verification is not satisfied, and when the ticket expires or is revoked, the mapping ticket and the key management unit delete the mapping ticket, the corresponding mapping entry and the key material, and write the ticket identification, the data record identification and the deletion time into the tamper-proof audit log.

[0100] The present application realizes precise, controllable and traceable protection of high sensitive data by introducing field-level reversible desensitization mapping and mapping ticket management mechanism. The field-level reversible desensitization mapping generates a unique desensitization token for each sensitive field and establishes a one-to-one mapping relationship without changing the original field structure and format, thereby ensuring the usability of data in the analysis process is not affected, while being accurately restored under authorized conditions. The mapping ticket centrally manages the mapping relationship of sensitive fields, and binds the effective time window, permission domain and audit information, cooperates with the distributed consistency storage of the mapping ticket and the key management unit, the hardware security module key management, the RBAC permission control and the tamper-proof audit log, to ensure the security and compliance of the mapping data in the whole life cycle. It effectively prevents unauthorized access and long-term retention risks of sensitive data, realizes the whole-process controllable and reversible of data in the transmission, processing and traceability links, balances the data security and business analysis demand, and improves the security, auditability and compliance of the system.

[0101] In the rapid exception determination process, the local confirmation task is automatically issued to the field device for suspected abnormality with low confidence or unconfirmed, the field device collects data and returns, the analysis platform performs consistency check on the backflow data and the main control chain result, determines the high-risk event and marks the high-risk event that needs to be traced, including:

[0102] Receiving a suspected abnormal event record, reading the data record identification, scheduling descriptor and mapping ticket reference associated with the suspected abnormal event record, and locking the time window involved in the event;

[0103] Retrieving candidate target devices and candidate sampling interfaces from a topology library and a device capability library based on the node identifier and the link identifier in the scheduling descriptor, filtering a target device set and a sampling interface set according to a risk level, a time delay level and a sensitivity label, wherein the topology library and the device capability library refer to a power communication network resource information set established and dynamically maintained before deployment, the topology library records the unique identifier of each node in the network, the physical and logical connection relationship, the link attribute, the transmission path and the redundant link condition, and the associated information can be quickly retrieved according to the node identifier and the link identifier; the device capability library records the model, the hardware configuration, the interface type, the supportable sampling and diagnosis function, the maximum number of concurrent tasks, the interface bandwidth and the processing performance of each type of communication device, the available sampling interfaces and the capability limitation can be queried according to the device identifier, and the combination of the two provides basic data support for accurate filtering of target devices and sampling interfaces;

[0104] Performing a task generation process on the target device set and the sampling interface set according to a rule library, determining the sampling frequency and the duration according to the risk level and the time delay level, determining the sampling index and the execution action sequence according to the link type and the device capability, and forming a local confirmation task draft, wherein the rule library refers to a task generation control rule set preset according to the operation characteristics of the power communication network, the device capability and the security policy, which is used to standardize the sampling frequency, the duration, the index and the execution sequence to ensure the safe and efficient execution of the local confirmation task;

[0105] Performing permission verification and compliance verification on the local confirmation task draft, applying short-time access authorization to a mapping ticket and a key escrow unit according to the sensitivity label, binding the authorized reference and the timeout policy to the task draft, and performing integrity signature on the task draft to generate a local confirmation task;

[0106] Downlink the local confirmation task to the target device through a control plane interface, record the task downlink timestamp and the response state, and reissue or switch the standby target device for the target device that does not respond according to the preset retry number and the fallback strategy, wherein the fallback strategy specifically includes:

[0107] When the target device does not respond within the timeout time for a plurality of times, switching the task to the standby device on the same link for execution, and recording the switching reason and the time;

[0108] When there is no standby device available on the link, reissuing the task after reducing the sampling frequency and the sampling index complexity to reduce the device load and improve the success rate;

[0109] When the task cannot be executed after a preset number of retries, marking the task as failed and writing it into an abnormal task queue, triggering manual intervention or a remote diagnosis process;

[0110] Receiving the backflow data returned by the target device, performing time synchronization and alignment according to the event time window and the device timestamp, eliminating repeated and missing records, and generating a backflow data set;

[0111] Conducting consistency comparison between the backflow data set and the output of the rapid abnormality judgment process and the processing result of the shadow channel, outputting a consistency conclusion, confirming or upgrading the risk level of the event according to the consistency conclusion, and marking the confirmed high-risk event as a high-risk event that needs to be traced, and the consistency comparison between the backflow data set and the output of the rapid abnormality judgment process and the processing result of the shadow channel is specifically:

[0112] Aligning the backflow data set according to the timestamp, node identifier and link identifier, ensuring that the data source and processing object correspond one by one, comparing the consistency of the output of the rapid abnormality judgment process and the processing result of the shadow channel in terms of abnormality type, risk level, occurrence time and associated link, and if the field values are completely consistent, it is determined that the consistency is consistent.

[0113] If there is a difference in risk level or abnormality type, it is determined that the consistency is inconsistent, and the difference field and difference value are recorded.

[0114] The present application introduces a dynamic retrieval mechanism of topology library and device capability library, combines the node identifier and link identifier in the scheduling descriptor, realizes the accurate screening of suspected abnormal event associated devices and sampling interfaces, avoids the low efficiency and error risk caused by traditional manual or static matching mode. The rule library is used to constrain the task generation process, so that the sampling frequency, duration and execution index are optimally configured under the premise of controllable risk, and the execution efficiency and coverage accuracy of local confirmation task are improved. In the task issuing link, through the combination of permission and compliance verification and short-time access authorization, the unauthorized operation and sensitive data leakage are effectively prevented; and a multi-layer rollback strategy is designed to ensure that the task can still be completed as much as possible in complex scenarios such as device failure and link interruption, thereby enhancing the resilience and availability of the system. The three-way consistency comparison mechanism of backflow data, main chain and shadow channel provides a high-reliability criterion for event confirmation and risk level evaluation, avoiding misjudgment and omission of single-path judgment. The present application realizes rapid verification, accurate positioning and efficient tracing of suspected abnormalities, significantly shortens the disposal delay and improves the accuracy and traceability of abnormality judgment.

[0115] In the embodiment, for the high-risk event that needs to be traced, the sensitive data is reversibly restored end to end within the authorized window based on the generated mapping ticket, and the restored sensitive data is subjected to abnormality analysis and judgment, and the mapping ticket and the key are destroyed after the tracing window is closed, comprising:

[0116] Receiving the high-risk event that needs to be traced, applying for an authorized window and binding the event time window, data record identifier and processing path;

[0117] Within the authorized window, the call mapping ticket and key management unit retrieve the corresponding field-level mapping entries, use the mapping relationship contained in the mapping ticket and the session key pair to perform end-to-end reversible restoration on the de-sensitized field, generate a restored data set and perform integrity check and time alignment, and the use of the mapping relationship contained in the mapping ticket and the session key pair to perform end-to-end reversible restoration on the de-sensitized field is specifically:

[0118] Read the field-level mapping reference identifier set contained in the mapping ticket, and retrieve the corresponding mapping entries in the mapping ticket and the key management unit to obtain the field identifier, de-sensitization token, original value digest and valid time window;

[0119] Call the session key to decrypt and format the de-sensitization token, and convert the restored value into usable data that is completely consistent with the original field according to the field scope information recorded in the mapping entry;

[0120] Insert the restored field value into the data structure according to the original field order of the data record, ensure that the restored data set is completely consistent with the de-sensitized data in content, format and field position, and perform integrity check and time stamp alignment on the restored result, and eliminate data fields not within the authorized window;

[0121] Based on the restored data set, combined with the output and backflow data of the fast exception judgment process, perform exception feature comparison and correlation verification to form an exception analysis and judgment result, and the execution of the exception feature comparison and correlation verification is specifically

[0122] Extract the key feature fields related to the event from the restored data set, including traffic pattern, link state change, device alarm code, session establishment and disconnection time, etc., and construct an exception feature vector;

[0123] Compare the exception feature vector with the judgment features in the output of the fast exception judgment process field by field, verify the consistency in exception type, risk level, occurrence time, associated link and impact range, and record the consistent and inconsistent items;

[0124] Use the original sampling value and device-side diagnostic information in the backflow data to trace the features with inconsistent items, analyze the source of the difference and evaluate the impact on the final conclusion, and generate an exception analysis and judgment result corrected by correlation verification;

[0125] Destroy the mapping ticket, mapping entry and session key at the end of the authorized window, and write the trace session identifier, ticket identifier, data record identifier and processing path digest into the tamper-proof audit log.

[0126] The application ensures that the original field can be completely restored and is strictly limited by time, authority and key control during sensitive data traceability analysis process by introducing an end-to-end reversible reduction mechanism in the authorized window, effectively preventing unauthorized access and data misuse risks. The secure retrieval of the mapping ticket and the key escrow unit, the temporary decryption of the session key, and the format-preserving restoration of the field scope information ensure the complete consistency of the restored data in content, structure and order. The restored data, the results of the rapid exception judgment process and the backflow data are compared and associated in multiple dimensions to achieve accurate identification of the exception type, risk level, occurrence time and link range and difference traceability, improving the accuracy of the exception analysis and the traceability of the traceability. After the authorized window is closed, the system immediately destroys the mapping ticket, the mapping entry and the session key, and writes the full-process audit information into the tamper-proof log, thereby forming a closed-loop processing mode of "controllable restoration-accurate comparison-full-process audit", which balances safety, compliance and traceability effectiveness.

[0127] In the embodiment, based on the abnormal analysis result, bandwidth adjustment, route switching, flow limiting, traffic splitting or redundant link activation are automatically triggered, and abnormal data, analysis path, backflow data and traceability record are written into the tamper-proof audit log, including:

[0128] According to the abnormal analysis and judgment result, a treatment scheme is generated, the target node and link are mapped to specific control actions and parameter set, the action is limited to bandwidth adjustment, route switching, flow limiting, traffic splitting or redundant link activation, and an original configuration snapshot and rollback plan are generated;

[0129] The execution authority and safety check of the treatment scheme are performed, including change window check, impact range evaluation, device capability and topology consistency pre-check, and the command arrangement and issuance table preparation are completed through the control plane interface;

[0130] The treatment command is automatically issued to the target device by the policy execution controller, and the bandwidth parameter change, master-slave route switching, port / queue flow limiting, policy-based traffic splitting or redundant link activation are completed in turn. After execution, key indicators are collected for closed-loop verification. If the standard is not met, the rollback plan or backup scheme is triggered;

[0131] The whole treatment process is written into the tamper-proof audit log, recording abnormal data summary, treatment scheme and parameters, execution timestamp, target device list, before and after configuration snapshot, verification result, backflow data and traceability record, and generating evidence chain identifier for tracing and compliance audit.

[0132] Reference Figure 2 A power communication analysis system based on big data, comprising the following modules:

[0133] A data collection and classification module is configured to collect multi-source heterogeneous data, perform classification, and generate data records.

[0134] A data aggregation and indexing module is configured to aggregate and partition data records, and establish multi-dimensional indexes.

[0135] A master chain scheduling module is configured to build an asynchronous master chain scheduling mechanism, and to distribute data records according to priority to a fast decision-making process or a shadow channel.

[0136] A reversible desensitization processing module is configured to perform field-level desensitization on high-sensitive data, and generate a short-time valid mapping ticket.

[0137] A local confirmation and verification module is configured to generate a local confirmation task, collect device backflow data, and compare the data with master chain results, identify high-risk events, and mark traceability requirements.

[0138] A restoration and abnormality analysis module is configured to restore sensitive data by calling a mapping ticket within an authorized window, complete abnormality analysis and positioning, and destroy related tickets and keys after the window is closed.

[0139] A disposal and audit module is configured to execute abnormality disposal strategies, and write abnormality data, analysis paths, backflow data, and traceability records into an unalterable audit log.

[0140] Embodiment 1

[0141] To verify the feasibility of the application in implementation, the application is applied to a large power communication network, which involves hundreds of nodes, thousands of links, and generates billions of communication records per day in daily operation. Existing analysis methods mostly use fixed pipeline sequential processing, and when facing sudden large-scale abnormalities, problems such as global analysis blockage, exposure of sensitive data during transmission, and long time consumption of abnormality traceability may occur, resulting in delayed operation and maintenance response and low fault disposal efficiency.

[0142] After the application method is deployed in the network, a data collection module is installed on each communication node to continuously collect multi-source heterogeneous data including link quality (such as bandwidth utilization, error rate, and packet loss rate), device operating status (such as CPU occupancy, memory usage, temperature and humidity), alarm logs (such as link interruption alarm and power alarm), and traffic indicators (such as packet rate and traffic surge). Sensitivity classification processing is directly performed at the collection end, and sensitivity levels (high sensitivity, medium sensitivity, and low sensitivity) are automatically calculated according to multi-dimensional parameters such as the importance of nodes in the network topology, link security level, and business impact range, and sensitivity labels are attached to the data records.

[0143] All data records are converged to the big data platform in real time, and form a multi-dimensional partition structure through time partition, node sub-partition, link sub-partition and label sub-partition, and establish a primary key index and a secondary index containing <time partition, node identification, link bucket, time delay level, risk level, sensitivity label>. The index supports millisecond-level fast retrieval and provides priority scheduling basis for asynchronous master chain scheduling mechanism.

[0144] In the scheduling link, high-priority data records directly enter the fast exception judgment process, and low-priority data enters the shadow channel asynchronous processing, both of which run independently to avoid global delay caused by blocking of a single processing link. When the sensitivity is higher than the set threshold, a one-time short mapping ticket is dynamically generated, and the desensitization state is maintained during the analysis process. If the confidence is insufficient in the exception judgment, the platform will issue a local confirmation task to the corresponding field device, and the device will collect higher-precision link and device operation data and return it. The platform combines the backflow data with the original analysis results for consistency check, and finally determines whether it is a high-risk event and marks the traceability requirement.

[0145] When the traceability is triggered, the system performs end-to-end reversible restoration within the authorized window using the mapping ticket, restores sensitive data and performs deep exception analysis. After the authorized window is closed, the ticket and the key are destroyed to ensure that the data cannot be used again. Finally, based on the analysis results, the system automatically triggers bandwidth adjustment, route switching, flow limiting or redundant link activation, and writes the full-process analysis data, traceability records and backflow data into the tamper-proof audit log, realizing the full-link traceable closed loop from data collection to exception handling.

[0146] Table 1 Performance comparison data before and after deployment

[0147]

[0148] From the data in Table 1, it can be seen that after the deployment of the method of the application, the processing efficiency and analysis accuracy of high-priority events are significantly improved. The initial test data on May 12, 2025 shows that the average decision delay is 2.8 seconds, the false positive rate is 8.6%, and the average time consumption for tracing is 5.0 minutes. At this time, the improvement of abnormal handling efficiency has not been counted. With the optimization of system operation and continuous self-adaptation of the model, the average decision delay decreased to 2.1 seconds on June 15, the false positive rate decreased to 6.9%, the tracing time consumption shortened to 3.4 minutes, and the abnormal handling efficiency improved by 32%. The data in July and August further shows that the decision delay and tracing time consumption remain a downward trend, the false positive rate decreases steadily, and the abnormal handling efficiency improvement gradually increases. On August 10, the abnormal handling efficiency has reached 38%. By September 9, the decision delay has decreased to 1.7 seconds, the false positive rate has decreased to 6.3%, the tracing time consumption has shortened to 3.0 minutes, and the handling efficiency has improved by 40%. The test results on October 11, 2025 show that the method of the application has optimized the average decision delay to 1.6 seconds, the false positive rate has decreased to 6.2%, the tracing time consumption has shortened to 2.9 minutes, and the abnormal handling efficiency has improved to 42%.

[0149] In the analysis of large-scale power communication data, the application can significantly reduce the delay, reduce the false positive rate, and speed up the tracing and handling speed through innovative mechanisms such as asynchronous master chain scheduling, dynamic reversible desensitization mapping, and fast tracing closed loop, thereby improving the stability and emergency response capability of the overall operation.

[0150] The above describes only the preferred embodiments of the application, but the protection scope of the application is not limited thereto. Any person skilled in the art can make equivalent replacements or changes to the technical solutions and inventive concepts of the application within the technical scope disclosed by the application, which should be covered within the protection scope of the application.

Claims

1. A big data-based power communication analysis method, characterized by, The application relates to a power communication network anomaly analysis method and device. Collecting multi-source heterogeneous data at nodes at all levels of a power communication network, classifying the multi-source heterogeneous data according to sensitivity, and generating data records containing sensitivity labels; Converging and storing the data records through a big data platform, partitioning the data records, and establishing multi-dimensional indexes; Based on the data records, an asynchronous master chain scheduling mechanism is constructed, high-priority data records enter a rapid anomaly judgment process, and the rest of the data records are processed in parallel in the master chain and shadow channel, and the master chain scheduling process is weakly coupled and asynchronously advanced; For data records with sensitivity labels higher than a set threshold, a dynamic reversible desensitization mapping technology is used to generate a one-time short-time effective mapping ticket, and the analysis process is carried out in a desensitized state; In the rapid anomaly judgment process, for suspected anomalies with low confidence or unable to be confirmed, a local confirmation task is automatically issued to the on-site equipment, the on-site equipment collects data and returns, the analysis platform performs consistency checking on the return flow data and the master chain result, determines high-risk events, and marks high-risk events that need to be traced; For high-risk events that need to be traced, based on the generated mapping ticket, sensitive data is reversibly restored within an authorized window, and the restored sensitive data is subjected to anomaly analysis and judgment, and the mapping ticket and the key are destroyed after the tracing window is closed; Based on the anomaly analysis result, bandwidth adjustment, routing switching, flow limiting, flow splitting or redundant link activation are automatically triggered, and abnormal data, analysis path, return flow data and trace record are written into an unalterable audit log.

2. The big data based power communication analysis method of claim 1, wherein, The multi-source heterogeneous data specifically includes link quality data, device running state data, alarm log data and flow index data in the power communication network.

3. The big data based power communication analysis method of claim 1, wherein, The sensitivity classification of the multi-source heterogeneous data to generate data records containing sensitivity labels is specifically referring to dividing the multi-source heterogeneous data into high-sensitivity, medium-sensitivity and low-sensitivity levels according to the node importance, link security level and business impact range involved in the data content, and adding the sensitivity labels corresponding to the sensitivity levels in the corresponding data records.

4. The big data based power communication analysis method of claim 1, wherein, The convergence and storage of the data records through the big data platform, the partitioning of the data records, and the establishment of multi-dimensional indexes are specifically referring to dividing the data into several fixed time windows according to the time stamps of the data records, forming corresponding time partitions, establishing node sub-partitions in each time partition according to node identifiers, performing consistent hash bucketing on link identifiers in each node sub-partition to form link sub-partitions, and establishing label sub-partitions in each link sub-partition according to the combination of time delay levels, risk levels and sensitivity labels. Each label sub-partition is written into the corresponding partition path of the distributed storage and a primary key index and a secondary index are generated, the primary key sequence is, and the secondary indexes are established on the link identifier, risk level and sensitivity label fields to support fast retrieval and permission domain isolation.

5. The big data based power communication analysis method of claim 1, wherein, The data records are based on the construction of asynchronous master chain scheduling mechanism, high priority data records enter the rapid exception judgment process, the rest of the data records are processed in the master chain and shadow channel in parallel, the master chain scheduling process maintains weak coupling and asynchronous advancement, including: Establishing a master chain, which is composed of a priority queue, a rapid exception judgment process processing unit, a merging unit and a rollback queue; establishing a shadow channel, which is composed of a shadow processing queue, a feature completion unit and a rule review unit, the master chain and the shadow channel run in independent threads or processes respectively; Obtaining data records, generating a scheduling descriptor for each data record; Routing judgment is performed on the scheduling descriptor according to the preset priority rule, and the data records with high priority are written into the priority queue, and the other data records are written into the shadow processing queue; The data records are taken out from the priority queue and sent to the rapid exception judgment process processing unit, the mirror image of the data records is generated, and the mirror image is written into the shadow processing queue, the shadow channel performs feature completion and rule review on the mirror image, and only the desensitization content and the mapping ticket reference are transmitted; The master chain conclusion of the rapid exception judgment process processing unit and the shadow conclusion of the shadow channel are subjected to consistency verification in the merging unit, and when consistent, the conclusion is output and the data record processing is completed, and when inconsistent, the data record is written into the rollback queue and redistributed or triggers a local confirmation task according to the rollback strategy; Periodically collect the queue length and average processing time delay of the priority queue and the shadow processing queue, and adjust the threshold, batch size and distribution ratio in the priority rule according to the collection results; Each routing, processing and merging action is written into the scheduling log, and a recoverable routing graph is generated.

6. The big data based power communication analysis method of claim 1, wherein, For the data records with sensitivity label higher than the set threshold, a one-time short-time effective mapping ticket is generated by using a dynamic reversible desensitization mapping technology, and the analysis process is carried out in a desensitization state, including: From the data records entering the processing, the desensitization object is determined according to the sensitivity label threshold, and the corresponding data record sensitive field list is generated according to the sensitive field rule library; Field-level reversible desensitization mapping is performed on each sensitive field in the data record sensitive field list to generate a field-level mapping reference identifier, a reversible code with format preservation and a field scope key are used to generate a desensitization token, and a one-to-one mapping relationship is established with the original value of the sensitive field to form a mapping entry; The corresponding sensitive field in the data record is replaced with the desensitization token, the original value of the non-sensitive field is kept unchanged, and the field-level mapping reference identifier and the mapping ticket placeholder identifier are written into the data record metadata; A mapping ticket is generated for the data record; The mapping entry and the mapping ticket are written into the mapping ticket and key management unit, the ticket reference is obtained, and the ticket reference is written into the data record metadata and the scheduling descriptor; The data record carrying the ticket reference is subjected to permission verification, and if the permission verification is not satisfied, it is not restored, and when the ticket expires or is revoked, the mapping ticket, the corresponding mapping entry and the key material are deleted by the mapping ticket and key management unit, and the ticket identifier, the data record identifier and the deletion time are written into the tamper-proof audit log.

7. The big data based power communication analysis method of claim 1, wherein, The suspected abnormality with low confidence or unable to be confirmed is automatically issued with a local confirmation task to the field device in the fast abnormality determination process, the field device collects data and returns, the analysis platform performs consistency check on the return data and the main control chain result, determines the high-risk event and marks the high-risk event that needs to be traced, including: Receiving a suspected abnormal event record, reading the data record identifier, scheduling descriptor and mapping ticket reference associated with the suspected abnormal event record, and locking the time window involved in the event; Based on the node identifier and link identifier in the scheduling descriptor, candidate target devices and candidate sampling interfaces are retrieved from the topology library and device capability library, and target device set and sampling interface set are selected according to risk level, time delay level and sensitivity label; According to the rule library, the task generation process is performed on the target device set and the sampling interface set, the sampling frequency and the duration time are determined according to the risk level and the time delay level, the sampling index and the execution action sequence are determined according to the link type and the device capability, and the local confirmation task draft is formed; The local confirmation task draft is subjected to permission check and compliance check, the short-time access authorization is applied to the mapping ticket and the key management unit according to the sensitivity label, the authorization reference and the timeout strategy are bound to the task draft, and the task draft is integrity signed to generate the local confirmation task; The local confirmation task is issued to the target device through the control plane interface, the task issuing timestamp and the response state are recorded, and the unresponded target device is reissued or switched to the standby target device according to the preset retry number and the fallback strategy; The return data returned by the target device is received, time synchronization and alignment are performed according to the event time window and the device timestamp, repeated and missing records are removed, and the return data set is generated; The return data set is compared with the fast abnormality determination process output and the shadow channel processing result for consistency, and the consistency conclusion is output, the event risk level is confirmed or upgraded according to the consistency conclusion, and the confirmed high-risk event is marked as a high-risk event that needs to be traced.

8. The big data based power communication analysis method of claim 1, wherein, For the high-risk event that needs to be traced, the sensitive data is reversibly restored end-to-end within the authorized window based on the generated mapping ticket, and the restored sensitive data is subjected to abnormality analysis and determination, and the mapping ticket and the key are destroyed after the tracing window is closed, including: Receiving a high-risk event that needs to be traced, applying an authorization window and binding an event time window, a data record identifier and a processing path; Within the authorized window, the corresponding field-level mapping entry is retrieved by calling the mapping ticket and the key management unit, the end-to-end reversible restoration is performed on the desensitized field by using the mapping relationship and the session key contained in the mapping ticket, the restored data set is generated and subjected to integrity check and time alignment; Based on the restored data set, the fast abnormality determination process output and the return data are combined to perform abnormal feature comparison and association verification, and the abnormality analysis and determination result is formed; At the end of the authorized window, the mapping ticket, the mapping entry and the session key are destroyed, and the tracing session identifier, the ticket identifier, the data record identifier and the processing path summary are written into the tamper-proof audit log. 9.A big data based power communication analysis system, performing the big data based power communication analysis method of any one of claims 1 to 8, characterized in that, The following modules are included: Data collection and grading module, for collecting multi-source heterogeneous data, grading, and generating data records; A data aggregation and indexing module is configured to aggregate, partition, and establish multi-dimensional indexes for the data records; A master chain scheduling module is configured to construct an asynchronous master chain scheduling mechanism and to distribute the data records to a fast decision flow or a shadow channel according to a priority; A reversible desensitization processing module is configured to perform field-level desensitization on high-sensitive data and to generate a short-time valid mapping ticket; A local confirmation and verification module is configured to generate a local confirmation task, collect device backflow data, and compare the data with master chain results, identify high-risk events, and mark traceability requirements; A restoration and abnormality analysis module is configured to restore sensitive data by calling a mapping ticket within an authorized window, complete abnormality analysis and positioning, and destroy related tickets and keys after the window is closed; A disposal and audit module is configured to execute abnormality disposal strategies and write abnormality data, analysis paths, backflow data, and traceability records into an unalterable audit log.

Images