A big data-based power communication analysis system and method

Abstract

The application discloses a kind of power communication analysis system and method based on big data, comprising: collecting multi-source heterogeneous data, sensitivity grading and generating label;Data is gathered to big data platform, storage, partition and index construction are completed;Asynchronous master chain mechanism is built, high-optimal data is scheduled to quickly determine exception, the rest data is processed in parallel;Sensitive mapping is executed to high-sensitive data, short-time mapping ticket is generated and desensitization analysis is carried out;Local task is issued to low-confidence exception, and high-risk event is determined by collecting backflow data and checking;Sensitive data is restored in authorization window, ticket and key are destroyed after completing exception analysis;Network regulation is triggered based on analysis result, and whole process is recorded to audit log.The application realizes efficient exception analysis and whole-process traceability of power communication big data under the premise of guaranteeing safety compliance by introducing asynchronous scheduling and reversible desensitization mechanism.

Description

Technical Field

[0001] This invention relates to the field of power communication and big data analysis technology, and in particular to a power communication analysis system and method based on big data. Background Technology

[0002] As power systems evolve towards intelligence, distribution, and high digitalization, power communication networks have become a core support for power grid operation scheduling, safety control, and remote monitoring. Existing power communication analysis methods largely rely on centralized data processing architectures and static rule engines, making it difficult to effectively handle large-scale heterogeneous data from different communication links and device nodes. Data acquisition, anomaly detection, and event tracing processes are generally executed linearly, resulting in significant response delays and poor robustness when facing sudden events, link failures, or highly sensitive data processing, severely restricting the real-time performance and stability of power communication networks.

[0003] In practical applications, traditional methods often employ fixed desensitization rules to process sensitive data, but lack dynamic and reversible control mechanisms. This limits the accuracy of analysis and makes it impossible to restore the original information during the tracing phase, failing to meet the dual requirements of controllable data use and security compliance. The identification of data anomalies relies on pre-set rules or static models, lacking flexible data scheduling mechanisms and on-site feedback capabilities, which can easily lead to misjudgments or omissions, failing to meet the requirements of high timeliness and high reliability in today's complex power communication scenarios.

[0004] Therefore, how to provide a power communication analysis system and method based on big data is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a power communication analysis system and method based on big data. This invention comprehensively utilizes an asynchronous main control chain scheduling mechanism, dynamic reversible desensitization mapping technology, and local confirmation and data feedback verification mechanisms. It details the entire process of achieving rapid anomaly detection and end-to-end traceable processing of high-priority data while ensuring the security and compliance of sensitive data. This invention possesses advantages such as flexible analysis workflow, high response time, secure data use, accurate anomaly identification, and full-link traceability, making it particularly suitable for real-time monitoring and intelligent handling of complex events in large-scale heterogeneous power communication networks.

[0006] According to an embodiment of the present invention, a power communication analysis method based on big data includes:

[0007] Collect multi-source heterogeneous data at each level of the power communication network, classify the sensitivity of the multi-source heterogeneous data, and generate data records containing sensitivity labels;

[0008] Data records are aggregated and stored through a big data platform, partitioned, and multidimensional indexes are created.

[0009] Based on data recording, an asynchronous main control chain scheduling mechanism is constructed. High-priority data records enter the fast anomaly judgment process, while the remaining data records are processed in parallel in the main control chain and shadow channel. The main control chain scheduling process maintains weak coupling and asynchronous progress.

[0010] For data records with sensitivity labels exceeding a set threshold, a dynamic reversible desensitization mapping technique is used to generate a one-time, short-term valid mapping ticket, and the analysis process is carried out in a desensitized state.

[0011] In the rapid anomaly detection process, for suspected anomalies with low confidence or that cannot be confirmed, a local confirmation task is automatically sent to the field equipment. The field equipment collects data and returns it. The analysis platform performs consistency verification between the returned data and the main control chain results, identifies high-risk events, and marks high-risk events that need to be traced.

[0012] For high-risk events that require tracing, sensitive data can be reversibly restored end-to-end within the authorization window based on the generated mapping ticket. Anomaly analysis and judgment are performed on the restored sensitive data. The mapping ticket and key are destroyed after the tracing window is closed.

[0013] Based on the anomaly analysis results, bandwidth adjustment, route switching, rate limiting, traffic splitting, or redundant link activation are automatically triggered, and the abnormal data, analysis path, backflow data, and source tracing records are written to the tamper-proof audit log.

[0014] Optionally, the multi-source heterogeneous data specifically includes link quality data, equipment operating status data, alarm log data, and traffic indicator data in the power communication network.

[0015] Optionally, the step of classifying the sensitivity of multi-source heterogeneous data and generating data records containing sensitivity labels specifically refers to classifying multi-source heterogeneous data into high-sensitivity, medium-sensitivity, and low-sensitivity levels based on the importance of nodes involved in the data content, the security level of the link, and the scope of business impact, and attaching sensitivity labels corresponding to the sensitivity level to the corresponding data records.

[0016] Optionally, the process of aggregating and storing data records through a big data platform, partitioning the data records, and establishing multi-dimensional indexes specifically refers to dividing the data into several fixed time windows according to the timestamps of the data records to form corresponding time partitions. Within each time partition, node sub-partitions are established according to node identifiers. Within each node sub-partition, consistent hashing and bucketing are performed on the link identifiers to form link sub-partitions. Within each link sub-partition, tag sub-partitions are established based on the combination of latency level, risk level, and sensitivity tag. Each tag sub-partition is written to the corresponding partition path of distributed storage and a primary key index and secondary indexes are generated. The primary key order is <time partition, node identifier, link bucket, latency level, risk level, sensitivity tag>. The secondary indexes are established on the link identifier, risk level, and sensitivity tag fields respectively to support fast retrieval and permission domain isolation.

[0017] Optionally, based on data records, an asynchronous main control chain scheduling mechanism is constructed. High-priority data records enter the rapid anomaly judgment process, while the remaining data records are processed in parallel in the main control chain and shadow channel. The main control chain scheduling process maintains weak coupling and asynchronous execution, including:

[0018] A main control chain is established, consisting of a priority queue, a fast exception judgment process unit, a merging unit, and a rollback queue. A shadow channel is established, consisting of a shadow processing queue, a feature completion unit, and a rule review unit. The main control chain and the shadow channel run in independent threads or processes.

[0019] Retrieve data records and generate a scheduling descriptor for each data record;

[0020] Based on the preset priority rules, the scheduling descriptor is routed, and high-priority data records are written to the priority queue, while other data records are written to the shadow processing queue.

[0021] Data records are retrieved from the priority queue and sent to the fast anomaly detection process unit to generate a mirror image of the data record. The mirror image is then written to the shadow processing queue. The shadow channel performs feature completion and rule review on the mirror image, and only transmits the de-identified content and the reference to the mapped ticket.

[0022] The main chain conclusion of the rapid anomaly judgment process processing unit and the shadow conclusion of the shadow channel are subjected to consistency verification in the merging unit. If they are consistent, the conclusion is output and the data record processing is completed. If they are inconsistent, the data record is written to the rollback queue and redistributed according to the rollback strategy or a local confirmation task is triggered.

[0023] The queue length and average processing latency of the periodic collection priority queue and shadow processing queue are adjusted according to the collection results, including the threshold, batch size, and allocation ratio in the priority rules.

[0024] Write each routing, processing, and merging action to the scheduling log and generate a recoverable routing graph.

[0025] Optionally, for data records with sensitivity labels exceeding a set threshold, a dynamic reversible desensitization mapping technique is employed to generate a one-time, short-term valid mapping ticket. The analysis process is performed in a desensitized state, including:

[0026] From the data records entering the processing, the objects to be de-identified are determined according to the sensitivity label threshold, and a list of sensitive fields of the corresponding data records is generated based on the sensitive field rule base;

[0027] Perform field-level reversible desensitization mapping on each sensitive field in the list of sensitive fields in the data record, generate a field-level mapping reference identifier, generate a desensitization token using format-preserving reversible encoding and field scope key, and establish a one-to-one mapping relationship with the original value of the sensitive field to form a mapping entry;

[0028] In the data record, replace the corresponding sensitive fields with desensitization tokens, keep the original values ​​of non-sensitive fields unchanged, and write field-level mapping reference identifiers and mapping ticket placeholder identifiers in the data record metadata;

[0029] Generate mapping tickets for data records;

[0030] Write the mapping entry and mapping ticket to the mapping ticket and key custody unit, obtain the ticket reference, and write the ticket reference to the data record metadata and scheduling descriptor;

[0031] Access checks are performed on the data records referenced by the invoices. Those that do not meet the access checks will not be restored. When the invoices expire or are revoked, the mapping invoice and key custody unit deletes the mapping invoice, the corresponding mapping entry and key material, and writes the invoice identifier, data record identifier and deletion time into the tamper-proof audit log.

[0032] Optionally, in the rapid anomaly determination process, for suspected anomalies with low confidence or those that cannot be confirmed, a local confirmation task is automatically sent to the field equipment. The field equipment collects data and returns it. The analysis platform performs consistency verification between the returned data and the main control chain results, identifies high-risk events, and marks high-risk events that require tracing, including:

[0033] Receive suspected abnormal event records, read the data record identifier, scheduling descriptor and mapping ticket reference associated with the suspected abnormal event records, and lock the time window involved in the event;

[0034] Based on the node identifier and link identifier in the scheduling descriptor, candidate target devices and candidate sampling interfaces are retrieved from the topology library and device capability library, and the target device set and sampling interface set are filtered according to risk level, latency level and sensitivity label;

[0035] Based on the rule base, a task generation process is executed on the target device set and the sampling interface set. The sampling frequency and duration are determined according to the risk level and latency level. The sampling indicators and execution action sequence are determined according to the link type and device capabilities to form a local confirmation task draft.

[0036] The system performs permission and compliance checks on the draft local confirmation task, requests short-term access authorization from the mapping ticket and key custody unit based on the sensitivity label, binds the authorization reference and timeout policy to the draft task, performs integrity signing on the draft task, and generates the local confirmation task.

[0037] The local confirmation task is sent to the target device through the control plane interface, and the task sending timestamp and response status are recorded. For target devices that do not respond, the task is resent or a backup target device is switched according to the preset number of retries and fallback strategy.

[0038] Receive the return data returned by the target device, synchronize and align the execution time according to the event time window and the device timestamp, remove duplicate and missing records, and generate the return dataset;

[0039] The backflow dataset is compared with the output of the rapid anomaly detection process and the shadow channel processing results to determine consistency. Based on the consistency conclusion, the event risk level is confirmed or upgraded, and the confirmed high-risk events are marked as high-risk events that need to be traced back to their source.

[0040] Optionally, for high-risk events requiring tracing, the process involves: achieving end-to-end reversible restoration of sensitive data within the authorization window based on the generated mapping ticket; performing anomaly analysis and judgment on the restored sensitive data; and destroying the mapping ticket and key after the tracing window is closed. This includes:

[0041] Receive high-risk events that require tracing, request an authorization window, and bind the event time window, data record identifier, and processing path;

[0042] Within the authorization window, the mapping ticket and key escrow unit are invoked to retrieve the corresponding field-level mapping entries. The mapping relationship contained in the mapping ticket and the session key are used to perform end-to-end reversible restoration of the de-identified fields, generate the restored dataset, and perform integrity verification and time alignment.

[0043] Based on the restored dataset, combined with the output and feedback data of the rapid anomaly judgment process, anomaly feature comparison and correlation verification are performed to form anomaly analysis and judgment results.

[0044] At the end of the authorization window, the mapping ticket, mapping entry, and session key are destroyed, and the traceability session identifier, ticket identifier, data record identifier, and processing path summary are written to the tamper-proof audit log.

[0045] According to an embodiment of the present invention, a power communication analysis system based on big data includes the following modules:

[0046] The data acquisition and classification module is used to collect multi-source heterogeneous data, classify it, and generate data records.

[0047] The data aggregation and indexing module is used to aggregate and partition data records and create multidimensional indexes;

[0048] The main control chain scheduling module is used to build an asynchronous main control chain scheduling mechanism to distribute data records to the fast decision process or shadow channel according to priority.

[0049] The reversible data masking module is used to perform field-level data masking on highly sensitive data and generate short-term valid mapping tickets.

[0050] The local confirmation and verification module is used to generate local confirmation tasks, collect device feedback data, compare it with the results of the main control chain, identify high-risk events, and mark traceability requirements.

[0051] The restoration and anomaly analysis module is used to call the mapped ticket to restore sensitive data within the authorized window, complete anomaly analysis and location, and destroy the relevant tickets and keys after the window is closed;

[0052] The handling and auditing module is used to execute anomaly handling strategies and write abnormal data, analysis paths, backflow data, and source tracing records into an immutable audit log.

[0053] The beneficial effects of this invention are:

[0054] (1) This invention addresses the problems of fixed processes, rigid scheduling, and data processing delays in existing power communication analysis methods by proposing a big data-based power communication analysis method. After data aggregation and partitioning, an asynchronous scheduling mechanism consisting of a main control chain and a shadow channel is introduced, enabling the data processing flow to be dynamically distributed according to priority. High-risk and time-sensitive data can directly enter the rapid anomaly judgment process, while the remaining data is processed in parallel in the shadow channel. This avoids the global blocking and bottleneck failure problems of the traditional linear processing mode in high-concurrency scenarios, and improves the flexibility of the processing flow and the overall robustness of the network.

[0055] (2) This invention uses dynamic reversible desensitization mapping technology to generate one-time short-term mapping tickets for highly sensitive data, maintaining the data desensitization state during the analysis process and preventing unauthorized leakage of sensitive information. When traceability is required, end-to-end reversible restoration can be performed within the authorization window based on the mapping ticket and key to ensure data integrity and authenticity; after the authorization window is closed, the ticket and key are immediately destroyed to prevent secondary leakage, balancing security compliance and business availability, and resolving the technical contradiction between insufficient analysis and inability to trace the source under the traditional static desensitization mechanism.

[0056] (3) In the anomaly determination stage, the present invention introduces a local confirmation and data feedback verification mechanism. For suspected anomalies with low confidence or that cannot be confirmed, the platform automatically generates a local confirmation task and sends it to the field equipment. The supplementary data collected on the field is fed back to the platform and compared with the results of the main control chain. Finally, the event level is determined and the traceability requirement is marked. This realizes the closed-loop collaboration between the platform-side rapid determination and the field real-time perception, effectively reducing the false alarm rate and the missed alarm rate, ensuring the accuracy and traceability of anomaly analysis, and comprehensively improving the security protection capability and intelligent analysis level of the power communication network. Attached Figure Description

[0057] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0058] Figure 1 This is a flowchart of a power communication analysis method based on big data proposed in this invention;

[0059] Figure 2 This is a schematic diagram of the structure of a power communication analysis system based on big data proposed in this invention. Detailed Implementation

[0060] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0061] refer to Figure 1 A power communication analysis method based on big data includes:

[0062] Collect multi-source heterogeneous data at each level of the power communication network, classify the sensitivity of the multi-source heterogeneous data, and generate data records containing sensitivity labels;

[0063] Data records are aggregated and stored through a big data platform, partitioned, and multidimensional indexes are created.

[0064] Based on data recording, an asynchronous main control chain scheduling mechanism is constructed. High-priority data records enter the fast anomaly judgment process, while the remaining data records are processed in parallel in the main control chain and shadow channel. The main control chain scheduling process maintains weak coupling and asynchronous progress.

[0065] For data records with sensitivity labels exceeding a set threshold, a dynamic reversible desensitization mapping technique is used to generate a one-time, short-term valid mapping ticket, and the analysis process is carried out in a desensitized state.

[0066] In the rapid anomaly detection process, for suspected anomalies with low confidence or that cannot be confirmed, a local confirmation task is automatically sent to the field equipment. The field equipment collects data and returns it. The analysis platform performs consistency verification between the returned data and the main control chain results, identifies high-risk events, and marks high-risk events that need to be traced.

[0067] For high-risk events that require tracing, sensitive data can be reversibly restored end-to-end within the authorization window based on the generated mapping ticket. Anomaly analysis and judgment are performed on the restored sensitive data. The mapping ticket and key are destroyed after the tracing window is closed.

[0068] Based on the anomaly analysis results, bandwidth adjustment, route switching, rate limiting, traffic splitting, or redundant link activation are automatically triggered, and the abnormal data, analysis path, backflow data, and source tracing records are written to the tamper-proof audit log.

[0069] In this embodiment, the multi-source heterogeneous data specifically includes link quality data, equipment operating status data, alarm log data, and traffic indicator data in the power communication network.

[0070] In this embodiment, the step of classifying multi-source heterogeneous data by sensitivity and generating data records containing sensitivity labels specifically refers to classifying multi-source heterogeneous data into high-sensitivity, medium-sensitivity, and low-sensitivity levels based on the importance of nodes involved in the data content, the link security level, and the scope of business impact, and attaching sensitivity labels corresponding to the sensitivity level to the corresponding data records.

[0071] In this embodiment, the data records are aggregated and stored through a big data platform, partitioned, and multi-dimensional indexes are established. Specifically, the data is divided into several fixed time windows according to the timestamps of the data records, forming corresponding time partitions. Within each time partition, node sub-partitions are established according to node identifiers. Within each node sub-partition, consistent hashing and bucketing are performed on the link identifiers to form link sub-partitions. Within each link sub-partition, tag sub-partitions are established based on the combination of latency level, risk level, and sensitivity tag. Each tag sub-partition is written to the corresponding partition path of distributed storage, and a primary key index and a secondary index are generated. The primary key order is <time partition, node identifier, link bucket, latency level, risk level, sensitivity tag>. The secondary indexes are established on the link identifier, risk level, and sensitivity tag fields respectively to support fast retrieval and permission domain isolation.

[0072] In this embodiment, an asynchronous main control chain scheduling mechanism is constructed based on data records. High-priority data records enter the fast anomaly detection process, while the remaining data records are processed in parallel in the main control chain and shadow channel. The main control chain scheduling process maintains weak coupling and asynchronous execution, including:

[0073] A main control chain is established, consisting of a priority queue, a fast exception judgment process unit, a merging unit, and a rollback queue. A shadow channel is established, consisting of a shadow processing queue, a feature completion unit, and a rule review unit. The main control chain and the shadow channel run in independent threads or processes.

[0074] Acquire data records and generate a scheduling descriptor for each data record. The scheduling descriptor includes a timestamp, node identifier, link identifier, sensitivity label, latency level and risk level that can be obtained from the partition index, effective time window and processing version number.

[0075] The scheduling descriptor is routed according to a preset priority rule. High-priority data records are written to a priority queue, and other data records are written to a shadow processing queue. The priority rule uses sensitivity labels, latency levels, risk levels, and effective time windows as criteria and supports online updates. The priority rule includes:

[0076] When a data record is labeled as highly sensitive, it is directly assigned to a priority queue for rapid processing.

[0077] When the expected processing latency of a data record is lower than the set latency threshold, it is prioritized to enter the priority queue to ensure real-time performance.

[0078] When the risk level of a data record reaches or exceeds the warning level, it is given priority to enter the priority queue for anomaly determination.

[0079] When the remaining time before the end of its business validity window is less than the set time limit, the data record is given priority to enter the priority queue to prevent data failure.

[0080] When data records are at an intermediate level in terms of sensitivity, latency, and risk, a comprehensive priority value is calculated using preset weights. Data above the priority threshold is entered into the priority queue, while data below the priority threshold is entered into the shadow processing queue.

[0081] Data records are retrieved from the priority queue and sent to the fast anomaly detection process unit to generate a mirror image of the data record. The mirror image is then written to the shadow processing queue. The shadow channel performs feature completion and rule review on the mirror image, and only transmits the de-identified content and the reference to the mapped ticket.

[0082] The main chain conclusion of the rapid anomaly determination process and the shadow conclusion of the shadow channel are subjected to consistency verification in the merging unit. If they are consistent, the conclusion is output and the data record processing is completed. If they are inconsistent, the data record is written to the rollback queue and redistributed according to the rollback strategy or a local confirmation task is triggered. The main chain conclusion refers to the anomaly analysis result generated after the asynchronous main control chain scheduling mechanism processes high-priority data records in the rapid anomaly determination process, including anomaly type, risk level, timestamp, and related links. The shadow conclusion refers to the result generated by the shadow channel after independently performing analysis on the same data records as the main control chain in the parallel processing path, including anomaly type, risk level, timestamp, and related links.

[0083] The queue length and average processing latency of the priority queue and shadow processing queue are collected periodically. The threshold, batch size and allocation ratio in the priority rules are adjusted according to the collection results. The queue length and average processing latency refer to the real-time number of data records to be processed in the priority queue and shadow processing queue counted within the scheduling period, as well as the average time taken from the time the data record enters the queue to the time the corresponding processing unit outputs the result.

[0084] Each routing, processing, and merging action is written to the scheduling log, and a recoverable routing graph is generated. The scheduling log records timestamps, data record identifiers, source queues, target processing units, processing version numbers, conclusion summaries, and mapping ticket references. The generation of a recoverable routing graph refers to generating a directed graph composed of nodes and edges in the flow order based on the timestamps, data identifiers, source and target processing unit information recorded in the scheduling log and storing it in a parsable format.

[0085] The asynchronous master control chain scheduling mechanism of this invention, through a dual-channel parallel architecture of the master control chain and shadow channels, achieves rapid anomaly detection for high-priority data and delayed processing of low-priority data, improving overall processing real-time performance and system stability. The master control chain prioritizes highly sensitive, high-risk, and time-sensitive data, ensuring immediate response to critical events; the shadow channel performs feature completion and rule verification on mirrored data, forming independent shadow conclusions, which are then consistent with the master chain conclusions, effectively reducing the probability of false alarms and missed alarms. Through a dynamic priority rule adjustment mechanism, the system can adaptively optimize resource allocation based on real-time queue length and processing latency, avoiding global blocking. The introduction of scheduling logs and recoverable routing graphs ensures that the processing path, judgment criteria, and traceability evidence for each data record are fully preserved, guaranteeing the traceability and compliance of abnormal events. Compared to existing technologies, this invention balances sensitive data security, real-time anomaly detection, and verifiability of analysis results, providing an efficient, reliable, and auditable technical path for security analysis in large-scale power communication data environments.

[0086] In this embodiment, for data records with sensitivity labels exceeding a set threshold, a dynamic reversible desensitization mapping technique is employed to generate a one-time, short-term valid mapping ticket. The analysis process is performed in a desensitized state, including:

[0087] From the data records entering the processing, the objects to be de-identified are determined according to the sensitivity label threshold, and a list of sensitive fields of the corresponding data records is generated based on the sensitive field rule base. The sensitive field rule base specifically refers to a set of field-level security control rules that are pre-established and continuously maintained. It defines and identifies information fields that may involve privacy, confidentiality or key business according to data type, business category and security level, including field name, data format, value range, sensitivity level and corresponding de-identification strategy. It is used to accurately match and extract the target fields that need to be de-identified during the processing.

[0088] For each sensitive field in the sensitive field list of data records, perform a field-level reversible de-identification mapping, generate a field-level mapping reference identifier, generate a de-identification token using format-preserving reversible encoding and field scope keys, and establish a one-to-one mapping relationship with the original value of the sensitive field to form a mapping entry. The mapping entry includes a field identifier, original value digest, de-identification token, effective time window, permission domain, and version number. Specifically, the process of performing field-level reversible de-identification mapping for each sensitive field in the sensitive field list is as follows:

[0089] Read the original values ​​of sensitive fields from data records, parse the data type, length, character set and format characteristics, establish field scope information, and provide constraints for desensitization processing without changing the original structure and format of the fields;

[0090] The original field value is reversibly encoded using the field scope key, which preserves the format, including the number of digits, date format, and string pattern. It is then combined with a unique field identifier and timestamp to generate a de-identification token, ensuring that the same field can be correctly restored within the same permission domain.

[0091] The field identifier, original value summary, de-identification token, effective time window, permission domain and version number are combined into a mapping entry and stored in a controlled mapping management table to realize a one-to-one reversible mapping relationship between the original value and the de-identification token, and to ensure that the mapping entry can only be accessed and restored within the authorized scope.

[0092] In the data record, replace the corresponding sensitive fields with desensitization tokens, keep the original values ​​of non-sensitive fields unchanged, and write field-level mapping reference identifiers and mapping ticket placeholder identifiers in the data record metadata;

[0093] A mapping ticket is generated for each data record. This mapping ticket includes a ticket identifier, a data record identifier, a list of sensitive fields, a set of field-level mapping reference identifiers, a permission domain, a valid time window, a revocation flag, and an audit sequence number. Specifically, generating a mapping ticket for each data record involves:

[0094] A globally unique ticket identifier is generated based on the data record identifier, the generated timestamp, and a random number, and a one-to-one correspondence is established between the ticket identifier and the data record identifier.

[0095] From the field-level reversible desensitization mapping step, obtain the list of sensitive fields corresponding to the data records and the set of field-level mapping reference identifiers, and write them into the ticket structure in the order of fields to ensure that each desensitization token is bound to the corresponding field one by one;

[0096] Based on the business scenario and security policy, the authorized access scope, start and end time are written to the ticket, and the revocation mark is initialized to the unrevoked state. At the same time, an audit sequence number is generated for tamper-proof log recording.

[0097] The generated mapping tickets are stored in the mapping ticket management table, and a primary key index is created according to the ticket identifier, and a secondary index is created according to the data record identifier to support authorized access and fast retrieval, while ensuring that the tickets automatically expire or are destroyed after the effective time window ends.

[0098] The mapping entries and mapping tickets are written to the mapping ticket and key escrow unit, the ticket reference is obtained, and the ticket reference is written to the data record metadata and scheduling descriptor. The mapping ticket and key escrow unit is an independent security module used to securely store mapping tickets, field-level mapping entries and keys and provide authorized access and auditing. It is built based on distributed key-value storage using the Raft consensus protocol, transparent database encryption, hardware security module HSM key escrow, RBAC-based access control, two-factor authentication and WORM immutable audit logs.

[0099] Access checks are performed on the data records referenced by the invoices. Those that do not meet the access checks will not be restored. When the invoices expire or are revoked, the mapping invoice and key custody unit deletes the mapping invoice, the corresponding mapping entry and key material, and writes the invoice identifier, data record identifier and deletion time into the tamper-proof audit log.

[0100] This invention achieves precise, controllable, and traceable protection of highly sensitive data by introducing a field-level reversible desensitization mapping and mapping ticket management mechanism. Field-level reversible desensitization mapping, without altering the original field structure and format, utilizes field scope keys and reversible encoding technology that preserves formatting to generate a unique desensitization token for each sensitive field and establish a one-to-one mapping relationship. This ensures that data availability remains unaffected during analysis and can be accurately restored under authorized conditions. The mapping ticket centrally manages the mapping relationships of sensitive fields and binds them to valid time windows, permission domains, and audit information. Combined with the distributed consistent storage of the mapping ticket and key custody unit, hardware security module key custody, RBAC access control, and tamper-proof audit logs, it ensures the security and compliance of mapped data throughout its entire lifecycle. This effectively prevents unauthorized access and long-term retention risks of sensitive data, achieving end-to-end controllability and reversibility of data during transmission, processing, and traceability. It balances data security and business analysis needs, improving the system's security, auditability, and compliance.

[0101] In this embodiment, during the rapid anomaly detection process, for suspected anomalies with low confidence or those that cannot be confirmed, a local confirmation task is automatically sent to the field equipment. The field equipment collects data and returns it. The analysis platform performs consistency verification between the returned data and the main control chain results, identifies high-risk events, and marks high-risk events requiring tracing, including:

[0102] Receive suspected abnormal event records, read the data record identifier, scheduling descriptor and mapping ticket reference associated with the suspected abnormal event records, and lock the time window involved in the event;

[0103] Based on the node and link identifiers in the scheduling descriptor, candidate target devices and candidate sampling interfaces are retrieved from the topology and device capability databases. The target device set and sampling interface set are then filtered according to risk level, latency level, and sensitivity tags. The topology and device capability databases refer to sets of power communication network resource information established and dynamically maintained before deployment. The topology database records the unique identifiers, physical and logical connections, link attributes, transmission paths, and redundant link status of each node in the network, allowing for quick retrieval of related information by node and link identifiers. The device capability database records the model, hardware configuration, interface type, supported sampling and diagnostic functions, maximum concurrent task count, interface bandwidth, and processing performance of various communication devices, allowing for querying available sampling interfaces and capability limitations by device identifier. The combination of these two databases provides fundamental data support for the accurate selection of target devices and sampling interfaces.

[0104] Based on the rule base, the task generation process is executed on the target device set and the sampling interface set. The sampling frequency and duration are determined according to the risk level and latency level, and the sampling indicators and execution action sequence are determined according to the link type and equipment capabilities, forming a local confirmation task draft. The rule base refers to the set of task generation control rules preset according to the operating characteristics of the power communication network, equipment capabilities and security policies, which is used to standardize the sampling frequency, duration, indicators and execution order to ensure the safe and efficient execution of the local confirmation task.

[0105] The system performs permission and compliance checks on the draft local confirmation task, requests short-term access authorization from the mapping ticket and key custody unit based on the sensitivity label, binds the authorization reference and timeout policy to the draft task, performs integrity signing on the draft task, and generates the local confirmation task.

[0106] The local acknowledgment task is sent to the target device via the control plane interface. The task sending timestamp and response status are recorded. For target devices that do not respond, the task is resent according to the preset retry count and fallback strategy, or a backup target device is switched. The fallback strategy specifically includes:

[0107] If the target device fails to respond within the timeout period multiple times in a row, the task will be switched to a backup device on the same link for execution, and the reason and time of the switch will be recorded.

[0108] When no backup equipment is available for the link, the sampling frequency and the complexity of the sampling indicators are reduced and the task is redistributed to reduce the equipment load and improve the success rate.

[0109] If a task still cannot be executed after a preset number of retries, the task will be marked as failed and written to the abnormal task queue, triggering manual intervention or remote diagnosis process.

[0110] Receive the return data returned by the target device, synchronize and align the execution time according to the event time window and the device timestamp, remove duplicate and missing records, and generate the return dataset;

[0111] The process involves comparing the returned dataset with the output of the rapid anomaly detection process and the shadow channel processing results to determine consistency. A consistency conclusion is then output, and the event risk level is confirmed or upgraded based on this conclusion. Confirmed high-risk events are marked as high-risk events requiring tracing. Specifically, this comparison involves:

[0112] Align the returned dataset according to timestamp, node identifier, and link identifier to ensure that the data source and the processing object correspond one by one. Compare the output of the rapid anomaly judgment process with the shadow channel processing results in terms of anomaly type, risk level, occurrence time, and related links. If all field values ​​are completely consistent, it is judged as consistent.

[0113] If there are differences in risk level or anomaly type, it is determined to be inconsistent, and the difference field and difference value are recorded.

[0114] This invention introduces a dynamic retrieval mechanism combining a topology library and a device capability library, along with node and link identifiers in the scheduling descriptor, to achieve precise screening of devices and sampling interfaces associated with suspected anomalies. This avoids the inefficiency and error risks associated with traditional manual or static matching methods. A rule base is used to constrain the task generation process, ensuring that sampling frequency, duration, and execution metrics are optimally configured under controllable risks, improving the execution efficiency and coverage accuracy of local confirmation tasks. In the task distribution phase, permission and compliance checks combined with short-term access authorization effectively prevent unauthorized operations and sensitive data leakage. A multi-layered rollback strategy is designed to ensure that tasks can still be completed as much as possible in complex scenarios such as device failure and link interruption, enhancing the system's resilience and availability. A three-way consistency comparison mechanism between the backflow data and the main chain and shadow channels provides highly reliable criteria for event confirmation and risk level assessment, avoiding misjudgments and omissions in single-path determination. This invention achieves rapid verification, precise location, and efficient source tracing of suspected anomalies, significantly shortening processing latency and improving the accuracy and traceability of anomaly determination.

[0115] In this embodiment, for high-risk events requiring tracing, the process of achieving end-to-end reversible restoration of sensitive data within the authorization window based on the generated mapping ticket, performing anomaly analysis and judgment on the restored sensitive data, and destroying the mapping ticket and key after the tracing window is closed includes:

[0116] Receive high-risk events that require tracing, request an authorization window, and bind the event time window, data record identifier, and processing path;

[0117] Within the authorization window, the mapping ticket and key escrow unit is invoked to retrieve the corresponding field-level mapping entries. The mapping relationship contained in the mapping ticket and the session key are used to perform end-to-end reversible restoration of the de-identified fields, generating a restored dataset and performing integrity verification and time alignment. Specifically, the end-to-end reversible restoration of the de-identified fields using the mapping relationship contained in the mapping ticket and the session key involves:

[0118] Read the set of field-level mapping reference identifiers contained in the mapping ticket, and retrieve the corresponding mapping entries in the mapping ticket and key custody unit to obtain the field identifier, de-identification token, original value digest and valid time window;

[0119] The session key is used to decrypt and restore the format of the de-identified token, and the restored value is converted into usable data that is completely consistent with the original field according to the field scope information recorded in the mapping entry;

[0120] The restored field values ​​are inserted into the data structure according to the original field order of the data records to ensure that the restored dataset is completely consistent with the one before anonymization in terms of content, format and field position. The restoration results are then checked for integrity and timestamp alignment, and data fields not in the authorization window are removed.

[0121] Based on the restored dataset, combined with the output and feedback data from the rapid anomaly detection process, anomaly feature comparison and correlation verification are performed to generate anomaly analysis and judgment results. Specifically, the anomaly feature comparison and correlation verification involves...

[0122] Extract key feature fields related to the event from the restored dataset, including traffic patterns, link status changes, device alarm codes, session establishment and disconnection times, and construct an anomaly feature vector;

[0123] The abnormal feature vector is compared field by field with the judgment features output by the rapid anomaly judgment process to verify the consistency in anomaly type, risk level, occurrence time, related links and scope of impact, and to record consistent and inconsistent items.

[0124] By using the original sampled values ​​in the reflux data and the equipment-side diagnostic information, the features with inconsistencies are traced and compared, the sources of differences are analyzed and the impact on the final conclusion is assessed, and the anomaly analysis and judgment results after correlation verification and correction are generated.

[0125] At the end of the authorization window, the mapping ticket, mapping entry, and session key are destroyed, and the traceability session identifier, ticket identifier, data record identifier, and processing path summary are written to the tamper-proof audit log.

[0126] This invention introduces an end-to-end reversible restoration mechanism within the authorization window, ensuring the complete recovery of original fields during sensitive data tracing and analysis while strictly adhering to time, permission, and key controls, effectively preventing unauthorized access and data misuse risks. Utilizing secure retrieval of mapping tickets and key escrow units, temporary decryption of session keys, and format preservation of field scope information, the restored data maintains complete consistency in content, structure, and order. Multi-dimensional feature comparison and correlation verification are performed between the restored data and the results of the rapid anomaly detection process and the returned data, enabling accurate confirmation and source tracing of anomaly types, risk levels, occurrence times, and link scopes, improving the accuracy of anomaly analysis and the traceability of source tracing. After the authorization window is closed, the system immediately destroys the mapping tickets, mapping entries, and session keys, and writes the full-process audit information to an immutable log, thus forming a closed-loop processing mode of "controllable restoration—accurate comparison—full-process audit," balancing security, compliance, and source tracing effectiveness.

[0127] In this embodiment, the automatic triggering of bandwidth adjustment, route switching, rate limiting, traffic splitting, or redundant link activation based on anomaly analysis results, and the writing of anomaly data, analysis paths, backflow data, and source tracing records into an immutable audit log, includes:

[0128] Based on the anomaly analysis and judgment results, a handling plan is generated, and the target node and link are mapped to specific control actions and parameter sets. The actions are limited to bandwidth adjustment, route switching, rate limiting, traffic diversion or redundant link activation, and an original configuration snapshot and rollback plan are generated.

[0129] The execution authority and security verification of the disposal plan include change window verification, impact scope assessment, and equipment capability and topology consistency pre-check. Command orchestration and drop-off table preparation are completed through the control plane interface.

[0130] The policy execution controller automatically sends processing commands to the target device, sequentially completing bandwidth parameter changes, primary / backup route switching, port / queue rate limiting, policy-based traffic diversion, or redundant link activation. After execution, key indicators are collected in real time for closed-loop verification. If the indicators are not met, a fallback plan or backup plan is triggered.

[0131] The entire process of handling the incident is written into an immutable audit log, which records the summary of abnormal data, handling plan and parameters, execution timestamp, target device list, before and after configuration snapshots, verification results, backflow data and traceability records, and generates evidence chain identifiers for traceability and compliance auditing.

[0132] refer to Figure 2 A power communication analysis system based on big data includes the following modules:

[0133] The data acquisition and classification module is used to collect multi-source heterogeneous data, classify it, and generate data records.

[0134] The data aggregation and indexing module is used to aggregate and partition data records and create multidimensional indexes;

[0135] The main control chain scheduling module is used to build an asynchronous main control chain scheduling mechanism to distribute data records to the fast decision process or shadow channel according to priority.

[0136] The reversible data masking module is used to perform field-level data masking on highly sensitive data and generate short-term valid mapping tickets.

[0137] The local confirmation and verification module is used to generate local confirmation tasks, collect device feedback data, compare it with the results of the main control chain, identify high-risk events, and mark traceability requirements.

[0138] The restoration and anomaly analysis module is used to call the mapped ticket to restore sensitive data within the authorized window, complete anomaly analysis and location, and destroy the relevant tickets and keys after the window is closed;

[0139] The handling and auditing module is used to execute anomaly handling strategies and write abnormal data, analysis paths, backflow data, and source tracing records into an immutable audit log.

[0140] Example 1:

[0141] To verify the feasibility of this invention in practice, it was applied to a large-scale power communication network. In daily operation, this network involves hundreds of nodes and thousands of links, generating billions of communication records daily. Existing analysis methods often employ a fixed pipeline sequence, which can easily lead to problems such as global analysis blockage, exposure of sensitive data during transmission, and lengthy anomaly tracing when faced with sudden large-scale anomalies, resulting in delayed operation and maintenance response and low fault handling efficiency.

[0142] After deploying the method of this invention in the network, each communication node is equipped with a data acquisition module to continuously collect multi-source heterogeneous data, including link quality (such as bandwidth utilization, bit error rate, and packet loss rate), device operating status (such as CPU usage, memory usage, temperature and humidity), alarm logs (such as link interruption alarms and power alarms), and traffic indicators (such as packet rate and traffic surges). Sensitivity classification processing is directly performed at the acquisition end. Based on multi-dimensional parameters such as the importance of the node in the network topology, link security level, and business impact scope, the sensitivity level (high sensitivity, medium sensitivity, and low sensitivity) is automatically calculated, and a sensitivity label is attached to the data record.

[0143] All data records are aggregated to the big data platform in real time, forming a multi-dimensional partitioning structure through time partitioning, node sub-partitioning, link sub-partitioning, and tag sub-partitioning. A primary key index and secondary indexes are established, containing attributes such as time partition, node identifier, link bucketing, latency level, risk level, and sensitivity tag. This index supports millisecond-level fast retrieval and provides priority scheduling criteria for the asynchronous master control chain scheduling mechanism.

[0144] During the scheduling phase, high-priority data records directly enter the rapid anomaly detection process, while low-priority data is processed asynchronously through a shadow channel. These two processes operate independently, avoiding global latency caused by a single processing link being blocked. When the sensitivity exceeds a set threshold, a one-time short-term mapping ticket is dynamically generated and remains de-identified during the analysis. If the confidence level is insufficient in the anomaly detection, the platform sends a local confirmation task to the corresponding field device. The device then collects higher-precision link and device operation data and sends it back. The platform combines the returned data with the original analysis results for consistency verification, ultimately determining whether it is a high-risk event and marking it as requiring tracing.

[0145] When source tracing is triggered, the system performs end-to-end reversible restoration using mapped tickets within the authorization window, recovering sensitive data and conducting in-depth anomaly analysis. After the authorization window is closed, the tickets and keys are destroyed to ensure that the data cannot be reused. Finally, based on the analysis results, the system automatically triggers strategies such as bandwidth adjustment, route switching, rate limiting, or redundant link activation, and writes the entire process analysis data, source tracing records, and feedback data into an immutable audit log, achieving a closed-loop traceability from data collection to anomaly handling.

[0146] Table 1 Performance comparison data before and after deployment

[0147]

[0148] As shown in Table 1, the deployment of the method of this invention significantly improved the processing efficiency and analysis accuracy of high-priority events. Initial test data from May 12, 2025, showed an average decision latency of 2.8 seconds, a false alarm rate of 8.6%, and an average source tracing time of 5.0 minutes. At this time, the improvement in anomaly handling efficiency was not yet statistically analyzed. With system optimization and continuous model adaptation, the average decision latency decreased to 2.1 seconds on June 15, the false alarm rate dropped to 6.9%, the source tracing time shortened to 3.4 minutes, and the anomaly handling efficiency improved by 32%. Data from July and August further showed that the decision latency and source tracing time maintained a continuous downward trend, the false alarm rate steadily decreased, and the improvement in anomaly handling efficiency gradually increased, reaching 38% by August 10. By September 9, the decision latency had decreased to 1.7 seconds, the false alarm rate had decreased to 6.3%, the source tracing time shortened to 3.0 minutes, and the handling efficiency improved by 40%. Test results on October 11, 2025 showed that the method of the present invention has optimized the average judgment delay to 1.6 seconds, reduced the false alarm rate to 6.2%, shortened the source tracing time to 2.9 minutes, and improved the anomaly handling efficiency by 42%.

[0149] In large-scale power communication data analysis, this invention, through innovative mechanisms such as asynchronous master control chain scheduling, dynamic reversible desensitization mapping, and rapid source tracing closed loop, can significantly reduce latency, lower false alarm rate, and accelerate source tracing and handling speed, thereby improving the overall operational stability and emergency response capability.

[0150] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A power communication analysis method based on big data, characterized in that, include: Collect multi-source heterogeneous data at each level of the power communication network, classify the sensitivity of the multi-source heterogeneous data, and generate data records containing sensitivity labels; Data records are aggregated and stored through a big data platform, partitioned, and multidimensional indexes are created. Based on data recording, an asynchronous main control chain scheduling mechanism is constructed. High-priority data records enter the fast anomaly judgment process, while the remaining data records are processed in parallel in the main control chain and shadow channel. The main control chain scheduling process maintains weak coupling and asynchronous progress. For data records with sensitivity labels exceeding a set threshold, a dynamic reversible desensitization mapping technique is used to generate a one-time, short-term valid mapping ticket, and the analysis process is carried out in a desensitized state. In the rapid anomaly detection process, for suspected anomalies with low confidence or that cannot be confirmed, a local confirmation task is automatically sent to the field equipment. The field equipment collects data and returns it. The analysis platform performs consistency verification between the returned data and the main control chain results, identifies high-risk events, and marks high-risk events that need to be traced. For high-risk events that require tracing, sensitive data can be reversibly restored end-to-end within the authorization window based on the generated mapping ticket. Anomaly analysis and judgment are performed on the restored sensitive data. The mapping ticket and key are destroyed after the tracing window is closed. Based on the anomaly analysis results, bandwidth adjustment, route switching, rate limiting, traffic splitting, or redundant link activation are automatically triggered, and the abnormal data, analysis path, backflow evidence, and source tracing records are written to the tamper-proof audit log. The aforementioned asynchronous main control chain scheduling mechanism, based on data records, allows high-priority data records to enter a rapid anomaly detection process, while other data records are processed in parallel within the main control chain and shadow channels. The main control chain scheduling process maintains weak coupling and asynchronous execution, including: A main control chain is established, consisting of a priority queue, a fast exception judgment process unit, a merging unit, and a rollback queue. A shadow channel is established, consisting of a shadow processing queue, a feature completion unit, and a rule review unit. The main control chain and the shadow channel run in independent threads or processes. Retrieve data records and generate a scheduling descriptor for each data record; The scheduling descriptor is routed according to a preset priority rule. High-priority data records are written to a priority queue, and other data records are written to a shadow processing queue. The priority rule uses sensitivity labels, latency levels, risk levels, and effective time windows as criteria and supports online updates. The priority rule includes: When a data record is labeled as highly sensitive, it is directly assigned to a priority queue for rapid processing. When the expected processing latency of a data record is lower than the set latency threshold, it is prioritized to enter the priority queue to ensure real-time performance. When the risk level of a data record reaches or exceeds the warning level, it is given priority to enter the priority queue for anomaly determination. When the remaining time before the end of its business validity window is less than the set time limit, the data record is given priority to enter the priority queue to prevent data failure. When data records are at an intermediate level in terms of sensitivity, latency, and risk, a comprehensive priority value is calculated using preset weights. Data above the priority threshold is entered into the priority queue, while data below the priority threshold is entered into the shadow processing queue. Data records are retrieved from the priority queue and sent to the fast anomaly detection process. At the same time, a mirror image is generated and written to the shadow processing queue. The shadow channel performs feature completion and rule review on the mirror data records, and only transmits the de-identified content and the reference to the mapped ticket. The main chain conclusion of the rapid anomaly determination process and the shadow conclusion of the shadow channel are checked for consistency in the merging unit. If they are consistent, the conclusion is output and the data record processing is completed. If they are inconsistent, the data record is written to the rollback queue and redistributed according to the rollback strategy or a local confirmation task is triggered. The queue length and average processing latency of the periodic collection priority queue and shadow processing queue are adjusted according to the collection results, including the threshold, batch size and allocation ratio in the priority rules. Each routing, processing, and merging action is written to the scheduling log, and a recoverable routing graph is generated.

2. The power communication analysis method based on big data according to claim 1, characterized in that, The multi-source heterogeneous data specifically includes link quality data, equipment operating status data, alarm log data, and traffic indicator data in the power communication network.

3. The power communication analysis method based on big data according to claim 1, characterized in that, The process of classifying multi-source heterogeneous data by sensitivity and generating data records with sensitivity labels specifically refers to classifying multi-source heterogeneous data into high-sensitivity, medium-sensitivity, and low-sensitivity levels based on the importance of nodes involved in the data content, the security level of the link, and the scope of business impact, and attaching sensitivity labels corresponding to the sensitivity level to the corresponding data records.

4. The power communication analysis method based on big data according to claim 1, characterized in that, The process involves aggregating and storing data records through a big data platform, partitioning the data records, and establishing multi-dimensional indexes. Specifically, this means dividing the data into fixed time windows based on timestamps, creating node sub-partitions within each time partition based on node identifiers, performing consistent hashing and bucketing on link identifiers within each node sub-partition to form link sub-partitions within each link sub-partition, and creating tag sub-partitions within each link sub-partition based on a combination of latency level, risk level, and sensitivity label. Each tag sub-partition is written to the corresponding partition path in distributed storage, generating a primary key index and secondary indexes. The primary key order is <time partition, node identifier, link bucket, latency level, risk level, sensitivity label>. The secondary indexes are created on the link identifier, risk level, and sensitivity label fields, respectively, to support fast retrieval and permission domain isolation.

5. The power communication analysis method based on big data according to claim 1, characterized in that, For data records with sensitivity tags exceeding a set threshold, a dynamic reversible desensitization mapping technique is employed to generate a one-time, short-term valid mapping ticket, which is managed by a security module. The analysis process is performed in a desensitized state, including: From the data records entering the processing, the objects to be de-identified are determined according to the sensitivity label threshold, and a list of sensitive fields of the corresponding data records is generated based on the sensitive field rule base; Perform field-level reversible desensitization mapping on each sensitive field in the sensitive field list, generate a field-level mapping reference identifier, generate a desensitization token using format-preserving reversible encoding and field scope key, and establish a one-to-one mapping relationship with the original value of the sensitive field to form a mapping entry; In the data record, replace the corresponding sensitive fields with desensitization tokens, keep the original values ​​of non-sensitive fields unchanged, and write field-level mapping reference identifiers and mapping ticket placeholder identifiers in the data record metadata; Generate mapping tickets for data records; Write the mapping entry and mapping ticket to the mapping ticket and key custody unit, obtain the ticket reference, and write the ticket reference to the data record metadata and scheduling descriptor; Access checks are performed on the data records referenced by the invoices. Those that do not meet the access checks will not be restored. When the invoices expire or are revoked, the mapping invoice and key custody unit deletes the mapping invoice, the corresponding mapping entry and key material, and writes the invoice identifier, data record identifier and deletion time into the tamper-proof audit log.

6. The power communication analysis method based on big data according to claim 1, characterized in that, In the rapid anomaly detection process, for suspected anomalies with low confidence or those that cannot be confirmed, a local confirmation task is automatically sent to the field equipment. The field equipment collects data and returns it. The analysis platform performs consistency verification between the returned data and the main control chain results, identifies high-risk events, and marks high-risk events that require tracing, including: Receive suspected abnormal event records, read the data record identifier, scheduling descriptor and mapping ticket reference associated with the suspected abnormal event records, and lock the time window involved in the event; Based on the node identifier and link identifier in the scheduling descriptor, candidate target devices and candidate sampling interfaces are retrieved from the topology library and device capability library, and the target device set and sampling interface set are filtered according to risk level, latency level and sensitivity label; Based on the rule base, a task generation process is executed on the target device set and the sampling interface set. The sampling frequency and duration are determined according to the risk level and latency level. The sampling indicators and execution action sequence are determined according to the link type and device capabilities to form a local confirmation task draft. The system performs permission and compliance checks on the draft local confirmation task, requests short-term access authorization from the mapping ticket and key custody unit based on the sensitivity label, binds the authorization reference and timeout policy to the draft task, performs integrity signing on the draft task, and generates the local confirmation task. The local confirmation task is sent to the target device through the control plane interface, and the task sending timestamp and response status are recorded. For target devices that do not respond, the task is resent or a backup target device is switched according to the preset number of retries and fallback strategy. Receive the return data returned by the target device, synchronize and align the execution time according to the event time window and the device timestamp, remove duplicate and missing records, and generate the return dataset; The backflow dataset is compared with the output of the rapid anomaly detection process and the shadow channel processing results to determine consistency. Based on the consistency conclusion, the event risk level is confirmed or upgraded, and the confirmed high-risk events are marked as high-risk events that need to be traced back to their source.

7. The power communication analysis method based on big data according to claim 1, characterized in that, For high-risk events requiring tracing, the generated mapping ticket enables end-to-end reversible restoration of sensitive data within the authorization window. The restored sensitive data undergoes anomaly analysis and judgment. After the tracing window is closed, the mapping ticket and key are destroyed, including: Receive high-risk events that require tracing, request an authorization window, and bind the event time window, data record identifier, and processing path; Within the authorization window, the mapping ticket and key escrow unit are invoked to retrieve the corresponding field-level mapping entries. The mapping relationship contained in the mapping ticket and the session key are used to perform end-to-end reversible restoration of the de-identified fields, generate the restored dataset, and perform integrity verification and time alignment. Based on the restored dataset, combined with the output and feedback data of the rapid anomaly judgment process, anomaly feature comparison and correlation verification are performed to form anomaly analysis and judgment results. At the end of the authorization window, the mapping ticket, mapping entry, and session key are destroyed, and the traceability session identifier, ticket identifier, data record identifier, and processing path summary are written to the tamper-proof audit log.

8. A power communication analysis system based on big data, executing the power communication analysis method based on big data as described in any one of claims 1 to 7, characterized in that, Includes the following modules: The data acquisition and classification module is used to collect multi-source heterogeneous data, classify it, and generate data records. The data aggregation and indexing module is used to aggregate and partition data records, and to create multidimensional indexes. The main control chain scheduling module is used to build an asynchronous main control chain mechanism and to distribute data records to the fast decision process or shadow channel according to priority. The reversible data masking module is used to perform field-level data masking on highly sensitive data and generate short-term mapping tickets. The local confirmation and verification module is used to generate local confirmation tasks, collect device feedback data, compare it with the results of the main control chain, identify high-risk events, and mark traceability requirements. The restoration and anomaly analysis module is used within the authorization window to call the mapped ticket to restore sensitive fields, complete anomaly analysis and location, and destroy the relevant tickets and keys after the window is closed; The handling and auditing module is used to execute anomaly handling strategies and write abnormal data, analysis paths, and tracing records into an immutable audit log.

Images