Intelligent substation process layer switch port flow monitoring and pre-warning system and method and storage medium

Abstract

The invention belongs to the technical field of power system automation and communication, particularly relates to an intelligent substation process level switch port flow monitoring and pre-warning system and method and a storage medium, and discloses an intelligent substation process level switch port flow monitoring and pre-warning system which comprises a data acquisition unit, a data processing unit and a data processing unit. The hardware input end is configured to perform non-intrusive coupling with a communication link of one or more target ports of the process layer switch to be monitored. According to the invention, tiny but fatal business logic risk precursor which cannot be identified in the prior art and is hidden under normal total flow can be found; and through a multi-level and multi-dimensional anomaly evaluation mechanism, the accuracy and timeliness of early warning are remarkably improved, so that the predictability and safety of the operation of the intelligent substation are greatly enhanced, and the method has great technical value for guaranteeing the stability and reliability of the whole power system.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of power system automation and communication technology, and specifically relates to an intelligent substation process layer switch port flow monitoring pre-alarm system and method and a storage medium. BACKGROUND

[0002] With the rapid development and intelligent transformation of modern power systems, the safety, reliability and real-time requirements of intelligent substation operation have reached an unprecedented height as a core physical node of building a strong smart grid. In the overall architecture of the intelligent substation, the communication network system defined by the International Electrotechnical Commission (IEC) 61850 standard is the cornerstone of realizing information interaction, coordinated control and comprehensive monitoring between devices in the station. The system is usually divided into station control layer, bay layer and process layer, among which the process layer network directly connects the intelligent electronic devices (IED) of primary equipment (such as circuit breakers, transformers) and secondary equipment (such as protection, measurement and control devices), and carries key business data streams such as Sampled Values (SV) messages and Generic Object Oriented Substation Event (GOOSE) messages. The determinism and low latency of its network communication are directly related to the correct execution of the entire power grid protection and control strategy. Therefore, effective monitoring of the port flow of the switch, the core device of the process layer network, is an indispensable technical link to ensure the safe and stable operation of the intelligent substation.

[0003] In existing technical practice, the flow monitoring of the substation process layer switch port usually draws on the network management methods in the traditional information technology (IT) field. Specifically, this method mainly relies on an alarm mechanism based on static thresholds. Its working principle is usually as follows: through the network management system (NMS) or the management function of the switch itself, using Simple Network Management Protocol (SNMP) and other methods, the macro flow statistical parameters of each port are periodically polled and collected, such as the total bandwidth utilization of the port, the total number of message transmission per unit time, or the error message count. The operation and maintenance personnel will pre-set one or more fixed, static alarm thresholds for these macro parameters based on experience or device rated performance. When the monitoring system finds that the real-time flow parameter of a port exceeds the pre-set threshold, an alarm event is triggered to notify the operation and maintenance personnel to troubleshoot. In the early stage of the development of intelligent substations, this monitoring method has played a positive role to a certain extent, as it can effectively discover some significant network faults, such as device port physical damage, link interruption, and "hard" faults caused by device abnormalities that lead to traffic surges, providing timely alarm basis for handling major network congestion or interruption problems.

[0004] However, with the continuous deepening of the complexity of smart substation business and the more stringent requirements for power grid safety margin, the above monitoring scheme based on static macroscopic threshold has some inherent characteristics in principle, which makes it gradually show deep limitations in dealing with new and hidden network risks. The reason is that the traffic of the process layer network is not homogeneous data flow, but a complex collection of messages with different business characteristics. For example, SV messages are continuous and periodic large-flow data, mainly reflecting the real-time electrical quantities of the primary side of the power system; while GOOSE messages are event-driven, non-periodic burst data, carrying key switch state and blocking logic, with extremely high real-time requirements for transmission. Any slight delay or packet loss may cause out-of-step or misoperation of protection. The traditional static threshold monitoring method only focuses on the "quantitative change" of the total port traffic, and completely ignores the composition and dynamic behavior pattern of the traffic "quality". This leads to a deep technical contradiction: the overall bandwidth utilization of a port may be far below the alarm threshold, and the network running state is normal on the surface, but it may be brewing hidden dangers that can cause protection logic errors. For example, a slight failure or configuration error of an IED may cause it to produce a small range of abnormal GOOSE message bursts at unnecessary times. This burst traffic is insignificant compared to the large SV traffic in the background, and it cannot touch the macro bandwidth threshold, but it may constitute a serious logic disturbance to the protection device receiving the GOOSE message. Similarly, small jitter or transient congestion in the network may cause delay of a few key SV messages, which will not cause significant changes in the total traffic parameters, but may destroy the data synchronization and integrity relied on by the protection algorithm.

[0005] The mismatch between this monitoring logic and the core requirements of process layer business has formed a huge "monitoring blind area". It can respond passively to large-scale network congestion that has occurred or is occurring, but it cannot effectively perceive and warn of subtle, precursory traffic anomaly patterns that indicate that the business logic is about to fail. Its monitoring granularity is too coarse, lacking deep perception and behavior analysis capabilities for business message flow, and it is essentially a passive alarm mechanism "after the fact" or "in the middle", which cannot meet the higher-order requirements of smart grid for "before the fact" fault prediction and active defense.

[0006] Therefore, how to build a monitoring system and method that can deeply perceive the characteristics of key business messages such as process layer SV, GOOSE, etc., model and analyze the fine-grained behavior patterns of traffic, accurately identify the micro-abnormal patterns hidden in normal macro-traffic that indicate business logic risks, and provide effective early warning before the actual failure occurs, has become a key challenge and technical problem to be solved for those skilled in the art. SUMMARY

[0007] The present application aims to overcome the deficiencies in the prior art, and provides an intelligent substation process layer switch port flow monitoring pre-alarm system and method, and a storage medium. The system and method aim to solve the technical problem that the prior art only relies on macro flow statistics and static threshold values, and thus cannot perceive abnormal micro flow behaviors that indicate business logic risks. The present application performs deep analysis and multi-dimensional feature extraction on sampled value (SV) packets and generic object-oriented substation event (GOOSE) packets that carry key services in the process layer network, establishes a high-fidelity flow behavior baseline model, and performs multi-level abnormality detection and determination on real-time flow based on the model, so as to accurately identify precursor network abnormalities before actual service failures occur, and achieve high-reliability pre-alarm.

[0008] To achieve the above-mentioned application purposes, the present application provides an intelligent substation process layer switch port flow monitoring pre-alarm system, which comprises: a data acquisition unit, a hardware input end of which is configured to be non-invasively coupled with a communication link of one or more target ports of a process layer switch to be monitored, for capturing all network data packets flowing through the target ports in real time, and adding a high-precision timestamp to each captured data packet; a flow feature vectorization unit, which is communicatively connected with the data acquisition unit, configured to receive the data packet sequence captured by the data acquisition unit and having added high-precision timestamps, and perform deep analysis on each data packet to identify its protocol type and extract a set of pre-defined feature parameters capable of representing the data packet service connotation and transmission behavior, so as to convert the discrete data packet sequence into a structured, multi-dimensional real-time feature vector stream; a baseline portrait construction unit, which is configured to run in a preset "baseline learning mode" of the system, for receiving and processing the feature vector stream generated in a confirmed substation normal operation period from the flow feature vectorization unit, and generating, for each specific service data stream on each monitored target port, a multi-dimensional dynamic behavior baseline portrait containing a set of deterministic constraint rules and a statistical behavior feature model, which uniquely corresponds to the specific service data stream; a real-time anomaly assessment unit, which is communicatively connected with the traffic feature vectorization unit and the baseline profile construction unit, and is configured to run in a "real-time monitoring mode" of the system, to continuously receive a real-time feature vector stream, and to call a corresponding baseline profile generated by the baseline profile construction unit, to perform a layer-by-layer and multi-dimensional comparison and judgment operation on the real-time feature vector stream, to identify a deviation between a real-time traffic behavior and the baseline profile, and to generate one or more original anomaly event signals of a deterministic violation alarm, a statistical deviation alarm or a predictive risk alarm according to a nature and a magnitude of the deviation; and a pre-alarm comprehensive generation unit, which is communicatively connected with the real-time anomaly assessment unit, and is configured to receive the original anomaly event signal, to perform an association analysis and a hazard level assessment on the original anomaly event signal, and to finally generate a structured pre-alarm report containing specific anomaly positioning information, quantified deviation data, a risk level and a diagnosis suggestion.

[0009] As a preferred embodiment of the present application, the data acquisition unit internally integrates a field programmable gate array (FPGA), which is directly connected with a gigabit or terabit Ethernet physical layer (PHY) transceiver chip supporting line-speed capture. A logic circuit internally fixed in the FPGA is used to add a hardware timestamp driven by a local high-stability crystal oscillator and having a resolution of no worse than 10 nanoseconds to a network data packet before the network data packet enters a medium access control (MAC) layer of the system. This design ensures that a data source for subsequent high-precision time correlation analysis such as jitter and time delay has absolute time accuracy. The data acquisition unit is coupled with a communication link of a target port through a passive optical tap (Optical TAP) or a port mirroring (Port Mirroring / SPAN) function configured on a switch.

[0010] Further, the traffic feature vectorization unit includes a protocol analysis subunit, a service flow identification subunit and a feature extraction subunit. The protocol analysis subunit is configured to analyze an Ethernet frame header, to distinguish a message type by checking a value of an EtherType field, to determine that the message is an SV message when the value is 0x88BA, and to determine that the message is a GOOSE message when the value is 0x88B8. The service flow identification subunit uses an application identifier (APPID) of the SV message as a unique identifier of the service data flow according to a definition of the IEC 61850 standard, and uses a GOOSE control block reference (gocbRef) of the GOOSE message as the unique identifier of the service data flow. The feature extraction subunit extracts multi-dimensional feature parameters of each identified service data flow to form a feature vector.

[0011] Specifically, the feature extraction subunit extracts the following feature parameter set for SV packet traffic: The first type is the protocol endogenous state feature: the sampling count value (smpCnt) and the configuration revision number (confRev) in the SV protocol data unit (PDU) are extracted and recorded.

[0012] The second type is the time behavior feature: based on the high-precision timestamp, the packet-by-packet arrival interval time of the SV packet sequence of the same APPID is calculated, and based on a sliding time window (for example, the window size is 400 packets, corresponding to 0.1 seconds under a 4000-point / week sampling rate), the average value, standard deviation (i.e., packet jitter), maximum value, and minimum value of the packet arrival interval time within the window are calculated.

[0013] The third type is the traffic statistical feature: in a unit of time (for example, 1 second), the total number of SV packets of the APPID is counted, i.e., the packet rate.

[0014] Similarly, the feature extraction subunit extracts the following feature parameter set for GOOSE packet traffic: The first type is the protocol endogenous state feature: the state number (stNum), sequence number (sqNum), test flag (Test), and timestamp (t) in the GOOSE PDU are extracted and recorded.

[0015] The second type is the time behavior feature: the packet-by-packet arrival interval time of the GOOSE packet sequence of the same gocbRef is calculated. In particular, this unit also records the stable retransmission interval time when the state does not change (stNum does not change, sqNum increases) and the internal interval time sequence of the burst packet cluster when the state changes (stNum increases).

[0016] The third type is the traffic statistical feature: in a unit of time, the total number of GOOSE packets of the gocbRef is counted, i.e., the packet rate, and the number of stable retransmission packets and the number of event-triggered burst packets are distinguished.

[0017] The multi-dimensional dynamic behavior baseline image generated by the baseline image construction unit has the following internal structure: A deterministic rule set, which is predefined according to the mandatory provisions of IEC 61850 protocol standard, combined with the information in the Substation Configuration Description (SCD) file, or automatically induced in the learning mode. For SV message stream, the rule set specifies that the smpCnt value must be strictly cyclically incremented between 0 and 3999 (for 4000 points / cycle sampling), and cannot jump or repeat; the confRev value must be consistent with the protection device configuration version defined in the SCD file. For GOOSE message stream, the rule set specifies that when the primary equipment state does not change, the stNum value remains unchanged, and the sqNum value monotonically increases with each retransmission message; when the primary equipment state changes, the stNum value must monotonically increase.

[0018] A statistical behavior characteristic model, which is the result of statistical analysis and mathematical modeling of a large number of characteristic parameters collected in the learning mode. For the time behavior characteristics of SV message stream, the model includes the Gaussian Mixture Model (GMM) fitting parameters of its message arrival interval time, the baseline mean value and baseline standard deviation of message jitter. For the time behavior characteristics of GOOSE message stream, the model includes its stable retransmission interval time expectation value and allowable deviation range. For the flow statistical characteristics of both types of messages, the model includes their nominal message rate per unit time.

[0019] A cross-flow association model, which describes the stable quantitative relationship between multiple different service data streams coexisting on the same switch port. For example, for a port connected to a merging unit, the message rates of multiple different phase SV message streams (distinguished by different APPIDs) contained in its upstream traffic should maintain a constant proportional relationship.

[0020] The internal working logic of the real-time anomaly assessment unit is divided into three progressive assessment levels: The first level, deterministic rule violation detection. This level compares the real-time extracted protocol endogenous state characteristics with the deterministic rule set in the baseline profile. Any violation of the rules, such as a jump in the smpCnt of SV message, or a change in the stNum of GOOSE message when the state does not change, will immediately trigger a high-priority deterministic rule violation alarm signal. Such anomalies directly indicate serious errors at the communication protocol level.

[0021] The second level, statistical deviation detection. This level compares the real-time calculated time behavior characteristics and flow statistical characteristics with the statistical behavior characteristic model in the baseline profile. The anomaly judgment is based on the following set of conditions: (a) For SV packet flows, if the real-time packet jitter (calculated as the standard deviation within a sliding time window) exceeds the baseline jitter mean plus a configurable multiple (e.g. 3 times) of the baseline jitter standard deviation, a statistical deviation alarm is triggered.

[0022] (b) For any traffic flow, if its real-time packet rate consistently (e.g. within 5 consecutive observation periods) exceeds or falls below its nominal packet rate by a pre-set percentage (e.g. ±20%), a statistical deviation alarm is triggered.

[0023] (c) For GOOSE packet flows, if its stable retransmission interval time exceeds the allowable deviation range defined in the baseline model, a statistical deviation alarm is triggered.

[0024] (d) Using Kolmogorov-Smirnov test or similar non-parametric test method, the empirical cumulative distribution function (ECDF) of the packet inter-arrival time series within a real-time window is compared with the probability distribution function (PDF) in the baseline model. If the test gets a p-value lower than a significance level (e.g. 0.01), it is determined that the real-time distribution has changed significantly, triggering a statistical deviation alarm.

[0025] The third level, predictive risk assessment. This level employs a time series prediction model based on long short-term memory (LSTM) neural network. In the baseline learning mode, the model is trained using normal feature vector sequences, learning to predict the most likely feature vector value at the next time instant (t+1). In the real-time monitoring mode, the model predicts the feature vector at t+1 based on the real-time feature vector sequence up to the current time instant (t). Then, by calculating the Mahalanobis Distance between the predicted vector and the actually observed feature vector at t+1, the difference between the two is quantified. When this Mahalanobis Distance exceeds a dynamically adjusted threshold value calculated based on the historical prediction error distribution, it is considered that the traffic behavior has shown a potential evolutionary trend that cannot be captured by existing statistical models, thus triggering a low-priority predictive risk alarm signal. This alarm indicates a weak abnormality sign that is still in its infancy.

[0026] The pre-alarm integrated generation unit receives the original abnormal event signals from the above three levels, and does not directly output. It first performs a correlation analysis process, for example, if the jitter increase alarm (statistical deviation) and smpCnt jump alarm (deterministic violation) for the same SV message stream are continuously received within a short time (such as 500 milliseconds), the system will combine the two independent events into a higher level composite pre-alarm indicating "combined unit clock synchronization abnormality or data processing disorder". Secondly, according to the type of abnormality (deterministic > statistical > predictive), the frequency of occurrence, the importance of the associated service flow (for example, the GOOSE flow of the main protection is higher than the SV flow of the backup protection), and other factors, the unit calculates a quantitative risk index (for example, 1-100) for each pre-alarm event through a pre-set fuzzy logic reasoning engine. Finally, the generated structured pre-alarm report not only contains the risk index, but also clearly points out the source of the abnormality (switch port number, service flow APPID / gocbRef), the specific manifestation of the abnormality (for example, "smpCnt value jumps from 1203 to 1250"), the timestamp of the abnormality occurrence, the comparison data with the baseline value (for example, "real-time jitter 25.3 microseconds, baseline jitter 5.1 microseconds"), and the preliminary diagnosis suggestion matched according to the built-in rule library (for example, "suggest checking the GPS clock synchronization state of the merging unit with APPID 0x4001").

[0027] The application also provides an intelligent substation process layer switch port flow monitoring pre-alarm method, which comprises the following steps: Step S1: Through the hardware probe coupled with the communication link of the target port of the process layer switch, all data packets flowing through the port are captured in real time at line speed, and a hardware timestamp with nanosecond-level precision is added to each data packet.

[0028] Step S2: The captured time-stamped data packets are protocol-analyzed to identify them as SV messages, GOOSE messages or other types of messages, and the messages are classified according to their APPID or gocbRef.

[0029] Step S3: For each classified service flow, the protocol-intrinsic state characteristics (such as smpCnt, stNum, etc.), the time behavior characteristics (such as jitter, inter-arrival distribution, etc.) calculated based on high-precision timestamps, and the traffic statistical characteristics (such as message rate) are extracted to form a continuous real-time feature vector stream.

[0030] Step S4: In the baseline learning phase performed by the system in advance, a feature vector stream generated in a recognized normal operation period is processed by an algorithm to generate a multi-dimensional dynamic behavior baseline portrait for each service stream, the portrait containing a set of deterministic rules, a statistical behavior feature model and a cross-stream association model, and the portrait is stored.

[0031] Step S5: In the real-time monitoring phase, the real-time feature vector stream generated in step S3 is compared with the corresponding baseline portrait stored in step S4 in multiple levels: first, deterministic rule violation detection, then statistical deviation detection, and finally predictive risk assessment.

[0032] Step S6: According to the comparison result of step S5, once the real-time behavior is found to violate the deterministic rules, or there is a significant deviation from the statistical model, or it is judged as abnormal evolution by the prediction model, a corresponding original abnormal event signal is generated.

[0033] Step S7: The received original abnormal event signal is subjected to correlation analysis and risk level quantitative assessment, and finally a structured pre-alarm report containing detailed positioning, quantitative data and diagnostic suggestions is generated and output.

[0034] A storage medium storing a computer program for executing the intelligent substation process layer switch port flow monitoring pre-alarm method.

[0035] In summary, the system and method provided by the present application establish a deep perception capability for process layer network flow by switching from "macro total amount" monitoring to "micro behavior" analysis. It not only can find the small but fatal business logic risk precursor hidden in the normal total flow which cannot be identified by the prior art, but also significantly improves the accuracy and timeliness of the early warning through a multi-level, multi-dimensional abnormality assessment mechanism, and upgrades the alarm information from simple "event notification" to "decision support" rich in diagnostic information, thereby greatly enhancing the predictability and safety of the intelligent substation operation, and having great technical value for ensuring the stability and reliability of the entire power system. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 The structural block diagram of the intelligent substation process layer switch port flow monitoring pre-alarm system provided by the present application; Figure 2 The flowchart of the intelligent substation process layer switch port flow monitoring pre-alarm method provided by the present application; Figure 3 The internal structural block diagram of the real-time abnormality assessment unit in the embodiment of the present application; Figure 4 The structural schematic diagram of the multi-dimensional dynamic behavior baseline portrait in the embodiment of the present application.

[0037] The reference signs are as follows: 100, data acquisition unit; 200, flow feature vectorization unit; 300, baseline portrait construction unit; 400, real-time anomaly assessment unit; 500, pre-alarm comprehensive generation unit; 310, deterministic rule set; 320, statistical behavior feature model; 330, cross-flow correlation model; 410, deterministic violation detection layer; 420, statistical deviation detection layer; 430, predictive risk assessment layer. DETAILED DESCRIPTION

[0038] To make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without any creative work fall within the protection scope of the present application.

[0039] To systematically set forth the intelligent substation process layer switch port flow monitoring and pre-alarm system and method provided by the present application, detailed engineering description will be made below with reference to the drawings.

[0040] Reference Figure 1 It shows the overall structure block diagram of the intelligent substation process layer switch port flow monitoring and pre-alarm system provided by the present application. The system can be physically deployed as an independent hardware device with high-performance processing capability, or deployed as a virtualized network function (VNF) on the general computing platform of the substation. The core purpose is to conduct unprecedented deep behavior portrait and abnormal pre-warning on the IEC 61850 messages carrying key business logic in the process layer network, especially the sample value (SV) messages and the generic object-oriented substation event (GOOSE) messages. The system is logically composed of multiple closely coordinated functional units, including a data acquisition unit 100, a flow feature vectorization unit 200, a baseline portrait construction unit 300, a real-time anomaly assessment unit 400 and a pre-alarm comprehensive generation unit 500.

[0041] Specifically, the data acquisition unit 100 as the perception front end of the entire system, its core task is to capture the process layer switch target port on the whole network communication data to be monitored with high fidelity, no omission. The physical interface of the unit, such as one or more SFP+ or QSFP28 optical module interface, through a passive optical tap or using the switch itself port mirror (Port Mirroring or SPAN) function, with the target communication link to achieve non-invasive coupling. The preferred way to use the optical tap, because it replicates the optical signal at the physical layer, the original communication link does not produce any delay, jitter or packet loss effect, to ensure the absolute purity of the data source. In a specific implementation, the optical tap splitting ratio can be set to 70 / 30, wherein 70% of the optical power continues to transmit to the original target device, 30% of the optical power is guided to the data acquisition unit 100 of the system, ensuring zero interference to the original communication.

[0042] The internal implementation of the data acquisition unit 100 is different from the traditional general network card based software packet capture scheme, which internally integrates a field programmable gate array (FPGA), such as a Kintex-7 series FPGA chip of Xilinx Company, which is directly connected with a gigabit Ethernet physical layer (PHY) transceiver chip (such as Marvell's Alaska series 88X3310P) supporting line speed capture. After the network data packet is received by the PHY chip and the physical layer decoding is completed, before entering the medium access control (MAC) layer logic of the system, the FPGA internally solidified hardware logic circuit will attach a high-precision timestamp to it. The timestamp is generated from a board-mounted high-stability temperature-compensated crystal oscillator (TCXO), which has a frequency stability better than ±1.0 ppm, driving a 64-bit nanosecond-level counter. Whenever the start of frame delimiter (SFD) of a data packet is detected, the FPGA will immediately latch the current counter value and send it as additional metadata with the data packet to the subsequent processing pipeline. The resolution of this hardware timestamp mechanism can reach 10 nanoseconds or even higher, far exceeding the microsecond-level timestamp provided by the operating system kernel, laying an important data foundation for subsequent accurate packet jitter, delay sequence analysis. All captured and timestamped data packets will be transmitted to the traffic feature vectorization unit 200 through a high-speed internal bus (such as AXI4-Stream).

[0043] The traffic feature vectorization unit 200 is the bridge connecting raw data and high-level analytics. It receives the raw packet sequence with high-precision timestamps from the data acquisition unit 100 and converts it into a structured multi-dimensional feature vector stream consumable by machine learning models. The unit is typically deployed on a high-performance multi-core processor, such as an SoC based on ARM Cortex-A72 architecture, and runs an optimized real-time operating system. The unit can be further divided into three cooperating sub-units: a protocol parsing sub-unit 210, a traffic flow identification sub-unit 220, and a feature extraction sub-unit 230.

[0044] The protocol parsing sub-unit 210 performs deep parsing on each incoming packet. It first checks the EtherType field in the Ethernet II frame header. When the field value is 0x88BA, the sub-unit determines that the message is an SV message; when the value is 0x88B8, it determines that the message is a GOOSE message. For other types of messages, such as ARP, PTP, or ICMP, the system can choose to ignore or perform basic statistics according to the configuration. Once the message type is determined, the protocol parsing sub-unit 210 continues to parse the message payload down to the IEC 61850 application layer protocol data unit (APDU) to expose all protocol fields needed for subsequent feature extraction.

[0045] Next, the traffic flow identification sub-unit 220 is responsible for assigning a unique traffic flow attribution label to each parsed SV or GOOSE message. This is crucial for distinguishing messages from different intelligent electronic devices (IEDs) or the same IED but serving different functions. According to the IEC 61850-9-2 (for SV) and IEC 61850-8-1 (for GOOSE) standards, the sub-unit uses the explicitly defined identifiers within the message APDU to uniquely identify a traffic data stream. For SV messages, the application identifier (APPID), a 16-bit integer value, is used as the unique identifier for the SV stream. For GOOSE messages, the GOOSE control block reference (gocbRef), a string type object reference, is used as the unique identifier for the GOOSE stream. In this way, the packet flood originally mixed on the same physical port is clearly sorted into multiple parallel data streams with clear business implications.

[0046] After the traffic flow is identified, the feature extraction sub-unit 230 extracts a set of pre-defined multi-dimensional feature parameters for each traffic flow, thereby converting the discrete message sequence into a continuous feature vector stream. These features are carefully designed to fully characterize the intrinsic state, temporal behavior, and macroscopic statistical properties of the traffic flow.

[0047] For a SV packet traffic flow identified by a specific APPID, the feature vector extracted by the feature extraction subunit 230 specifically contains the following dimensions: First, the protocol-intrinsic state features. This subunit directly extracts and records two key state fields from the SV protocol data unit (PDU): the sample count value (smpCnt) and the configuration revision number (confRev). smpCnt is a cyclic counter whose value reflects the sequence position of the sampling point within each power frequency cycle; confRev identifies the current configuration version of the merging unit (MU) that publishes this SV flow.

[0048] Second, the time behavior features. Using the high-precision hardware timestamps attached to the data acquisition unit 100, this subunit calculates the difference between the timestamps of two consecutive packets in the SV packet sequence of the same APPID, i.e., the inter-packet arrival interval time. To smooth out transient fluctuations and observe trends, this subunit maintains a fixed-size sliding time window, for example, for a sampling rate of 4000 points per cycle, the window size can be set to 400 packets, which corresponds to a time span of 0.1 seconds. Within this window, the statistical quantities of all packet arrival interval times are calculated in real time, including the arithmetic mean, standard deviation (which is the quantified packet jitter), maximum value, and minimum value. These statistical quantities constitute key features that describe time stationarity.

[0049] Third, the traffic statistics features. Within a longer, fixed time window, for example, 1 second, this subunit counts the total number of SV packets of this APPID, thereby obtaining the instantaneous packet rate (units: packets per second, pps) of this traffic flow.

[0050] Similarly, for a GOOSE packet traffic flow identified by a specific gocbRef, the feature vector extracted by the feature extraction subunit 230 focuses on its event-driven characteristics: First, the protocol-intrinsic state features. Extract and record the state number (stNum), sequence number (sqNum), test flag (Test), and timestamp (t) encapsulated inside the PDU in the GOOSE PDU. The change of stNum indicates a change in the state of the device, sqNum increases with each retransmission when stNum does not change, the Test bit is used to distinguish between real events and test signals, and the internal timestamp t records the time of event occurrence.

[0051] Second, time behavior feature. Again based on high-precision hardware timestamps, the subunit calculates the inter-packet arrival interval time of the GOOSE message sequence of the same gocbRef. Unlike SV, the time behavior of GOOSE presents a bimodal pattern: when there is no change in the device state, GOOSE messages are retransmitted in a heartbeat mode with a relatively fixed long period, and this subunit records the stable retransmission interval time at this time; when the state changes (stNum increases), GOOSE enters a fast retransmission stage and publishes a series of intensive burst message clusters, and this subunit captures and records the interval time sequence of each pair of consecutive messages in the burst message cluster.

[0052] Third, traffic statistics feature. In a unit of time (e.g., 1 second), the subunit counts the total number of GOOSE messages of the gocbRef. Further, the subunit distinguishes and counts the number of heartbeat messages in stable retransmission and the number of burst messages in event triggering according to whether sqNum is zero and whether stNum changes, which provides a more detailed perspective for understanding the real-time working condition of the substation.

[0053] The baseline portrait construction unit 300 is the learning and modeling core of the present application. It runs in a preset "baseline learning mode" of the system. In this mode, the system administrator confirms that the substation is in a fault-free, undisturbed, stable and representative working condition (e.g., a typical summer high-load working day, lasting for more than 24 hours). The unit continuously receives and accumulates the feature vector stream from the traffic feature vectorization unit 200, and processes it through a series of algorithms to generate a highly customized multi-dimensional dynamic behavior baseline portrait for each specific service data stream (identified by APPID or gocbRef) on each monitored target port. Referring to Figure 4 The portrait is not a single model, but a composite structure, which specifically includes: A deterministic rule set 310. This rule set is a hard constraint, any violation means an explicit error. Its content is partly derived from the mandatory provisions of IEC 61850 protocol standard, and partly automatically generated by parsing the specific engineering configuration file (i.e. SCL file, including SCD, ICD, CID, etc.) of this substation, thus tightly coupled with the specific engineering implementation of this station. For SV message stream, this rule set strictly specifies that smpCnt value must be strictly, without missing, without repetition, cyclically incremented by 1 between 0 and N-1 (N is the number of sampling points per power frequency cycle, for example, N=4000 for 4000 points / cycle); any jump (such as from 100 to 105) or stagnation (two consecutive messages with the same smpCnt) is a violation. Meanwhile, confRev value must be constant, and exactly identical to the configuration version number defined in SCD file for this merging unit. For GOOSE message stream, this rule set specifies that when the device state does not change, its stNum value must remain unchanged, while sqNum value should be monotonically incremented from 0 with each retransmission message; when the device state changes, stNum value must be monotonically incremented by 1 than the previous state's stNum value.

[0054] A statistical behavior model 320. This model describes the random fluctuation law of traffic flow under normal state. It is the result of statistical analysis and probability modeling on a large number of feature parameter samples collected in learning mode. For the time behavior feature of SV message stream, this model can be a Gaussian Mixture Model (GMM) to fit the multi-peak distribution that its message arrival interval time may present after verification, the model stores the weight, mean and variance of each Gaussian component of GMM. At the same time, the baseline average value and baseline standard deviation of its message jitter (i.e. arrival interval time standard deviation) in the learning period are also recorded in the model, which constitutes the benchmark for subsequent jitter anomaly detection. For the time behavior feature of GOOSE message stream, this model records the mathematical expectation value of its stable retransmission interval time and an allowable deviation range (for example, the expected value is 1000 milliseconds, and the allowable deviation is ±10 milliseconds). For the traffic statistical features of the two types of messages, this model records their nominal message rates per unit time, for example, the nominal rate of an SV stream is 4000 pps, and the nominal rate of a GOOSE stream under stable state is 1 pps.

[0055] A cross-flow correlation model 330. This model is used to capture the hidden but stable quantitative or timing relationship between multiple different traffic data flows coexisting on the same switch port, which is a more macroscopic system-level behavior characteristic. For example, a switch uplink port connected to a merging unit, its traffic must contain multiple different phase (A phase, B phase, C phase) current and voltage SV message streams issued by the merging unit, which are distinguished by different APPIDs. Under normal circumstances, the message rates of these SV streams should maintain a constant 1:1:1... proportional relationship. This model will solidify this correlation relationship, and any deviation from this proportion may indicate a problem with the processing of a channel inside the merging unit.

[0056] When the baseline image is built and solidified, the system switches to the "real-time monitoring mode", at which time the real-time anomaly assessment unit 400 begins to play a role. Referring to Figure 3 The internal working logic of this unit is carefully designed as a progressive, three-layer assessment system from shallow to deep, to achieve fast, accurate, and multi-dimensional qualitative characterization of anomalies.

[0057] The first level is the deterministic rule violation detection layer 410. The work of this level is the most direct and efficient. It performs a real-time, packet-by-packet, hard comparison of the protocol endogenous state features in the feature vector generated by the traffic feature vectorization unit 200 with the deterministic rule set 310 in the baseline image. Any mismatch will immediately trigger a high-priority deterministic rule violation alarm signal. For example, if the smpCnt value of an SV message jumps from 1203 to 1250 suddenly, which seriously violates the rule that smpCnt must be continuously incremented, this level will immediately generate an "smpCnt jump" alarm pointing to the SV stream. Similarly, if it is monitored that the stNum of a GOOSE message has a non-increasing change between two events (e.g., from 5 back to 4), or that the sqNum does not start from 0 and increment when the state does not change (stNum does not change), a deterministic rule violation alarm will be triggered. Such an alarm directly indicates a serious error or device functionality failure at the communication protocol level, with very high credibility.

[0058] The second level is the statistical deviation detection layer 420. When the traffic behavior appears to be compliant at the protocol level, this layer further checks whether its statistical characteristics deviate from the normal "comfort zone". It will continuously perform statistical tests on the time behavior features and traffic statistical features calculated in real time, with the statistical behavior feature model 320 in the baseline image. The triggering of a statistical deviation alarm is based on the satisfaction of one or more conditions: Condition (a), jitter anomaly detection for SV packet flows. If the real-time packet jitter value (standard deviation) calculated over a sliding time window exceeds the baseline jitter mean plus a configurable multiple (e.g., 3 times) of the baseline jitter standard deviation recorded in the baseline model, i.e., Jitter_realtime > Jitter_baseline_mean + 3 * Jitter_baseline_stddev, then a significant jitter anomaly is determined to have occurred, and a statistical deviation alarm is triggered. This usually indicates network congestion or a decrease in the source device clock synchronization performance.

[0059] Condition (b), rate anomaly detection for any traffic flow. If the real-time packet rate consistently exceeds or falls below a pre-set percentage threshold (e.g., ±20%) of the nominal packet rate in its baseline profile over consecutive multiple observation periods (e.g., 5 consecutive 1-second periods), a statistical deviation alarm is triggered. Persistent rate decrease can imply packet loss, while rate increase can indicate device abnormality or configuration error.

[0060] Condition (c), stable retransmission period anomaly detection for GOOSE packet flows. During state invariance, if the real-time stable retransmission interval time exceeds the allowable deviation range defined in the baseline model (e.g., measured value 985 ms, exceeding the range [990, 1010] ms), a statistical deviation alarm is triggered, which can indicate abnormality in the protection device communication function.

[0061] Condition (d), detection of packet inter-arrival time distribution pattern. This level can use non-parametric test methods such as Kolmogorov-Smirnov (K-S) test to compare the empirical cumulative distribution function (ECDF) of the packet inter-arrival time series in the most recent real-time window with the theoretical probability distribution function (PDF, e.g., GMM PDF) stored in the baseline model. If the p-value calculated by the K-S test is lower than a pre-set significance level (e.g., 0.01), it means there is sufficient statistical evidence to suggest that the distribution pattern of the real-time traffic has changed significantly, even if its mean or variance may still be within the allowed range. This is a more sensitive detection method that can capture changes in behavior patterns.

[0062] The third tier is the predictive risk assessment tier 430. This tier aims to capture those more subtle, incipient, weak abnormal evolving trends that are difficult to perceive by traditional statistical methods. At its core is a time series prediction model based on a long short-term memory (LSTM) neural network. During the baseline learning mode, the model is trained using a large amount of time series of feature vectors that are confirmed to be normal. The goal of the training is to let the model learn to accurately predict the most likely value of the feature vector at the next time step (t+1) given the sequence of feature vectors at the past time window (e.g., the past 100 time steps).

[0063] In the real-time monitoring mode, the pre-trained LSTM model receives the real-time sequence of feature vectors up to the current time (t) and outputs the predicted value V_pred(t+1) of the feature vector at t+1. When the actual feature vector V_actual(t+1) at t+1 is observed, the tier calculates the Mahalanobis Distance between the predicted vector and the actual observed vector. The advantage of the Mahalanobis Distance over the Euclidean Distance is that it takes into account the correlation between the dimensions of the feature vector and is not sensitive to the scale of the measurement. Its calculation requires the covariance matrix of the prediction error vectors obtained during the training phase. When the calculated Mahalanobis Distance exceeds a dynamically adjusted threshold (which can be set based on the quantile of the historical prediction error distribution, e.g., the 99.9% quantile), the system considers that there is an "unexpectedness" in the real-time traffic behavior, i.e., its evolution path deviates from all the patterns learned by the model from the normal history. At this time, a low-priority predictive risk alert signal is triggered. This alert is not an indication of an already occurred failure, but a signal of "increased uncertainty" that prompts the operations personnel to pay attention to the potential risks of the business flow.

[0064] Finally, the pre-alarm synthesis unit 500, as the decision output hub of the system, is responsible for refining and distilling the various raw and scattered abnormal event signals from the real-time anomaly assessment unit 400 into a structured pre-alarm report with high guiding value for the operation and maintenance personnel. It does not simply forward the alarms, but performs a complex synthesis processing procedure. First, it performs a correlation analysis process. For example, a rule engine based on time window and event attribute is configured here. If the system receives a risk alarm from the predictive risk assessment layer 430, followed by a jitter increase alarm from the statistical deviation detection layer 420, and finally an smpCnt jump alarm from the deterministic violation detection layer 410 within a very short time (such as 500 milliseconds) for the same SV message stream, the unit will correlate and combine these three independent events semantically into a higher-level composite pre-alarm event with stronger root cause pointing, and its diagnostic conclusion may be "combined cell clock synchronization anomaly or internal data processing logic disorder".

[0065] Secondly, the unit performs risk level quantitative assessment on each (or combined) pre-alarm event. A pre-set fuzzy logic reasoning engine can be used for this purpose. The input variables of the engine include: the type of anomaly (the intrinsic weight of deterministic violation is the highest, followed by statistical deviation, and the lowest is predictive risk), the frequency and duration of anomaly occurrence, the business importance level of the associated business flow defined in the SCD file (for example, the importance of the GOOSE flow carrying the main protection logic is higher than that of the SV flow carrying the measurement and control data), etc. Through a series of "IF-THEN" fuzzy rule reasoning, such as "IF abnormal type IS deterministic AND business importance IS high THEN risk index IS very high", and after de-fuzzification calculation (such as barycenter method), a quantitative risk index ranging from 1 to 100 is finally calculated for each pre-alarm event.

[0066] Finally, the unit generates and outputs a structured pre-alarm report. This report is far from a simple "Port G1 / 0 / 5 is abnormal". Its content is extremely detailed, including: a unique event ID, a timestamp of the abnormality occurrence with nanosecond precision, a quantified risk index, precise location information of the abnormality source (switch name, port number, VLAN ID, APPID or gocbRef of the service flow), a specific phenomenon description of the abnormality (e.g. "stNum of GOOSE message gocbRef 'IED_Bay01_Prot_Trip' changed from 34 to 35 while state unchanged"), detailed quantified comparison data with baseline values (e.g. "real-time message jitter reached 25.3 microseconds, significantly higher than the 5.1±1.2 microseconds range in the baseline profile"), and a crucial preliminary diagnosis suggestion automatically matched according to the built-in expert rule library (e.g. "suggest checking the PTP clock synchronization status of the merging unit with APPID 0x4001 immediately, and verifying the master clock source, network path and synchronization log of the unit").

[0067] Corresponding to the above system, the application also provides an intelligent substation process layer switch port flow monitoring pre-alarm method, referring to Figure 2 The flowchart clearly shows the execution steps of the method.

[0068] Step S1, data acquisition and timestamp stamping. Through the passive coupling hardware probe (i.e. data acquisition unit 100) on the communication link of the target port of the process layer switch, all network data packets flowing through the port are captured in real time at line speed, and a hardware timestamp with nanosecond resolution is accurately stamped on the starting frame of each data packet using FPGA hardware logic.

[0069] Step S2, protocol analysis and service flow attribution. The captured data packet sequence with high-precision timestamp is subjected to deep protocol analysis to identify whether it is an SV message, a GOOSE message or other types of messages. According to the IEC 61850 standard, each message is accurately divided into the service data flow it belongs to according to the application identifier (APPID) or GOOSE control block reference (gocbRef) in the message content.

[0070] Step S3, multi-dimensional feature extraction. For each service flow divided in step S2, its multi-dimensional feature parameters are extracted in real time and continuously to form a continuous real-time feature vector stream. These features include protocol-inherent state features (such as smpCnt, stNum, sqNum, confRev, etc.), time behavior features calculated based on high-precision timestamps (such as packet-by-packet arrival interval, message jitter, arrival interval distribution pattern, etc.), and flow statistics features (such as message rate, heartbeat message and burst message differentiation count, etc.).

[0071] Step S4, baseline profile learning and construction. At the initial stage of system deployment or at specified maintenance window, a baseline learning phase is performed. In this phase, a stream of feature vectors generated in a period confirmed as normal and stable operation of the substation is input to the baseline profile construction unit 300. The unit generates a unique multi-dimensional dynamic behavior baseline profile for each service flow by deterministic rule induction, statistical distribution modeling and cross-flow correlation analysis algorithms, and stores it in the system's knowledge base.

[0072] Step S5, real-time multi-level anomaly assessment. In the normal online monitoring phase, the feature vector stream generated in real time in step S3 is continuously compared with the baseline profile of the corresponding service flow stored in step S4 in multiple levels. The comparison process is strictly performed in three levels as shown in the figure: first, deterministic violation detection 410 is performed to compare the real-time protocol state with the deterministic rule set; if there is no violation, statistical deviation detection 420 is performed to compare the real-time statistical features with the statistical model; finally, predictive risk assessment 430 is performed to find potential evolving anomalies by using time series prediction model. Figure 3

[0073] Step S6, original anomaly event generation. According to the results of multi-level comparison in step S5, once it is found that the real-time traffic behavior violates the deterministic rules, or its statistical features deviate significantly and continuously from the baseline model, or it is judged as an evolving anomaly by the time series prediction model, the corresponding deterministic violation alarm, statistical deviation alarm or predictive risk alarm, etc. original anomaly event signal is generated immediately, and these signals are transmitted to the subsequent processing unit.

[0074] Step S7, pre-alarm comprehensive generation and output. The original anomaly event signals received in step S6 are processed at a high level. Through the correlation analysis engine, multiple low-level events that are related in time and logically are merged into meaningful composite events. By using fuzzy logic reasoning and other methods, the events are comprehensively quantitatively evaluated. Finally, a structured and information-rich pre-alarm report is generated and output, which contains detailed positioning, quantitative data, risk level and executable diagnosis suggestions of the anomaly.

[0075] A storage medium storing a computer program for executing the above-mentioned intelligent substation process layer switch port traffic monitoring pre-alarm method.

[0076] Embodiment ​To illustrate the practical application effect of the system and method provided by the present application more specifically, an embodiment in a simulated 220kV intelligent substation environment is provided.

[0077] Scenario setting: The system of the present application is deployed to monitor GE1 / 0 / 5 port of a process layer switch (Model: HUAWEIS5735-L). This port is connected downstream to a merging unit MU-01 (Model: NARI Relay RCS-978), which is responsible for collecting analog quantities of phase A voltage (Ua) and current (Ia), and generating two SV message streams according to IEC 61850-9-2 LE specification at 4000 points per cycle (i.e. sampling frequency of 200kHz), and sending them upstream through GE1 / 0 / 5 port. The SV stream APPID corresponding to Ua is 0x400A, and the SV stream APPID corresponding to Ia is 0x400B. Meanwhile, this port also carries a GOOSE message stream from another protection device IED-P02, which is used to block reclosing, with gocbRef of “IED_P02 / LLN0GOBlkReclose”, and is retransmitted at a period of 2000ms under normal conditions.

[0078] Step 1: Baseline profile construction The system runs in “baseline learning mode” for 72 hours. During this period, the power grid runs smoothly, and all devices work normally. The baseline profile construction unit 300 generates the following core baseline profile for the three service streams on GE1 / 0 / 5 port: SV stream (APPID: 0x400A): Deterministic rule set: smpCnt cyclically increases in the range of 0-3999; confRev is constant at 10. Statistical behavior characteristic model: nominal rate 4000 pps; message arrival interval time mean value is 250.0 microseconds, and its distribution is approximately a Gaussian distribution with mean value of 250.0µs and standard deviation of 0.8µs; baseline jitter (standard deviation of arrival interval within sliding window) mean value is 5.1µs, and baseline jitter standard deviation is 1.2µs. SV stream (APPID: 0x400B): profile content is basically the same as 0x400A.

[0079] GOOSE stream (gocbRef:...BlkReclose): Deterministic rule set: when the state does not change, stNum is constant at 1, and sqNum monotonically increases from 0.

[0080] Statistical behavior characteristic model: stable retransmission interval time expectation value is 2000ms, and allowable deviation range is [1995ms, 2005ms].

[0081] Cross-flow correlation model: The packet rate ratio of SV flows 0x400A and 0x400B is always 1:1.

[0082] Step 2: Real-time monitoring and anomaly discovery The system switches to "real-time monitoring mode". At 14:30:00 on a certain day, the PTP clock synchronization module inside the MU-01 device begins to malfunction slightly, causing a slight drift in its local clock frequency.

[0083] 14:30:15: The LSTM model of the predictive risk assessment layer 430 first detects the anomaly. For SV flows with APPID 0x400A and 0x400B, the evolution of their real-time feature vectors (especially the packet inter-arrival time series) begins to deviate from the model's predictions. Although statistical indicators such as jitter have not exceeded the limit, the Mahalanobis distance between the predicted vector and the actual observed vector has begun to consistently exceed the pre-set 99.9% quantile threshold. The system generates two low-priority "predictive risk" alarms, with a risk index assessment of 15, suggesting "pay attention to the time behavior stability of this SV flow".

[0084] 14:31:05: The clock drift of MU-01 intensifies. The statistical deviation detection layer 420 begins to alarm. For the SV flow with APPID 0x400A, the real-time jitter calculation value within the sliding window is 25.3µs. This value exceeds the threshold for statistical deviation (5.1µs + 3 * 1.2µs = 8.7µs). The system immediately generates a medium-priority "statistical deviation" alarm, indicating "abnormal increase in SV packet jitter". The pre-alarm synthesis unit 500 correlates this alarm with the previous predictive risk alarm, raising the combined event risk index to 65.

[0085] 14:31:40: The clock of MU-01 is completely lost, causing its internal sampling and packet logic to reset. The deterministic violation detection layer 410 captures a fatal error. For the SV flow with APPID 0x400A, its smpCnt value is monitored to jump directly from 1203 to 0. This is a serious protocol violation. The system generates a high-priority "deterministic violation" alarm.

[0086] 14:31:41: After receiving the smpCnt jump alarm, the pre-alarm synthesis unit 500 immediately correlates it with the previous jitter increase and predictive risk alarms, generating a final, high-risk composite pre-alarm report.

[0087] Step 3: Pre-alarm report generation The final structured pre-alarm report content is summarized as follows: Event ID: EVT-20230815-0012 Risk Index: 98 (Very High) Time of occurrence: 2023-08-15 14:31:40.123456789 Location: Switch SWH-PL-01, Port GE1 / 0 / 5, SV service flow, APPID=0x400A Abnormal sequences: [14:30:15] Predictive risk: Time behavior deviates from the prediction model.

[0088] [14:31:05] Statistical deviation: Message jitter 25.3µs, far exceeding the baseline value of 5.1±1.2µs.

[0089] [14:31:40] Deterministic violation: smpCnt jumps from 1203 to 0.

[0090] Diagnostic Recommendation: "A cascading anomaly, ranging from predictive to statistical to deterministic, has been detected in the SV stream associated with merging unit MU-01. The root cause is most likely a loss of clock synchronization in MU-01 or a failure in its internal processing unit. Please immediately check the PTP synchronization status, power supply, and hardware status lights of MU-01." Through this embodiment, the system of the present invention issues a multi-level warning from low to high more than 1 minute in advance before the quality of the SV message of MU-01 deteriorates to a level sufficient to affect the correct decision of the protection device (usually smpCnt jump or a large number of packet losses will cause the protection logic to be abnormal), thus winning valuable time for operation and maintenance personnel to handle the situation.

[0091] Comparative Example To further highlight the advanced nature of the technical solution of this invention, a comparative example based on existing conventional technology is established.

[0092] Scenario Setup: The scenario is identical to the example. However, the monitoring system is replaced with a traditional network monitoring system based on SNMP (Simple Network Management Protocol) and static thresholds. This system is configured to poll the MIB (Management Information Base) variables of the GE1 / 0 / 5 port of the process layer switch every 30 seconds. The main monitoring metrics are: total port traffic (ifInOctets / ifOutOctets) and the port packet loss counter (ifInDiscards). A static threshold is set for the total inbound traffic to the port; for example, an alarm is triggered if the total bandwidth utilization exceeds 80%.

[0093] Abnormal process and results: During the same MU-01 clock failure process as in the embodiment: 14:30:00 - 14:31:40: Clock drift, jitter increase, even smpCnt jump of MU-01, all these changes belong to the category of message content and micro time behavior. For the SNMP monitoring system, the total byte traffic on the port (ifInOctets) has almost no change, because the message quantity is still about 8000 pps (two SV streams), and the size of each message has not changed. Therefore, the bandwidth usage is far below the alarm threshold. At the same time, as long as the switch itself does not discard messages due to congestion, the ifInDiscards counter remains 0.

[0094] Results: The traditional monitoring system cannot perceive any abnormalities throughout the entire abnormal evolution process. It is completely blind to the micro traffic behavior (jitter, smpCnt sequence) that indicates business logic risk. The system will remain silent until the SV messages output by MU-01 cause the upper layer protection device (such as line differential protection) to lock or misoperate due to receiving invalid sampling data, thus causing a real power system fault. Only after the fault occurs can the operation and maintenance personnel trace back the cause through post-analysis of message recording.

[0095] Effect comparison of the embodiment and the comparative example:

[0096] In summary, the present application successfully overcomes the deficiencies of the prior art in perceiving and predicting the abnormality of micro traffic behavior of business logic risk by deep analysis of process layer switch port traffic, multi-dimensional feature extraction, establishment of high-fidelity baseline image, and multi-level real-time abnormality evaluation. The system and method provided by the present application can realize high-sensitivity and high-accuracy pre-alarm of potential fault precursors, and the technical scheme has significant innovation and practical value. It is of great significance to ensure the safe and stable operation of intelligent substation and even the entire power system.

[0097] The above is only a preferred embodiment of the present application, and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An intelligent substation process level switch port flow monitoring pre-alarm system, characterized in that, The system comprises: a data acquisition unit (100), the hardware input end of which is configured to be non-invasively coupled with the communication link of one or more target ports of a process layer switch to be monitored, for capturing all network data packets flowing through the target ports in real time and attaching a high-precision timestamp to each captured data packet; a traffic feature vectorization unit (200) in communication connection with the data acquisition unit (100) and configured to receive the data packet sequence captured by the data acquisition unit (100) and having attached a high-precision timestamp, and perform deep parsing on each data packet to identify the protocol type thereof and extract a set of predefined feature parameters capable of representing the business content and transmission behavior of the data packet, thereby converting the discrete data packet sequence into a structured, multi-dimensional real-time feature vector stream; a baseline portrait construction unit (300) configured to operate in a "baseline learning mode" of the system, for receiving and processing the feature vector stream generated in a confirmed normal operation period of the substation from the traffic feature vectorization unit (200), and generating, for each specific business data stream on each monitored target port, a multi-dimensional dynamic behavior baseline portrait uniquely corresponding thereto, comprising a set of deterministic constraint rules and a statistical behavior feature model; a real-time anomaly evaluation unit (400) in communication connection with the traffic feature vectorization unit (200) and the baseline portrait construction unit (300) and configured to operate in a "real-time monitoring mode" of the system, for continuously receiving the real-time feature vector stream and calling the corresponding baseline portrait generated by the baseline portrait construction unit (300) to perform layer-by-layer, multi-dimensional comparison and judgment operations on the real-time feature vector stream, so as to identify the deviation between the real-time traffic behavior and the baseline portrait, and generate one or more original anomaly event signals of deterministic violation alarm, statistical deviation alarm or predictive risk alarm according to the nature and magnitude of the deviation; and a pre-alarm comprehensive generation unit (500) in communication connection with the real-time anomaly evaluation unit (400) and configured to receive the original anomaly event signal and perform correlation analysis and hazard level evaluation thereon, and finally generate a structured pre-alarm report comprising specific anomaly positioning information, quantitative deviation data, risk level and diagnostic suggestions.

2. The system of claim 1, wherein, The traffic feature vectorization unit (200) comprises: a protocol parsing subunit (210) configured to parse the data packet, distinguish the message type by checking the EtherType field value in the Ethernet frame header, and determine that the message is a sampling value (SV) message when the value is 0x88BA and a generic object-oriented substation event (GOOSE) message when the value is 0x88B8. a service flow identification subunit (220) configured to, according to the IEC 61850 standard, use an application identifier (APPID) of the SV message as a unique identifier of the service data flow, and use a GOOSE control block reference (gocbRef) of the GOOSE message as a unique identifier of the service data flow, so as to realize service flow attribution division of the data packet; and a feature extraction subunit (230) configured to extract a multi-dimensional feature parameter of each service data flow identified by the service flow identification subunit (220) to form the feature vector.

3. The system of claim 2, wherein, The feature parameter set extracted by the feature extraction subunit (230) for the SV message service flow specifically includes: in-protocol state features, which are a sampling count value (smpCnt) and a configuration revision number (confRev) directly extracted from an SV protocol data unit; time behavior features, which are a packet-by-packet arrival interval time of an SV message sequence of the same APPID obtained based on the high-precision timestamp calculation, and an average value, a standard deviation, a maximum value and a minimum value of the message jitter obtained by performing statistical operation on the message arrival interval time in a preset sliding time window; and flow statistical features, which are a total number of SV messages of the APPID obtained by statistical calculation in a unit time, i.e., a message rate.

4. The system of claim 2, wherein, The feature parameter set extracted by the feature extraction subunit (230) for the GOOSE message service flow specifically includes: in-protocol state features, which are a state number (stNum), a sequence number (sqNum), a test flag (Test) and an internal timestamp (t) directly extracted from a GOOSE protocol data unit; time behavior features, which are a packet-by-packet arrival interval time of a GOOSE message sequence of the same gocbRef obtained based on the high-precision timestamp calculation, and are further distinguished into a stable retransmission interval time when the state does not change and an internal interval time sequence of a burst message cluster when the state changes; and flow statistical features, which are a total number of GOOSE messages of the gocbRef obtained by statistical calculation in a unit time, i.e., a message rate, and are distinguished into a stable retransmission message quantity and an event-triggered burst message quantity.

5. The system of claim 1, wherein, The multi-dimensional dynamic behavior baseline portrait generated by the baseline portrait construction unit (300) has an internal structure specifically including: a deterministic rule set (310), the content of which is predefined according to the IEC 61850 protocol standard and a specific engineering configuration file of a substation or automatically generated in a learning mode, and the rule set specifies that the smpCnt value of the SV message flow must be strictly cyclically increased and the confRev value must be kept unchanged, and specifies the change logic of the stNum value and the sqNum value of the GOOSE message flow. a statistical behavior model (320) which is the result of statistical analysis and mathematical modeling of the large number of feature parameters collected in the learning mode, the model includes the message inter-arrival time distribution model of the SV message stream, the baseline mean and baseline standard deviation of the message jitter, the expected value and the allowable deviation range of the stable retransmission interval time of the GOOSE message stream, and the nominal message rate of the two types of messages; and a cross-stream correlation model (330) which describes the stable quantitative relationship between multiple different service data streams coexisting on the same switch port.

6. The system of claim 1 or 5, wherein, The internal working logic of the real-time anomaly assessment unit (400) is divided into three progressive assessment levels, including: The first level, the deterministic violation detection layer (410), is configured to compare the real-time extracted protocol endogenous state features with the deterministic rule set (310) in the baseline profile, and any violation of the rules will trigger the deterministic violation alarm signal; The second level, the statistical deviation detection layer (420), is configured to compare the real-time calculated time behavior features and traffic statistical features with the statistical behavior model (320) in the baseline profile, and when the deviation between the real-time features and the model exceeds the preset threshold, the statistical deviation alarm signal is triggered; and The third level, the predictive risk assessment layer (430), is configured to use a pre-trained time series prediction model to predict the feature vector at the next moment according to the historical feature vector sequence, and identify the potential evolution trend by calculating the difference between the predicted vector and the actual observed vector, and when the difference exceeds the dynamic threshold, the predictive risk alarm signal is triggered.

7. The system of claim 6, wherein, The conditions for the statistical deviation detection layer (420) to determine statistical deviation include at least one of the following: (a) For the SV message stream, the real-time calculated message jitter exceeds the sum of the baseline jitter mean and a configurable multiple of the baseline jitter standard deviation; (b) For any service stream, the real-time message rate continuously exceeds or is lower than a preset percentage of the nominal message rate for a plurality of consecutive observation periods; (c) For the GOOSE message stream, the stable retransmission interval time when the state does not change exceeds the allowable deviation range defined in the baseline model; (d) Using a non-parametric test method, it is determined that there is a significant difference between the empirical distribution function of the message inter-arrival time sequence in a real-time window and the probability distribution function in the baseline model.

8. The system of claim 6, wherein, The time series prediction model used by the predictive risk assessment layer (430) is a long short-term memory (LSTM) neural network model; the model is trained using normal feature vector sequences in the "baseline learning mode"; in the "real-time monitoring mode", the predictive risk assessment layer (430) quantifies the difference between the predicted feature vector output by the LSTM model and the actual observed feature vector at the next time by calculating the Mahalanobis distance between the two, and triggers the predictive risk warning signal when the Mahalanobis distance exceeds a dynamic threshold calculated based on the historical prediction error distribution; The specific configuration of the pre-warning comprehensive generation unit (500) is: Performing an association analysis process to merge multiple independent original abnormal event signals received within a preset time window for the same service data flow into a higher-level composite pre-warning event; According to the type, frequency of occurrence, and importance level of the associated service flow, a quantitative risk index is calculated for each pre-warning event through a preset fuzzy logic reasoning engine; And Generating the structured pre-warning report, which explicitly includes the risk index, the switch port number and service flow identifier of the abnormal source, the specific description of the abnormal phenomenon, the quantitative comparison data of the abnormal data and the baseline value, and the preliminary diagnosis suggestion matched according to the built-in rule base.

9. A method applied to the intelligent substation process layer switch port flow monitoring pre-alarm system of any one of claims 1-5, characterized in that, The method comprises the following steps: Step S1: Coupling the hardware probe through the communication link with the target port of the process layer switch, real-time line-speed capture all data packets flowing through the port, and adding a hardware timestamp with nanosecond-level precision to each data packet; Step S2: Protocol analysis of the captured time-stamped data packets, identifying them as SV messages, GOOSE messages or other types of messages, and classifying the messages according to their APPID or gocbRef for service flow attribution; Step S3: For each attributed service flow, extract its protocol endogenous state features, time behavior features calculated based on high-precision timestamps, and traffic statistics features to form a continuous real-time feature vector stream; Step S4: In the baseline learning phase performed by the system in advance, generate a multi-dimensional dynamic behavior baseline portrait for each service flow through algorithm processing of the feature vector stream generated during a recognized normal operation period, the portrait contains a set of deterministic rules, a statistical behavior feature model and a cross-flow association model, and store it solidly; Step S5: In the real-time monitoring phase, compare the real-time feature vector stream generated in step S3 with the corresponding baseline portrait stored in step S4 at multiple levels: first, deterministic rule violation detection, then statistical deviation detection, and finally predictive risk assessment; Step S6: According to the comparison results of step S5, once the real-time behavior is found to violate the deterministic rules, or there is a significant deviation from the statistical model, or it is judged as abnormal evolution by the prediction model, the corresponding original abnormal event signal is generated; Step S7: Correlation analysis and risk level quantitative evaluation are performed on the received original abnormal event signal, and finally a structured pre-alarm report containing detailed positioning, quantitative data and diagnostic suggestions is generated and output.

10. A storage medium storing a computer program for executing the method of claim 9.

Images