A method and system for monitoring the operating state of a substation communication network device

Abstract

The application discloses a kind of operating state monitoring method and system of substation communication network equipment, it is related to equipment state monitoring technical field.The method comprises: establishing the multimodal operation database of each communication network equipment in substation communication network;Corresponding abnormality traceability verification database is obtained, abnormality mode is associated with concurrent analysis, and concurrent analysis integrated model is established;With multimodal operation database training multimodal abnormality identification module, each communication network equipment is monitored, when the output abnormality mode identification result is in abnormality mode concurrent state, concurrent analysis integrated model is called to carry out concurrent analysis, and concurrent correlation identification result is output;Abnormality mode identification result and concurrent correlation identification result are sent to the management terminal of substation communication network and carry out early warning.Solve the technical problem that substation communication network equipment operating state monitoring is not accurate in prior art, reach the technical effect of improving monitoring accuracy.

Description

Technical Field

[0001] This invention relates to the field of equipment condition monitoring technology, specifically to a method and system for monitoring the operating status of substation communication network equipment. Background Technology

[0002] With the continuous advancement of communication technology, substation communication networks have become a crucial guarantee for supporting core functions such as substation equipment automation, remote monitoring, and fault diagnosis. However, current technologies for monitoring the operational status of substation communication network equipment largely rely on single data sources and static monitoring methods, which have certain limitations. For example, hardware anomalies, software anomalies, network anomalies, and security anomalies are often intertwined and difficult to identify using a single method. Furthermore, existing monitoring systems primarily rely on post-event analysis for anomaly diagnosis, lacking real-time, dynamic, and accurate monitoring capabilities, and are unable to effectively address the concurrent occurrence and complex correlations of multiple anomalies in the communication network. Summary of the Invention

[0003] This application provides a method and system for monitoring the operating status of substation communication network equipment, which solves the technical problem of inaccurate monitoring of the operating status of substation communication network equipment in the prior art.

[0004] In view of the above problems, this application provides a method and system for monitoring the operating status of substation communication network equipment.

[0005] A first aspect of this application provides a method for monitoring the operational status of substation communication network equipment, the method comprising:

[0006] A multimodal operation database is established for each communication network device in the substation communication network. This database includes historical communication network device operation logs corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies. An anomaly tracing and verification database corresponding to the multimodal operation database is acquired, and concurrent correlation analysis of anomalies is performed to establish a concurrent correlation analysis ensemble model. A multimodal anomaly identification module is trained using the multimodal operation database to monitor anomalies in each communication network device in the substation communication network. When the output anomaly mode identification result indicates concurrent anomalies, the concurrent correlation analysis ensemble model is invoked to perform concurrent correlation analysis and output the concurrent correlation identification result. The anomaly mode identification result and the concurrent correlation identification result are sent to the management terminal of the substation communication network for early warning.

[0007] A second aspect of this application provides an operational status monitoring system for substation communication network equipment, the system comprising:

[0008] The system includes a database construction unit for establishing a multimodal operation database for each communication network device in the substation communication network. This database includes historical communication network device operation log data corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies. An analysis unit is used to acquire the anomaly tracing and verification database corresponding to the multimodal operation database, perform concurrent correlation analysis of anomalies, and establish a concurrent correlation analysis integration model. An anomaly monitoring unit is used to train a multimodal anomaly identification module using the multimodal operation database to monitor anomalies in each communication network device in the substation communication network. When the output anomaly identification result is in a concurrent anomaly state, the concurrent correlation analysis integration model is invoked to perform concurrent correlation analysis and output the concurrent correlation identification result. An early warning unit is used to send the anomaly identification result and the concurrent correlation identification result to the management terminal of the substation communication network for early warning.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] First, a multimodal operation database is established for each communication network device in the substation communication network. This database includes historical communication network device operation logs corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies. Next, an anomaly tracing and verification database corresponding to the multimodal operation database is acquired, and concurrent correlation analysis of anomalies is performed to establish a concurrent correlation analysis ensemble model. Then, a multimodal anomaly identification module is trained using the multimodal operation database to monitor anomalies in each communication network device in the substation communication network. When the output anomaly mode identification result indicates a concurrent anomaly mode, the concurrent correlation analysis ensemble model is invoked to perform concurrent correlation analysis and output the concurrent correlation identification result. Finally, the anomaly mode identification result and the concurrent correlation identification result are sent to the substation communication network management terminal for early warning. This solves the technical problem of inaccurate monitoring of the operating status of substation communication network devices in existing technologies, achieving the technical effect of improving monitoring accuracy. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A schematic flowchart of a method for monitoring the operating status of substation communication network equipment provided in this application embodiment;

[0013] Figure 2This is a schematic diagram of the operating status monitoring system for substation communication network equipment provided in an embodiment of this application.

[0014] Figure labeling: Database construction unit 11, analysis unit 12, anomaly monitoring unit 13, early warning unit 14. Detailed Implementation

[0015] This application provides a method and system for monitoring the operating status of substation communication network equipment, which solves the technical problem of inaccurate monitoring of the operating status of substation communication network equipment in the prior art.

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0017] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0018] Example 1, as Figure 1 As shown, this application provides a method for monitoring the operating status of substation communication network equipment, wherein the method includes:

[0019] A multimodal operation database is established for each communication network device in the substation communication network. The multimodal operation database includes historical communication network device operation log data corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies, respectively.

[0020] Operational data from various communication network devices in the substation is collected through various monitoring equipment and sensors. Data sources include hardware performance indicators (such as sensor data for current, voltage, temperature, and vibration), equipment software system operation logs (such as operating system logs, application logs, and error logs), communication network data (such as network latency, bandwidth, signal strength, and data loss), and security logs (such as intrusion detection, access control logs, and authentication information). This data is then stored according to different types to form historical equipment operation logs, recording abnormal events for each device, including hardware failures, software crashes, network outages, and security attacks, along with the specific time and device status of each anomaly. Next, based on the collected multi-category data, a multimodal operation database is established. This database contains multiple tables that record information on hardware anomalies, software anomalies, network anomalies, and security anomalies, with interrelationships between the tables for easy querying and analysis. Hardware anomalies refer to fault information in the hardware components of the equipment, such as power failure, port failure, optical module / fiber damage, abnormal temperature, hard drive or storage failure; software anomalies are related to the software system running the equipment, such as operating system crashes, software vulnerabilities, application errors, network protocol incompatibility, etc.; network anomalies are problems related to the communication network itself, such as communication signal interruption, network latency, insufficient bandwidth or packet loss, etc.; security anomalies are related to security events, such as intrusion detection, data leakage, unauthorized access, malware attacks, etc. Finally, the multimodal operation database is regularly updated and maintained to ensure that the latest operating data and anomaly information of the equipment are reflected in the database in a timely manner, and the integrity and timeliness of the data are ensured through automated data collection tools and database backup methods.

[0021] Furthermore, the substation communication network includes a production control area network and a management information area network. The production control area network adopts an industrial Ethernet switch network. The management information area network includes an optical fiber communication network carrying fixed terminals and aggregated wireless access devices, as well as a wireless communication network carrying mobile terminals and terminals in areas inaccessible by existing cables.

[0022] The substation communication network comprises a production control area network and a management information area network. The production control area network utilizes an industrial Ethernet switch network, responsible for real-time data transmission and control command delivery to internal substation equipment, ensuring efficient data transmission and precise equipment control. The management information area network includes a fiber optic communication network carrying fixed terminals and aggregating wireless access devices, as well as a wireless communication network carrying mobile terminals and terminals in areas inaccessible by existing cabling. Specifically, the industrial Ethernet switch network features high bandwidth and low latency, meeting the high real-time performance and stability requirements of substation production control. The fiber optic communication network is primarily used for fixed terminal connections, providing a high-speed and stable data transmission channel, while also aggregating wireless access devices to ensure network connectivity for all types of terminals within the substation.

[0023] For mobile terminals that cannot be connected via traditional wired methods or terminals located in special areas within the power station, wireless communication networks are used for connection, ensuring flexible data access and seamless equipment coverage. This hybrid communication network structure not only enhances the flexibility and scalability of the substation communication network but also optimizes collaboration between production and management.

[0024] Obtain the anomaly tracing and verification database corresponding to the multimodal operation database, perform concurrent correlation analysis of the anomaly modes, and establish an integrated model for concurrent correlation analysis.

[0025] An anomaly tracing and verification database is used to track and verify the occurrence of various anomalies. By recording the source and propagation path of anomalies, it helps the system understand how anomalies spread from one node to other related nodes. Based on the data in the anomaly tracing and verification database, concurrent correlation analysis of anomaly modes is performed to identify potential mutual influences and correlations between different anomaly modes. For example, a hardware failure in a device may cause network instability, further leading to system software crashes, or different types of anomalies may occur simultaneously within the same time period. The simultaneous occurrence of these phenomena may indicate a potential source of system failure. For instance, a DDoS (Distributed Denial of Service) attack may consume a large amount of invalid traffic, consuming the processing power and bandwidth of a device, ultimately leading to overheating or hardware damage (such as power modules, network cards, switches, etc.). Based on the results of the concurrent correlation analysis, an integrated concurrent correlation analysis model is constructed. This model can not only accurately identify the type of current anomaly but also analyze whether these anomalies are a cascading effect caused by a major failure or whether they all point to a potential source of failure.

[0026] Furthermore, the anomaly tracing and verification database corresponding to the multimodal operation database is obtained, and concurrent correlation analysis of the anomaly modes is performed to establish an integrated model for concurrent correlation analysis, including:

[0027] Based on the anomaly tracing and verification database, first associated operational data with concurrent correlation and corresponding first associated anomaly mode combinations are extracted according to the verification results; a first association analyzer for the first associated anomaly mode combinations is trained using the first associated operational data; and the first association analyzer is added to the concurrent association analysis ensemble model.

[0028] Specifically, based on the anomaly tracing and verification database, the system extracts first-related operational data with concurrent correlations by analyzing the anomaly tracing and verification results, and identifies the corresponding first-related anomaly mode combinations. These first-related operational data and first-related anomaly mode combinations represent situations where multiple anomaly types, such as hardware failures, network interruptions, and software crashes, may occur simultaneously or under related conditions during past device operation. By verifying these concurrency relationships, the system can identify potential fault modes, thus providing an accurate basis for system fault prediction. Next, the extracted first-related operational data is used to train a first-related correlation analyzer, which focuses on analyzing the concurrency patterns involved in the first-related anomaly mode combinations. During training, the analyzer learns the concurrent occurrence patterns of anomaly modes in historical data to establish a mathematical model or rule, enabling accurate judgment of concurrent anomalies in new operational data. Finally, the trained first-related correlation analyzer is added to the concurrent correlation analysis ensemble model, becoming part of the ensemble model. The concurrency correlation analysis ensemble model aggregates the outputs of multiple independent analyzers, comprehensively analyzes the complex relationships between multiple abnormal modes, determines whether concurrent anomalies exist in the current system, and analyzes the mutual influence and root causes of these anomalies. Through this ensemble model, the system can efficiently handle different types of concurrent anomalies, providing more accurate fault diagnosis and early warning information.

[0029] Furthermore, based on the aforementioned anomaly tracing and verification database, the first associated operational data with concurrent relationships and the corresponding first associated anomaly mode combinations are extracted according to the verification results, including:

[0030] Based on the anomaly tracing and verification database, determine several verification results corresponding to several data entries in the multimodal operation database; parse the several verification results to determine several associated anomaly modality combinations corresponding to the several verification results; cluster the several associated anomaly modality combinations with the same combination to generate multiple associated anomaly modality combinations; randomly extract one combination from the associated anomaly modality combinations, denoted as the first associated anomaly modality combination, and extract the concurrent anomaly operation data corresponding to the first associated anomaly modality combination from the multimodal operation database to generate the first associated operation data.

[0031] First, the system uses data from the anomaly tracing and verification database to determine the verification results corresponding to several data entries in the multimodal operation database. These verification results reflect the occurrence of different types of anomalies during historical operation and provide correlation information between these anomalies and other anomalies. Next, the system parses these verification results to identify several corresponding associated anomaly mode combinations. Each combination consists of multiple anomaly modes, representing how multiple anomaly types (such as hardware failures, network problems, etc.) occur concurrently and are interconnected under specific time periods or conditions. Then, these associated anomaly mode combinations are clustered using clustering algorithms such as K-means, grouping anomaly modes with the same combination into one class, generating multiple different associated anomaly mode combinations. Finally, one combination is randomly selected from these associated anomaly mode combinations, designated as the first associated anomaly mode combination, and the concurrent anomaly operation data corresponding to the first associated anomaly mode combination is extracted from the multimodal operation database, thus generating the first associated operation data.

[0032] Furthermore, training a first association analyzer for the first association anomaly mode combination using the first association running data includes:

[0033] Identify multiple associated modes in the first associated abnormal mode combination; analyze multiple operational data features corresponding to the multiple associated modes in the first associated operational data; establish the relative data change relationship between the multiple operational data features, and train the first association analyzer.

[0034] Specifically, multiple associated modes are identified from the first set of associated anomaly modes. Each associated mode represents a type of anomaly, such as hardware failure, software problem, or network anomaly. The system analyzes historical data to determine which modes exhibit concurrent correlation under specific conditions. Next, the system analyzes multiple operational data features corresponding to these associated modes in the first set of associated operational data. These features can be key indicators obtained from device sensors, log files, or network monitoring systems, such as temperature, current, network bandwidth, and latency. Each associated mode may exhibit different characteristics under different operating environments. The system extracts the specific data features of each mode and reveals their intrinsic relationships with the anomaly modes through analysis. Then, relative data change relationships are established among multiple operational data features. These relationships reflect how each operational data feature interacts when a specific anomaly mode occurs. For example, hardware failure may cause drastic fluctuations in current, while network problems may manifest as increased transmission latency. Finally, the system uses the established data change relationships to train the first correlation analyzer. During training, the analyzer gradually optimizes its recognition and analysis capabilities based on these feature change relationships using machine learning or statistical modeling methods. As training progresses, the analyzer will be able to accurately identify the characteristics of each abnormal mode and improve the monitoring accuracy of equipment operating status in the substation communication network through the learned patterns. Ultimately, the first correlation analyzer, after training, will be able to determine whether equipment is in an abnormal state based on real-time data, providing more intelligent fault diagnosis and early warning capabilities, and providing strong support for subsequent anomaly detection and system optimization.

[0035] The multimodal anomaly identification module is trained using the multimodal operation database to monitor anomalies in various communication network devices in the substation communication network. When the output anomaly identification result is in an anomaly concurrent state, the concurrent correlation analysis integration model is called to perform concurrent correlation analysis and output the concurrent correlation identification result.

[0036] Using data extracted from a multimodal operational database, a multimodal anomaly recognition module is trained. This module can identify different types of anomaly modes, such as hardware failures, software problems, network anomalies, or security risks. By learning from historical operational data, the multimodal anomaly recognition module can understand the characteristics of each anomaly mode and accurately determine whether these anomalies occur during device operation. When the system monitors for device anomalies, the anomaly mode recognition module outputs the anomaly mode recognition results based on real-time data. If the recognition results indicate that multiple anomaly modes occur simultaneously, meaning the system has detected concurrent anomaly modes, this suggests the possibility of more complex fault modes or multiple fault sources acting together at the same time. In this case, the system will invoke the established concurrency correlation analysis ensemble model for further concurrency correlation analysis. The concurrency correlation analysis ensemble model will conduct in-depth analysis of concurrent anomaly modes based on the correlations between multiple anomaly modes. Through model analysis, the system can identify which anomaly modes have significant correlations, and thus infer the root causes of these anomalies. The analysis results will be output in the form of concurrent correlation identification results, which will help technicians understand the relationship between the current abnormal modes and take timely measures to troubleshoot and handle the faults.

[0037] The abnormal mode identification results and the concurrent correlation identification results are sent to the management terminal of the substation communication network for early warning.

[0038] When the system detects an abnormal mode identification result and confirms that the abnormal mode is in a concurrent state, the system will invoke the concurrent correlation analysis integrated model to perform concurrent correlation analysis and output the corresponding concurrent correlation identification result. Subsequently, the system integrates the abnormal mode identification result and the concurrent correlation identification result and sends this important information to the substation communication network management terminal via network communication. At the management terminal, the operator can receive these two results in real time and make corresponding decisions and early warning responses accordingly.

[0039] Furthermore, it also includes:

[0040] The communication information type and encryption level of each communication network device in the substation communication network are determined; based on the communication information type and encryption level, a preset sensitivity database is invoked to perform a sensitivity analysis of security anomalies, generating various sensitivity indicators corresponding to each communication network device; when the anomaly mode identification result includes a security anomaly, an upgrade warning for the corresponding device is issued based on the various sensitivity indicators.

[0041] First, the communication information types and encryption levels of each communication network device in the substation's communication network are determined. Each communication network device transmits different types of information during operation, which may include equipment control commands, status reports, sensor data, network traffic, etc. The communication encryption level reflects the strength of the encryption method used in these data transmissions, typically categorized as high, medium, and low. For example, control command communication information may have a high encryption level, while general status reports may use a lower encryption level. Based on the communication information type and encryption level, the system calls a preset sensitivity database to perform a sensitivity analysis of security anomalies. The preset sensitivity database contains sensitivity assessment data for different types of communication information. The system analyzes the potential security threats to each type of information based on the device's communication information type and encryption level, and calculates a sensitivity index for each device. These sensitivity indices reflect the potential risks and possible impacts of a device encountering security anomalies. For example, highly sensitive devices may suffer significant losses when facing security vulnerabilities, while low-sensitivity devices face lower risks.

[0042] When the abnormal mode identification results include security anomalies, the system will issue upgrade warnings for the corresponding equipment based on the generated sensitivity indicators. Specifically, the system will determine the vulnerability of a device in the event of a security anomaly based on the sensitivity of its communication information. For example, for highly sensitive equipment, the system will issue a warning to strengthen security protection measures, which may include increasing encryption levels, strengthening authentication, and adding intrusion detection mechanisms. In addition, the system may also conduct additional audits on communications involving sensitive data to ensure their security. Through this mechanism, the system can take timely measures when security anomalies occur to prevent potential security threats from affecting the substation communication network.

[0043] Furthermore, it also includes:

[0044] A digital twin model is performed on the substation communication network to establish a twin communication network; the abnormal impact simulation of each communication network device is performed using the twin communication network to establish a device abnormal impact topology; the abnormal communication network device corresponding to the abnormal mode identification result is determined, and the abnormal source device is identified and warned in combination with the device abnormal impact topology.

[0045] Specifically, digital twin modeling creates a virtual model of the substation communication network, accurately simulating the various devices and relationships within the actual communication network. This twin communication network not only reflects real-time changes in device status but also synchronously updates operational data, including device status, network traffic, signal quality, and other indicators. Using the established twin communication network, the system simulates the impact of anomalies on various communication network devices. It simulates the effects of different types of abnormal events (such as equipment failures and communication interruptions) on each device in the communication network, analyzing how anomalies propagate and affect the entire network. By establishing an impact relationship diagram between devices—that is, the device anomaly impact topology—the system can identify the propagation path of an abnormal event from the source device to surrounding devices and understand the scope and degree of impact of the abnormal event in the communication network. Once an abnormal mode is detected, the system identifies the root cause device based on the real-time status and impact topology of the devices in the digital twin model. Simultaneously, by analyzing the device's location in the topology and its impact on other devices, the system can predict the propagation path of the anomaly source, thus providing early warnings. In this way, managers can quickly identify the source of the malfunction and take timely measures to repair it, preventing the problem from spreading and affecting the stability of the entire communication network.

[0046] In summary, the embodiments of this application have at least the following technical effects:

[0047] First, a multimodal operation database is established for each communication network device in the substation communication network. This database includes historical communication network device operation logs corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies. Next, an anomaly tracing and verification database corresponding to the multimodal operation database is acquired, and concurrent correlation analysis of anomalies is performed to establish a concurrent correlation analysis ensemble model. Then, a multimodal anomaly identification module is trained using the multimodal operation database to monitor anomalies in each communication network device in the substation communication network. When the output anomaly mode identification result indicates a concurrent anomaly mode, the concurrent correlation analysis ensemble model is invoked to perform concurrent correlation analysis and output the concurrent correlation identification result. Finally, the anomaly mode identification result and the concurrent correlation identification result are sent to the substation communication network management terminal for early warning. This solves the technical problem of inaccurate monitoring of the operating status of substation communication network devices in existing technologies, achieving the technical effect of improving monitoring accuracy.

[0048] Example 2, based on the same inventive concept as the method for monitoring the operating status of substation communication network equipment in the foregoing examples, such as... Figure 2 As shown, this application provides an operational status monitoring system for substation communication network equipment, wherein the system includes:

[0049] Database construction unit 11 is used to establish a multimodal operation database for each communication network device in the substation communication network, wherein the multimodal operation database includes historical communication network device operation log data corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies, respectively; analysis unit 12 is used to obtain the anomaly tracing and verification database corresponding to the multimodal operation database, perform concurrent correlation analysis of anomalies, and establish a concurrent correlation analysis integrated model; anomaly monitoring unit 13 is used to train a multimodal anomaly identification module with the multimodal operation database, perform anomaly monitoring on each communication network device in the substation communication network, and when the output anomaly mode identification result is in an anomaly mode concurrent state, call the concurrent correlation analysis integrated model to perform concurrent correlation analysis and output concurrent correlation identification results; early warning unit 14 is used to send the anomaly mode identification results and the concurrent correlation identification results to the management terminal of the substation communication network for early warning.

[0050] Furthermore, the analysis unit 12 is used to perform the following methods:

[0051] Based on the anomaly tracing and verification database, first associated operational data with concurrent correlation and corresponding first associated anomaly mode combinations are extracted according to the verification results; a first association analyzer for the first associated anomaly mode combinations is trained using the first associated operational data; and the first association analyzer is added to the concurrent association analysis ensemble model.

[0052] Furthermore, the analysis unit 12 is used to perform the following methods:

[0053] Based on the anomaly tracing and verification database, determine several verification results corresponding to several data entries in the multimodal operation database; parse the several verification results to determine several associated anomaly modality combinations corresponding to the several verification results; cluster the several associated anomaly modality combinations with the same combination to generate multiple associated anomaly modality combinations; randomly extract one combination from the associated anomaly modality combinations, denoted as the first associated anomaly modality combination, and extract the concurrent anomaly operation data corresponding to the first associated anomaly modality combination from the multimodal operation database to generate the first associated operation data.

[0054] Furthermore, the analysis unit 12 is used to perform the following methods:

[0055] Identify multiple associated modes in the first associated abnormal mode combination; analyze multiple operational data features corresponding to the multiple associated modes in the first associated operational data; establish the relative data change relationship between the multiple operational data features, and train the first association analyzer.

[0056] Furthermore, the database construction unit 11 is used to perform the following methods:

[0057] The substation communication network includes a production control area network and a management information area network. The production control area network adopts an industrial Ethernet switch network. The management information area network includes an optical fiber communication network carrying fixed terminals and aggregated wireless access devices, as well as a wireless communication network carrying mobile terminals and terminals in areas inaccessible by existing cables.

[0058] Furthermore, the early warning unit 14 is used to perform the following method:

[0059] The communication information type and encryption level of each communication network device in the substation communication network are determined; based on the communication information type and encryption level, a preset sensitivity database is invoked to perform a sensitivity analysis of security anomalies, generating various sensitivity indicators corresponding to each communication network device; when the anomaly mode identification result includes a security anomaly, an upgrade warning for the corresponding device is issued based on the various sensitivity indicators.

[0060] Furthermore, the early warning unit 14 is used to perform the following method:

[0061] A digital twin model is performed on the substation communication network to establish a twin communication network; the abnormal impact simulation of each communication network device is performed using the twin communication network to establish a device abnormal impact topology; the abnormal communication network device corresponding to the abnormal mode identification result is determined, and the abnormal source device is identified and warned in combination with the device abnormal impact topology.

[0062] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0063] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0064] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A method for monitoring the operating status of substation communication network equipment, characterized in that, The method includes: A multimodal operation database is established for each communication network device in the substation communication network. The multimodal operation database includes historical communication network device operation log data corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies, respectively. Obtain the anomaly tracing and verification database corresponding to the multimodal operation database, perform concurrent correlation analysis of the anomaly modes, and establish an integrated model for concurrent correlation analysis; The multimodal anomaly identification module is trained using the multimodal operation database to monitor anomalies in various communication network devices in the substation communication network. When the output anomaly identification result is in an anomaly concurrent state, the concurrent correlation analysis ensemble model is called to perform concurrent correlation analysis and output the concurrent correlation identification result. The abnormal mode identification results and the concurrent correlation identification results are sent to the management terminal of the substation communication network for early warning; Also includes: A digital twin model of the substation communication network is performed to establish the twin communication network; The abnormal impact simulation of each communication network device is performed using the twin communication network to establish the device abnormal impact topology; Determine the abnormal communication network device corresponding to the abnormal mode identification result, and perform abnormal source device identification and early warning based on the abnormal influence topology of the device; The step of obtaining the anomaly tracing and verification database corresponding to the multimodal operation database, performing concurrent correlation analysis of anomalies, and establishing an integrated model for concurrent correlation analysis includes: Based on the aforementioned anomaly tracing and verification database, the first associated running data with concurrent correlation and the corresponding first associated anomaly mode combination are extracted according to the verification results; The first association analyzer is trained using the first association runtime data for the first association anomaly mode combination; Add the first association analyzer into the concurrent association analysis ensemble model.

2. The method for monitoring the operating status of substation communication network equipment as described in claim 1, characterized in that, Based on the aforementioned anomaly tracing and verification database, the first associated operational data with concurrent correlation and the corresponding first associated anomaly mode combination are extracted according to the verification results, including: Based on the anomaly tracing and verification database, determine several verification results corresponding to several data entries in the multimodal operation database; Analyze the verification results to determine the associated abnormal mode combinations corresponding to the verification results; Clustering the aforementioned combinations of related anomalous modes with identical combinations generates multiple combinations of related anomalous modes. A combination is randomly selected from the associated abnormal modal combinations and denoted as the first associated abnormal modal combination. The concurrent abnormal operation data corresponding to the first associated abnormal modal combination is extracted from the multimodal operation database to generate the first associated operation data.

3. The method for monitoring the operating status of substation communication network equipment as described in claim 1, characterized in that, Training a first association analyzer for the first association anomaly mode combination using the first association running data includes: Identify multiple associated modes in the first associated abnormal mode combination; Analyze the multiple operational data features corresponding to the multiple associated modalities in the first associated operational data; Establish the relative data change relationships among the multiple operational data features, and train the first correlation analyzer.

4. The method for monitoring the operating status of substation communication network equipment as described in claim 1, characterized in that, The substation communication network includes a production control area network and a management information area network. The production control area network adopts an industrial Ethernet switch network. The management information area network includes an optical fiber communication network carrying fixed terminals and a wireless access network, as well as a wireless communication network.

5. The method for monitoring the operating status of substation communication network equipment as described in claim 1, characterized in that, Also includes: Determine the communication information types and encryption levels of each communication network device in the substation communication network; Based on the communication information type and communication encryption level, a preset sensitive database is invoked to perform a sensitivity analysis of security anomalies, generating various sensitivity indicators corresponding to each communication network device. When the abnormal modality identification result includes a security anomaly, an upgrade warning for the corresponding device is issued based on the various sensitivity indicators.

6. A substation communication network equipment operation status monitoring system, characterized in that, A method for monitoring the operational status of substation communication network equipment according to any one of claims 1-5, the system comprising: The database construction unit is used to establish a multimodal operation database for each communication network device in the substation communication network. The multimodal operation database includes historical communication network device operation log data corresponding to hardware anomalies, software anomalies, network anomalies, and security anomalies, respectively. The analysis unit is used to obtain the anomaly tracing and verification database corresponding to the multimodal operation database, perform concurrent correlation analysis of the anomaly modes, and establish an integrated model for concurrent correlation analysis. An anomaly monitoring unit is used to train a multimodal anomaly identification module with the multimodal operating database to perform anomaly monitoring on each communication network device in the substation communication network. When the output anomaly mode identification result is in an anomaly mode concurrent state, the unit calls the concurrent correlation analysis integration model to perform concurrent correlation analysis and outputs the concurrent correlation identification result. An early warning unit is used to send the anomaly mode identification result and the concurrent correlation identification result to the management terminal of the substation communication network for early warning.

Images