Flow load monitoring management method and system for electric power communication network

Abstract

The invention provides a traffic load monitoring management method and system for an electric power communication network, and the method comprises the steps: carrying out the initial multilayer analysis of a collected traffic data package based on a DPI probe, and obtaining the initial analysis data of the traffic; performing windowing processing on the flow initial analysis data based on the time sliding windows to obtain a flow load index and a service load index corresponding to each time sliding window, and associating the flow load indexes with the service load indexes to form structured flow feature data; inputting the structured traffic feature data into an anomaly detection model to obtain an anomaly recognition result output by the anomaly detection model; carrying out secondary analysis on an original abnormal data packet extracted from the traffic data packet based on an abnormal identification result, associating with the traffic primary analysis data, and constructing an abnormal traffic traceability chain; and determining a load regulation and control strategy based on the abnormal traffic traceability chain in combination with a pre-constructed traffic load regulation and control decision library. The fault recovery efficiency of the power communication network is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and system for monitoring and managing traffic load in power communication networks. Background Technology

[0002] Power communication networks are an indispensable part of modern power systems, responsible for transmitting and processing various data and information within the power grid. With the development of smart grids, the scale and complexity of power communication networks are constantly increasing. To ensure the stable operation of the power system, flow load monitoring and management are core components for guaranteeing reliable transmission of grid dispatch commands, real-time data exchange in substation automation, and stable power user services. Therefore, effective monitoring and management of the flow load of power communication networks has become particularly important.

[0003] Existing methods for monitoring and managing traffic load in power communication networks often employ periodic sampling based on fixed thresholds. However, due to the long sampling intervals, these methods cannot capture frequent bursts of traffic in the power communication network (such as massive fault waveform data transmission during grid failures or load forecast data exchange during peak electricity consumption periods). This can easily lead to missed or false detections, and can only determine if there is an overload, without distinguishing the service type and source of the overload traffic. Furthermore, while traditional DPI methods can classify services, they lack real-time analysis capabilities for dynamic traffic characteristics. When network load anomalies occur (such as bandwidth congestion or a sudden increase in packet retransmission rate), only the link or device where the anomaly occurred can be identified, without tracing the specific initiating node of the abnormal traffic (such as terminal equipment in a substation or a server in a dispatch center) and the corresponding service process. This forces maintenance personnel to spend a considerable amount of time troubleshooting, severely impacting the fault recovery efficiency of the power communication network and potentially posing risks to the safe and stable operation of the power grid. Summary of the Invention

[0004] This invention provides a method and system for monitoring and managing traffic load in power communication networks, which solves the problems of traditional methods being unable to capture sudden traffic and having high rates of missed and false detections. It also improves the fault recovery efficiency of power communication networks and eliminates the potential risks to the safe and stable operation of the power grid caused by excessively long fault investigation times.

[0005] In a first aspect, the present invention provides a method for monitoring and managing traffic load in power communication networks, comprising: The initial multi-layer parsing of the collected traffic data packets is performed based on the DPI probe to obtain the initial parsed traffic data. The initial parsed traffic data is processed by windowing based on time sliding windows to obtain traffic load indicators and service load indicators corresponding to each time sliding window. The traffic load indicators and service load indicators are then associated to form structured traffic feature data indexed by time window, link identifier, and service tag. The structured traffic feature data is input into the anomaly detection model to obtain the anomaly identification result output by the anomaly detection model. Based on the anomaly identification results, the original abnormal data packets extracted from the traffic data packets are parsed a second time, and the second parsing results are associated with the initial parsing data of the traffic to construct an abnormal traffic tracing chain; Based on the abnormal traffic tracing chain and the pre-built traffic load control decision library, a load control strategy is determined.

[0006] In a second aspect, the present invention also provides a traffic load monitoring and management system for power communication networks, applied to the traffic load monitoring and management method for power communication networks as described in the first aspect; the traffic load monitoring and management system for power communication networks includes: The DPI initial parsing module is used to perform initial multi-layer parsing on the collected traffic data packets based on the DPI probe to obtain the initial parsing data of the traffic. The feature processing module is used to perform windowing processing on the initial parsed traffic data based on a time sliding window, to obtain the traffic load index and service load index corresponding to each time sliding window, and to associate the traffic load index and the service load index to form structured traffic feature data indexed by time window, link identifier and service tag. An anomaly detection module is used to input the structured traffic feature data into the anomaly detection model and obtain the anomaly identification result output by the anomaly detection model. The DPI deep source tracing module is used to perform secondary analysis on the original abnormal data packets extracted from the traffic data packets based on the anomaly identification results, and associate the secondary analysis results with the initial analysis data of the traffic to construct an abnormal traffic source tracing chain. The load control decision library construction module is used to determine the load control strategy based on the abnormal traffic tracing chain and the pre-built traffic load control decision library.

[0007] Thirdly, the present invention also provides an electronic device, comprising: a memory for storing computer software programs; and a processor for reading and executing the computer software programs, thereby realizing the flow load monitoring and management method for power communication networks as described above.

[0008] Fourthly, the present invention also provides a non-transitory computer-readable storage medium storing a computer software program, which, when executed by a processor, implements the above-described method for monitoring and managing traffic loads for power communication networks.

[0009] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the flow load monitoring and management method for power communication networks as described above.

[0010] The traffic load monitoring and management method for power communication networks provided in this invention performs initial multi-layer parsing of collected traffic data packets based on DPI probes and combines this with time sliding window processing to obtain traffic load indicators and service load indicators corresponding to each time window, and associates them to form structured traffic feature data. This method can overcome the limitations of traditional fixed-threshold periodic sampling due to long sampling intervals, accurately capture frequently occurring bursts of traffic in power communication networks, and effectively avoid missed or false detections. Furthermore, by using link identifiers and service tags for indexing, it achieves clear differentiation of the service type and source of overload traffic, overcoming the shortcomings of traditional methods that can only determine whether there is an overload but cannot clearly define the specific attributes of the overload traffic. In addition, based on... The anomaly detection model identifies anomalies in structured traffic feature data and extracts original abnormal data packets based on the anomaly identification results for secondary parsing. It then associates these anomaly packets with the initially parsed data to construct an anomaly traffic tracing chain. This overcomes the shortcomings of traditional DPI methods, which lack real-time analysis capabilities for dynamic traffic features. It can not only identify the links or devices where network load anomalies occur, but also accurately trace the specific initiating node of the abnormal traffic and the corresponding business process. Combined with a pre-built traffic load control decision library, it determines the load control strategy. This solves the problem that existing methods require maintenance personnel to spend a long time troubleshooting the root cause of faults, significantly improves the fault recovery efficiency of power communication networks, and eliminates the potential risks to the safe and stable operation of the power grid caused by excessively long fault troubleshooting times. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating the traffic load monitoring and management method for power communication networks provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the flow load monitoring and management system for power communication networks provided in an embodiment of the present invention; Figure 3 An embodiment diagram of the electronic device provided in this invention; Figure 4 An embodiment diagram of a computer-readable storage medium provided in accordance with the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0014] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0015] See Figure 1 , Figure 1 This is a flowchart illustrating the traffic load monitoring and management method for power communication networks provided by the present invention. In this embodiment, the execution entity of the traffic load monitoring and management method for power communication networks is the traffic load monitoring and management system. Therefore, the traffic load monitoring and management method for power communication networks includes: Step 10: Perform initial multi-layer parsing on the collected traffic data packets based on the DPI probe to obtain initial parsed traffic data.

[0016] Optionally, the traffic load monitoring and management system first collects traffic data packets in the network in real time using DPI (Deep Packet Inspection) probes deployed at key nodes of the power communication network (such as substation entrances and exits, core switch ports of the dispatch center). The data traffic packets contain data from various services in the power communication network, such as fault waveform data during power grid faults, load forecast data during peak electricity consumption periods, and daily equipment monitoring data.

[0017] Furthermore, the traffic load monitoring and management system performs initial multi-layered parsing (covering multiple layers of the network protocol stack) on the collected traffic data packets, specifically including the physical layer, data link layer, network layer, transport layer, and application layer. For physical layer parsing, physical transmission parameters such as signal strength and transmission rate are extracted to determine the physical link status of data transmission. For data link layer parsing, the focus is on obtaining the MAC address (Media Access Control address) to identify the source and destination nodes of the data packets at the data link layer. For network layer parsing, IP addresses (Internet Protocol addresses) are extracted to clarify the routing path of the traffic data packets in the network, while also identifying the network layer protocol type, such as IPv4 or IPv6. For transport layer parsing, the port number and transport layer protocol type (such as TCP or UDP) are obtained. The port number can initially indicate the service type corresponding to the data packet; for example, certain ports are often used for the transmission of load forecasting data. For application layer parsing, the analysis delves into the application layer data portion of the data packet to extract key fields and identification information related to the service, such as fault recording data containing specific fault codes and recording times. Finally, through multi-layer parsing, the initial parsing data of the traffic is obtained, which includes key information such as the physical layer parameters, MAC address, IP address, port number, transport layer protocol type, and application layer service identifier of each data packet.

[0018] In one embodiment, taking a power communication network in a certain region as an example, when a line short-circuit fault occurs in the power grid, the substation generates a large amount of fault waveform data, which is transmitted to the dispatch center via the network. Simultaneously, during peak electricity consumption, the load forecasting system is also continuously transmitting load forecast data to the dispatch center. The flow load monitoring and management system collects flow data packets containing fault waveform data and load forecast data through DPI probes deployed at the substation's inlet and outlet. First, physical layer parsing is performed; the system detects that the transmission rate of these data packets is 1000 Mbps, and the signal strength is stable at -20 dBm, indicating that the physical link transmission status is normal. In the data link layer parsing, the source MAC address of the fault recording data packet is 00-1B-44-11-3A-7D (fault recording device of the emergency response substation), and the destination MAC address is 00-1B-44-22-5B-8E ​​(fault data receiving server of the dispatch center); the source MAC address of the load forecast data packet is 00-1B-44-33-6C-9F (load forecast system server), and the destination MAC address is also 00-1B-44-22-5B-8E ​​(data aggregation server of the dispatch center). During network layer analysis, the source IP address of the fault recording data packet was found to be 192.168.1.10 (the IP address of the substation fault recording device), and the destination IP address was 10.0.0.5 (the IP address of the dispatch center's fault data receiving server), with the protocol type being IPv4. The source IP address of the load forecasting data packet was 192.168.2.20 (the IP address of the load forecasting system server), and the destination IP address was 10.0.0.8 (the IP address of the dispatch center's data aggregation server), also with the protocol type being IPv4. During transport layer analysis, it was found that the fault recording data packet used the TCP transport layer protocol, with port number 5000 (the pre-defined fault recording data transmission port); the load forecasting data packet used the UDP transport layer protocol, with port number 8000 (the pre-defined load forecasting data transmission port). In the application layer analysis, information such as the fault code "F001" and the recording start time "202X-XX-XX 10:30:00" were extracted from the fault recording data packet; information such as the prediction period "202X-XX-XX 18:00-22:00" and the prediction area "eastern urban area" were extracted from the load prediction data packet. Combining the results of these various layers of analysis, the initial analysis data of the collected traffic flow was obtained.

[0019] Step 20: Perform windowing processing on the initial parsed traffic data based on the time sliding window to obtain the traffic load index and service load index corresponding to each time sliding window. Then, associate the traffic load index and service load index to form structured traffic feature data indexed by time window, link identifier and service tag.

[0020] Optionally, after obtaining the initial parsed traffic data, the traffic load monitoring and management system introduces a time-sliding window mechanism to perform windowing processing. Specifically, it is necessary to first determine the relevant parameters of the time-sliding window, including the window size and sliding step. The setting of the window size needs to comprehensively consider the frequency of traffic changes in the power communication network and the system's real-time requirements. For example, for scenarios involving the transmission of fault recording data with strong suddenness, the window size can be set to 1 second to ensure that short-term traffic fluctuations can be captured. The sliding step is adjusted according to the data update frequency as needed, and is generally set to 1 / 2 or 1 / 4 of the window size. For example, when the window size is 1 second, the sliding step can be set to 0.5 seconds to achieve intensive monitoring of traffic data.

[0021] Furthermore, during the windowing process, the traffic load monitoring and management system distributes the initial traffic parsing data to corresponding windows according to the set time sliding windows. For each time sliding window, it calculates traffic load indicators and service load indicators. The traffic load indicators primarily reflect the overall network traffic load within that window, specifically including the total number of data packets, total data traffic (unit: bytes), average data packet transmission rate (unit: bytes / second), data packet loss rate (number of lost data packets / total number of received data packets), and data packet retransmission rate (number of retransmitted data packets / total number of sent data packets). When calculating these indicators, the system iterates through all the initial traffic parsing data within the window, collects relevant data, and performs the calculations. Simultaneously, the service load indicators are calculated separately for different service types to reflect the load of each service within the window. First, services are categorized based on application layer service identifiers, port numbers, and other information in the initial traffic parsing data, determining service labels such as "fault recording service," "load prediction service," and "equipment monitoring service." Then, for each type of service, calculate the number of data packets, data traffic, average transmission rate, and service share (data traffic of the service / total data traffic within the window) for that service. These indicators together constitute the service load index.

[0022] Furthermore, after calculating traffic load and service load metrics, the traffic load monitoring and management system correlates the two. Simultaneously, based on information such as IP addresses and MAC addresses in the initial traffic parsing data, it determines the links traversed by data packets and generates link identifiers (e.g., composed of source IP address - destination IP address - transmission path number). Then, using time windows (e.g., "202X-XX-XX 10:30:00-10:30:01"), link identifiers (e.g., "192.168.1.10-10.0.0.5-L001"), and service tags (e.g., "fault recording service") as indexes, the corresponding traffic load and service load metrics are organized to form structured traffic characteristic data, facilitating subsequent anomaly detection and data analysis.

[0023] Continuing with the above embodiment, taking the flow load monitoring and management system with a time sliding window size of 1 second and a sliding step of 0.5 seconds as an example, the system performs windowing processing on the initial analysis data of the collected flow, which includes fault waveform data and load prediction data, within a certain period after a power grid fault occurs.

[0024] Taking one time window, "202X-XX-XX 10:30:00-10:30:01", as an example, the system begins calculating the traffic load and service load metrics for this window. When calculating the traffic load, the system iterates through all the initial traffic data within the window, obtaining a total of 1000 data packets and a total data flow of 10^6 bytes. The average data packet transmission rate is calculated as: Total Data Flow / Window Size = 10^6 bytes / 1 second = 10^6 bytes / second. During data transmission, the system detects 10 data packet losses out of a total of 1000 received data packets, resulting in a data packet loss rate of 10 / 1000 = 1%; 5 data packets are retransmitted out of a total of 1000 sent data packets, resulting in a data packet retransmission rate of 5 / 1000 = 0.5%. In summary, the traffic load metrics for this window are: total number of data packets 1000, total data traffic 10^6 bytes, average data packet transmission rate 10^6 bytes / second, data packet loss rate 1%, and data packet retransmission rate 0.5%.

[0025] Next, the service load metrics are calculated. Based on the port number and application layer service identifier in the initial traffic parsing data, the system categorizes the data packets within the window into two types: "Fault Recording Service" and "Load Prediction Service," with corresponding service tags "GLB001" and "FHYC001," respectively. For the "Fault Recording Service" (tag GLB001), the number of data packets is 800, and the data traffic is 8 × 10^5 bytes. The average transmission rate for this service is 8 × 10^5 bytes / second = 8 × 10^5 bytes / second; the service share is 8 × 10^5 bytes / 10^6 bytes = 80%. For the "Load Prediction Service" (tag FHYC001), the number of data packets is 200, and the data traffic is 2 × 10^5 bytes. The average transmission rate is 2 × 10^5 bytes / second = 2 × 10^5 bytes / second; the service share is 2 × 10^5 bytes / 10^6 bytes = 20%.

[0026] Then, the system determines the link information based on the IP addresses in the initial parsing data of the traffic. The "Fault Recording Service" data packet is transmitted from the source IP address 192.168.1.10 (substation fault recording device) to the destination IP address 10.0.0.5 (dispatch center fault data receiving server), and the transmission path number is L001, so the link identifier is "192.168.1.10-10.0.0.5-L001"; the "Load Forecasting Service" data packet is transmitted from the source IP address 192.168.2.20 (load forecasting system server) to the destination IP address 10.0.0.8 (dispatch center data aggregation server), and the transmission path number is L002, so the link identifier is "192.168.2.20-10.0.0.8-L002".

[0027] Finally, the system uses the time window “202X-XX-XX10:30:00-10:30:01”, the link identifier “192.168.1.10-10.0.0.5-L001”, and the service tag “GLB001” as indexes to associate the corresponding traffic load indicators and the “fault recording service” load indicators; using the same time window, the link identifier “192.168.2.20-10.0.0.8-L002”, and the service tag “FHYC001” as indexes, it associates the corresponding traffic load indicators and the “load prediction service” load indicators, thus forming structured traffic characteristic data under this time window.

[0028] Step 30: Input the structured traffic feature data into the anomaly detection model to obtain the anomaly identification results output by the anomaly detection model; the anomaly identification results include anomaly link identifiers, anomaly time windows, and anomaly service labels.

[0029] Optionally, the traffic load monitoring and management system pre-builds an anomaly detection model using a hybrid deep learning-based model architecture. This model combines the advantages of Long Short-Term Memory (LSTM) networks and autoencoders, effectively capturing the temporal characteristics and nonlinear anomaly patterns of power communication network traffic. During model training, the system uses a large amount of historical, normal, structured traffic feature data to train the model, allowing it to learn the characteristic distribution patterns of normal traffic and determine the characteristic threshold range of normal traffic. When the real-time generated structured traffic feature data is input into the trained anomaly detection model, the LSTM layer can effectively memorize the dependencies between traffic features across different time windows using its gating mechanism (input gate, forget gate, output gate). For example, it can capture the trend of gradually increasing traffic for load forecasting during peak electricity consumption periods, as well as the instantaneous characteristics of sudden surges in traffic for fault recording services when a fault occurs. Then, the feature data processed by the LSTM layer is fed into the encoder part of the autoencoder. The encoder performs dimensionality reduction on the features through multiple convolutional and pooling layers, extracting the core representation of the traffic features. Then, the decoder reconstructs the core representation, restoring the reconstructed feature data with the same dimensions as the input feature data. The model then calculates the reconstruction error (using mean squared error, MSE) between the input structured traffic feature data and the reconstructed feature data, comparing the calculated reconstruction error with an anomaly threshold determined during model training. If the reconstruction error exceeds the anomaly threshold, the traffic corresponding to the structured traffic feature data is determined to be abnormal. The model further analyzes the link identifier, time window, and service label information in the structured traffic feature data to determine the specific link, time range, and corresponding service type where the anomaly occurred, ultimately outputting an anomaly identification result containing the abnormal link identifier, abnormal time window, and abnormal service label.

[0030] In one embodiment, it is assumed that the anomaly detection model of the traffic load monitoring and management system has been trained using a large amount of historical data, and the anomaly threshold is set to 0.15. When detecting structured traffic characteristic data within a certain time period, the structured traffic characteristic data corresponding to the time window "202X-XX-XX10:30:02-10:30:03", link identifier "192.168.1.10-10.0.0.5-L001", and service tag "GLB001" (fault recording service) are input into the model. The traffic load indicators in this structured traffic characteristic data are: total number of data packets 1500, total data traffic 1.8×10^6 bytes, average data packet transmission rate 1.8×10^6 bytes / second, data packet loss rate 5%, and data packet retransmission rate 3%; the service load indicators are: fault recording service data packet number 1500, data traffic 1.8×10^6 bytes, average transmission rate 1.8×10^6 bytes / second, and service share 100%. The model first processes the data through an LSTM layer, capturing a sharp increase in fault-recorded traffic within this time window compared to previous normal windows (such as the "202X-XX-XX 10:30:00-10:30:01" window), along with a significant increase in packet loss and retransmission rates. These temporal variation features are effectively memorized and extracted by the LSTM layer. Subsequently, the encoder performs dimensionality reduction on the feature data output by the LSTM layer, extracting core features. Assuming the core feature vector is [1.5, 1.8, 5, 3, 1.8, 100] (corresponding to the relative values ​​of total packet count, total data traffic, packet loss rate, packet retransmission rate, average service transmission rate, and service percentage, respectively), the decoder reconstructs the feature vector based on the core feature vector, resulting in a reconstructed feature vector of [1.1, 1.2, 1.2, 0.8, 1.2, 90]. Based on this, the calculated reconstruction error (MSE) is 20.027. Since the calculated reconstruction error of 20.027 is much larger than the anomaly threshold of 0.15, the model determines that the traffic is abnormal. By analyzing the information in the structured traffic feature data, the model identifies the abnormal link as "192.168.1.10-10.0.0.5-L001", the abnormal time window as "202X-XX-XX10:30:02-10:30:03", and the abnormal service label as "GLB001" (fault recording service), and outputs the anomaly identification result.

[0031] Step 40: Based on the anomaly identification results, perform secondary parsing on the original abnormal data packets extracted from the traffic data packets, and associate the secondary parsing results with the initial parsing data of the traffic to construct an abnormal traffic tracing chain.

[0032] Optionally, after obtaining the anomaly identification results, the traffic load monitoring and management system filters out the original abnormal data packets belonging to the abnormal link, within the abnormal time window, and corresponding to the abnormal service label from the originally collected traffic data packets based on the abnormal link identifier, abnormal time window, and abnormal service label in the anomaly identification results. Then, it performs secondary parsing on the original abnormal data packets to analyze key information more deeply. The secondary parsing results are then correlated with the initial traffic parsing data to construct an abnormal traffic tracing chain, as described in steps 401-405. This ensures that the constructed abnormal traffic tracing chain clearly shows the complete path of abnormal traffic from the initiating device, through network link transmission, to the abnormal presentation of service data, providing direct evidence for subsequent maintenance personnel to trace the root cause of the anomaly.

[0033] Step 50: Determine the load control strategy based on the abnormal traffic tracing chain and the pre-built traffic load control decision library.

[0034] Optionally, a dynamic control decision library for flow load is pre-built within the flow load monitoring and management system. This library is constructed based on the topology of the power communication network, service priority rules, historical fault handling cases, and load control effect feedback data. After obtaining the abnormal flow tracing chain, the feature information in the abnormal flow tracing chain is extracted and matched with the flow load control decision library to ultimately determine the load control strategy, as described in steps 501-505.

[0035] This invention utilizes a DPI probe to perform initial multi-layer parsing of collected traffic data packets and combines this with time-sliding window processing to obtain traffic load and service load indicators for each time window, which are then correlated to form structured traffic feature data. This overcomes the limitations of traditional fixed-threshold periodic sampling due to long sampling intervals, accurately capturing frequent bursts of traffic in power communication networks and effectively avoiding missed or false detections. Furthermore, by using link identifiers and service tags for indexing, it clearly distinguishes the service type and source of overloaded traffic, overcoming the shortcomings of traditional methods that can only determine whether there is an overload but cannot clearly define the specific attributes of the overloaded traffic. In addition, based on an anomaly detection model, the structured traffic... This method uses quantitative feature data for anomaly identification, extracts original abnormal data packets based on the anomaly identification results for secondary parsing, and associates them with the initial parsed data to construct an abnormal traffic tracing chain. This overcomes the shortcomings of traditional DPI methods, which lack real-time analysis capabilities for dynamic traffic features. It can not only identify the links or devices where network load anomalies occur, but also accurately trace the specific initiating node of abnormal traffic and the corresponding business process. Combined with a pre-built traffic load control decision library, it determines the load control strategy, solving the problem that existing methods require maintenance personnel to spend a long time troubleshooting the root cause of faults. This significantly improves the fault recovery efficiency of power communication networks and eliminates the potential risks to the safe and stable operation of the power grid caused by excessively long fault troubleshooting time.

[0036] In one embodiment, steps 401-405 are described as follows: Step 401: Extract all original data packets with abnormal service tags corresponding to the abnormal link and within the abnormal time window from the traffic data packets based on the abnormal link identifier, abnormal time window and abnormal service tag to obtain the original abnormal data packets.

[0037] Optionally, the traffic load monitoring and management system first extracts the abnormal link identifier, abnormal time window, and abnormal service tag from the anomaly identification results. The abnormal link identifier contains key information such as the source IP address, destination IP address, and link number, used to determine the specific network link traversed by the abnormal traffic transmission; the abnormal time window clarifies the specific time range of the abnormal traffic occurrence, accurate to the millisecond level to ensure accurate definition of the time boundary of the abnormal data packet; the abnormal service tag corresponds to the specific service type that generated the abnormal traffic, such as "GLB001" representing a fault recording service. Then, it iterates through all collected raw traffic data packets and initiates a multi-condition joint filtering mechanism. In the screening process, the key attributes of each raw data packet are verified one by one: First, check whether the timestamp of the data packet falls within the abnormal time window. If the timestamp is not within this range, the data packet is directly excluded. Next, verify whether the source IP address and destination IP address of the data packet completely match the IP information in the abnormal link identifier. At the same time, confirm whether the link number corresponding to the data packet transmission is consistent with the abnormal link identifier. If the IP address or link number does not match, the data packet is also excluded. Finally, identify the service identifier information in the application layer of the data packet and determine whether it matches the abnormal service label. Extract the traffic data packets that completely meet these three screening conditions to obtain the raw abnormal data packets.

[0038] Furthermore, to ensure the completeness and accuracy of the screening results, after extracting the initial set of raw abnormal data packets, the system will perform a second traversal of the data packets in the set, and recheck the timestamp, IP address, link number and service identifier of each data packet to prevent omissions or misselections caused by data transmission delays, unclear identification information and other issues, and finally form a complete and accurate set of raw abnormal data packets.

[0039] In one embodiment, taking the anomaly identification result output in step 30 as an example, the abnormal link identifier is "192.168.1.10-10.0.0.5-L001" (source IP address 192.168.1.10, destination IP address 10.0.0.5, link number L001), the abnormal time window is "202X-XX-XX10:30:02.000-10:30:03.000" (accurate to milliseconds), and the abnormal service label is "GLB001" (fault recording service).

[0040] The traffic load monitoring and management system begins to traverse the collected raw traffic data packets. During this traversal, the timestamp of the data packets is checked first. For example, a data packet with a timestamp of "202X-XX-XX10:30:01.999" is excluded because it is not within the abnormal time window; a data packet with a timestamp of "202X-XX-XX10:30:02.500" meets the timestamp requirements and proceeds to the next verification step. Next, the IP address and link number are verified. The source IP address of this data packet is 192.168.1.10, and the destination IP address is 10.0.0.5, which matches the IP information of the abnormal link identifier. Furthermore, the transmission link number is L001, meeting the link conditions, and thus proceeding to the service tag verification stage. Finally, the application layer service identifier is identified. The service code "GLB001" is extracted from the application layer data of this data packet, which perfectly matches the abnormal service tag. Therefore, this data packet is determined to be a raw abnormal data packet and extracted. After a comprehensive traversal and multiple rounds of verification, the system extracted a total of 1,500 original abnormal data packets that met all the filtering criteria. These data packets all belonged to the "192.168.1.10-10.0.0.5-L001" link, were within the "202X-XX-XX10:30:02.000-10:30:03.000" time window, and had the "GLB001" service tag, thus forming the original abnormal data packet set.

[0041] Step 402: Determine the core field range for secondary parsing based on the original abnormal data packet, and extract abnormal features from the abnormal identification results based on the core field range to generate a secondary parsing strategy; the secondary parsing strategy includes field parsing order, field value matching conditions, and abnormal feature association logic.

[0042] Optionally, the traffic load monitoring and management system first performs sample analysis on the original abnormal data packets, randomly selecting a certain number (usually 10%-20% of the total) of data packets as samples. The system then parses the full field structure of each sample data packet, identifying all fields contained within the packet, covering network layer, transport layer, application layer, and device-level related fields. Next, based on the core requirements of anomaly tracing, the scope of core fields for secondary analysis is determined. Anomaly tracing requires clarifying key information such as abnormal transmission paths, abnormal data content, and abnormal device processes. Therefore, the core field scope mainly includes: network layer TTL values ​​and routing record option fields; transport layer TCP sequence numbers, acknowledgment numbers, window sizes, retransmission reason identifier fields, and UDP checksum fields; application layer key business data fields (such as fault current values, voltage values, and data integrity check codes in fault recording services); and device-level source device model, firmware version, process ID, destination device receive port occupancy rate, and process priority fields. These fields directly reflect the key characteristics of abnormal traffic in terms of transmission, data content, and device operation, and are the core basis for anomaly tracing.

[0043] Furthermore, the traffic load monitoring and management system extracts abnormal features from the anomaly identification results. Information such as abnormal link identifiers, abnormal time windows, and abnormal service tags in the anomaly identification results, combined with the characteristics of the original abnormal data packets analyzed in the preliminary analysis, can be used to extract specific abnormal features, such as "abnormally decreasing TTL value," "excessively high TCP retransmission rate," "application layer data verification failure," and "excessively high CPU utilization of the source device process." Finally, based on the core field range and the extracted abnormal features, a secondary parsing strategy is generated. This includes adhering to the principle of parsing fields from the bottom layer to the top layer, and from basic information to key anomaly information, first parsing network layer fields, then transport layer fields, and finally application layer and device-level fields, ensuring a gradual and in-depth approach to anomaly localization; setting field value matching conditions based on anomaly characteristics, such as "TTL value less than the expected value under normal path", "TCP retransmission reason marked as 'timeout retransmission'", "application layer data integrity check code does not match the preset value", and "source device process CPU utilization greater than 80%", clearly defining the criteria for judging whether a field value is abnormal; and defining the correlation logic between different anomaly fields, such as when "TCP retransmission rate is too high" and "destination device receive port utilization is too high", it can be correlated to "destination device receive buffer insufficient, causing retransmission", integrating scattered anomaly field characteristics through correlation logic to form a complete basis for anomaly cause analysis.

[0044] In one embodiment, based on the 1500 original abnormal data packets obtained in step 401, the traffic load monitoring and management system randomly selects 150 data packets as samples for full-field parsing. After parsing, it is found that these data packets contain network layer TTL values ​​and routing record options; transport layer TCP sequence numbers, acknowledgment numbers, window sizes, and retransmission reason identifiers; application layer fault current values, voltage values, and CRC32 checksums; and device-level source device model, firmware version, process ID, and CPU utilization; as well as destination device port utilization and process priority. Based on the requirements for anomaly tracing, the core fields for secondary parsing are determined to be: network layer TTL values ​​and routing record options; transport layer TCP window size and retransmission reason identifiers; application layer fault current values ​​and CRC32 checksums; and device-level source device process ID and CPU utilization, and destination device port 5000 utilization and process priority. Based on the anomaly identification results from step 30, namely "abnormal link identifier 192.168.1.10-10.0.0.5-L001, abnormal time window 10:30:02-10:30:03, and abnormal service tag GLB001", and preliminary sample analysis, the following abnormal features were extracted: "TTL value dropped from 64 to 58 (normally it should drop to 60)", "TCP retransmission rate 30%", "CRC32 check failed for some data packets", "source device process CPU utilization rate 85%", and "destination device port 5000 utilization rate 90%".

[0045] Finally, a secondary parsing strategy is generated based on the above information: Field parsing order: First, parse the network layer TTL value and routing record options; then parse the transport layer TCP window size and retransmission reason identifier; next, parse the application layer fault current value and CRC32 checksum; finally, parse the device-level source device process ID, CPU utilization, destination device port 5000 utilization, and process priority.

[0046] Field value matching conditions: TTL value < 60; TCP retransmission reason identifier = "timeout retransmission"; CRC32 checksum ≠ preset value "0x12345678"; source device process CPU utilization > 80%; destination device port 5000 utilization > 85%.

[0047] Anomaly correlation logic: If "TCP retransmission reason identifier = timeout retransmission" and "destination device port 5000 utilization rate > 85%", then the correlation is determined as "insufficient receive buffer on destination device port 5000 leading to TCP timeout retransmission"; if "CRC32 checksum ≠ preset value", then it is determined as "application layer data corruption"; if "source device process CPU utilization rate > 80%", then it is determined as "insufficient resources in the source device process". Step 403: Perform secondary parsing on the original abnormal data packet based on the secondary parsing strategy to obtain the secondary parsing result.

[0048] Optionally, the traffic load monitoring and management system parses each data packet in the original abnormal data packet set one by one according to a secondary parsing strategy. During the parsing process, it strictly follows the field parsing order specified in the strategy, first parsing the network layer fields of each original abnormal data packet. Using a dedicated network protocol parsing module, it extracts the TTL value and routing record option information, and determines whether the TTL value is abnormal (e.g., whether it is less than the expected value) based on field value matching conditions. Simultaneously, it analyzes the routing record options to check for non-preset routing nodes, recording the network layer parsing results and abnormal judgment status. After completing the network layer parsing, the system continues to parse the transport layer fields in sequence. For TCP protocol packets, it parses the TCP sequence number, acknowledgment number, and window size, focusing on identifying retransmission reason identifiers, and determines whether there are timeout retransmissions or other abnormalities based on matching conditions. For UDP protocol packets, it parses the checksum field to determine if the checksum is incorrect. The parsed values ​​of each transport layer field are compared with the matching conditions, and the transport layer parsing results and abnormal status are recorded. Subsequently, the system parses the application layer fields. For different business types, the corresponding application layer protocol parsing plugin is invoked. For example, for fault recording business, key business fields such as fault current value and voltage value are extracted, and data integrity check code (such as CRC32 code) is calculated or read. The check code is compared with the preset value to determine whether the data is corrupted, and the parsing results and abnormal information of the application layer are recorded.

[0049] Finally, the system parses device-level fields. Through data interaction with the device management system, it obtains information such as the source device's model, firmware version, corresponding service process ID, and CPU utilization; the destination device's corresponding receiving port utilization and receiving process priority. This device-level information is then compared with the field value matching conditions to determine if there are any anomalies such as insufficient device resources or unreasonable process priority settings, and the device-level parsing results are recorded. After completing the above full-field parsing for all original abnormal data packets, the system organizes the parsing results for each data packet, summarizing the parsed field values ​​and anomaly judgment results according to network layer, transport layer, application layer, and device level. Simultaneously, based on the anomaly characteristic association logic, it integrates the anomaly information from each layer to form a complete parsing report for each original abnormal data packet. Finally, the system summarizes the parsing reports of all data packets, removes duplicate information, and forms a secondary parsing result covering the entire set of original abnormal data packets. This result comprehensively reflects the detailed characteristics and anomalies of the abnormal traffic in terms of network transmission, data content, and device operation.

[0050] Continuing with the above embodiment, the traffic load monitoring and management system analyzes 1500 original abnormal data packets one by one according to the secondary analysis strategy. Taking one data packet as an example, the network layer field is analyzed first: the TTL value is extracted by the network protocol analysis module and found to be 57, which is less than "60" in the matching condition, and is judged to be abnormal; the routing record option shows that the data packet passed through the node "192.168.1.254", which is not a preset routing node, and the network layer abnormal information is recorded. Next, the transport layer field is analyzed: the data packet is a TCP protocol, and the TCP window size is 16384 bytes (normal is 65535 bytes), and the retransmission reason is marked as "timeout retransmission", both of which meet the abnormal matching conditions, and the transport layer abnormal information is recorded. Then, the application layer field is analyzed: the fault waveform service analysis plugin is called to extract the fault current value as "NULL" (normally it should contain a specific value), and the CRC32 check code is read as "0x87654321", which does not match the preset value "0x12345678", and the application layer data is judged to be corrupted, and the application layer abnormal information is recorded. Finally, the device-level fields were parsed: Interacting with the device management system, the source device model was obtained as "FR-2000", firmware version as "V2.5.3", process ID as "12345", and CPU utilization as 85% (a match condition greater than 80%); the destination device port 5000 utilization was 90% (a match condition greater than 85%), and the receiving process priority was "normal". Device-level anomaly information was recorded. Based on the anomaly characteristic association logic, the anomaly information from each layer of the data packet was integrated: "TCP retransmission reason identifier = timeout retransmission" and "destination device port 5000 utilization = 90%" were correlated and determined as "insufficient receive buffer on destination device port 5000 leading to TCP timeout retransmission"; "CRC32 checksum mismatch" was determined as "application layer data corruption"; and "source device process CPU utilization = 85%" was determined as "insufficient resources in the source device process". After the system completed the above parsing of 1500 data packets, it summarized the secondary parsing results, which showed that: 80% of the data packets had abnormal TTL values ​​(55-59) and passed through a non-preset node "192.168.1.254"; 90% of the data packets had abnormal TCP window sizes (12000-18000 bytes) and were retransmitted data packets (timeout retransmissions accounted for 85%); 30% of the data packets had missing application layer fault current values ​​or failed CRC32 checks; the CPU utilization of the source device process 12345 fluctuated between 82% and 88%, and the CPU utilization of the destination device port 5000 fluctuated between 88% and 92%.

[0051] Step 404: Based on the secondary parsing results and the initial traffic parsing data, extract the same related key fields to obtain the related key field group.

[0052] Optionally, the traffic load monitoring and management system analyzes the field structures of both the secondary parsing results and the initial traffic parsing data, listing all field names and their meanings for each. The initial traffic parsing data includes fields such as physical layer parameters of the data packets (e.g., signal strength, transmission rate), MAC addresses at the data link layer, IP addresses at the network layer, port numbers and protocol types at the transport layer, and service identifiers at the application layer. The secondary parsing results include fields such as the TTL value and routing record options at the network layer, TCP sequence numbers and acknowledgment numbers at the transport layer, fault current values ​​at the application layer, and source device model and process ID at the device level. Then, based on the principle of data correlation, fields that exist in both the secondary parsing results and the initial traffic parsing data, have the same meaning, and can uniquely identify the same data packet or a batch of related data packets are selected; these fields are the key correlation fields. This mainly includes: the source and destination MAC addresses at the data link layer (uniquely identifying the source and destination nodes of the data packet at the data link layer); the source and destination IP addresses at the network layer (identifying the start and end points of the data packet's transmission path at the network layer); the source and destination port numbers at the transport layer (corresponding to specific service processes); the timestamp of the data packet (accurate to milliseconds, determining the time the data packet was generated); and the unique service identifier at the application layer (such as the fault code in fault recording services, distinguishing different service instances). These fields are consistent and unique in both data parsing processes, serving as a crucial link between them.

[0053] Finally, the system organizes the selected common key fields and categorizes them according to the data link layer, network layer, transport layer, and application layer to form key field groups. These field groups ensure that the secondary parsing results and the initial traffic parsing data can establish an accurate correspondence through these common fields, laying the foundation for subsequent data association and fusion.

[0054] Continuing with the above embodiments, the traffic load monitoring and management system sorts out the fields of the secondary parsing results, including: source MAC address, destination MAC address, source IP address, destination IP address, source port number, destination port number, timestamp, fault code (unique identifier for application layer services), TTL value, TCP window size, fault current value, source device process ID, etc.; the fields of the initial traffic parsing data include: source MAC address, destination MAC address, source IP address, destination IP address, source port number, destination port number, timestamp, fault code, signal strength, transmission rate, transport layer protocol type, etc.

[0055] Based on the principle of data correlation, fields common to both and with the same meaning are selected: source MAC address (e.g., 00-1B-44-11-3A-7D), destination MAC address (e.g., 00-1B-44-22-5B-8E), source IP address (192.168.1.10), destination IP address (10.0.0.5), source port number (5000), destination port number (5000), timestamp (e.g., 202X-XX-XX10:30:02.500), and fault code (e.g., F001). The system then categorizes these selected common key fields according to the data link layer, network layer, transport layer, and application layer, forming key field groups. Data link layer: source MAC address (00-1B-44-11-3A-7D), destination MAC address (00-1B-44-22-5B-8E); Network layer: Source IP address (192.168.1.10), Destination IP address (10.0.0.5); Transport layer: source port number (5000), destination port number (5000); Application layer: timestamp (202X-XX-XX10:30:02.500), fault code (F001). This group of key related fields provides a clear and unique matching basis for the subsequent association and fusion of secondary parsing results and initial traffic parsing data.

[0056] Step 405: Based on the associated key field group, the secondary parsing results and the initial traffic parsing data are associated and merged to construct an abnormal traffic tracing chain.

[0057] Optionally, the traffic load monitoring and management system can associate and merge the secondary parsing results and the initial traffic parsing data based on the associated key field groups to construct an abnormal traffic tracing chain, as described in steps 4051-4054.

[0058] This invention employs a multi-condition joint screening and duplicate verification mechanism based on "abnormal link identifier + abnormal time window + abnormal business tag," which improves screening accuracy compared to traditional single screening methods based solely on links or time. Secondary analysis focuses on key information for anomaly tracing, improving analysis efficiency. Simultaneously, the analysis depth is extended to the device process level, providing more fundamental and comprehensive anomaly information support for tracing. Furthermore, using associated key field groups as a link, composite index matching and consistency verification achieve precise association and fusion of secondary analysis results with initial analysis data, avoiding data fragmentation and hierarchical breaks in traditional tracing, and providing a complete data foundation for building the tracing chain.

[0059] In one embodiment, steps 4051-4054 ​​are described as follows: Step 4051: Based on the associated key field group, the secondary parsing results and the initial traffic parsing data are associated and merged to obtain the merged data group.

[0060] Optionally, after obtaining the associated key field group, the traffic load monitoring and management system uses these fields as a bridge to correlate and fuse the secondary parsing results and the initial traffic parsing data. Specifically, firstly, the data structures of the secondary parsing results and the initial traffic parsing data are aligned to ensure consistency in field types and data formats, facilitating subsequent correlation operations. Then, using fields from the associated key field group (such as source MAC address, destination MAC address, source IP address, destination IP address, timestamp, service unique identifier, etc.), the information of each data packet in the secondary parsing results is matched with the corresponding data packet information in the initial traffic parsing data through database correlation queries or custom matching algorithms. During the matching process, the matched fields are integrated; for fields with the same meaning, their valid values ​​are retained; for fields with different dimensions but related, they are combined and stored to form a fused data record containing full-dimensional information from both the initial and secondary parsing. Finally, all successfully matched fused data records are summarized to form a fused data group. Each data entry in the fused data group contains complete information about the data packet from the physical layer to the device layer, providing a comprehensive data foundation for subsequent extraction of propagation path features and calculation of node impact.

[0061] Continuing with the above embodiment, let's take the case where the associated key field group includes the source MAC address "00-1B-44-11-3A-7D", the destination MAC address "00-1B-44-22-5B-8E", the source IP address "192.168.1.10", the destination IP address "10.0.0.5", the timestamp "202X-XX-XX10:30:02.500", and the fault code "F001" as an example.

[0062] The traffic load monitoring and management system performs data structure alignment on the secondary parsing results (including TTL value 57, routing record containing "192.168.1.254", TCP window size 16384 bytes, retransmission reason identifier "timeout retransmission", fault current value "NULL", CRC32 checksum "0x87654321", source device model "FR-2000", process ID "12345", CPU utilization 85%, destination device port 5000 utilization 90%) and the initial traffic parsing data (including signal strength "-20dBm", transmission rate "1000Mbps", transport layer protocol type "TCP") to ensure consistency in timestamp format, IP address format, etc. By matching key field groups, the secondary parsing results and the corresponding data from the initial traffic parsing are integrated to form a fused data record. This record contains information from the physical layer (signal strength, transmission rate), data link layer (source MAC address, destination MAC address), network layer (source IP address, destination IP address, TTL value, routing record), transport layer (transport protocol type, source port number, destination port number, TCP window size, retransmission reason identifier), application layer (fault code, fault current value, CRC32 checksum), and device layer (source device model, process ID, CPU utilization, destination device port utilization). Finally, all similar fused data records are aggregated to obtain a fused data group.

[0063] Step 4052: Extract the propagation path features of abnormal traffic in the power communication network based on the fused data group, and construct the propagation path feature group.

[0064] Optionally, after obtaining the fused data set, the traffic load monitoring and management system extracts the propagation path characteristics of abnormal traffic from the fused data set. Specifically, it first analyzes the network layer and transport layer information in each fused data record to determine the source node, destination node, and intermediate nodes traversed during the transmission of data packets. Using information such as source IP address, destination IP address, and routing record options, the propagation path of abnormal traffic is traced, for example, "Node A (source) → Node B → Node C → Node D (destination)". Then, the system extracts key features along the propagation path, including the identifier of each node (e.g., IP address, device model), the link identifiers between nodes (e.g., link number, bandwidth), the number of times data packets are forwarded at each node, and the transmission duration on each link. Simultaneously, it extracts traffic characteristics during the propagation process, such as the number of data packets, data traffic, and changes in transmission rate. Finally, these extracted propagation path features are organized and categorized according to dimensions such as node order and link order, constructing a propagation path feature group. The propagation path feature group provides crucial feature information for subsequent calculations of node impact and the construction of a source tracing chain.

[0065] Continuing with the above embodiments, based on the fused data group, the traffic load monitoring and management system analyzes the source IP address "192.168.1.10" (corresponding to node A, the device is the substation fault recording device FR-2000), the destination IP address "10.0.0.5" (corresponding to node D, the device is the dispatch center fault data receiving server) and the routing record options of each fused data record, and sorts out the propagation path of abnormal traffic as "node A → node B (IP: 192.168.1.1) → node C (IP: 192.168.1.254, not a preset node) → node D". Next, the features along the propagation path are extracted: Node A is identified as "192.168.1.10 (FR-2000)", Node B as "192.168.1.1 (Router R1)", Node C as "192.168.1.254 (Switch S1)", and Node D as "10.0.0.5 (Server Srv1)"; the link from Node A to Node B is identified as "L001", the bandwidth is "1000Mbps", the number of times the data packet is forwarded at Node A is "1", and the number of times it is forwarded at Node B is "1". The number of packets sent is "1", and the number of forwards at node C is "1". The transmission time of the data packet from node A to node B is "0.1ms", the transmission time from node B to node C is "0.2ms", and the transmission time from node C to node D is "0.3ms". The number of abnormal traffic data packets is "1500", the data volume is "1.8 × 10^6 bytes", and the transmission rate is "1000Mbps" from node A to node B, decreasing to "800Mbps" from node B to node C, and decreasing to "500Mbps" from node C to node D. After organizing these characteristics, the system constructs a propagation path feature group according to the node order and link order of the propagation path, including a list of path nodes, node identifiers, link identifiers and bandwidths, forwarding times at each node, transmission times at each link, and traffic characteristics.

[0066] Step 4053: Determine the influence of each node in the abnormal traffic propagation process based on the propagation path feature group, and prioritize the nodes based on the influence to obtain the node source tracing priority ranking result.

[0067] Optionally, after obtaining the propagation path characteristic group, the traffic load monitoring and management system will, according to the given node influence formula... ;in, Represents a node The degree of influence of the nodes; Represents a node The number of times abnormal data was forwarded; Represents a node The duration of the link transmission involved; This represents the set of node identifiers in the abnormal traffic propagation path, and the influence of each node in the abnormal traffic propagation process is calculated. Specifically, the number of abnormal data forwardings for each node is first extracted from the propagation path feature set. and the duration of link transmission involved Then calculate the values ​​of all nodes. The sum of Finally, each node's Divide by this sum to obtain the influence of each node. Then, based on the magnitude of their impact, the nodes are prioritized. The nodes with greater impact have higher priority in anomaly tracing, thus obtaining the node tracing priority ranking result.

[0068] Continuing with the above embodiments, based on the propagation path feature group, the traffic load monitoring and management system extracts the data from each node. and Among them, nodes , Node B , ;node , ;node (Destination node, do not forward) , First calculate Then calculate the influence of each node: ; ; ; The nodes are prioritized according to their influence, and the results are: Node C (0.5) > Node B (0.333) > Node A (0.167) > Node D (0), thus obtaining the node tracing priority ranking result.

[0069] Step 4054: Based on the node tracing priority ranking results and the fused data group, construct the abnormal traffic tracing chain; the abnormal traffic tracing chain includes node connection relationships, data transmission timing, and abnormal feature association information.

[0070] Optionally, after obtaining the node tracing priority ranking results and the fused data set, the traffic load monitoring and management system, in constructing the abnormal traffic tracing chain by combining the two, firstly, determines the key nodes for tracing based on the node tracing priority ranking results, prioritizing the analysis of relevant data from high-priority nodes. Then, it extracts the abnormal characteristic information of the key nodes, as well as the connection relationships and data transmission timing between nodes, from the fused data set. Node connection relationships include link connections and forwarding relationships between nodes; data transmission timing includes the transmission time and forwarding order of data packets at each node; abnormal characteristic association information includes abnormal characteristics appearing on each node (such as routing anomalies on node C, bandwidth reduction on node B, insufficient process resources on node A, etc.) and the association relationships between these abnormal characteristics (such as routing anomalies on node C causing bandwidth reduction from node B to node C, thus affecting data transmission at node A). Finally, the node connection relationships, data transmission timing, and abnormal characteristic association information are integrated and organized according to a certain logical structure (such as time order, node priority order) to construct the abnormal traffic tracing chain. The traceability chain clearly shows the propagation process of abnormal traffic from the source node to the destination node, the abnormal conditions of each node, and the correlation between abnormalities, providing direct evidence for operation and maintenance personnel to trace the root cause of abnormalities.

[0071] Continuing with the above embodiments, based on the node tracing priority ranking results (Node C > Node B > Node A > Node D) and the fused data group, the traffic load monitoring and management system constructs an abnormal traffic tracing chain: Node connection relationship: Node A (192.168.1.10) → Node B (192.168.1.1) → Node C (192.168.1.254) → Node D (10.0.0.5). Data transmission timing: The data packet is sent from Node A at 10:30:02.000 on 202X-XX-XX, arrives at Node B at 10:30:02.100, arrives at Node C at 10:30:02.300, and arrives at Node D at 10:30:02.600. Anomaly characteristics and associated information: Node C (switch S1) has a non-preset route, causing an increase in the link transmission time from node B to node C (from the normal 0.1ms to 0.2ms) and a decrease in bandwidth (from 1000Mbps to 800Mbps); due to the decreased link bandwidth, node B (router R1) experiences a reduction in data packet transmission rate, which in turn increases the CPU utilization of process ID 12345 in node A (fault recording device FR-2000) (reaching 85%) to cope with data transmission delays; insufficient process resources in node A, coupled with the routing anomaly in node C, ultimately leads to anomalies such as abnormal TCP window size (16384 bytes), retransmissions (timeout retransmissions), and application layer data verification failures (CRC32 checksum mismatch) in data packets transmitted to node D. Integrating this information constructs an anomaly traffic tracing chain, clearly demonstrating the propagation process of the anomaly and the anomaly associations of each node.

[0072] This invention, by integrating full-dimensional data from initial and secondary analysis, and combining propagation path characteristics and node impact analysis, can accurately locate the propagation path and key influencing nodes of abnormal traffic, thus improving the accuracy of anomaly tracing. Furthermore, based on the priority ranking of node impact, operations and maintenance personnel can prioritize investigating high-impact nodes, reducing the time spent on blind investigations. Finally, the constructed tracing chain includes node connection relationships, data transmission sequence, and anomaly characteristic association information, enabling operations and maintenance personnel to clearly understand the propagation process of anomalies and the causal relationships between various anomalies, providing a clear basis for quickly formulating fault repair strategies.

[0073] In one embodiment, steps 501-505 are described as follows: Step 501: Based on the abnormal traffic tracing chain, extract the association pairs of abnormal link identifiers and abnormal service tags that have abnormal traffic to obtain candidate link service groups, and evaluate each candidate association pair in the candidate link service group based on the traffic load control decision library to obtain the abnormal traffic impact degree of each candidate association pair in the abnormal time window.

[0074] Optionally, the traffic load monitoring and management system first extracts the abnormal link identifiers and abnormal service tags containing abnormal traffic from the abnormal traffic tracing chain, and combines them to form candidate association pairs. For example, if the tracing chain shows abnormal traffic with the abnormal service tag "GLB001" (fault recording service) on a link with the abnormal link identifier "L001", then "L001-GLB001" constitutes a candidate association pair. The system then traverses the tracing chain, extracts all candidate association pairs, and forms candidate link service groups. Based on the traffic load control decision library, each candidate association pair in the candidate link service group is evaluated. Specifically, the traffic load control decision library stores information such as the service importance corresponding to various service tags, traffic characteristics (e.g., burst coefficient, bandwidth demand fluctuation range), and the link criticality corresponding to the link identifier (e.g., whether it is a core link, the number of service types it carries). Based on this information, combined with factors such as the scale and duration of abnormal traffic in the candidate association pair, the impact of abnormal traffic on each candidate association pair within the abnormal time window is calculated. The impact score takes into account the importance of the business, the criticality of the link, and the degree of interference of abnormal traffic on the normal operation of the network. The higher the score, the greater the impact of the abnormal traffic of the candidate association pair on the network.

[0075] Furthermore, the formula for calculating the impact of abnormal traffic flow can be: ; in, For the corresponding link identifier Business Tags Time window The impact of abnormal traffic; For the corresponding link identifier Business Tags Time window The scale of abnormal traffic; Link identifier in the traffic load control decision base Importance coefficient (value range 0-1, the larger the value, the more important the link); Business tags in the traffic load control decision library Priority coefficient (value range 0-1, the larger the value, the higher the business priority). This represents the total number of links involved in the abnormal traffic tracing chain. For abnormal traffic tracing chain Total number of business transactions involved: For abnormal traffic tracing chain The total number of time windows involved.

[0076] In one embodiment, the abnormal traffic tracing chain shows abnormal traffic with the abnormal service tag "GLB001" (fault recording service) on the abnormal link identifier "L001" (the link from source IP address 192.168.1.10 to destination IP address 10.0.0.5), and a small amount of abnormal traffic with the abnormal service tag "FHYC001" (load forecasting service) on the abnormal link identifier "L002" (the link from source IP address 192.168.2.20 to destination IP address 10.0.0.8). The traffic load monitoring and management system extracts these two candidate association pairs to form candidate link service groups: {"L001-GLB001", "L002-FHYC001"}. Then, based on the evaluation of the traffic load control decision base: the "GLB001" service is a fault recording service, which is a high-importance service, and the scale of this abnormal traffic is large (1500 data packets, 1.8 × 10^6 bytes); "L001" is the core link connecting the substation and the dispatch center. After comprehensive evaluation, the impact of abnormal traffic on "L001-GLB001" was calculated to be 0.85. "FHYC001" is a load forecasting service, of secondary importance, and its abnormal traffic scale is small (200 data packets, 2 × 10^5 bytes); "L002" is a non-core link. The impact of abnormal traffic on "L002-FHYC001" was evaluated to be 0.3.

[0077] Step 502: For the first link identifier of each candidate association pair in the candidate link service group, based on the impact of abnormal traffic, the actual load of the first link identifier in the abnormal traffic tracing chain during the abnormal time window, and the maximum load threshold of the first link identifier in the traffic load control decision library, determine the link load redundancy of the first link identifier in the corresponding abnormal time window.

[0078] Optionally, the traffic load monitoring and management system determines the first link identifier (i.e., any abnormal link identifier in the candidate link pair) for each candidate association pair in the candidate link service group. Then, it obtains the actual load of the first link identifier within the abnormal time window from the abnormal traffic tracing chain, and simultaneously obtains the maximum load threshold of the first link identifier from the traffic load control decision library. Link load redundancy reflects the remaining load capacity of the link within the abnormal time window, and its calculation formula is: Link load redundancy = (Maximum load threshold - Actual load) / Maximum load threshold. Simultaneously, the link load redundancy is corrected based on the abnormal traffic impact degree of the candidate association pair obtained in step 501. This is because association pairs with a high abnormal traffic impact degree may have a more critical actual load occupancy on the link; therefore, the corrected link load redundancy can more accurately reflect the remaining load capacity of the link after considering the impact of abnormal traffic.

[0079] Continuing with the above embodiment, for the candidate association pair "L001-GLB001", the first link is identified as "L001". From the abnormal traffic tracing chain, the actual load of "L001" within the abnormal time window "202X-XX-XX 10:30:02-10:30:03" is obtained as 8 × 10^5 bytes (total data traffic 1.8 × 10^6 bytes, of which abnormal traffic accounts for approximately 44.4%). From the traffic load control decision base, the maximum load threshold for "L001" is obtained as 1 × 10^6 bytes. First, calculate the basic link load redundancy: The abnormal traffic impact of "L001-GLB001" is adjusted to 0.85. Assuming the adjustment coefficient is 1 - 0.85 * 0.5 (the larger the abnormal traffic impact, the larger the adjustment; this is just an example coefficient), the adjusted link load redundancy is... For the candidate association pair "L002-FHYC001", the first link is identified as "L002", the actual load is 1.5 × 10^5 bytes, the maximum load threshold is 5 × 10^5 bytes, and the impact of abnormal traffic is 0.3. Basic link load redundancy. The correction factor is 1 - 0.3 * 0.5 = 0.85, resulting in a corrected link load redundancy. .

[0080] Step 503: Based on the traffic load control decision library, link load redundancy, and abnormal traffic impact, candidate link service groups are screened to obtain the link service groups to be controlled. For the second link identifier of each link service pair in the link service group to be controlled, the adaptability coefficient of the link service group to be controlled from the second link identifier to other abnormal links is determined based on the link load redundancy, the traffic transmission requirements of the link service pair in the abnormal traffic tracing chain, and the transmission adaptation parameters of the corresponding abnormal service tag in the traffic load control decision library.

[0081] Optionally, the traffic load monitoring and management system filters candidate link service groups based on the filtering rules set in the traffic load control decision library, combined with link load redundancy and abnormal traffic impact. The filtering rules typically set a lower limit for link load redundancy and an upper limit for abnormal traffic impact. Only candidate association pairs that simultaneously meet the conditions of link load redundancy below the lower limit and abnormal traffic impact above the upper limit are selected into the link service group to be controlled, because these association pairs correspond to links with high load pressure and significant abnormal impact, requiring control. After obtaining the link service groups to be controlled, for the second link identifier of each link service pair (i.e., any first link identifier that needs to be considered for migration), the system obtains the traffic transmission requirements (such as bandwidth requirements, transmission latency requirements, etc.) of that link service pair from the abnormal traffic tracing chain, and obtains the transmission adaptation parameters (such as bandwidth requirement values, transmission latency tolerance values, etc.) of the corresponding abnormal service tag from the traffic load control decision library. Then, according to the adaptability coefficient formula... Calculate the adaptability coefficient of the service group to be regulated from the second link identifier to other abnormal links. Among them, The adaptability coefficient for the service group of the link to be adjusted to migrate from the second link identifier to other abnormal links; For link identification; The first link identifier is in the corresponding abnormal time window. Link load redundancy; For traffic load regulation decision base Abnormal business tags Bandwidth requirement: For traffic load regulation decision base Abnormal business tags The transmission delay tolerance value; For traffic load regulation decision base The actual transmission delay value of the middle link identifier. A higher adaptability coefficient indicates better adaptability for migrating the service from the second link identifier to other links.

[0082] In one embodiment, according to the screening rules of the traffic load control decision library, candidate associations with link load redundancy below 0.2 and abnormal traffic impact above 0.5 need to be controlled. Link load redundancy Impact of abnormal traffic Therefore, it was selected into the business group for the links to be regulated; Not met, not selected. The service group awaiting adjustment is... The second link is identified as L001.

[0083] Next, the traffic transmission requirements of this link's service pair are obtained from the abnormal traffic tracing chain: bandwidth requirement approximately... byte Seconds, transmission latency requirement Obtain from the traffic load control decision library Business byte Second, ms; actual transmission delay of the "L001" link Link load redundancy Substitute into the fitness coefficient formula to calculate: .

[0084] Step 504: Based on the maximum value of the abnormal traffic impact, link load redundancy, and adaptability coefficient of the link service group to be regulated, prioritize all link service pairs within the link service group to be regulated to obtain the priority ranking result.

[0085] Optionally, the traffic load monitoring and management system considers three factors for each link service pair within the link service group to be regulated: the impact of abnormal traffic, link load redundancy, and adaptability coefficient. First, it determines the maximum value of the adaptability coefficient, as a higher coefficient indicates better migration feasibility. Then, it constructs a priority evaluation model, comprehensively weighting the impact of abnormal traffic, link load redundancy, and adaptability coefficient to obtain a priority score for each link service pair. A higher priority score indicates that the link service pair requires priority load regulation. Specifically, the priority score calculation highlights link service pairs with high impact of abnormal traffic, low link load redundancy, and high adaptability coefficient. The system sorts all link service pairs within the link service group to be regulated according to their priority scores from highest to lowest, obtaining the priority ranking result.

[0086] Continuing with the above embodiment, the link service group to be regulated contains only one link service pair, "L001-GLB001". Its abnormal traffic impact is 0.85, link load redundancy is 0.115, and adaptability coefficient is approximately 57500.416. A priority evaluation model is constructed, assuming priority score = abnormal traffic impact × 100 + (1 - link load redundancy) × 100 + adaptability coefficient / 1000 (scaling indicators of different magnitudes for easier synthesis). The calculated priority score is: 0.85 × 100 + (1 - 0.115) × 100 + 57500.416 / 1000 ≈ 85 + 88.5 + 57.500416 ≈ 231.000416. Since the link service group to be regulated contains only this one link service pair, the priority ranking result is "L001-GLB001" ranked first.

[0087] Step 505: For the top few link service pairs in the priority ranking result, determine the load control strategy based on the remaining load capacity and adaptability coefficient of each target link in the traffic load control decision library.

[0088] Optionally, the traffic load monitoring and management system determines the load control strategy for the top few link service pairs based on the remaining load capacity and adaptability coefficient of each target link in the traffic load control decision library, as described in steps 5051-5054.

[0089] This invention, through precise abnormal traffic impact assessment, link load redundancy calculation, adaptability coefficient analysis, and priority ranking, can accurately identify link service pairs that need to be regulated. By combining the remaining load capacity and adaptability coefficient of the target link, a targeted load regulation strategy can be formulated to ensure the regulation effect and effectively alleviate network load pressure.

[0090] In one embodiment, steps 5051-5054 are described as follows: Step 5051: The top few link service pairs in the priority ranking result are identified as migration link service pairs. Based on the remaining load capacity of each target link in the traffic load control decision library and the adaptability coefficient of each link service pair in the migration link service pair to the target link, the amount of traffic migration allocated to each migration link service pair to different target links is determined.

[0091] Optionally, the traffic load monitoring and management system first selects several top-ranked link service pairs as migration link service pairs based on priority ranking results. Typically, the top 1-3 link service pairs are selected because these pairs have the greatest impact from abnormal traffic and offer the highest control benefits. Then, the remaining load capacity of each target link (the link capable of handling the migrated traffic) is obtained from the traffic load control decision library; that is, the maximum additional traffic that the target link can currently handle. Simultaneously, the adaptability coefficient calculated in step 503 is invoked. This coefficient reflects the degree of matching between the migration link service pair and the target link. Using the adaptability coefficient as a weight, combined with the remaining load capacity of the target link, the amount of traffic migrated from each migration link service pair to different target links is calculated. The allocation principle is: the higher the adaptability coefficient of the target link, the more migration traffic is allocated, but it cannot exceed its remaining load capacity. Ultimately, this ensures that the total abnormal traffic of the migration link service pairs is reasonably distributed across multiple target links, achieving load balancing.

[0092] Continuing with the above embodiment, in the priority ranking results, "L001-GLB001" is the first-ranked link service pair and is identified as the migrated link service pair, with a total abnormal traffic of 1.8 × 10⁻⁶. 6Bytes. Obtain target link information from the traffic load control decision library: Target link L003: Remaining load capacity 1.2 × 10^6 bytes. 6 Bytes, adaptability coefficient 57500.416; Target link L004: Remaining load capacity 8×10 5 The byte size has an adaptation coefficient of 42300.289. Therefore, when calculating the adaptation coefficient weights, the weight of L003 is approximately 57500.416 / (57500.416 + 42300.289) ≈ 0.576; the weight of L004 is approximately 42300.289 / (57500.416 + 42300.289) ≈ 0.424. Thus, the theoretical allocation is: Theoretical allocation for L003 = 1.8 × 10^6 bytes. 6 ×0.576≈1.037×10 6 bytes (not exceeding its remaining capacity of 1.2 × 10^6 bytes) 6 (Bytes, valid); L004 theoretical allocation = 1.8 × 10^6 6 ×0.424≈7.63×10 5 bytes (not exceeding 8 × 10 of its remaining capacity) 5 (Bytes, valid), final traffic migration amount determined: 1.037 × 10^6 bytes migrated to L003. 6 Bytes; Migrating 7.63 × 10 to L004 5 byte.

[0093] Step 5052: For each link service pair in the migration link service pair, based on the total amount of traffic migration from the link service pair to each target link, combined with the bandwidth occupancy rate of the third link identifier of the link service pair before migration in the abnormal traffic tracing chain and the bandwidth adjustment coefficient of the third link identifier in the traffic load control decision library, determine the bandwidth adjustment range of the third link identifier.

[0094] Optionally, the traffic load monitoring and management system calculates the total traffic migration amount to all target links for each migrated link service pair (i.e., the total traffic migrated out of the original link). It extracts the bandwidth occupancy rate of the third link identifier (original link identifier) ​​of the link service pair before migration from the abnormal traffic tracing chain, i.e., the proportion of the original link's currently used bandwidth to the total bandwidth. It obtains the bandwidth adjustment coefficient of the third link identifier from the traffic load control decision library. This coefficient is set according to the link type, the characteristics of the carried services, etc. (e.g., the adjustment coefficient for core links is lower to avoid excessive speed reduction affecting basic communication), and its value range is (e.g., 0-1). The bandwidth adjustment magnitude is calculated using the formula: Bandwidth Adjustment Magnitude = (Total Traffic Migration Amount / Total Bandwidth of Original Link) × Bandwidth Adjustment Coefficient × (1 - Bandwidth Occupancy Rate Before Migration). This ensures that the adjustment magnitude is proportional to the migrated traffic, while also considering the current load status of the link and a safe adjustment range to avoid excessive adjustment magnitude leading to link oscillation.

[0095] Continuing with the above embodiment, the third link identifier for the migration link service "L001-GLB001" is L001, and the total traffic migration amount to the target link is 1.8 × 10⁻⁶. 6 Bytes (1.037×10) 6 +7.63×10 5 From the abnormal traffic tracing chain, we obtained that the total bandwidth of L001 is 10×10. 6 bytes / second, bandwidth utilization rate before migration was 80% (8×10 6 (Bytes / second). From the traffic load control decision library: L001 is the core link, and the bandwidth adjustment coefficient is 0.8. Therefore, when calculating the bandwidth adjustment magnitude: Bandwidth adjustment magnitude = (1.8 × 10^6)^6 6 / 10×10 6 )×0.8×(1-80%)=0.18×0.8×0.2=0.0288 (i.e. 2.88%). This means the bandwidth of L001 needs to be reduced by 2.88%, from the original 80% utilization rate to 77.12%.

[0096] Step 5053: Based on the traffic migration amount of each link service pair in the migration link service pair and the bandwidth adjustment magnitude of the corresponding third link identifier, combined with the transmission path topology parameters of each link in the traffic load control decision library, optimize the service transmission path of each link service pair in the migration link service pair to obtain the optimal transmission path of each link service pair; the transmission path topology parameters reflect the tightness of the connection between the link and the service.

[0097] Optionally, the traffic load monitoring and management system obtains transmission path topology parameters from the traffic load control decision library, including link connectivity matrix (indicating whether links are directly connected), link-service affinity (higher values ​​indicate stronger compatibility between the link and the service), and node forwarding delay coefficient. These parameters quantify the tightness of the connection between the link and the service. A path optimization model is constructed by combining the traffic migration amount of the migrated link service pair (determining the traffic scale carried by the path) and the bandwidth adjustment magnitude of the third link identifier (reflecting the load change of the original link). The model aims at "minimizing total transmission delay" and "balancing link load," and selects the optimal transmission path by calculating the comprehensive cost of each candidate path (including forwarding delay, link load rate, and affinity matching degree). During the optimization process, it prioritizes link combinations with high service affinity, low current load, and low node forwarding delay, while ensuring that the total path bandwidth can meet the migration traffic requirements and avoiding bottleneck segments of the original link after bandwidth adjustment.

[0098] Continuing with the above embodiments, the migration from "L001-GLB001" to L003 is 1.037 × 10 6The data transmission path topology parameters for each byte are as follows: Link-service affinity: L003 has an affinity of 0.9 with GLB001 (high affinity), and L005 has an affinity of 0.6 with GLB001 (medium affinity); Link load rate: L003 is currently at 30%, and L005 is currently at 45%; Node forwarding latency coefficient: Node B → Node E is 0.1ms / 10 6 The time from node E to node D is 0.08ms / 10 bytes. 6 Bytes. Candidate paths: 1. Original path: L001 (node ​​A→B→C→D) → L003 (node ​​C→E→D) (a bottleneck exists due to bandwidth adjustment of L001); 2. New path 1: node A→B→E→D (via a branch link of L003); 3. New path 2: node A→F→E→D (via L005). Calculate the overall cost (latency + load penalty): Total latency of new path 1 = 1.037 × 10 6 Bytes × (0.1 + 0.08) ms / 10 6 Byte ≈ 0.186ms, load penalty = 30% × 0.1 = 0.03, total cost ≈ 0.216; total latency of new path 2 = 1.037 × 10 6 Bytes × (0.12 + 0.08) ms / 10 6 Byte ≈ 0.207ms, load penalty = 45% × 0.1 = 0.045, total cost ≈ 0.252. The optimal transmission path is determined to be new path 1 (node ​​A→B→E→D), which has lower overall cost and higher affinity matching.

[0099] Step 5054: Based on the priority ranking results, the traffic migration amount of the migration link service pair, the bandwidth adjustment range of the third link identifier, and the optimal transmission path of each link service pair, and combined with the preset control policy effective conditions in the traffic load control decision library, generate a load control policy for the migration link service pair.

[0100] Optionally, the traffic load monitoring and management system integrates priority ranking results (determining the control order), traffic migration amount (clarifying the migration scale), bandwidth adjustment range (developing link parameter modification schemes), and optimal transmission path (planning traffic forwarding routes) as the core elements of the load control strategy. It retrieves preset control strategy activation conditions from the traffic load control decision library, including: time conditions: avoiding peak business periods (e.g., the power system's morning peak of 8:00-10:00); status conditions: the target link's current load rate < 70%, and the migration path node's CPU utilization rate < 60%; and safety conditions: core service interruption time < 50ms, and data retransmission rate < 0.1%. The system verifies whether the core elements meet the activation conditions. If so, it generates a specific load control strategy, including: the control execution time window, traffic allocation instructions for each target link, bandwidth adjustment parameters for the original link, routing configuration commands for the new transmission path, and post-control verification indicators (such as latency and integrity requirements).

[0101] Continuing with the above embodiment, the control elements based on "L001-GLB001" are: Priority: 1 (highest); Traffic migration amount: L003 receives 1.037 × 10 6 Bytes, L004 receives 7.63 × 10 5 Bytes; Bandwidth adjustment range: L001 reduced by 2.88%; Optimal transmission path: L003 direction is A→B→E→D, L004 direction is A→B→F→D. Effective conditions for the traffic load control decision base: Current time 10:35 (off-peak period), L003 load rate 30% < 70%, L004 load rate 25% < 70%, CPU utilization of nodes B, E, and F are all < 50%. Then, the load control strategy is generated: Execution time: 10:40:00-10:40:10 (10-second window); Traffic allocation: Send 1.037 × 10 to L003. 6 7.63 × 10 bytes of traffic from GLB001 were sent to L004. 5 The bandwidth of GLB001 is adjusted to: increase the bandwidth limit of L001 from 10×10 bytes. 6 The bytes / second has been adjusted to 9.712 × 10 6 Bytes / second; Routing configuration: Add a static route on node B to distribute GLB001 service traffic proportionally to E (60%) and F (40%); Verification indicators: Within 5 minutes after adjustment, L001 load rate must be ≤77.12%; New path transmission delay ≤0.3ms; Data integrity ≥99.99%.

[0102] The embodiments of the present invention reduce the load rate of the original abnormal links, improve the overall load balance of the network, avoid local link overload, and meet the high requirements of the power system for real-time performance and reliability through precise traffic allocation, bandwidth adjustment, path optimization and condition verification.

[0103] Furthermore, the flow load monitoring and management system for power communication networks provided by the present invention will be described below. The flow load monitoring and management system for power communication networks described below can be referred to in correspondence with the flow load monitoring and management method for power communication networks described above.

[0104] Optional, refer to Figure 2 , Figure 2 This is a schematic diagram of the flow load monitoring and management system for power communication networks provided by the present invention. The flow load monitoring and management system for power communication networks includes: The DPI initial parsing module 210 is used to perform initial multi-layer parsing on the collected traffic data packets based on the DPI probe to obtain the initial parsing data of the traffic. The feature processing module 220 is used to perform windowing processing on the initial parsed traffic data based on the time sliding window, to obtain the traffic load index and service load index corresponding to each time sliding window, and to associate the traffic load index and service load index to form structured traffic feature data indexed by time window, link identifier and service tag. The anomaly detection module 230 is used to input structured traffic feature data into the anomaly detection model and obtain the anomaly identification results output by the anomaly detection model. The DPI deep tracing module 240 is used to perform secondary analysis on the original abnormal data packets extracted from the traffic data packets based on the anomaly identification results, and associate the secondary analysis results with the initial analysis data of the traffic to construct an abnormal traffic tracing chain. The control decision library construction module 250 is used to determine the load control strategy based on the abnormal traffic tracing chain and the pre-built traffic load control decision library.

[0105] This invention utilizes a DPI probe to perform initial multi-layer parsing of collected traffic data packets and combines this with time-sliding window processing to obtain traffic load and service load indicators for each time window, which are then correlated to form structured traffic feature data. This overcomes the limitations of traditional fixed-threshold periodic sampling due to long sampling intervals, accurately capturing frequent bursts of traffic in power communication networks and effectively avoiding missed or false detections. Furthermore, by using link identifiers and service tags for indexing, it clearly distinguishes the service type and source of overloaded traffic, overcoming the shortcomings of traditional methods that can only determine whether there is an overload but cannot clearly define the specific attributes of the overloaded traffic. In addition, based on an anomaly detection model, the structured traffic... This method uses quantitative feature data for anomaly identification, extracts original abnormal data packets based on the anomaly identification results for secondary parsing, and associates them with the initial parsed data to construct an abnormal traffic tracing chain. This overcomes the shortcomings of traditional DPI methods, which lack real-time analysis capabilities for dynamic traffic features. It can not only identify the links or devices where network load anomalies occur, but also accurately trace the specific initiating node of abnormal traffic and the corresponding business process. Combined with a pre-built traffic load control decision library, it determines the load control strategy, solving the problem that existing methods require maintenance personnel to spend a long time troubleshooting the root cause of faults. This significantly improves the fault recovery efficiency of power communication networks and eliminates the potential risks to the safe and stable operation of the power grid caused by excessively long fault troubleshooting time.

[0106] Please see Figure 3 , Figure 3 An embodiment diagram of an electronic device provided in accordance with the present invention. For example... Figure 3 As shown, this embodiment of the invention provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, it performs the following steps: The initial multi-layer parsing of the collected traffic data packets is performed based on the DPI probe to obtain the initial parsed traffic data. The initial traffic parsing data is processed by windowing based on time sliding windows to obtain the traffic load index and service load index corresponding to each time sliding window. The traffic load index and service load index are then correlated to form structured traffic feature data indexed by time window, link identifier and service tag. The structured traffic feature data is input into the anomaly detection model to obtain the anomaly identification results output by the anomaly detection model. Based on the anomaly identification results, the original abnormal data packets extracted from the traffic data packets are parsed a second time, and the results of the second parsing are associated with the initial parsing data of the traffic to construct an abnormal traffic tracing chain. Based on the abnormal traffic tracing chain and the pre-built traffic load control decision library, the load control strategy is determined.

[0107] Please see Figure 4 , Figure 4 An embodiment diagram of a computer-readable storage medium provided in accordance with an embodiment of the present invention is shown. Figure 4 As shown, this embodiment provides a computer-readable storage medium 400 on which a computer program 311 is stored. When the computer program 311 is executed by a processor, it performs the following steps: The initial multi-layer parsing of the collected traffic data packets is performed based on the DPI probe to obtain the initial parsed traffic data. The initial traffic parsing data is processed by windowing based on time sliding windows to obtain the traffic load index and service load index corresponding to each time sliding window. The traffic load index and service load index are then correlated to form structured traffic feature data indexed by time window, link identifier and service tag. The structured traffic feature data is input into the anomaly detection model to obtain the anomaly identification results output by the anomaly detection model. Based on the anomaly identification results, the original abnormal data packets extracted from the traffic data packets are parsed a second time, and the results of the second parsing are associated with the initial parsing data of the traffic to construct an abnormal traffic tracing chain. Based on the abnormal traffic tracing chain and the pre-built traffic load control decision library, the load control strategy is determined.

[0108] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the flow load monitoring and management method for power communication networks provided by the above methods, the method comprising: The initial multi-layer parsing of the collected traffic data packets is performed based on the DPI probe to obtain the initial parsed traffic data. The initial traffic parsing data is processed by windowing based on time sliding windows to obtain the traffic load index and service load index corresponding to each time sliding window. The traffic load index and service load index are then correlated to form structured traffic feature data indexed by time window, link identifier and service tag. The structured traffic feature data is input into the anomaly detection model to obtain the anomaly identification results output by the anomaly detection model. Based on the anomaly identification results, the original abnormal data packets extracted from the traffic data packets are parsed a second time, and the results of the second parsing are associated with the initial parsing data of the traffic to construct an abnormal traffic tracing chain. Based on the abnormal traffic tracing chain and the pre-built traffic load control decision library, the load control strategy is determined.

[0109] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0110] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0111] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring and managing traffic load in power communication networks, characterized in that, include: The initial multi-layer parsing of the collected traffic data packets is performed based on the DPI probe to obtain the initial parsed traffic data. The initial parsed traffic data is processed by windowing based on time sliding windows to obtain traffic load indicators and service load indicators corresponding to each time sliding window. The traffic load indicators and service load indicators are then associated to form structured traffic feature data indexed by time window, link identifier, and service tag. The structured traffic feature data is input into the anomaly detection model to obtain the anomaly identification result output by the anomaly detection model. Based on the anomaly identification results, the original abnormal data packets extracted from the traffic data packets are parsed a second time, and the second parsing results are associated with the initial parsing data of the traffic to construct an abnormal traffic tracing chain; Based on the abnormal traffic tracing chain and the pre-built traffic load control decision library, a load control strategy is determined.

2. The method for monitoring and managing traffic load in power communication networks according to claim 1, characterized in that, The determination of load control strategies based on the abnormal traffic tracing chain and a pre-built traffic load control decision library includes: Based on the abnormal traffic tracing chain, abnormal link identifiers and abnormal service tags are extracted to find the association pairs of abnormal traffic, resulting in candidate link service groups. Each candidate association pair in the candidate link service group is evaluated based on the traffic load control decision library to obtain the abnormal traffic impact degree of each candidate association pair in the abnormal time window. For the first link identifier of each candidate association pair in the candidate link service group, the link load redundancy of the first link identifier in the corresponding abnormal time window is determined based on the abnormal traffic impact degree, the actual load of the first link identifier in the abnormal traffic tracing chain in the abnormal time window, and the maximum load threshold of the first link identifier in the traffic load control decision library. Based on the traffic load control decision base, the link load redundancy, and the abnormal traffic impact, the candidate link service groups are screened to obtain the link service groups to be controlled. For the second link identifier of each link service pair in the link service group to be controlled, the adaptability coefficient of the link service group to be controlled from the second link identifier to other abnormal links is determined based on the link load redundancy, the traffic transmission requirements of the link service pair in the abnormal traffic tracing chain, and the transmission adaptation parameters of the corresponding abnormal service tag in the traffic load control decision base. Based on the link service group to be regulated, combined with the impact of abnormal traffic, the link load redundancy and the maximum value of the adaptability coefficient, all link service pairs in the link service group to be regulated are prioritized to obtain the priority ranking result. For the top few link service pairs in the priority ranking result, the load control strategy is determined based on the remaining load capacity of each target link in the traffic load control decision library and the adaptability coefficient.

3. The method for monitoring and managing traffic load in power communication networks according to claim 2, characterized in that, The method for determining the load control strategy for the top few link service pairs based on the priority ranking result, based on the remaining load capacity of each target link in the traffic load control decision library and the adaptability coefficient, includes: The top few link service pairs in the priority ranking result are determined as migration link service pairs. Based on the remaining load capacity of each target link in the traffic load control decision library and the adaptability coefficient of each link service pair in the migration link service pair to the target link, the amount of traffic migration allocated to each migration link service pair to different target links is determined. For each link service pair in the migration link service pair, based on the total traffic migration amount of the link service pair to each target link, combined with the bandwidth occupancy rate of the third link identifier of the link service pair before migration in the abnormal traffic tracing chain and the bandwidth adjustment coefficient of the third link identifier in the traffic load control decision library, the bandwidth adjustment range of the third link identifier is determined. Based on the traffic migration amount of each link service pair in the migration link service pair and the bandwidth adjustment range of the corresponding third link identifier, combined with the transmission path topology parameters of each link in the traffic load control decision library, the service transmission path of each link service pair in the migration link service pair is optimized to obtain the optimal transmission path of each link service pair; the transmission path topology parameters reflect the tightness of the connection between the link and the service. Based on the priority ranking results, the traffic migration amount of the migration link service pair, the bandwidth adjustment range of the third link identifier, and the optimal transmission path of each link service pair, combined with the preset control strategy activation conditions in the traffic load control decision library, the load control strategy for the migration link service pair is generated.

4. The method for monitoring and managing traffic load in power communication networks according to claim 2, characterized in that, The formula for the adaptability coefficient is: ； in, The adaptability coefficient for the service group of the link to be adjusted to migrate from the second link identifier to other abnormal links; The first link identifier is in the corresponding abnormal time window. Link load redundancy; For traffic load regulation decision base Abnormal business tags Bandwidth requirement: For traffic load regulation decision base Abnormal business tags The transmission delay tolerance value; For traffic load regulation decision base The actual transmission delay value of the mid-link identifier.

5. The method for monitoring and managing traffic load in power communication networks according to claim 1, characterized in that, The anomaly identification results include anomaly link identifier, anomaly time window, and anomaly service label; The process of performing secondary parsing on the original abnormal data packets extracted from the traffic data packets based on the anomaly identification results, and associating the secondary parsing results with the initial traffic parsing data to construct an abnormal traffic tracing chain includes: Based on the abnormal link identifier, the abnormal time window, and the abnormal service label, extract all original data packets with the abnormal service label corresponding to the abnormal link and within the abnormal time window from the traffic data packet to obtain the original abnormal data packet; Based on the original abnormal data packet, the core field range of the secondary parsing is determined, and the abnormal features in the abnormal identification result are extracted based on the core field range to generate a secondary parsing strategy; the secondary parsing strategy includes field parsing order, field value matching conditions, and abnormal feature association logic; The original abnormal data packet is parsed a second time based on the aforementioned secondary parsing strategy to obtain the secondary parsing result; Based on the secondary parsing results and the initial traffic parsing data, the same related key fields are extracted to obtain the related key field group; Based on the aforementioned key field group, the secondary parsing results and the initial traffic parsing data are correlated and fused to construct the abnormal traffic tracing chain.

6. The method for monitoring and managing traffic load in power communication networks according to claim 5, characterized in that, The step of associating and fusing the secondary parsing results and the initial traffic parsing data based on the associated key field group to construct the abnormal traffic tracing chain includes: Based on the associated key field group, the secondary parsing result and the initial traffic parsing data are associated and fused to obtain a fused data group; Based on the fused data set, the propagation path characteristics of abnormal traffic in the power communication network are extracted, and a propagation path characteristic set is constructed. Based on the propagation path feature group, the influence of each node in the abnormal traffic propagation process is determined, and the nodes are prioritized based on the influence to obtain the node source tracing priority ranking result. Based on the node tracing priority ranking result and the fused data group, the abnormal traffic tracing chain is constructed; the abnormal traffic tracing chain includes node connection relationships, data transmission timing, and abnormal feature association information.

7. The method for monitoring and managing traffic load in power communication networks according to claim 6, characterized in that, The formula for the influence of the node in the abnormal traffic propagation process is: ； in, Represents a node The degree of influence of the nodes; Represents a node The number of times abnormal data was forwarded; Represents a node The duration of the link transmission involved; This represents the set of node identifiers in the abnormal traffic propagation path.

8. A flow load monitoring and management system for power communication networks, characterized in that, The method for monitoring and managing traffic load in power communication networks as described in any one of claims 1 to 7; The traffic load monitoring and management system for power communication networks includes: The DPI initial parsing module is used to perform initial multi-layer parsing on the collected traffic data packets based on the DPI probe to obtain the initial parsing data of the traffic. The feature processing module is used to perform windowing processing on the initial parsed traffic data based on a time sliding window, to obtain the traffic load index and service load index corresponding to each time sliding window, and to associate the traffic load index and the service load index to form structured traffic feature data indexed by time window, link identifier and service tag. An anomaly detection module is used to input the structured traffic feature data into the anomaly detection model and obtain the anomaly identification result output by the anomaly detection model. The DPI deep source tracing module is used to perform secondary analysis on the original abnormal data packets extracted from the traffic data packets based on the anomaly identification results, and associate the secondary analysis results with the initial analysis data of the traffic to construct an abnormal traffic source tracing chain. The load control decision library construction module is used to determine the load control strategy based on the abnormal traffic tracing chain and the pre-built traffic load control decision library.

9. An electronic device, characterized in that, include: Memory, used to store computer software programs; A processor is configured to read and execute the computer software program, wherein when the processor executes the computer software program, it implements the flow load monitoring and management method for power communication networks as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer software program, which, when executed by a processor, implements the flow load monitoring and management method for power communication networks as described in any one of claims 1 to 7.

Images