A Method and System for Mapping Secondary Equipment in Substations Based on Intelligent Variable Speed ​​Active Detection

Abstract

This invention relates to the field of network asset mapping technology, and particularly to a method and system for mapping secondary equipment in substations based on intelligent variable-speed active detection. The method includes: collecting feature information of secondary equipment in the substation network space; fusing and processing the feature information to construct an asset topology model including multiple equipment nodes; constructing an asset mapping architecture for the substation network space based on the asset topology model and preset network space mapping parameters; performing in-depth asset analysis on the asset topology model based on the asset mapping architecture to obtain an updated asset topology model; planning the optimal detection path in the updated asset topology model based on an intelligent variable-speed active detection algorithm and executing the active detection scheme; dynamically adjusting the active detection scheme based on real-time response data and executing active detection again. This invention improves the completeness and systematic nature of the mapping results, achieving high-coverage, high-precision, and low-interference asset mapping.

Description

Technical Field

[0001] This invention relates to the field of network asset mapping technology, and in particular to a method and system for mapping secondary equipment in substations based on intelligent variable speed active detection. Background Technology

[0002] With the rapid development of smart grids, substations, as key hubs connecting power generation and consumption, are facing increasingly complex network environments. During the digital and intelligent transformation of traditional substations, the number of assets such as industrial control equipment, IoT terminals, and security devices has surged, blurring network boundaries and significantly reducing asset visibility. This change makes substations a prime target for cyberattacks, leading to frequent threats such as ransomware and supply chain attacks. The long-term existence of hidden and botnet assets further amplifies security risks. Outdated asset status can create defensive vulnerabilities, allowing attackers to penetrate the entire business system through a single vulnerability. Against this backdrop, cyberspace asset mapping has become fundamental to building a proactive defense system.

[0003] Existing cyberspace asset mapping technologies suffer from three main problems: First, low detection efficiency, lack of overall architecture modeling capability for asset topology, and fixed-frequency detection is prone to causing business interference or incomplete coverage; second, insufficient identification accuracy, with fixed detection schemes, insufficient accuracy in multimodal asset feature identification, and incomplete support for power-specific protocols; and third, unstable network resource consumption, with active detection causing interference to business networks and low resource utilization. Summary of the Invention

[0004] Based on the above analysis, the embodiments of the present invention aim to provide a method and system for mapping secondary equipment in substations based on intelligent variable speed active detection, in order to solve the problems of low detection efficiency, insufficient identification accuracy, and unstable network resource consumption in the existing technology.

[0005] On one hand, embodiments of the present invention provide a method for mapping secondary equipment in substations based on intelligent variable speed active detection, including:

[0006] Collect feature information of secondary equipment in the substation network space, perform fusion processing on the feature information of the secondary equipment, and construct an asset topology model including multiple equipment nodes;

[0007] Based on the asset topology model and the preset network space mapping parameters, an asset mapping architecture for the substation network space is constructed.

[0008] Based on the asset mapping architecture, the asset topology model is subjected to in-depth asset analysis to obtain an updated asset topology model.

[0009] Based on the intelligent variable-speed active detection algorithm, the optimal detection path is planned in the updated asset topology model, and the active detection scheme is executed in the substation network space according to the optimal detection path; the active detection scheme is dynamically adjusted based on the real-time response data fed back by each secondary device during the detection process, and active detection is executed again.

[0010] Furthermore, the secondary equipment feature information includes at least: basic equipment information and operating status information;

[0011] The basic device information includes at least: device name, IP address, MAC address, device category, device type, device model, software version, hardware version, serial number, manufacturer, and installation location;

[0012] The operating status information includes at least: health status, operating voltage, device temperature, storage utilization, CPU utilization, transmit / receive power, alarm information, and network load.

[0013] Furthermore, the process of fusing the feature information of the secondary equipment and constructing an asset topology model including multiple equipment nodes includes:

[0014] The basic equipment information and the operational status information are linked and integrated to form network asset fusion information corresponding to each equipment entity;

[0015] Each of the aforementioned device entities is mapped to a device node in the asset topology model, and the network asset fusion information is used as the node information of the corresponding device node.

[0016] Furthermore, constructing the asset topology model also includes:

[0017] The importance of each device node is evaluated, wherein the evaluation includes calculating the degree centrality and betweenness centrality of each device node.

[0018] Based on the degree centrality and the betweenness centrality, the importance score of each device node is calculated, and the core nodes and edge nodes of the asset topology model are marked based on the importance score.

[0019] Furthermore, the formula for calculating the degree centrality includes:

[0020] ;

[0021] in, Indicates the degree centrality of node v; N represents the degree of node v; N represents the total number of nodes.

[0022] The formula for calculating betweenness centrality includes:

[0023] ;

[0024] in, Indicates the betweenness centrality of node v; This represents the number of shortest paths from node s to node t; This represents the number of shortest paths passing through node v.

[0025] Furthermore, the step of constructing the asset mapping architecture of the substation network space based on the asset topology model and preset network space mapping parameter information includes:

[0026] Based on the preset network space mapping parameter information, an asset depth analysis strategy is defined for the asset mapping architecture;

[0027] Based on the asset topology model, the detection targets and range of the asset mapping architecture are determined.

[0028] Furthermore, the asset mapping architecture includes at least:

[0029] Pre-configured topology association analysis module and multimodal feature matching module;

[0030] The topology association analysis module is used to perform topology association analysis on the asset topology model;

[0031] The multimodal feature matching module is used to perform multimodal feature matching on the asset topology model.

[0032] Furthermore, the step of performing deep asset analysis on the asset topology model based on the asset mapping architecture to obtain an updated asset topology model includes:

[0033] Based on the topology association analysis module, topology association analysis is performed on each device node of the asset topology model, and the association relationship of each device node in the asset topology model is updated.

[0034] Based on the multimodal feature matching module and combined with the preset feature library, multimodal feature matching is performed on the network asset fusion information of each device node to identify the asset attributes corresponding to each device node in the asset topology model.

[0035] Based on the updated association relationships of each device node and the identified asset attributes of each device node, the updated asset topology model is obtained.

[0036] Furthermore, the calculation formula for the topological association analysis includes:

[0037] ;

[0038] in, This indicates the strength of the association between node i and node j; This represents the communication frequency between node i and node j. This represents the maximum communication frequency between all device nodes; This represents the distance between node i and node j in terms of hop count.

[0039] Furthermore, the calculation formula for the multimodal feature matching includes:

[0040] ;

[0041] in, The value represents the cosine of vector A and vector B; A represents the asset feature vector extracted from the network asset fusion information of the device node; B represents the template feature vector in the preset feature library. Describes the component vectors of vector A. d represents a subvector of vector B; d represents the total dimension of the vector; k represents the dimension index.

[0042] Furthermore, the method of planning an optimal detection path in the updated asset topology model based on the intelligent variable-speed active detection algorithm, and executing an active detection scheme in the substation network space according to the optimal detection path, includes:

[0043] Based on the intelligent variable speed active detection algorithm, an active detection scheme is dynamically generated according to the updated asset topology model and the real-time collected network load monitoring data.

[0044] Based on Dijkstra's shortest path algorithm, an optimal detection path is planned for the updated asset topology model, and the active detection scheme is executed in the substation network space according to the optimal detection path.

[0045] Furthermore, the active detection scheme includes at least a detection cycle for performing active detection; the calculation formula for the detection cycle includes:

[0046] ;

[0047] in, This indicates the detection period of node v; Indicates the reference detection period; This represents the importance score of node v in the updated asset topology model; Indicates the maximum load threshold; L represents the current network load rate; This represents the adjustment coefficient.

[0048] Furthermore, the dynamic adjustment of the active detection scheme based on the real-time response data fed back by each secondary device during the detection process, and the execution of active detection again, includes:

[0049] During the detection process, detection messages are sent to each secondary device in the substation network space based on the optimal detection path.

[0050] Obtain real-time response data from each secondary device; dynamically adjust the active detection scheme based on the real-time response data, and perform active detection again in the substation network space.

[0051] Furthermore, the dynamically adjusted active detection scheme includes at least: a first detection scheme and a second detection scheme;

[0052] The first detection scheme includes: extending the detection period and performing low-frequency survival detection;

[0053] The second detection scheme includes: shortening the detection cycle and performing high-frequency depth detection.

[0054] Furthermore, the re-performance of active detection includes:

[0055] If a high load is detected in the secondary equipment, the first detection scheme is executed in the substation network space;

[0056] Otherwise, the second detection scheme is executed in the substation network space; wherein, the secondary device is the actual device corresponding to the device node in the substation network space.

[0057] Furthermore, the method also includes:

[0058] When a numerical jump is detected in the real-time response data fed back by the secondary device, the jump value is smoothed while maintaining the active detection scheme unchanged; the smoothing formula includes:

[0059] ;

[0060] in, This represents the smoothed state value for the current period t; This represents the actual observed value for the current period t. It is a smoothing factor; Indicates the previous cycle The smooth state value.

[0061] On the other hand, embodiments of the present invention provide a substation secondary equipment mapping system based on intelligent variable speed active detection, comprising:

[0062] The first construction module is used to collect the feature information of secondary equipment in the substation network space, perform fusion processing on the feature information of the secondary equipment, and construct an asset topology model including multiple equipment nodes.

[0063] The second construction module is used to construct the asset mapping architecture of the substation network space based on the asset topology model and the preset network space mapping parameter information.

[0064] The deep analysis module is used to perform deep analysis of the asset topology model based on the asset mapping architecture, and obtain an updated asset topology model.

[0065] The detection execution module is used to plan the optimal detection path in the updated asset topology model based on the intelligent variable speed active detection algorithm, and execute the active detection scheme in the substation network space according to the optimal detection path; dynamically adjust the active detection scheme based on the real-time response data fed back by each secondary device during the detection process, and execute the active detection again.

[0066] Furthermore, the secondary equipment feature information includes at least: basic equipment information and operating status information;

[0067] The basic device information includes at least: device name, IP address, MAC address, device category, device type, device model, software version, hardware version, serial number, manufacturer, and installation location;

[0068] The operating status information includes at least: health status, operating voltage, device temperature, storage utilization, CPU utilization, transmit / receive power, alarm information, and network load.

[0069] Furthermore, the first construction module is also used to associate and integrate the basic device information and the operating status information to form network asset fusion information corresponding to each device entity;

[0070] Each of the aforementioned device entities is mapped to a device node in the asset topology model, and the network asset fusion information is used as the node information of the corresponding device node.

[0071] Furthermore, the asset mapping architecture includes at least: a pre-configured topology association analysis module and a multimodal feature matching module;

[0072] Based on the topology association analysis module, topology association analysis is performed on each device node of the asset topology model, and the association relationship of each device node in the asset topology model is updated.

[0073] Based on the multimodal feature matching module and combined with the preset feature library, multimodal feature matching is performed on the network asset fusion information of each device node to identify the asset attributes corresponding to each device node in the asset topology model.

[0074] Based on the updated association relationships of each device node and the identified asset attributes of each device node, the updated asset topology model is obtained.

[0075] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0076] First, unlike related technologies which lack comprehensiveness in surveying, this invention breaks through the limitations of traditional local surveying by constructing an asset topology model and asset surveying architecture for the substation network space. It can quantify the dynamic business relationships between assets, fully grasp the correlation and global distribution between assets, and improve the completeness and systematicness of the surveying results.

[0077] Secondly, unlike related technologies which suffer from insufficient mapping accuracy, this invention performs topological association analysis on each device node in the asset topology model to obtain information on associated nodes in the topology structure. Furthermore, by combining this with a pre-defined feature library to perform multimodal feature matching on the network asset fusion information of each device node, it can accurately identify information such as device type, software version, operating status, and configuration parameters of various assets. This not only improves the identification accuracy of individual assets but also clarifies the role and influence of assets within the model topology structure, thus improving asset profiling and providing more comprehensive decision support for power system security risk assessment and emergency response.

[0078] Third, unlike related technologies where network resource consumption is unstable and detection parameters cannot be adjusted in real time, this invention plans the optimal detection path and executes the active detection scheme based on an intelligent variable-speed active detection algorithm. This not only prioritizes coverage of key nodes and core links in the asset topology model, but also dynamically adjusts the active detection scheme based on real-time response data from secondary devices during the detection process. This achieves on-demand detection, ensuring high coverage monitoring of core assets while reducing resource consumption of non-critical assets, effectively reducing interference to the normal business network environment, and truly achieving the technical goals of high coverage, high precision, and low interference.

[0079] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0080] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0081] Figure 1 This is a flowchart of a substation secondary equipment surveying method based on intelligent variable speed active detection, according to an embodiment of the present invention.

[0082] Figure 2 This is a schematic diagram of the asset topology model according to an embodiment of the present invention;

[0083] Figure 3 This is a functional architecture diagram of the asset surveying process according to an embodiment of the present invention;

[0084] Figure 4 This is a schematic diagram of the main modules of the substation secondary equipment mapping system based on intelligent variable speed active detection according to an embodiment of the present invention. Detailed Implementation

[0085] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0086] A specific embodiment of the present invention discloses a method for surveying and mapping secondary equipment in substations based on intelligent variable speed active detection, such as... Figure 1 As shown, the steps S1 to S4 are as follows:

[0087] Step S1: Collect the feature information of secondary equipment in the substation network space, perform fusion processing on the feature information of the secondary equipment, and construct an asset topology model including multiple equipment nodes.

[0088] The substation network space in this embodiment of the invention refers to the real physical network environment composed of physical network devices and industrial control devices based on communication connections, that is, the physical network in the production control area and management information area.

[0089] The substation network space includes substation secondary equipment, which is the general term for the equipment that constitutes the substation secondary system. Specifically, it is divided into computer equipment, network equipment, and security equipment.

[0090] Secondary equipment is mainly auxiliary equipment used for monitoring, measuring, controlling, regulating and protecting primary equipment. It is not directly connected to the main power circuit and has the characteristic of not directly participating in power transmission.

[0091] For example, substation secondary equipment includes at least: data communication gateway, alarm graphics gateway, PMU concentrator (PMU refers to power management unit), power acquisition device, fault recording device, information protection substation, monitoring backend, five-proof host, integrated application server, workstation, network analyzer, switch, firewall and isolation device, etc.

[0092] In this embodiment of the invention, assets refer to objects in the substation secondary system that need to be detected and identified by the network, including but not limited to various physical devices (such as relay protection devices, measurement and control units, communication gateways, etc.), as well as the services running on these devices, open ports, and protocols used.

[0093] In the context of this invention, assets specifically correspond to secondary equipment in the substation network space, and equipment nodes are also asset nodes; collecting characteristic information of various secondary equipment in the substation network space aims to achieve accurate identification and dynamic mapping of secondary equipment.

[0094] Preferably, the secondary equipment feature information includes at least: basic equipment information and operating status information.

[0095] Basic equipment information, also known as static basic information of secondary equipment, includes at least: asset name, IP address (Internet Protocol address), MAC address (Media Access Control address), asset classification, asset type, asset model, software version, hardware version, factory serial number, manufacturer, and installation location.

[0096] Operating status information, also known as dynamic operating information of secondary equipment, includes at least: health status, operating voltage, device temperature, storage utilization, CPU utilization (central processing unit utilization), transmit and receive power, alarm information, and network load.

[0097] During implementation, the characteristic information of the aforementioned secondary equipment can be directly collected from the power monitoring system, and supplemented by manual input and asset detection technologies.

[0098] It is understandable that asset detection technologies mainly include IP activity detection, port openness detection, service scanning, asset fingerprinting, and traffic capture and analysis.

[0099] The core objective of IP activity detection is to determine whether a specific IP address in the network is active. This can be achieved by using technologies such as ICMP (Internet Control Message Protocol), fping (a fast ping tool), and nmap (a network mapper) to detect whether the target host is online.

[0100] For example, if an ICMP echo request message is sent to a target IP address, and the target host is active and allows ICMP responses, it will return an ICMP echo reply message to confirm the IP's activity.

[0101] Port openness probing aims to determine which ports on a target host are open. This is done by sending specific data packets to different ports on the target host and judging the port status based on the returned responses. For example, port probing methods mainly include TCP SYN (Transmission Control Protocol Synchronization Sequence Number) scanning and TCP Connect (Transmission Control Protocol Connection) scanning.

[0102] Service scanning, after identifying the open ports of a target host, further identifies the specific services running on each open port. It's understood that different services use different protocols and data interaction modes during communication. By sending specific request data to an open port and analyzing the returned response data, the type of service running on that port can be determined.

[0103] For example, Nmap (network mapper) technology can be used to identify the protocol type, structure, and information carried by the returned data through protocol parsing and in-depth packet analysis.

[0104] Asset fingerprinting identifies specific information and characteristics of network assets through signature matching and behavioral analysis. Using asset fingerprinting, information such as the brand, model, operating system version, and application type of asset devices can be accurately identified, providing crucial data for network asset management and security assessment.

[0105] Traffic capture and analysis involves deploying a traffic analysis module to capture network traffic data, analyze asset-initiated outbound communication data, identify business communication relationships, and thereby obtain asset information.

[0106] Specifically, in the embodiment of the present invention, during the information collection phase, basic equipment information is obtained through the asset management platform of the power monitoring system, and static data such as the department to which the asset belongs and the person in charge of operation and maintenance are supplemented by manual input; based on asset detection technology, traffic capture equipment is deployed to passively collect TCP / UDP protocol connections (TCP refers to Transmission Control Protocol, UDP refers to User Datagram Protocol), data transmission protocols, and dynamic interaction data between assets in the network; then, data cleaning and denoising algorithms are used to filter effective data and remove redundant information, and an asset information database is established using the filtered feature information of various secondary equipment.

[0107] Preferably, the collected secondary equipment feature information needs to undergo data processing operations such as data quality assessment and communication behavior identification and analysis.

[0108] For example, information entropy is used to assess data quality and filter valid data. The higher the entropy value, the more messy the data is, requiring further cleaning. Meanwhile, passively collecting network traffic data often results in the inclusion of a large amount of redundant, noisy, or atypical communication data.

[0109] Traditional thresholding methods struggle to effectively distinguish between normal and abnormal traffic, making it difficult to construct accurate asset topology models. Therefore, the DBSCAN clustering algorithm (density-based spatial clustering algorithm) can be used to cluster and analyze the communication behavior of assets, identifying abnormal communication patterns to aid in modeling.

[0110] The DBSCAN clustering algorithm relies on two parameters: neighborhood radius (Eps) and minimum number of samples (MinPts). The neighborhood radius parameter defines a circular region with the sample point as the center and the neighborhood radius Eps as the radius. The minimum number of samples parameter is the threshold for determining whether a sample point can become a core sample point.

[0111] If a sample point's Eps neighborhood contains at least the minimum number of sample points MinPts, then that point is marked as a core point, and a cluster is formed based on it. Starting from the core point, all points with density reachable from it are assigned to the same cluster. Points that do not belong to any cluster are marked as noise or outliers.

[0112] For example, communication behavior data between devices (such as connection frequency, time period, data volume, etc.) can be transformed into feature vectors and input into the DBSCAN clustering algorithm model to cluster assets with similar communication patterns, such as periodic heartbeat communication between the monitoring backend and the gateway machine; while sparse or irregular connections are identified as noise.

[0113] The aforementioned noisy data, such as temporary debugging by maintenance personnel, network scanning, or attack probing, will be filtered out when constructing the asset topology model. This enables the adaptive discovery of asset groups in the substation network space, effectively identifying standard equipment groups and abnormal equipment, ensuring that the asset topology model only reflects stable and real business relationships, thereby improving the accuracy and reliability of the model.

[0114] The secondary equipment feature information is fused and processed to construct an asset topology model including multiple equipment nodes, including:

[0115] The basic equipment information and the operating status information are associated and integrated to form network asset fusion information corresponding to each equipment entity; each equipment entity is mapped to each equipment node in the asset topology model, and the network asset fusion information is used as the node information of the corresponding equipment node, thereby constructing a comprehensive and accurate asset topology model.

[0116] Network asset fusion information is a multi-dimensional set of device data generated through data fusion technology. It integrates and correlates basic information and operational status information of various devices from different sources to form fusion information corresponding to each device entity. It can be understood that the device entity here refers to the information object that represents the corresponding secondary device after integrating and summarizing various types of information.

[0117] During implementation, the physical connections, logical relationships, and data transmission paths between secondary equipment can be sorted out based on the graph theory principles in topology, forming the main connection relationships of various secondary equipment involved in the substation, and realizing the construction of the asset topology model.

[0118] Specifically, each device entity is mapped to a model node, and the connection relationships between nodes (such as physical connections, logical communication links, etc.) are used as edges of the model to construct an asset topology model of the form of an undirected graph G=(V,E), where V represents the set of device nodes and E represents the set of connection relationships.

[0119] In a complex topology composed of numerous device nodes, it is necessary to identify core nodes and edge nodes in order to allocate probe resources.

[0120] Therefore, the process of constructing the asset topology model also includes: evaluating the importance of each device node, wherein the evaluation of the importance of the node includes calculating the degree centrality and betweenness centrality of each device node.

[0121] Degree centrality can be used to characterize the total number of other device nodes directly connected to a certain device node, and betweenness centrality can be used to characterize the frequency with which the current node acts as an intermediate node in communication with other nodes. Based on the degree centrality and betweenness centrality, the importance score of each device node is calculated, and the core nodes and edge nodes of the asset topology model are marked based on the importance score, thereby clarifying the asset hierarchical structure in the model, such as the station control layer, the interval layer, and the process layer.

[0122] Furthermore, the asset hierarchy can be configured by relevant technical personnel based on actual application scenarios and substation standard network architecture. The functions and definitions of various asset hierarchies will not be elaborated here.

[0123] refer to Figure 2 As shown, Figure 2 The overall topology is divided into two security zones. Each security zone contains a multi-level network architecture and is equipped with key equipment nodes such as real-time switches, vertical encryption devices, communication gateways, and various business servers, thus forming a hierarchical asset connection relationship.

[0124] Furthermore, the formula for calculating the degree centrality includes:

[0125] ;

[0126] in, Indicates the degree centrality of node v; N represents the degree of node v, which is the number of edges directly connected to node v; N represents the total number of nodes.

[0127] Hub nodes can be identified by calculating degree centrality. The more devices a node connects to and the higher its degree, the greater its direct influence in the network.

[0128] For example, the station control layer server is usually connected to multiple interval layer devices, and its degree centrality is very high. These nodes are the focus of detection and monitoring.

[0129] The formula for calculating betweenness centrality includes:

[0130] ;

[0131] in, Indicates the betweenness centrality of node v; This represents the number of shortest paths from node s to node t; This represents the number of shortest paths passing through node v.

[0132] Bridge nodes can be identified by calculating betweenness centrality, thus revealing potential single points of failure. A certain type of node may have a small number of direct connections, but communication between other nodes must pass through this type of node.

[0133] For example, nodes corresponding to devices such as network switches or gateways; if such nodes fail, they will disrupt the network and cause widespread communication outages.

[0134] The importance score of a node can be obtained by calculating the degree centrality and betweenness centrality of each device node in the asset topology model and then weighting and summing them.

[0135] It is worth noting that the node importance score will change dynamically as the model is continuously updated. The final node importance score can be used in subsequent steps to calculate the detection cycle for performing active probing.

[0136] For example, secondary devices (such as core servers and gateways) corresponding to high-scoring nodes are marked as key core assets and are subject to shorter detection cycles (higher detection frequency) and higher detection intensity.

[0137] For example, secondary equipment corresponding to low-scoring nodes (such as a single measurement and control device) is marked as edge assets and uses a longer detection cycle (lower detection frequency) to save resources.

[0138] Therefore, the detection frequency is increased for core nodes and assets with high interaction frequency to ensure monitoring accuracy, while the detection frequency is adaptively reduced for edge nodes and low-load assets to save resources, realizing the transformation from "indiscriminate general detection" to "precise detection based on importance".

[0139] Step S2: Based on the asset topology model and preset network space mapping parameter information, construct the asset mapping architecture of the substation network space.

[0140] Specifically, this includes: defining an asset depth analysis strategy for the asset mapping architecture based on the preset network space mapping parameter information; and determining the detection targets and range of the asset mapping architecture based on the asset topology model.

[0141] Among them, the preset cyberspace mapping parameter information refers to the core configuration set used to define and drive the asset deep analysis strategy in the asset mapping architecture, and its specific content can be customized according to actual mapping needs.

[0142] For example, in scanning rules, you can define the target IP address range, port list, protocol type, and scanning frequency; in parsing rules, you can configure the protocol fingerprint database, device feature matching rules, operating system identification rules, and service identification rules required for asset feature identification.

[0143] Therefore, the asset deep analysis strategy can be accurately adapted to substation network environments with different architectures, realize topological correlation analysis of each asset, and accurately extract and identify the multi-dimensional features of the assets.

[0144] It is understandable that the multimodal feature matching module is implemented based on multimodal feature matching technology. Modality refers to the form or source of data information. Common modal data include active scanning data, passive traffic data, log data, vulnerability scanning data, and configuration management data.

[0145] Multimodal features refer to features with different attributes extracted from data of different modalities; multimodal feature matching technology is a general term for all the technologies used to achieve the multimodal matching process.

[0146] It is understandable that the core principle of multimodal feature matching technology is to find or construct a shared subspace or public representation, under the premise of acknowledging and overcoming the semantic gap between different modalities, to transform heterogeneous data into comparable isomorphic features within this space, and then use similarity measures to achieve accurate feature association.

[0147] Specifically, multimodal feature matching technology is used in several key steps of the matching process. For example, in the transformation estimation and mismatch removal stages, robust estimation algorithms such as RANSAC random sampling consensus can be used to address the unreliability of initial matching results caused by data heterogeneity and network noise.

[0148] The RANSAC algorithm assumes a transformation model between features by repeatedly randomly sampling the smallest sample set from the initial matching data containing a large number of mismatches (outsides), and uses this transformation model to test the remaining data, counting the number of data that conform to the model (i.e., insides). After multiple iterations, the transformation model with the largest number of insides and the most consistent is finally selected as the optimal estimate.

[0149] The above process can effectively eliminate incorrect matching pairs and filter out correct associations with high confidence, thereby providing a reliable foundation for subsequent steps and ensuring the overall accuracy and robustness of multimodal feature matching.

[0150] Preferably, the matching process typically includes steps such as data preprocessing, fingerprint extraction, preliminary fingerprint matching, transform estimation and mismatch removal, verification and refinement, and asset identification. In practice, by aggregating and analyzing data from multiple modalities and utilizing the inherent correlations between different modalities, accurate identification of assets and equipment can be achieved, and the attribute positioning of various types of equipment can be clarified.

[0151] Preferably, the asset mapping architecture includes at least: a pre-configured topology association analysis module and a multimodal feature matching module.

[0152] The topology association analysis module is used to perform topology association analysis on the asset topology model; the multimodal feature matching module is used to perform multimodal feature matching on the asset topology model.

[0153] Among them, the topology association analysis module is responsible for analyzing the location, association strength and influence range of assets in the topology structure; the multimodal feature matching module is responsible for integrating various fingerprint databases and feature databases to achieve in-depth identification of asset attributes through comprehensive comparison.

[0154] In traditional network topology diagrams, connections typically represent binary relationships of presence or absence. However, the association strength algorithm built into the topology association analysis module can upgrade the asset topology model from a physical / logical connection diagram to a business association diagram through quantitative analysis. This allows for the rapid identification of assets with strong associations to faulty assets, thereby helping technical personnel determine priority targets for emergency response and providing support for the development of subsequent proactive detection plans.

[0155] Meanwhile, during multimodal feature matching, the system does not rely on any single piece of information, but rather uses cross-validation of multiple features to ensure the accuracy of identification. This mechanism is particularly suitable for power secondary equipment systems, which contain a large number of dedicated devices (such as protection devices and monitoring and control devices) that use proprietary or customized protocols, making them unrecognizable by traditional scanning tools due to the lack of a corresponding fingerprint database.

[0156] Therefore, this invention integrates various equipment features by constructing a dedicated multi-dimensional feature fingerprint database, specifically including: a power secondary equipment fingerprint database, which contains feature parameters of devices such as protection devices, measurement and control devices, and PMUs (Power Management Units); an operating system fingerprint database, which covers protocol stack features, TTL (Time To Live), and window size of systems such as Windows and Linux; a server feature database, which contains port response features, response message formats, and banner information (service identification information) of web servers and database servers; and an application feature database, which covers the interaction features and message structure of power-specific software. The above fingerprint database integrates key features such as specific protocol interaction sequences, vendor identifiers in response messages, and firmware version numbers, effectively solving the problem of identifying specialized equipment.

[0157] Preferably, constructing a fingerprint database for secondary power equipment specifically includes the following aspects:

[0158] First, according to the collection cycle, the multidimensional features of the secondary power equipment are periodically collected and preprocessed.

[0159] Second, based on the stability index values ​​of each feature, weights are dynamically assigned to each feature, and tolerance mapping is performed on the preprocessed features based on the weights to generate robust feature strings.

[0160] Third, based on the multiple high-stability features of the secondary power equipment, a dynamic S-box with a lightweight encryption algorithm specific to the secondary power equipment is generated.

[0161] Fourth, using the dedicated dynamic S-box, a robust feature string is encrypted using a lightweight encryption algorithm, and the encryption result is hashed to dynamically generate a fixed-length device fingerprint for the current collection period.

[0162] Meanwhile, the construction of a fingerprint database for secondary power equipment mainly involves the following three core components:

[0163] (1) Device-side agent: Deployed on the secondary power equipment, responsible for feature collection and transmitting the collected features to the central server.

[0164] (2) Central server: Deployed in the control center, responsible for the registration, verification, storage and management of device fingerprints, as well as the training of the federated learning framework used to generate dynamic weights.

[0165] (3) Secure communication channel: The communication channel between the power secondary equipment and the central server adopts TLCP (Transport Layer Cryptography Protocol) or TLS (Transport Layer Security) based on SM2 certificate.

[0166] Furthermore, multidimensional features include static features, dynamic features, and environmental features.

[0167] Static features include at least one of the following: electronic identification card information, trusted chip identity, processor serial number, memory serial number, MAC address, operating system type, and software version.

[0168] Dynamic characteristics include at least one of the following: user access behavior, process behavior, network access behavior, file access behavior, and the time of this boot.

[0169] Environmental characteristics include at least one of the following: boot time, geographical location, affiliated unit information, and running process list characteristics.

[0170] Furthermore, the process of generating robust feature strings specifically includes:

[0171] Assign weights to each feature; calculate the mapping parameters of each feature based on the preset mapping function and the weights corresponding to each feature; merge the preprocessed multidimensional feature values ​​with their corresponding mapping parameters to generate intermediate feature values ​​with tolerance; concatenate the intermediate feature values ​​in a predetermined order to generate a robust feature string.

[0172] The weights are dynamically updated based on the stability index values ​​of each feature. The dynamic update method includes: the central server uses a federated learning framework to aggregate the feature change information periodically reported by each power secondary device for dynamic update.

[0173] Furthermore, the dynamic updating of weights also includes the following steps:

[0174] Based on the federated learning framework, the central server initializes a pre-trained global weight prediction model. Based on the collection cycle, each secondary power device reports the collected multi-dimensional features to the central server. Based on the reported multi-dimensional features, the central server calculates the stability index value of each feature of each secondary power device, and calculates and encrypts the model update amount based on the stability index value. The central server uses a secure aggregation protocol to aggregate multiple encrypted model update amounts to update the global weight prediction model and dynamically output the weights of the corresponding features. The central server then distributes the dynamically updated weights of the corresponding features to each corresponding secondary power device.

[0175] Furthermore, the stability index value of the feature is calculated, including:

[0176] Calculate the standard deviation of the preprocessed feature collected multiple times within a predetermined time window, and calculate the stability index value of the feature based on the standard deviation; wherein, the magnitude of the stability index value is negatively correlated with the stability of the feature.

[0177] Furthermore, a dynamic S-box is generated that uses a lightweight encryption algorithm specific to secondary power equipment, including:

[0178] Based on the high stability features of the secondary power equipment, a seed key is generated; based on the seed key, a dynamic S-box specific to the secondary power equipment is generated through a dynamic S-box generation algorithm.

[0179] The seed key generation process includes: concatenating multiple highly stable features of the secondary power equipment in a predetermined order to form a seed string; calculating the hash value of the seed string; and extracting the first 128 bits of the hash value as the seed key.

[0180] Preferably, the dynamic S-box generation algorithm specifically includes:

[0181] Initialize a linear sequence S containing all integers from 0 to M-1, where M is the size of the S-box; generate a key stream based on the seed key using a key expansion algorithm; perform multiple rounds of pseudo-random permutations on the linear sequence S based on the key stream to obtain a confused sequence; perform multiplicative inverse calculations and affine transformations on a finite field on each element in the confused sequence to complete nonlinear enhancement; output the nonlinearly enhanced sequence as the final dynamic S-box.

[0182] Preferably, the key expansion algorithm specifically includes:

[0183] Initialize a 128-bit counter and set its initial value to 0; use the SM4 algorithm with the seed key as the key to encrypt the current value of the counter, and use the encryption result as a data block of the key stream; increment the value of the counter; repeat this encryption and incrementing process until the total length of the generated key stream is not less than a preset length threshold; where the preset length threshold is the product of the size of the S-box and the number of pseudo-random permutation rounds.

[0184] Furthermore, dynamically generating a fixed-length device fingerprint for the current acquisition cycle specifically includes:

[0185] Using a dedicated dynamic S-box, a robust feature string is encrypted using a lightweight symmetric encryption algorithm to obtain ciphertext; the hash value of the ciphertext is calculated, and the obtained hash value is used as a fixed-length device fingerprint within the current collection period; among them, the SM3 algorithm is used to calculate the hash value of the ciphertext.

[0186] Through the above methods, the present invention dynamically establishes a series of feature databases, including a computer equipment fingerprint database, a network equipment fingerprint database, a security equipment fingerprint database, an operating system fingerprint database, a service fingerprint database, and an application feature database, forming a complete fingerprint system for substation secondary equipment.

[0187] Because the fingerprint database is built by deeply integrating the static, dynamic and environmental features of secondary power equipment, it is extremely difficult for attackers to forge or tamper with all the features at the same time. The dynamically updated device fingerprints are more unique and have significantly improved anti-forgery capabilities. This not only significantly improves the uniqueness and credibility of the identification of secondary power equipment, but also fundamentally solves the security problem that a single feature is easily copied, forged or tampered with.

[0188] Step S3: Perform in-depth analysis of the asset topology model based on the asset mapping architecture to obtain an updated asset topology model.

[0189] In practice, the specific steps include: First, based on the topology association analysis module, performing topology association analysis on each device node of the asset topology model, updating the association relationship of each device node in the asset topology model, and then assigning different weight values ​​to the paths between each device node.

[0190] Secondly, based on the multimodal feature matching module and combined with the preset feature library, multimodal feature matching is performed on the network asset fusion information of each device node to identify the asset attributes corresponding to each device node in the asset topology model.

[0191] For example, network asset fusion information is formed by using asset attribute tables, topology relationships, and asset status logs as core data sources and associating them. Multimodal feature matching technology is then used to match the multi-dimensional features extracted from the network asset fusion information with feature templates from relevant feature libraries.

[0192] Finally, based on the updated association relationships of each device node and the identified asset attributes of each device node, the updated asset topology model is obtained; this enables accurate identification and association analysis of network assets, enriches the asset topology model of the network space, and provides a basis for intelligent scheduling decisions.

[0193] Preferably, the calculation formula for the topological association analysis includes:

[0194] ;

[0195] in, This indicates the strength of the association between node i and node j; This represents the communication frequency between node i and node j. This represents the maximum communication frequency between all device nodes, which is also the maximum communication frequency for all asset pairs. This represents the hop distance between node i and node j, where the hop count represents the number of routing nodes a data packet passes through during transmission.

[0196] Preferably, the calculation formula for the multimodal feature matching includes:

[0197] ;

[0198] in, The value represents the cosine of vector A and vector B; A represents the asset feature vector extracted from the network asset fusion information of the device node; B represents the template feature vector in the preset feature library. Describes the component vectors of vector A. d represents a subvector of vector B; d represents the total dimension of the vector; k represents the dimension index.

[0199] Specifically, firstly, multi-dimensional feature data of the corresponding device entity at the protocol, port, behavior, and service levels are extracted from the network asset fusion information corresponding to each device node to form a multi-dimensional feature vector of the device entity; then, the multi-dimensional feature vector is matched and similarity is calculated with the multi-dimensional feature template in the preset fingerprint database; finally, the system determines the location and attributes of the asset based on the template with the highest weighted comprehensive similarity, such as identifying various asset attributes such as IP address, device type, transmission protocol, and business role, thereby accurately identifying the true identity of unknown assets, realizing in-depth analysis of various assets in the substation network space, and forming a complete asset profile.

[0200] Step S4: Based on the intelligent variable speed active detection algorithm, plan the optimal detection path in the updated asset topology model, and execute the active detection scheme in the substation network space according to the optimal detection path; dynamically adjust the active detection scheme based on the real-time response data fed back by each secondary device during the detection process, and execute the active detection again.

[0201] The technical principle of the intelligent variable speed active detection algorithm is to dynamically assign weights to various device nodes, calculate the optimal access path for various assets by combining topology theory, and dynamically adjust the active detection cycle and detection intensity according to changes in asset status.

[0202] Specifically, during the detection process, the system continuously monitors real-time information such as the response mode, load status, and risk changes of various devices, and adaptively adjusts the detection frequency and intensity. For example, high-frequency and in-depth refined detection is implemented for high-risk or abnormally behaving devices; for stable operating devices, the detection intensity is appropriately reduced and the detection interval is extended.

[0203] Therefore, it can not only prioritize the coverage of key nodes and core links in the asset topology model, but also dynamically adjust the active detection scheme based on the real-time response data fed back by each secondary device during the detection process; it achieves high coverage, high accuracy, and low interference in asset mapping targets, and by establishing a dynamic relationship between asset status and detection strategy, it forms a closed-loop perception mechanism of continuous adjustment, optimization, and dynamic circulation, which minimizes the impact on the business network while ensuring detection effectiveness and effectively reduces the occupation of network and equipment resources.

[0204] Fixed-frequency active detection is often interfered with during peak business periods, while insufficient coverage occurs during off-peak periods. The essence of the intelligent variable-speed active detection algorithm is a dynamic adjustment model based on multi-factor feedback. It can run continuously in the detection strategy scheduling module built into the dynamic adjustment model, receive the node importance score in the asset topology model, and collect and monitor the network load monitoring data of each secondary device in the substation network space in real time. Then, it dynamically calculates and updates the detection cycle, frequency and intensity of each asset.

[0205] For example, during off-peak periods, intensive probing is conducted on core secondary equipment with high scores, while during peak periods, the probing cycle of all non-core secondary equipment is automatically extended, or even their deep probing is suspended, to ensure smooth operation; thus, the goal of optimizing resource mapping with high coverage, high precision, and low interference is achieved.

[0206] Furthermore, an active detection scheme is executed in the substation network space according to the optimal detection path, specifically including:

[0207] Based on the intelligent variable speed active detection algorithm, an active detection scheme is dynamically generated according to the updated asset topology model and the real-time collected network load monitoring data.

[0208] Based on the topology and Dijkstra's shortest path algorithm, the optimal detection path is planned for the updated asset topology model.

[0209] The active detection scheme is executed in the substation network space according to the optimal detection path, that is, the active detection scheme is executed on various secondary devices in the real environment.

[0210] For example, starting from the core node, the nodes in the station control layer, interval layer, and process layer are covered in sequence to avoid repeatedly probing the same link and improve probing efficiency.

[0211] It should be noted that when the nodes in the updated asset topology model change, the importance score of the relevant nodes needs to be recalculated. Nodes with higher importance are prioritized for detection, so as to achieve dynamic adjustment of the detection scheme.

[0212] It is understandable that probing assets in random order or by IP address would lead to repeated transmission of probe packets on the network link, resulting in low efficiency and potentially causing unnecessary congestion by repeatedly traversing the core link.

[0213] Therefore, the shortest path from a single source vertex to all other vertices can be found using Dijkstra's algorithm; the asset topology model in this embodiment of the invention can be regarded as a weighted graph, and the link weight is defined as a function that is positively correlated with the link load and latency, that is, the higher the load, the greater the weight.

[0214] Meanwhile, the exploration mission starts from the core node (source node) in the asset topology model and calculates the optimal path from the source node to all other assets.

[0215] The active detection scheme includes at least a detection cycle for performing active detection; the calculation formula for the detection cycle includes:

[0216] ;

[0217] in, This indicates the detection period of node v; Indicates the reference detection period; This represents the importance score of node v in the updated asset topology model. ; Indicates the maximum load threshold; L represents the current network load rate; This represents the adjustment coefficient.

[0218] For example, the baseline value for the detection cycle is set to 30 minutes. For devices corresponding to core nodes in the asset topology model, the cycle is shortened to 10 minutes, and for devices corresponding to edge nodes, the cycle is extended to 60 minutes. When the current network load rate exceeds 70%, the detection intensity of all non-core devices is automatically reduced, and unnecessary deep detection tasks are suspended.

[0219] Furthermore, the dynamic adjustment of the active detection scheme based on the real-time response data fed back by each secondary device during the detection process, and the execution of active detection again, includes:

[0220] During the detection process, detection messages are sent to each secondary device in the substation network space based on the optimal detection path.

[0221] The specific types of probe messages include: network layer probe messages (such as ICMP protocol), host discovery messages for quickly finding live addresses (such as fping tool), port scan messages for identifying open ports and service types (such as nmap tool), etc.; obtain real-time response data from each secondary device; dynamically adjust the active probe scheme based on the real-time response data, and perform active probe again in the substation network space until the expected probe effect is achieved, thereby realizing continuous iterative optimization of the scheme and dynamic looping of the execution process.

[0222] Preferably, the real-time response data fed back by each secondary device can also be matched and analyzed in real time through a multimodal feature matching module, and the real-time analysis results can be stored in the asset information database to update the asset status.

[0223] Preferably, the dynamically adjusted active detection scheme includes at least: a first detection scheme and a second detection scheme.

[0224] The first detection scheme includes: extending the detection period and performing low-frequency survival detection; the second detection scheme includes: shortening the detection period and performing high-frequency depth detection.

[0225] Furthermore, if a secondary device is detected to be under high load, the first detection scheme is executed on the high-load secondary device in the substation network space, for example, by extending the detection cycle and automatically calling back after the load returns to normal.

[0226] If the real-time operating status of the secondary equipment is detected to be low load, the second detection scheme is executed on the low-load secondary equipment in the substation network space, for example, shortening the detection cycle and automatically calling back after returning to normal.

[0227] Subsequently, various detection tasks along the same path are merged, detection commands are issued and executed again; the secondary equipment is the actual equipment corresponding to the equipment node in the substation network space.

[0228] In some implementations, when the device corresponding to the core node experiences a sustained high load, such as a CPU utilization rate exceeding 80%, the detection cycle of that node can be temporarily extended, and it will automatically revert to normal operation once the load returns to normal.

[0229] When the device corresponding to the edge node continues to exhibit abnormal responses, such as a packet loss rate exceeding 30%, the detection frequency can be temporarily increased to continuously monitor the abnormal state. Once the abnormality is eliminated, the original detection scheme can be restored.

[0230] Thus, by avoiding high-intensity detection tasks during peak business periods, refined scheduling of network resources was achieved, ensuring that business interference was minimized while asset mapping was completed.

[0231] Furthermore, when a value jump is detected in the real-time response data fed back by the secondary device, the jump value is smoothed while maintaining the active detection scheme unchanged.

[0232] The formula for the smoothing process includes:

[0233] ;

[0234] in, This represents the smoothed state value for the current period t; This represents the actual observed value for the current period t. It is a smoothing factor; Indicates the previous cycle The smooth state value.

[0235] Since network load and node status are instantaneous values, directly using these instantaneous values ​​to trigger the dynamic adjustment mechanism of the detection scheme would cause the scheme to switch back and forth in a short period of time. Therefore, the real-time network load data can be input into the EWMA filter (exponentially weighted moving average filter).

[0236] For example, if the CPU utilization of a device suddenly spikes to 85%, but the smoothed value is 75%, which does not reach the 80% adjustment threshold, the detection scheme that extends the detection cycle will not be triggered, thus avoiding policy misadjustment caused by instantaneous peak values. This ensures the stability and robustness of active detection.

[0237] To further illustrate the asset mapping process of the present invention, a specific embodiment is provided below.

[0238] like Figure 3 As shown, the functional architecture of asset mapping includes multiple levels, among which:

[0239] In the data acquisition and input layer, the initial acquisition of secondary equipment characteristic information is achieved through methods such as manual input or network traffic analysis, providing a basic data source for the system.

[0240] As the core data hub, the data processing and asset modeling layer is responsible for in-depth analysis of the asset topology model. In particular, it uses the analysis engine to perform multimodal feature matching on the network asset fusion information of each device node and identify the asset attributes corresponding to each node.

[0241] For example, by using asset attribute tables, topology relationships, and asset status logs as core data sources, and matching them with relevant feature libraries through multimodal feature matching technology, accurate identification and correlation analysis of network assets can be achieved, enriching the asset topology model and providing decision-making basis for intelligent scheduling.

[0242] At the intelligent scheduling layer, based on the fusion information in the asset topology model, business cycles, and real-time network load, the detection scheme is intelligently adjusted and issued to achieve efficient resource allocation and scheduling of detection tasks.

[0243] At the action execution layer, detection packets are sent to the substation network space, dispatch instructions are received to dynamically adjust detection behavior, real-time response data of secondary equipment is actively acquired and fed back, forming a closed-loop execution of detection actions and adaptive adjustment of the detection cycle.

[0244] It is understood that the above embodiments are only for ease of understanding and simplification of description, and should not be construed as limitations on the present invention. The present invention does not specifically limit the types of secondary equipment, the implementation methods of asset depth analysis, and the intelligent variable speed active detection algorithm.

[0245] In another embodiment of the present invention, a substation secondary equipment mapping system based on intelligent variable speed active detection is proposed, such as... Figure 4 As shown, it specifically includes the following modules:

[0246] The first construction module is used to collect the feature information of secondary equipment in the substation network space, perform fusion processing on the feature information of the secondary equipment, and construct an asset topology model including multiple equipment nodes.

[0247] The second construction module is used to construct the asset mapping architecture of the substation network space based on the asset topology model and the preset network space mapping parameter information.

[0248] The deep analysis module is used to perform deep analysis of the asset topology model based on the asset mapping architecture, and obtain an updated asset topology model.

[0249] The detection execution module is used to plan the optimal detection path in the updated asset topology model based on the intelligent variable speed active detection algorithm, and execute the active detection scheme in the substation network space according to the optimal detection path; dynamically adjust the active detection scheme based on the real-time response data fed back by each secondary device during the detection process, and execute the active detection again.

[0250] Furthermore, the secondary equipment feature information includes at least: basic equipment information and operating status information;

[0251] The basic device information includes at least: device name, IP address, MAC address, device category, device type, device model, software version, hardware version, serial number, manufacturer, and installation location;

[0252] The operating status information includes at least: health status, operating voltage, device temperature, storage utilization, CPU utilization, transmit / receive power, alarm information, and network load.

[0253] Furthermore, the first building module is also used for:

[0254] The basic equipment information and the operational status information are linked and integrated to form network asset fusion information corresponding to each equipment entity;

[0255] Each of the aforementioned device entities is mapped to a device node in the asset topology model, and the network asset fusion information is used as the node information of the corresponding device node.

[0256] Furthermore, the asset mapping architecture includes at least:

[0257] Pre-configured topology association analysis module and multimodal feature matching module;

[0258] Based on the topology association analysis module, topology association analysis is performed on each device node of the asset topology model, and the association relationship of each device node in the asset topology model is updated.

[0259] Based on the multimodal feature matching module and combined with the preset feature library, multimodal feature matching is performed on the network asset fusion information of each device node to identify the asset attributes corresponding to each device node in the asset topology model.

[0260] Based on the updated association relationships of each device node and the identified asset attributes of each device node, the updated asset topology model is obtained.

[0261] In summary, the substation secondary equipment mapping method and system based on intelligent variable speed active detection according to the embodiments of the present invention have the following beneficial effects:

[0262] On the one hand, by constructing an asset topology model and asset mapping architecture for the substation network space and conducting in-depth asset analysis, the limitations of traditional local mapping are overcome. This enables the quantification of dynamic business relationships between assets, a comprehensive understanding of the relationships and global distribution between assets, and an improvement in the completeness and systematic nature of the mapping results.

[0263] On the other hand, by conducting in-depth asset analysis of the asset topology model through asset mapping architecture, not only can the identification accuracy of individual assets be improved, but also the role and scope of influence of assets in the model topology structure can be clarified, providing more comprehensive decision support for power system security risk assessment and emergency response.

[0264] On the other hand, by planning the optimal detection path and executing the active detection scheme based on the intelligent variable speed active detection algorithm, while ensuring high coverage monitoring of core assets, the resource consumption of non-critical assets is reduced, and the interference to the normal business network environment is effectively reduced, truly achieving the technical goals of high coverage, high precision, and low interference.

[0265] The above-described method and system embodiments are based on the same principles, and their related aspects can be referenced from each other to achieve the same technical effects. For specific implementation processes, please refer to the foregoing embodiments, which will not be repeated here.

[0266] Those skilled in the art will understand that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0267] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0268] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for mapping secondary equipment of a substation based on intelligent variable-speed active detection, characterized in that, The method comprises the following steps: Collecting characteristic information of secondary equipment in the network space of a substation, fusing the characteristic information of the secondary equipment, and constructing an asset topology model comprising a plurality of equipment nodes; According to the asset topology model and preset network space mapping parameter information, an asset mapping architecture of the substation network space is constructed; The asset mapping architecture at least comprises a pre-configured topology correlation analysis module and a multi-modal feature matching module; The topology correlation analysis module is used for topology correlation analysis of the asset topology model; the multi-modal feature matching module is used for multi-modal feature matching of the asset topology model; wherein, in the multi-modal feature matching process of the asset topology model, a special power secondary equipment fingerprint library is constructed to integrate various equipment features; the construction of the power secondary equipment fingerprint library specifically comprises: According to the collection cycle, the multi-dimensional features of the power secondary equipment are periodically collected and preprocessed; based on the stability index value of each feature, the weight of each feature is dynamically allocated, and the tolerance mapping of the preprocessed features is performed based on the weight to generate a robust feature string; based on a plurality of high-stability features of the power secondary equipment, a dynamic S-box of a lightweight encryption algorithm dedicated to the power secondary equipment is generated; the robust feature string is encrypted by the lightweight encryption algorithm using the dedicated dynamic S-box, and the encryption result is subjected to a hash operation to dynamically generate a fixed-length device fingerprint of the current collection cycle; Based on the asset mapping architecture, the asset topology model is subjected to asset depth analysis, and an updated asset topology model is obtained; Based on an intelligent variable-speed active detection algorithm, an optimal detection path is planned in the updated asset topology model, and an active detection scheme is executed in the substation network space according to the optimal detection path, wherein the active detection scheme at least comprises a detection cycle for executing active detection; The calculation formula of the detection cycle comprises: ； wherein, representing a detection period of a node v ; representing a reference detection period; representing an importance score of a node v in the updated asset topology model; representing a maximum load threshold; L representing a current network load rate; representing an adjustment coefficient; based on the real-time response data fed back by each secondary device in the detection process, the active detection scheme is dynamically adjusted, and active detection is performed again.

2. The mapping method of claim 1, wherein, The characteristic information of the secondary equipment at least comprises equipment basic information and running state information; The equipment basic information at least comprises equipment name, IP address, MAC address, equipment classification, equipment type, equipment model, software version, hardware version, factory serial number, manufacturer, and installation location; The running state information at least comprises health status, working voltage, device temperature, storage usage, CPU usage, transceiver power, alarm information, and network load.

3. The mapping method of claim 2, wherein, The fusion processing of the characteristic information of the secondary equipment and the construction of the asset topology model comprising a plurality of equipment nodes comprise: The equipment basic information and the running state information are associated and integrated to form network asset fusion information corresponding to each equipment entity; Each equipment entity is mapped to each equipment node of the asset topology model, and each network asset fusion information is taken as node information of the corresponding equipment node.

4. The mapping method of claim 3, wherein, The construction of the asset topology model further comprises: Node importance evaluation is performed on each equipment node, wherein the node importance evaluation comprises calculating the degree centrality and betweenness centrality of each equipment node; According to the degree centrality and the betweenness centrality, an importance score of each device node is calculated, and a core node and an edge node of the asset topology model are marked based on the importance score.

5. The mapping method of claim 4, wherein, The calculation formula of the degree centrality comprises: ； wherein, denotes the degree centrality of a node v ; denotes the degree of a node v ; N denotes the total number of nodes; The calculation formula of the betweenness centrality comprises: ； wherein, representing betweenness centrality of a node v ; representing the number of shortest paths from a node s to a node t ; representing the number of shortest paths passing through a node v .

6. The mapping method of claim 1, wherein, The asset mapping architecture of the substation network space is constructed according to the asset topology model and preset network space mapping parameter information, comprising: Based on the preset network space mapping parameter information, an asset depth analysis strategy of the asset mapping architecture is defined; Based on the asset topology model, a detection target and a range of the asset mapping architecture are determined.

7. The mapping method of claim 1, wherein, The asset topology model is analyzed in depth based on the asset mapping architecture, and an updated asset topology model is obtained, comprising: Based on the topology correlation analysis module, a topology correlation analysis of each device node of the asset topology model is performed, and the correlation relationship of each device node in the asset topology model is updated; Based on the multi-modal feature matching module, and in combination with a preset feature library, a multi-modal feature matching of network asset fusion information of each device node is performed, and asset attributes corresponding to each device node in the asset topology model are identified; According to the updated correlation relationship of each device node and the identified asset attributes of each device node, the updated asset topology model is obtained.

8. The mapping method of claim 7, wherein, The calculation formula of the topology correlation analysis comprises: ； wherein, represents the association strength between the node i and the node j ; represents the communication frequency between the node i and the node j , represents the maximum value of the communication frequency between all device nodes; represents the distance of the hop count between the node i and the node j .

9. The mapping method of claim 7, wherein, The calculation formula of the multi-modal feature matching comprises: ； wherein, denotes a cosine value between vectors A and B ; A denotes an asset feature vector extracted from the network asset fusion information of the device node; B denotes a template feature vector in the preset feature library; denotes a sub-vector of vector A ; denotes a sub-vector of vector B ; d denotes a total dimension of vector k denotes a dimension index.

10. The mapping method of claim 1, wherein, Based on the intelligent variable-speed active detection algorithm, an optimal detection path is planned in the updated asset topology model, and an active detection scheme is executed in the substation network space according to the optimal detection path, comprising: Based on the intelligent variable-speed active detection algorithm, an active detection scheme is dynamically generated according to the updated asset topology model and real-time collected network load monitoring data; Based on the Dijkstra shortest path algorithm, an optimal detection path is planned for the updated asset topology model, and the active detection scheme is executed in the substation network space according to the optimal detection path.

11. The mapping method of claim 10, wherein, The active detection scheme is dynamically adjusted based on real-time response data fed back by each secondary device during the detection process, and active detection is performed again, comprising: During the detection process, detection packets are sent to each secondary device in the substation network space based on the optimal detection path; Real-time response data fed back by each secondary device is obtained; the active detection scheme is dynamically adjusted according to the real-time response data, and active detection is performed again in the substation network space.

12. The mapping method of claim 11, wherein, The dynamically adjusted active detection scheme at least includes a first detection scheme and a second detection scheme; The first detection scheme includes extending the detection period and performing low-frequency survival detection; The second detection scheme includes shortening the detection period and performing high-frequency deep detection.

13. The mapping method of claim 12, wherein, The active detection is performed again, comprising: If the secondary equipment is monitored as high load, the first detection scheme is executed in the substation network space; otherwise, the second detection scheme is executed in the substation network space; wherein the secondary equipment is the real equipment corresponding to the device node in the substation network space.

14. The mapping method of claim 1, wherein, The method further comprises: When detecting that the real-time response data fed back by the secondary equipment has a numerical jump, the jumped value is smoothed, and the active detection scheme is maintained unchanged; The formula of the smoothing processing comprises: ； wherein, represents the smoothed state value for the current period t; is the actual observation value for the current period t; is the smoothing factor; represents the smoothed state value for the previous period t-1.

15. A smart variable speed active probing based substation secondary equipment mapping system, characterized in that, It comprises: The first construction module is configured to collect secondary equipment characteristic information in the substation network space, perform fusion processing on the secondary equipment characteristic information, and construct an asset topology model comprising a plurality of device nodes; The second construction module is configured to construct an asset mapping architecture of the substation network space according to the asset topology model and preset network space mapping parameter information; The asset mapping architecture at least comprises a pre-configured topology correlation analysis module and a multi-modal feature matching module; The topology correlation analysis module is configured to perform topology correlation analysis on the asset topology model; the multi-modal feature matching module is configured to perform multi-modal feature matching on the asset topology model; wherein in the multi-modal feature matching process of the asset topology model, various device characteristics are integrated by constructing a special power secondary equipment fingerprint library; the construction of the power secondary equipment fingerprint library specifically comprises: According to a collection period, periodically collect multi-dimensional features of power secondary equipment and perform preprocessing; based on the stability index value of each feature, dynamically assign a weight to each feature, and based on the weight, perform tolerance mapping on the preprocessed features to generate a robust feature string; based on a plurality of high-stability features of the power secondary equipment, a dynamic S-box of a lightweight encryption algorithm dedicated to the power secondary equipment is generated; the robust feature string is encrypted by the lightweight encryption algorithm using the dedicated dynamic S-box, and the encryption result is subjected to a hash operation to dynamically generate a fixed-length device fingerprint of the current collection period; The deep analysis module is configured to perform asset deep analysis on the asset topology model based on the asset mapping architecture, and obtain an updated asset topology model; The detection execution module is configured to plan an optimal detection path in the updated asset topology model based on an intelligent variable-speed active detection algorithm, and execute an active detection scheme in the substation network space according to the optimal detection path, wherein the active detection scheme at least comprises a detection period for executing active detection; The calculation formula of the detection period comprises: ； wherein, representing a detection cycle of a node v ; representing a reference detection cycle; representing an importance score of a node v in the updated asset topology model; representing a maximum load threshold value; L representing a current network load rate; representing an adjustment coefficient; based on the real-time response data fed back by each secondary device in the detection process, the active detection scheme is dynamically adjusted, and active detection is performed again.

16. The mapping system of claim 15, wherein, The secondary equipment characteristic information at least comprises device basic information and running state information; The device basic information at least comprises device name, IP address, MAC address, device classification, device type, device model, software version, hardware version, factory serial number, manufacturer, and installation location; The running state information at least comprises health status, working voltage, device temperature, storage usage, CPU usage, transceiver power, alarm information, and network load.

17. The mapping system of claim 16, wherein The first construction module is further configured to associate and integrate the device basic information and the running state information, and form network asset fusion information corresponding to each device entity; Each of the device entities is mapped to each device node of the asset topology model, and each of the network asset fusion information is taken as node information of the corresponding device node.

18. The mapping system of claim 17, wherein, Based on the topology correlation analysis module, topology correlation analysis is performed on each device node of the asset topology model, and the correlation relationship of each device node in the asset topology model is updated; Based on the multi-modal feature matching module, and in combination with a preset feature library, multi-modal feature matching is performed on the network asset fusion information of each device node to identify the asset attributes corresponding to each device node in the asset topology model; According to the updated correlation relationship of each device node and the identified asset attributes of each device node, the updated asset topology model is obtained.

Images