Comprehensive monitoring and management system for transformer substation

Abstract

The invention provides a comprehensive monitoring and management system for a transformer substation, and belongs to the field of transformer substation monitoring and management. The system comprises a data acquisition module which acquires node environment and substation operation state data and generates an original multi-dimensional data set; the data processing module performs deep preprocessing and quality verification to obtain a standard data packet; the data transmission module transmits the standard data packet to the main node, and performs network fault detection and network topology self-repairing; the data decryption module decrypts the encrypted standard data packet to obtain an aligned data set; the feature fusion analysis module performs feature fusion and abnormal event judgment through a bimodal feature fusion unit; the alarm linkage module triggers graded alarms according to the judged security and protection abnormal event result and links the substation equipment; and the optimization feedback module sends an optimization feedback instruction to the self-repairing network topology control unit. According to the method, the continuity of data transmission in an extreme environment is guaranteed, the anomaly recognition accuracy is improved, and the self-adaptive capability of the system is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of substation monitoring management, in particular to a substation comprehensive monitoring management system. BACKGROUND

[0002] The substation refers to the place for transforming voltage and current, accepting and distributing electric energy in the power system. The substation in the power plant is a step-up substation, which functions to feed the electric energy generated by the generator into the high-voltage power grid after being stepped up. The existing substation uses many electrical equipment, which is mostly integrated in the substation box for use. Due to the difference in working state and use environment of the equipment in each group of substation boxes, it is necessary to monitor and manage them.

[0003] In the prior art, in the extreme environment of high cold, high humidity and strong electromagnetic interference, the substation security sensor network is easy to be interrupted, and the data acquisition and transmission stability is poor. Moreover, the single modal security data of the substation is easy to be distorted, and the multi-modal data is not synchronized, which is easy to cause high abnormal identification misjudgment and missing judgment rate. In addition, the existing substation security abnormal disposal is lagging behind, the network has no self-adaptive optimization capability, and the data traceability is low. SUMMARY

[0004] The purpose of the present application is to provide a substation comprehensive monitoring management system to solve the technical problems of substation security sensor network interruption, poor data acquisition and transmission stability, high abnormal identification misjudgment and missing judgment rate, lagging behind in security abnormal disposal, and low data traceability in the prior art.

[0005] In order to achieve the above purpose, the present application provides a substation comprehensive monitoring management system, which comprises: a data acquisition module for acquiring node environment and substation operation state data according to the sensor nodes deployed in the target security area of the substation, and generating an original multi-dimensional data set; a data processing module for deep preprocessing and quality checking of the original multi-dimensional data set to obtain a standard data package; a data transmission module for constructing a mesh sensor network with the main node as the core based on a self-repairing network topology control unit, transmitting the standard data package to the main node, and detecting network faults and self-repairing network topology; a data decryption module for decrypting the encrypted standard data package and synchronizing and aligning the multi-modal data through time stamp and device identification to obtain an aligned data set; a feature fusion analysis module for extracting double-modal features from the aligned data set by using a voiceprint feature extraction unit and a behavior feature extraction unit, and performing feature fusion and abnormal event determination through a double-modal feature fusion unit.

[0006] Optionally, the step of collecting node environment and substation operation status data from sensor nodes deployed in the target security area of ​​the substation to generate a raw multi-dimensional dataset includes: collecting voiceprint data using the voiceprint acquisition unit built into the sensor node; collecting behavior association data using the behavior association data acquisition unit built into the sensor node; collecting status data of the sensor node using the environmental status acquisition unit built into the sensor node; and encapsulating the voiceprint data, behavior association data, and status data into a raw multi-dimensional dataset using the local processing submodule built into the sensor node.

[0007] Optionally, the step of performing deep preprocessing and quality verification on the original multi-dimensional dataset to obtain a standard data package includes: using an adaptive noise cancellation algorithm to remove environmental noise from the voiceprint data; using distortion correction and resolution normalization processing methods to process behavioral association data; using a smoothing filtering algorithm to remove random interference from the state data; using a quality verification rule base to perform multi-dimensional quality verification on the preprocessed original multi-dimensional dataset; retaining the original multi-dimensional datasets that pass the quality verification, discarding the original multi-dimensional datasets that fail the quality verification, and re-collecting data; and re-encapsulating all the original multi-dimensional datasets that pass the quality verification to obtain a standard data package.

[0008] Optionally, the step of constructing a mesh sensor network with a master node as the core based on the self-healing network topology control unit and transmitting the standard data packets to the master node includes: deploying a master node in the main control room of the substation using the self-healing network topology control unit, and all sensor nodes deployed in the target security area of ​​the substation as slave nodes; establishing bidirectional communication links between "master node-slave node" and "slave node-slave node" to form an initial mesh topology; and using a lightweight symmetric encryption algorithm to encrypt the standard data packets through the slave nodes and transmit them through the bidirectional communication links.

[0009] Optionally, the network fault detection and network topology self-repair includes: the master node monitoring the status of slave nodes through a periodic heartbeat mechanism, with slave nodes sending heartbeat packets to the master node every preset period; the slave nodes monitoring the link packet loss rate and latency with neighboring nodes, and determining a node fault or link interruption when a heartbeat packet is not received on time or the link parameters exceed a preset threshold, and sending a fault alarm to the master node through the slave node; after receiving the fault alarm, the master node uses a topology reconstruction algorithm to analyze the fault location and surrounding available nodes, and performs network topology self-repair.

[0010] Optionally, the step of decrypting the encrypted standard data packets and synchronizing and aligning multimodal data using timestamps and device identifiers to obtain an aligned dataset includes: using a decryption algorithm matched to the slave node and utilizing the decryption module built into the master node to decrypt the encrypted standard data packets; using a preprocessing unit to perform format unification processing on the data within the decrypted standard data packets to obtain standardized data; and using the timestamp as the core index, associating and binding the standardized data through the preprocessing unit to form a unified "time-space-multimodal" aligned dataset.

[0011] Optionally, the step of using the voiceprint feature extraction unit and the behavior feature extraction unit to extract bimodal features from the aligned dataset, and performing feature fusion and security anomaly event determination through the bimodal feature fusion unit, includes: using the Mel frequency cepstral coefficient algorithm to extract voiceprint features from the voiceprint data, and performing similarity matching with a preset substation voiceprint feature library to generate a voiceprint similarity score and the matched voiceprint type; using a target detection and tracking algorithm to extract behavior features from the behavior-related data, and performing similarity matching with a preset substation behavior feature library to generate a behavior similarity score and the matched behavior type; based on the voiceprint similarity score and the matched voiceprint type, and the behavior similarity score and the matched behavior type, using a Bayesian fusion model to calculate the joint probability of the fused features pointing to a security anomaly; when the joint probability exceeds a preset threshold, it is determined to be a security anomaly event, and the security anomaly event is classified; when the joint probability does not exceed the preset threshold, it is determined to be a normal event.

[0012] Optionally, the monitoring and management system further includes an alarm linkage module, which uses an intelligent alarm unit to trigger hierarchical alarms and link substation equipment based on the determined results of security anomalies.

[0013] Optionally, the use of the intelligent alarm unit to trigger tiered alarms and link substation equipment based on the determined security anomaly event includes: the intelligent alarm unit receiving the anomaly event determination result and classification information, and triggering tiered alarms according to the severity of the security anomaly event; when a level one alarm is triggered, the on-site audible and visual alarm device is triggered, alarm information is sent to the mobile terminal of the substation maintenance personnel, and a pop-up notification is displayed through the security management platform; when a level two alarm is triggered, the on-site audible and visual alarm device is triggered, and alarm information is sent to the mobile terminal of the substation maintenance personnel; when a level three alarm is triggered, a notification message is sent only to the substation maintenance platform; the intelligent alarm unit links the substation security equipment to perform abnormal area photography, lock access control equipment, and turn on lighting equipment.

[0014] Optionally, the monitoring and management system further includes: an optimization feedback module, which uses the dual-modal security processing layer to analyze the associated data of abnormal events, send optimization feedback instructions to the self-healing network topology control unit to achieve network optimization feedback, and transmit the associated data to the blockchain evidence storage module.

[0015] Through the above technical solutions, by deploying flexible sensing nodes resistant to extreme environments and constructing a self-healing network topology control unit, the outage rate of the sensing network in extreme environments is significantly reduced, achieving long-term stable passive operation without frequent manual maintenance, and adapting to the unattended operation requirements of remote and harsh substations. The dual-modal data acquisition and dual-modal feature fusion units significantly improve the accuracy of anomaly identification, effectively solving the problems of missed and false positives caused by single-modal data distortion and cross-modal asynchrony in extreme environments. This is particularly suitable for complex scenarios such as nighttime and dense fog, reducing the risk of missed and false positives from single-modal data and improving the accuracy of anomaly identification. The intelligent alarm unit linkage control and closed-loop optimization feedback mechanism improve the response speed to anomaly events, and the network continuously improves operational quality through adaptive optimization. Blockchain evidence storage enables reliable traceability throughout the entire "collection-analysis-processing" process, providing a reliable basis for operation and maintenance management and responsibility determination.

[0016] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating a substation integrated monitoring and management system according to the present invention. Figure 1 ; Figure 2 This is a schematic diagram of the process for generating the original multidimensional dataset in this invention; Figure 3 This is a schematic diagram of the process for obtaining standard data packets in this invention; Figure 4 This is a schematic diagram of the process of constructing a mesh sensor network with the master node as the core in this invention; Figure 5 This is a flowchart illustrating the network fault detection and network topology self-repair process in this invention. Figure 6 This is a schematic diagram of the process for obtaining the aligned dataset in this invention; Figure 7 This is a flowchart illustrating the feature fusion and security anomaly event determination process in this invention. Figure 8This is a schematic diagram of the process for triggering hierarchical alarms and linking substation equipment in this invention; Figure 9 This is a flowchart illustrating a substation integrated monitoring and management system according to the present invention. Figure 2 . Detailed Implementation

[0018] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0019] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0020] Please refer to Figure 1 This invention provides a substation integrated monitoring and management system, which may include: a data acquisition module for collecting node environment and substation operating status data from sensor nodes deployed in the target security area of ​​the substation, generating a raw multi-dimensional dataset; a data processing module for performing deep preprocessing on the raw multi-dimensional dataset and quality verification to obtain standard data packets; a data transmission module for constructing a mesh sensor network with the master node as the core based on a self-healing network topology control unit, transmitting the standard data packets to the master node, and performing network fault detection and network topology self-healing; a data decryption module for decrypting the encrypted standard data packets and synchronizing and aligning the multimodal data using timestamps and device identifiers to obtain an aligned dataset; and a feature fusion analysis module for extracting bimodal features from the aligned dataset using a voiceprint feature extraction unit and a behavior feature extraction unit, and performing feature fusion and abnormal event determination through a bimodal feature fusion unit.

[0021] Combination Figure 9 In this embodiment of the invention, the data acquisition module can be used to collect node environment and substation operation status data based on the sensor nodes deployed in the target security area of ​​the substation, and generate an original multi-dimensional dataset.

[0022] Please refer to Figure 2 In a preferred embodiment of the present invention, based on the sensor nodes deployed in the target security area of ​​the substation, data on the node environment and substation operating status are collected to generate an original multi-dimensional dataset, which may include: Step S110: Collect voiceprint data according to the voiceprint acquisition unit built into the sensing node.

[0023] In a preferred embodiment of the present invention, flexible sensing nodes resistant to extreme environments can be uniformly deployed in key areas such as the perimeter of the substation, equipment area, and main control room entrance, as well as extreme environmental areas such as high-voltage areas, outdoor open areas, and remote corners, according to the security requirements of the substation. The sensing nodes are made of weather-resistant flexible packaging materials and have the characteristics of resisting extreme temperatures, preventing electromagnetic interference, and preventing moisture and dust, making them suitable for different extreme scenarios.

[0024] In a preferred embodiment of the present invention, the voiceprint acquisition unit includes a high-sensitivity sound pickup module and a preliminary noise reduction submodule. The sound pickup module acquires full-band voiceprints of the deployment area in real time, covering normal operation sounds of the substation (e.g., stable equipment operation sounds, natural environmental sounds, etc.) and potentially abnormal voiceprints (e.g., friction sounds from illegal climbing, metal impact sounds from equipment prying, abnormal personnel activity sounds, etc.). The preliminary noise reduction submodule uses a basic filtering algorithm to filter high-frequency electromagnetic noise and outputs the original voiceprint data after preliminary noise reduction.

[0025] Step S120: Collect behavior-related data according to the behavior-related data acquisition unit built into the sensor node.

[0026] In a preferred embodiment of the present invention, the behavior-related data acquisition unit includes a miniature image acquisition submodule and a micro-vibration sensing submodule. The miniature image acquisition submodule captures continuous video frames in the area in real time, focusing on the shape and movement trajectory of people and objects. The micro-vibration sensing submodule synchronously acquires micro-vibration signals from the ground, walls, or equipment casing, capturing vibration characteristics generated by people stepping on objects, objects hitting objects, etc.

[0027] Step S130: Collect the status data of the sensor node according to the built-in environmental status acquisition unit of the sensor node.

[0028] In a preferred embodiment of the present invention, the environmental status acquisition unit collects environmental parameters such as temperature, humidity, and electromagnetic intensity of the environment in which the node is located in real time, as well as operating parameters such as the node's own power and the working status of the acquisition module, to provide a basis for subsequent data quality verification and network fault judgment.

[0029] Step S140: Using the local processing submodule built into the sensor node, encapsulate the voiceprint data, behavior association data and status data into a raw multi-dimensional dataset.

[0030] In a preferred embodiment of the present invention, the local processing submodule built into the sensing node adds a unique device identifier and a collection timestamp to each channel of collected data, and encapsulates the “voiceprint data-behavior association data-status data” into a raw data packet, which is then temporarily stored in the node’s local cache.

[0031] For example, in a high-altitude substation, flexible sensing nodes resistant to extreme environments are deployed: At the nodes deployed in the outdoor main transformer equipment area, the acoustic signature acquisition unit collects the low-frequency humming sound of the main transformer operating normally and occasional wind sounds from a distance; the behavior correlation data acquisition unit's miniature image acquisition submodule captures video frames of the equipment area where there is no personnel activity, and the micro-vibration sensing submodule collects stable vibration signals generated by the main transformer operation; the environmental status acquisition unit collects high-altitude low-temperature environmental parameters and node full-charge status data. All data is encapsulated into raw data packets after adding device numbers and timestamps and is temporarily stored in the node cache.

[0032] In this embodiment of the invention, the data processing module can be used to perform in-depth preprocessing on the original multi-dimensional dataset and perform quality verification to obtain a standard data packet.

[0033] Please refer to Figure 3 In a preferred embodiment of the present invention, deep preprocessing and quality verification are performed on the original multidimensional dataset to obtain a standard data package, which may include: Step S210: Adaptive noise cancellation algorithm is used to remove environmental noise from the voiceprint data and retain the voiceprint features of key frequency bands.

[0034] Step S220: Process the behavior-related data using distortion correction and resolution normalization methods to improve the accuracy of subsequent feature extraction.

[0035] Step S230: Use a smoothing filtering algorithm to remove random interference from the state data and extract the effective vibration waveform.

[0036] Step S240: Use the quality verification rule base to perform multi-dimensional quality verification on the preprocessed original multi-dimensional dataset.

[0037] In a preferred embodiment of the present invention, when performing multi-dimensional quality verification, the signal-to-noise ratio of the voiceprint data can be checked to see if it meets the standard, and blurry data with too low a signal-to-noise ratio can be eliminated; the clarity and frame rate of the video frame data in the behavior-related data can be checked, and blurry or dropped frame data caused by poor lighting or temporary module failure can be eliminated; the stability of the signal amplitude of the vibration data in the status data can be checked, and abrupt data caused by temporary sensor interference can be eliminated; at the same time, combined with the status data, if the environmental parameters exceed the normal working range of the sensing node, the corresponding data is marked as "to be reviewed".

[0038] Step S250: Keep the original multidimensional datasets that pass the quality check, discard the original multidimensional datasets that fail the quality check, and re-collect the data.

[0039] In a preferred embodiment of the present invention, data that passes quality verification can be marked as "valid" and retained; data that fails quality verification can be discarded directly; for data that is "to be reviewed", the corresponding acquisition module is instructed to re-acquire the data within a short period of time. If the re-acquired data still does not meet the standard, it is marked as invalid and the module status is recorded.

[0040] Step S260: Repackage all the original multidimensional datasets that have passed quality verification to obtain a standard data package.

[0041] In a preferred embodiment of the present invention, the local processing submodule repackages all "valid" data according to the association relationship of "voiceprint-behavior-state", adds a quality verification qualified identifier and a re-collection mark, forms a standard data packet, and waits to be transmitted through the access network.

[0042] For example, in the original data packets cached by the perimeter node of a coastal high-humidity substation, video frames had insufficient clarity due to dense fog. After verification by the local processing submodule, they were marked as "invalid" and discarded. The signal-to-noise ratio of the acoustic data met the standard after deep noise reduction, the vibration data waveform was stable, and the status data showed that the humidity was high but not beyond the node's working range. All three were marked as "valid". The system did not trigger a re-sampling instruction and finally encapsulated the valid data into a standard data packet, waiting for transmission.

[0043] In this embodiment of the invention, the data transmission module can be used to construct a mesh sensor network with the master node as the core based on the self-healing network topology control unit, transmit standard data packets to the master node, and perform network fault detection and network topology self-healing.

[0044] Please refer to Figure 4 In a preferred embodiment of the present invention, based on a self-healing network topology control unit, a mesh sensor network with a master node as its core is constructed, and standard data packets are transmitted to the master node, which may include: Step S310: Using a self-healing network topology control unit, deploy a master node in the main control room of the substation, and all sensor nodes deployed in the target security area of ​​the substation (e.g., flexible sensor nodes resistant to extreme environments) serve as slave nodes.

[0045] Step S320: Establish bidirectional communication links between "master node and slave node" and "slave node and slave node" to form an initial mesh topology.

[0046] Once started, the slave node automatically scans for surrounding slave nodes and master nodes. The master node stores the location, number, and neighbor node information of all slave nodes.

[0047] Step S330: A lightweight symmetric encryption algorithm is used to encrypt standard data packets by slave nodes and transmit them through a bidirectional communication link.

[0048] In a preferred embodiment of the invention, slave nodes closer to the master node directly transmit encrypted data packets to the master node; slave nodes farther away relay the packets through neighboring slave nodes until the standard data packets reach the master node. During transmission, each relay node verifies the integrity of the standard data packets to ensure that the data is not corrupted.

[0049] Please refer to Figure 5 In a preferred embodiment of the present invention, network fault detection and network topology self-repair may include: Step S301: The master node monitors the status of the slave node through a periodic heartbeat mechanism. The slave node sends a heartbeat packet to the master node every preset period (for example, it may contain node running status and link quality parameters).

[0050] Step S302: The slave node monitors the packet loss rate and latency of the link with neighboring nodes. When the heartbeat packet is not received on time or the link parameters exceed the preset threshold, it is determined that the node is faulty or the link is interrupted, and a fault alarm is sent to the master node through the slave node.

[0051] Step S303: After receiving the fault alarm, the master node uses the topology reconstruction algorithm to analyze the fault location and surrounding available nodes, and performs network topology self-repair.

[0052] In a preferred embodiment of the present invention, if the link is interrupted, the slave nodes at both ends of the interrupted link are instructed to rescan the surrounding nodes and establish a new relay link; if the node is faulty, the slave nodes around the faulty node are instructed to expand the communication coverage, take over the data transmission task of the monitoring area of ​​the faulty node, and at the same time reallocate the relay path to complete the self-repair of the network topology.

[0053] In a preferred embodiment of the present invention, the energy harvesting module of the flexible sensing node resistant to extreme environments works synchronously. It collects environmental energy through a solar energy acquisition module and a vibration energy conversion module, and then supplies power to the node after storage and voltage regulation by the energy management submodule. With the help of a low-power transmission protocol, it can achieve passive long-term operation in extreme environments.

[0054] For example, in a high-altitude substation, a peripheral node in a perimeter wall experienced a temporary communication module failure due to low temperatures, failing to send heartbeat packets to the master node. The master node determined this as a node failure and triggered self-repair: it retrieved the location information of the faulty node and found two neighboring nodes. It then instructed these two nodes to increase their communication power and expand their coverage area to cover the original faulty node's region. Simultaneously, it adjusted the relay path, redirecting data from other nodes that were originally transmitted through the faulty node to the new neighboring node. After reconstruction, standard data packets from the surrounding nodes were successfully transmitted to the master node via the new link without any data interruption.

[0055] In this embodiment of the invention, the data decryption module can be used to decrypt encrypted standard data packets and perform multimodal data synchronization alignment using timestamps and device identifiers to obtain an aligned dataset.

[0056] Please refer to Figure 6 In a preferred embodiment of the present invention, the encrypted standard data packet is decrypted, and the multimodal data is synchronized and aligned using timestamps and device identifiers to obtain an aligned dataset, which may include: Step S410: Use a decryption algorithm that matches the slave node and the decryption module built into the master node to decrypt the encrypted standard data packet.

[0057] In a preferred embodiment of the present invention, the decrypted standard data packet can be decapsulated to extract "voiceprint valid data - behavior association valid data - status data" and the corresponding device identifier and timestamp information, and then transmitted to the preprocessing unit of the dual-modal security processing layer.

[0058] Step S420: Using the preprocessing unit, perform format unification processing on the data in the decrypted standard data packet to obtain standardized data.

[0059] In a preferred embodiment of the present invention, voiceprint data can be converted into a standard spectral data format; video frame data can be converted into a uniform resolution image format and key frames can be extracted; vibration data can be converted into a standard time-domain waveform format; and the state data can be numerically normalized to form standardized data.

[0060] Step S430: Using timestamps as the core index, standardized data are associated and bound through preprocessing units to form a unified "time-space-multimodal" aligned dataset.

[0061] In a preferred embodiment of the invention, the preprocessing unit uses timestamps as the core index and combines them with device identifiers to associate and bind voiceprint data, video keyframes, and vibration data collected at the same time and from the same device. For data with slight timestamp discrepancies, a linear interpolation algorithm is used for time calibration. For data collected from the same area across devices, spatial association is performed based on device location information to form a unified "time-space-multimodal" aligned dataset. Furthermore, the aligned dataset is temporarily stored in the cache database of the dual-modal security processing layer, with an index directory established for subsequent feature extraction modules to access as needed. The data source and processing status are also marked for easy traceability.

[0062] For example, the master node receives encrypted data packets from two adjacent slave nodes at the east gate of the substation. After decryption, it obtains standard data containing acoustic signatures, video, vibration, and status data. The preprocessing unit converts the acoustic signature data into a spectrogram, extracts keyframes from one frame per second of the video frame and standardizes the resolution, and converts the vibration data into a time-domain waveform. Through timestamp calibration, a slight time difference is found between the data collected by the two nodes. After interpolation calibration, the acoustic signatures of the east gate area, video keyframes from different angles, and wall vibration data collected by the two nodes at the same time are associated and bound to form an aligned dataset, which is then stored in the cache database.

[0063] In this embodiment of the invention, the feature fusion analysis module can be used to extract bimodal features from the aligned dataset using the voiceprint feature extraction unit and the behavior feature extraction unit, and to perform feature fusion and abnormal event determination through the bimodal feature fusion unit.

[0064] Please refer to Figure 7 In a preferred embodiment of the present invention, a voiceprint feature extraction unit and a behavior feature extraction unit are used to extract bimodal features from an aligned dataset, and a bimodal feature fusion unit is used to perform feature fusion and security anomaly event determination, which may include: Step S510: Using the Mel frequency cepstral coefficient algorithm, extract the voiceprint features (e.g., spectral features, energy change features, and frequency peak features) from the voiceprint data, and perform similarity matching with the preset substation voiceprint feature library (e.g., containing normal voiceprint template library and abnormal voiceprint template library) to generate a voiceprint similarity score and the matched voiceprint type.

[0065] Step S520: Using target detection and tracking algorithms, extract behavioral features (e.g., contour features of people / objects, movement trajectory features, action features, etc.) from the behavioral association data, and perform similarity matching with the preset substation behavioral feature library (e.g., normal behavior template library and abnormal behavior template library) to generate behavioral similarity scores and matched behavioral types.

[0066] In a preferred embodiment of the present invention, the vibration amplitude, frequency and duration features can be extracted from the vibration data using a frequency analysis algorithm, and the two types of features can be fused into a behavioral feature vector.

[0067] Step S530: Based on the voiceprint similarity score and the matched voiceprint type, and the behavior similarity score and the matched behavior type, use a Bayesian fusion model to calculate the joint probability of the fused features pointing to security anomalies.

[0068] In a preferred embodiment of the present invention, when the similarity of a single modality meets the standard but the similarity of another modality does not meet the standard, the joint probability can be reduced to avoid misjudgment; when the similarity of both modalities meets the standard, the joint probability can be increased to ensure that the false negative rate is reduced.

[0069] Step S540: When the joint probability exceeds the preset threshold of the joint probability, it is determined to be a security anomaly event, and the security anomaly event is classified.

[0070] In a preferred embodiment of the present invention, the types of dual-modal feature matching can be combined to classify security anomalies, including illegal climbing over walls, illegal entry into equipment areas, malicious damage to equipment, and abnormal lingering of personnel.

[0071] Step S550: When the joint probability does not exceed the preset threshold of the joint probability, it is determined to be a normal event, and only the data is recorded without triggering subsequent alarms.

[0072] For example, when the substation is operating at night, the aligned dataset from the nodes of the east gate perimeter wall is input into the dual-modal security processing layer: the voiceprint feature extraction subunit extracts a feature vector of a high-frequency friction sound, which has a high similarity score with the abnormal voiceprint template of "illegally climbing over the wall"; the behavior feature extraction subunit detects the trajectory features of a human silhouette moving along the wall from video keyframes, and extracts the feature vector of continuous vibration of the wall from vibration data, which meets the similarity score with the abnormal behavior template of "illegally climbing over the wall". The dual-modal feature fusion unit calculates that the joint probability exceeds the threshold, and determines it as an abnormal event of "illegally climbing over the wall", and the classification result is transmitted to the intelligent alarm unit.

[0073] In this embodiment of the invention, the alarm linkage module can be used to trigger hierarchical alarms and link substation equipment based on the determined results of security anomalies by utilizing the intelligent alarm unit.

[0074] Please refer to Figure 8 In a preferred embodiment of the present invention, the use of an intelligent alarm unit to trigger tiered alarms and link substation equipment based on the determined results of security anomalies may include: Step S610: The intelligent alarm unit receives the abnormal event judgment result and classification information, and triggers graded alarms according to the severity of the security abnormal event.

[0075] Step S620: When a Level 1 alarm is triggered (e.g., malicious damage to equipment), the on-site audible and visual alarm device is triggered to send alarm information (e.g., abnormal location, type, real-time data, etc.) to the mobile terminal of the substation maintenance personnel, and a pop-up notification is displayed through the security management platform.

[0076] Step S630: When a level 2 alarm is triggered (e.g., illegal trespassing), the on-site audible and visual alarm device is activated, and alarm information is sent to the mobile terminal of the substation maintenance personnel.

[0077] Step S640: When a Level 3 alarm is triggered (e.g., suspected anomaly), only a prompt message is sent to the substation operation and maintenance platform, and the data is retained for manual review.

[0078] Step S650: The intelligent alarm unit links with the substation security equipment to take pictures of abnormal areas, lock access control equipment, and turn on lighting equipment.

[0079] In a preferred embodiment of the present invention, when the intelligent alarm unit is linked with the existing security equipment in the substation, it can link the high-definition PTZ camera in the area of ​​the security anomaly to focus and capture the scene details; link the access control equipment in the area of ​​the security anomaly to lock to prevent abnormal personnel from spreading their activities; and link the lighting equipment to turn on (for example, in a night scene) to improve the clarity of video capture.

[0080] In this embodiment of the invention, the optimization feedback module can be used to analyze the associated data of abnormal events using the dual-modal security processing layer, send optimization feedback instructions to the self-healing network topology control unit to achieve network optimization feedback, and transmit the associated data to the blockchain evidence storage module.

[0081] In a preferred embodiment of the present invention, the dual-modal security processing layer analyzes the running data of slave nodes associated with security anomalies. If it finds that the data acquisition accuracy of slave nodes in a certain area is insufficient or the transmission delay is high, it sends an optimization feedback instruction to the self-healing network topology control unit. The self-healing network topology control unit adjusts the acquisition frequency, communication power or relay path of slave nodes in that area according to the instruction to improve the quality of subsequent data acquisition and transmission.

[0082] In a preferred embodiment of the present invention, the determination result of security anomalies, the associated raw data, the processing log and alarm records are synchronously transmitted to the blockchain evidence storage module to generate an immutable blockchain transaction record, forming a trusted traceability chain for the entire process of "collection-analysis-disposal" for subsequent auditing and responsibility determination.

[0083] For example, upon receiving a Level 2 alarm command for "illegally climbing over the wall," the intelligent alarm unit immediately triggers the audio-visual alarm device at the east gate to issue a warning; it pushes alarm information, including the location of the east gate, the type of anomaly, on-site audio clips, and video screenshots, to the mobile terminals of maintenance personnel; it also activates the high-definition PTZ camera at the east gate to focus on the point of wall climbing and locks the east gate access control system. Simultaneously, the dual-modal security processing layer detects a slightly high transmission latency in one of the two slave nodes at the east gate and sends feedback to the self-healing network topology control unit, instructing that node to adjust its communication power. All anomaly data and processing logs are synchronously uploaded to the blockchain for evidence storage. After receiving the information, maintenance personnel rush to the scene to handle the situation, and afterwards, the entire process data can be traced through the blockchain.

[0084] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0086] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0087] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0088] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0089] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0090] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0091] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0092] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A substation integrated monitoring and management system, characterized by, The monitoring management system comprises: A data acquisition module for acquiring node environment and substation operation state data from a sensing node deployed in a target security area of a substation to generate an original multi-dimensional data set; A data processing module for deep preprocessing of the original multi-dimensional data set and quality checking to obtain a standard data package; A data transmission module for constructing a mesh sensing network with a main node as the core based on a self-repairing network topology control unit, transmitting the standard data package to the main node, and detecting network faults and self-repairing network topology; A data decryption module for decrypting the encrypted standard data package and synchronously aligning multi-modal data through time stamp and device identification to obtain an aligned data set; A feature fusion analysis module for extracting dual-modal features from the aligned data set by a voiceprint feature extraction unit and a behavior feature extraction unit and performing feature fusion and abnormal event determination through a dual-modal feature fusion unit.

2. The substation integrated supervisory management system according to claim 1, characterized by, The sensing node deployed in the target security area of the substation acquires node environment and substation operation state data to generate an original multi-dimensional data set, comprising: Acquiring voiceprint data from a voiceprint acquisition unit built in the sensing node; Acquiring behavior correlation data from a behavior correlation data acquisition unit built in the sensing node; Acquiring state data of the sensing node from an environment state acquisition unit built in the sensing node; Using a local processing sub-module built in the sensing node to encapsulate the voiceprint data, behavior correlation data and state data into an original multi-dimensional data set.

3. The substation integrated supervisory management system according to claim 2, characterized by, The original multi-dimensional data set is deeply preprocessed and quality checked to obtain a standard data package, comprising: Using an adaptive noise cancellation algorithm to remove environmental noise from the voiceprint data; Using a distortion correction and resolution normalization processing method to process the behavior correlation data; Using a smoothing filter algorithm to remove random interference from the state data; Using a quality checking rule library to perform multi-dimensional quality checking on the preprocessed original multi-dimensional data set; Retaining the original multi-dimensional data set that passes the quality check and discarding the original multi-dimensional data set that fails the quality check and reacquiring data; Re-encapsulating all the original multi-dimensional data sets that pass the quality check to obtain a standard data package.

4. The substation integrated supervisory management system according to claim 1, characterized by, The self-repairing network topology control unit is used to construct a mesh sensing network with a main node as the core and transmit the standard data package to the main node, comprising: Using a self-repairing network topology control unit to deploy a main node in the main control room of the substation, with all sensing nodes deployed in the target security area of the substation as slave nodes; Establishing a bidirectional communication link between the master node and the slave nodes and between the slave nodes to form an initial mesh topology; Using a lightweight symmetric encryption algorithm to encrypt the standard data package through the slave nodes and transmit it through the bidirectional communication link.

5. The substation integrated supervisory management system according to claim 4, characterized by, The network fault detection and network topology self-repairing comprises: The main node monitors the slave node state through a periodic heartbeat mechanism, and the slave node sends a heartbeat packet to the main node every preset period. The slave node monitors the packet loss rate and delay of the link with the neighbor node, and determines that the node fails or the link is interrupted when the heartbeat packet is not received on time or the link parameters exceed the preset threshold, and sends a failure alarm to the master node; After receiving the failure alarm, the master node analyzes the failure position and the available nodes in the surrounding area by using a topology reconstruction algorithm to perform network topology self-repair.

6. The substation integrated supervisory management system according to claim 1, characterized by, The encrypted standard data packet is decrypted, and the multi-modal data is synchronized and aligned through the timestamp and the device identifier to obtain an aligned data set, including: The encrypted standard data packet is decrypted by using a decryption algorithm matched with the slave node and a decryption module built in the master node; The data in the decrypted standard data packet is uniformly processed in format by using a preprocessing unit to obtain standardized data; The standardized data is associated and bound by using the preprocessing unit with the timestamp as the core index to form a unified aligned data set of "time-space-multi-modal".

7. The substation integrated supervisory management system according to claim 1, characterized by, The double-modal features are extracted from the aligned data set by using a voiceprint feature extraction unit and a behavior feature extraction unit, and the features are fused by using a double-modal feature fusion unit to determine the security and protection abnormal event, including: The voiceprint features of the voiceprint data are extracted by using a mel-frequency cepstral coefficient algorithm, and similarity matching is performed with a preset substation voiceprint feature library to generate a voiceprint similarity score and a matched voiceprint type; The behavior features of the behavior correlation data are extracted by using a target detection and tracking algorithm, and similarity matching is performed with a preset substation behavior feature library to generate a behavior similarity score and a matched behavior type; Based on the voiceprint similarity score and the matched voiceprint type, the behavior similarity score and the matched behavior type, a Bayesian fusion model is used to calculate the joint probability of the fused features pointing to the security and protection abnormal event; When the joint probability exceeds a preset joint probability threshold, it is determined that there is a security and protection abnormal event, and the security and protection abnormal event is classified; When the joint probability does not exceed the preset joint probability threshold, it is determined that there is a normal event.

8. The substation integrated supervisory management system of claim 1, wherein, The monitoring management system further includes: An alarm linkage module is configured to trigger hierarchical alarms and link the substation equipment according to the determined security and protection abnormal event results by using an intelligent alarm unit.

9. The substation integrated supervisory management system according to claim 8, characterized by, The intelligent alarm unit triggers hierarchical alarms and links the substation equipment according to the determined security and protection abnormal event results, including: The intelligent alarm unit receives the abnormal event determination results and classification information, and triggers hierarchical alarms according to the severity of the security and protection abnormal event; When a first-level alarm is triggered, an on-site sound and light alarm device is triggered, alarm information is sent to a substation operation and maintenance personnel mobile terminal, and a pop-up window is prompted on a security and protection management platform; When a second-level alarm is triggered, the on-site sound and light alarm device is triggered, and alarm information is sent to the substation operation and maintenance personnel mobile terminal; When a third-level alarm is triggered, only prompt information is sent to the substation operation and maintenance platform; The intelligent alarm unit links the security and protection equipment of the substation to take photos of the abnormal area, lock the access control equipment, and turn on the lighting equipment.

10. The substation integrated supervisory management system of claim 1, wherein, The monitoring management system further includes: The optimization feedback module is used for analyzing the associated data of the abnormal event by using the dual-mode security processing layer, sending an optimization feedback instruction to the self-repairing network topology control unit to realize network optimization feedback, and transmitting the associated data to the blockchain storage module.

Images