Substation network message analysis method, system and equipment based on semantic recognition and medium

Abstract

The invention discloses a substation network message analysis method, system and equipment based on semantic recognition and a medium, and the method comprises the following steps: capturing a communication message in an intelligent substation network to form an original message data set, and preprocessing the original message data set to form a preprocessed data set; performing feature extraction on the preprocessed data set, fusing binary features and text features by adopting a double-flow hybrid architecture, and constructing a hierarchical feature set; performing semantic disambiguation, information extraction and intention recognition according to the structured syntax tree, and recognizing a message intention; and analyzing the transformer substation network message based on the message intention, extracting key information, and generating structured output. According to the method, the binary structure feature and the text semantic feature of the message are processed at the same time by adopting the double-flow hybrid architecture, the hierarchical feature set from the physical layer to the application layer is constructed, and unified characterization and accurate recognition of various power communication protocols are achieved.

Description

Technical Field

[0001] This invention relates to the field of smart grid communication technology, and in particular to a method, system, device and medium for parsing substation network messages based on semantic recognition. Background Technology

[0002] Smart substations are core nodes of smart grids, relying on advanced communication, information, and control technologies to achieve intelligent monitoring, automated operation, and optimized operation of equipment within the substation. As a crucial foundation supporting its advanced applications, network communication carries massive amounts of real-time, heterogeneous message data. However, current smart substation network protocols exhibit significant diversity: although the IEC 61850 standard is widely adopted, its framework still includes various protocols such as GOOSE (Gross Events for General Objects), SV (Sample Values), and MMS (Manufacturing Message Specifications) to meet different real-time requirements. Furthermore, various manufacturers' proprietary protocols also exist in practical applications. This fragmentation of the protocol system, while satisfying specific functional requirements, leads to heterogeneity in network message formats and semantics. Traditional parsing methods based on predefined templates or fixed rules often suffer from poor adaptability, maintenance difficulties, and insufficient parsing accuracy when faced with complex, variable, and even non-standard protocol messages.

[0003] Domestic smart substations widely adopt various network protocols, including GOOSE and MMS message protocols under the DL / T860 (IEC61850) framework, as well as IEC60870-5-104, NARI Network 103 protocol, and Beijing Sifang Network 103 protocol. Among them, IEC 61850, as a globally accepted standard, has effectively promoted the standardization of smart substation implementation and flexible information exchange between devices by defining a layered system of station control layer, bay layer, and process layer, and object-oriented data modeling (adopting a client / server architecture). However, this coexistence of multiple protocols (covering international standards, industry protocols, and manufacturer-specific protocols) has led to significant differences in the syntax and inherent semantics of network messages. Traditional message parsing methods that rely on manually predefined rules or fixed templates are unable to achieve efficient, accurate, and adaptive understanding and processing in such a complex, dynamic, and semantically heterogeneous message environment, becoming a key bottleneck restricting the deepening of advanced applications and data value mining in smart substations.

[0004] GOOSE (Generic Object Oriented Substation Event) is a substation automation communication service defined in the IEC 61850 standard, employing a publish / subscribe model to achieve fast and reliable data transmission. MMS (Manufacturing Message Specification), as the communication implementation protocol of the IEC 61850 standard, supports communication between devices in a peer-to-peer network through the mapping from the Special Communication Service Interface (ACSI) to MMS. The IEC 60870-5-104 protocol is a communication protocol between power plants and distribution network master stations in a power system. Based on Ethernet transmission and employing a balanced service mode, it is typically used for data exchange between the dispatching end (master station / client) and the server end (substation / RTU / TTU, etc.). The NARI Network 103 protocol and the Beijing Sifang Network 103 protocol are power system-specific communication protocols customized by enterprises according to specific needs.

[0005] Semantic recognition technology is an advanced technology based on Natural Language Processing (NLP) and Artificial Intelligence (AI). Its core lies in extracting deep-level information by analyzing the semantic content of text or signals. This technology enables the understanding and reasoning of complex information through multi-level data analysis, including lexical, syntactic, and semantic levels. In the field of industrial communication, the application of semantic recognition technology is increasingly demonstrating its enormous potential, especially in substation message parsing and data processing for multimodal sensing terminals, providing new solutions for improving communication efficiency and fault detection capabilities. Summary of the Invention

[0006] In view of the aforementioned existing problems, the present invention is proposed.

[0007] Therefore, this invention provides a method, system, device, and medium for parsing substation network messages based on semantic recognition to solve the problems of poor compatibility, low processing efficiency, and complex parsing in the current domestic smart substation networks due to the coexistence of multiple protocols, each with different characteristics in function and application.

[0008] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a substation network message parsing method based on semantic recognition, comprising the following steps: capturing communication messages in a smart substation network to form an original message dataset, and preprocessing the original message dataset to form a preprocessed dataset; extracting features from the preprocessed dataset, using a dual-stream hybrid architecture to fuse binary features and text features to construct a hierarchical feature set; segmenting and tagging the text content in the messages using the hierarchical feature set and the preprocessed dataset, performing syntactic analysis, and outputting a structured syntax tree; performing semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree to identify the message intent; and parsing the substation network messages based on the message intent to extract key information and generate structured output.

[0009] As a preferred embodiment of the substation network message parsing method based on semantic recognition described in this invention, the preprocessing step of the original message dataset includes: denoising, removing irrelevant information, formatting, protocol filtering, and abnormal traffic cleaning operations on the original message dataset; the denoising operation is used to remove message errors caused by channel noise; the removal of irrelevant information is used to strip redundant fields that are only used for underlying communication verification or are unrelated to protocol parsing; the formatting is used to convert message data from different sources or formats into a unified structured representation; the protocol filtering is used to filter out messages of specific protocols; and the abnormal traffic cleaning is used to identify and remove abnormal traffic messages that do not conform to network communication specifications, have format errors, or are suspected of being generated by malicious attacks.

[0010] As a preferred embodiment of the substation network message parsing method based on semantic recognition described in this invention, the step of constructing the hierarchical feature set includes: performing multimodal input preprocessing on the preprocessed dataset, converting the preprocessed dataset into a binary stream and a text stream; using a dual-stream deep learning model to process the binary stream and the text stream respectively, with the first branch using a convolutional neural network (CNN) to process the binary stream and extract fixed structure features; and the second branch using a Transformer to process the text stream and extract semantic features; fusing the output features of the CNN and the Transformer to form dual-stream output features; and extracting key features of different protocol layers from the dual-stream output features, including physical layer features, data link layer features, transport layer features, and application layer features, to form a hierarchical feature set.

[0011] The beneficial effects of this preferred technical solution are: by using a dual-stream deep learning model to process binary streams and text streams respectively, it can simultaneously capture the low-level structural features and high-level semantic features of the message, thus solving the problem of information loss caused by traditional methods that only focus on a single feature.

[0012] As a preferred embodiment of the substation network message parsing method based on semantic recognition described in this invention, the preprocessing of the preprocessed dataset includes: converting the preprocessed dataset into a fixed-length byte sequence to form a binary stream; generating a sub-word sequence using a byte-level word segmenter for text protocols; and extracting semantic units by parsing the binary structure for non-text protocols to generate a pseudo-text sequence.

[0013] As a preferred embodiment of the substation network message parsing method based on semantic recognition described in this invention, the step of outputting a structured syntax tree includes: obtaining the application layer protocol type using the hierarchical feature set; selecting the corresponding parsing method according to the application layer protocol type; extracting the request line or status line, header fields, and message body text layer by layer, and retaining the delimiters as syntax anchors; selecting the corresponding word segmentation method according to the application layer protocol type; quickly matching the protocol-specific dictionary according to the Trie tree; inputting the word segmentation sequence and application layer protocol type features; performing part-of-speech tagging using a sequence labeling model and a protocol-specific part-of-speech tag set; and parsing dependency relations using a protocol syntax rule engine based on a graph neural network (GNN) to output a structured syntax tree.

[0014] The beneficial effects of this preferred technical solution are: after obtaining the application layer protocol type using a hierarchical feature set, the optimal word segmentation method and parsing strategy can be selected for different protocols, avoiding parsing errors caused by the traditional unified processing method.

[0015] As a preferred embodiment of the substation network message parsing method based on semantic recognition described in this invention, the sequence labeling model adopts 128-dimensional word vectors.

[0016] As a preferred embodiment of the substation network message parsing method based on semantic recognition described in this invention, the steps of semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree include: constructing a protocol-specific context vector, disambiguating polysemous words in the message, and combining domain knowledge graphs to assist semantic judgment; using a BiLSTM-CRF model for named entity recognition to identify key information entities in the protocol context; extracting triples of relationships between entities to extract hierarchical data content in nested structures; fusing binary stream features and text stream semantic features, and using a hierarchical intent recognition model to identify message intent; performing protocol compliance checks on the identified message intent, using anomaly detection algorithms to detect abnormal intent combinations, performing session consistency checks, filtering misidentification results and correcting semantic deviations, and outputting the verified message intent.

[0017] The beneficial effects of this preferred technical solution are: by constructing a protocol-specific context vector for semantic disambiguation and combining it with domain knowledge graphs for auxiliary judgment, it is possible to understand the professional terms and specific semantics in power communication protocols.

[0018] Secondly, the present invention provides a substation network message parsing system based on semantic recognition, comprising: a message collection module, used to capture communication messages in a smart substation network, form an original message dataset, and perform preprocessing to obtain a preprocessed dataset; The protocol feature extraction module is used to extract features from the preprocessed dataset. It adopts a dual-stream hybrid architecture to fuse binary features and text features to construct a hierarchical feature set. The word segmentation and syntactic analysis module is used to segment and tag the part-of-speech tags of the text content in the message using the hierarchical feature set and the preprocessed dataset, perform syntactic analysis, and output a structured syntax tree. The semantic analysis module is used to perform semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree, and to identify the message intent. The parsing and output module is used to parse substation network messages based on message intent, extract key information, and generate structured output.

[0019] Thirdly, the present invention provides an electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the substation network message parsing method based on semantic recognition.

[0020] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the semantic recognition-based substation network message parsing method.

[0021] Compared with existing technologies, the beneficial effects of this invention are as follows: By employing a dual-stream hybrid architecture to simultaneously process the binary structural features and textual semantic features of messages, a hierarchical feature set from the physical layer to the application layer is constructed, achieving unified representation and accurate identification of multiple power communication protocols. Compared with traditional methods based on fixed rules or template matching, this invention can automatically learn message features, reducing reliance on manually predefined rules and significantly improving the accuracy of protocol identification and the efficiency of message parsing, especially demonstrating stronger adaptability when handling non-standard protocols and complex semantic scenarios.

[0022] By employing protocol-aware word segmentation, syntax-enhanced part-of-speech tagging, and structure-aware syntactic analysis, combined with multi-level semantic analysis techniques, accurate understanding of the deep semantics and intent of messages is achieved. Domain knowledge graph-assisted semantic disambiguation, named entity recognition for key information extraction, multi-modal intent recognition fusing multi-source features, and intent verification and correction mechanisms ensure the reliability of the results, forming a complete semantic understanding and verification closed loop. This method can not only accurately extract key information such as equipment status, measured values, and alarm signals, but also identify abnormal behaviors and potential security threats, providing strong support for real-time monitoring, fault diagnosis, and security protection of substation networks. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the overall process of a substation network message parsing method based on semantic recognition according to an embodiment of the present invention. Detailed Implementation

[0025] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0026] Example 1, referring to Figure 1 As an embodiment of the present invention, a substation network message parsing method based on semantic recognition is provided, including the following steps S100~S500: S100. Capture communication messages in the smart substation network to form an original message dataset, and preprocess the original message dataset to form a preprocessed dataset.

[0027] S200. Feature extraction is performed on the preprocessed dataset. A dual-stream hybrid architecture is used to fuse binary features and text features to construct a hierarchical feature set.

[0028] S300. Using the hierarchical feature set and the preprocessed dataset, the text content in the message is segmented and labeled with part-of-speech tags, syntactic analysis is performed, and a structured syntax tree is output.

[0029] S400. Perform semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree to identify the message intent.

[0030] S500 parses substation network messages based on message intent, extracts key information, and generates structured output.

[0031] It should be noted that smart substations, as core nodes of smart grids, carry massive, real-time, and heterogeneous message data in their network communications. Currently, smart substation network protocols exhibit diversity, including multiple protocols under the IEC 61850 standard framework such as GOOSE, SV, and MMS, as well as industry protocols and manufacturer-specific protocols such as IEC 60870-5-104, NARI Network 103 protocol, and Beijing Sifang Network 103 protocol. This coexistence of multiple protocols leads to significant differences in the syntax and inherent semantics of network messages, posing a significant challenge to message identification and parsing. Traditional parsing methods based on predefined rules or fixed templates often suffer from poor adaptability, maintenance difficulties, and insufficient parsing accuracy when faced with complex, variable, and even non-standard protocol messages. They struggle to accurately understand the deep semantics of the messages and cannot effectively support the real-time monitoring, fault diagnosis, and security protection needs of substation networks.

[0032] Therefore, to address the aforementioned issues of protocol identification and message parsing, the S100-S500 steps employ a deep learning model to automatically learn the hierarchical features of messages, integrating binary structure and textual semantic information to achieve unified representation and accurate identification of multiple power communication protocols. Through protocol-aware word segmentation, grammar-enhanced part-of-speech tagging, and structure-aware syntactic analysis, a precise structured syntax tree is constructed. Combined with multi-level semantic analysis technology, accurate understanding of the deep semantics and intent of messages is achieved, accurately extracting key information such as equipment status, measured values, and alarm signals. Simultaneously, through protocol compliance checks, anomaly detection algorithms, and session consistency verification, abnormal behavior and potential security threats are identified, enabling intelligent parsing and real-time monitoring of substation network messages, providing reliable support for operation and maintenance decisions.

[0033] Example 2, refer to Figure 1 This is one embodiment of the present invention. Based on the above embodiment, a substation network message parsing method based on semantic recognition is provided.

[0034] In this embodiment of the application, the step of preprocessing the original message dataset in step S100 includes: performing noise reduction, removing irrelevant information, formatting, protocol filtering, and abnormal traffic cleaning operations on the original message dataset.

[0035] Specifically, denoising is used to remove message errors caused by channel noise. In the network communication process of smart substations, due to factors such as electromagnetic interference and signal attenuation, messages may generate bit errors or data corruption during transmission. Denoising can identify and correct these errors, or directly remove unrepairable damaged messages, ensuring the data quality of subsequent processing.

[0036] Removing irrelevant information involves stripping away redundant fields that are only used for underlying communication verification or are irrelevant to protocol parsing. For example, fields such as the preamble, start-of-frame delimiter, and frame check sequence (FCS) in an Ethernet frame are essential for physical layer transmission but have no practical significance for application layer protocol parsing. Removing these redundant fields can reduce data processing volume and improve parsing efficiency.

[0037] The formatting is used to convert message data from different sources or formats into a unified structured representation. Since there are various acquisition devices and packet capture tools in a smart substation network, the acquired messages may be stored in different formats, such as PCAP, PCAPNG, or pure binary streams. The formatting operation converts these different formats of data into a standardized structured representation, facilitating unified processing by subsequent algorithms.

[0038] The protocol filtering is used to filter out packets of specific protocols. Based on actual analysis needs, packets of the target protocol are filtered out from massive network traffic. For example, only packets of the IEC 61850 GOOSE protocol, MMS protocol, or IEC 60870-5-104 protocol are retained, while other protocol traffic irrelevant to the analysis task, such as ARP protocol and ICMP protocol, is filtered out, thereby focusing on in-depth analysis of the target protocol.

[0039] The abnormal traffic scrubbing process is used to identify and remove abnormal traffic packets that do not conform to network communication standards, contain format errors, or are suspected of being generated by malicious attacks. By checking key parameters such as the packet length field, checksum, and protocol header structure, obviously abnormal packets are identified, such as those with length field discrepancies, incorrect checksums, or missing protocol header fields. At the same time, malicious traffic characteristics such as suspected port scanning and denial-of-service attacks are detected, and these abnormal packets are removed from the dataset, ensuring the effectiveness and security of the preprocessed dataset.

[0040] In this embodiment of the application, the step of constructing the hierarchical feature set in step S200 includes A1 to A4: A1. Perform multimodal input preprocessing on the preprocessed dataset, converting the preprocessed dataset into binary streams and text streams.

[0041] The multimodal input preprocessing of the preprocessed dataset includes A1.1 to A1.3: A1.1 Convert the preprocessed dataset into a fixed-length byte sequence to form a binary stream.

[0042] For each message in the preprocessed dataset, the original data is read byte-by-byte and converted into a fixed-length byte sequence, such as 128 bytes or 256 bytes. Messages that are too short are padded with zeros to reach the fixed length; messages that are too long are truncated. Each byte has a value ranging from 0 to 255, forming a standardized binary stream input for consistent processing by the subsequent Convolutional Neural Network (CNN).

[0043] A1.2. Use a byte-level tokenizer to generate a sequence of sub-words for the text protocol.

[0044] For text protocol messages such as HTTP and JSON protocols in the preprocessed dataset, byte-level encoding (BPE) is used for tokenization. The byte-level tokenizer can decompose text content into sub-word units; for example, "application / json" is decomposed into sub-words such as "app", "lic", "ation", " / ", and "json", with each sub-word corresponding to a token identifier. This tokenization method can effectively handle out-of-vocabulary words and multilingual text, generating variable-length sub-word sequences and providing standardized text input for the Transformer model.

[0045] A1.3. For non-text protocols, semantic units are extracted by parsing the binary structure to generate pseudo-text sequences.

[0046] For non-text protocol messages in the preprocessed dataset, such as GOOSE and MMS protocols, these protocols use binary encoding and do not contain readable text content. By parsing their binary TLV structure (type-length-value structure), the key fields and data units in the protocol can be identified.

[0047] For example, by parsing the ASN.1 encoding structure of the MMS protocol, semantic units such as service type, object name, and data value can be extracted and converted into symbolic pseudo-text sequences, such as "MMS_Read_Service", "Device_LLN0", and "Status_Value", so that non-text protocols can also be processed by the Transformer model in a text-like form.

[0048] A2. A dual-stream deep learning model is used to process the binary stream and the text stream respectively. The first branch uses a convolutional neural network (CNN) to process the binary stream and extract fixed structure features; the second branch uses a Transformer to process the text stream and extract semantic features.

[0049] In this embodiment, the first branch of the Convolutional Neural Network (CNN) is specifically used to process the fixed-length byte sequence generated in step A1.1. The CNN model includes an embedding layer, multiple one-dimensional convolutional layers, activation function layers, and pooling layers. The embedding layer maps each byte value to an 8-dimensional vector representation; subsequently, multiple one-dimensional convolutional layers, using convolution kernels of different sizes such as 3 and 5, perform sliding convolution operations on the byte sequence to capture local fixed-position patterns, such as fixed-position features of MAC addresses, specific byte combinations of IP header checksums, etc. After introducing a non-linear transformation through the ReLU activation function, downsampling is performed through a max-pooling layer to reduce the feature dimension. Finally, a flattening operation converts the multi-dimensional feature map into a one-dimensional feature vector, which serves as the output feature of the CNN branch.

[0050] The second branch of the Transformer model is specifically designed to process the variable-length subword sequences or pseudo-text sequences generated in steps A1.2 and A1.3. The Transformer model includes a positional encoding layer and a multi-layer encoder. The positional encoding layer adds positional information to each token, enabling the model to perceive the relative positional relationships of elements in the sequence. The multi-layer encoder consists of four layers, each containing an eight-head self-attention mechanism and a feedforward neural network. The self-attention mechanism calculates the association strength between any two tokens in the sequence, capturing long-distance dependencies and semantic contextual information, such as the semantic association between "Content-Type" and "application / json" in an HTTP request header. After layer-by-layer abstraction by the multi-layer encoder, the first special token of the output sequence, the CLS vector, encodes the semantic summary information of the entire sequence, serving as the output feature of the Transformer branch.

[0051] A3. The output features of the Convolutional Neural Network (CNN) and the Transformer are fused to form dual-stream output features.

[0052] Specifically, the feature vector output from the CNN branch in step A2 is concatenated with the CLS vector output from the Transformer branch to form a comprehensive dual-stream output feature vector. For example, the CNN branch outputs a 4032-dimensional feature vector, and the Transformer branch outputs a 768-dimensional feature vector; concatenation yields a 4800-dimensional dual-stream output feature. Subsequently, the dual-stream output features are further processed by a self-attention fusion layer. This layer calculates attention weights, learns the interaction between binary and semantic features, and automatically assigns importance weights to different features. For example, for messages containing a fixed protocol header, the binary features extracted by the CNN have higher weights; for messages containing rich text content, the semantic features extracted by the Transformer have higher weights. After processing by the self-attention fusion layer, a fully connected layer reduces the high-dimensional feature vector to 512 dimensions, forming the final fused feature representation, which retains the underlying structural features while incorporating high-level semantic information.

[0053] A4. Extract key features of different protocol layers from the dual-stream output features, including physical layer features, data link layer features, transport layer features, and application layer features, to form a hierarchical feature set.

[0054] Specifically, key features of different protocol layers are extracted through the intermediate layer outputs of the deep learning model. In the physical and data link layers, features are extracted from the activation values ​​of the first convolutional layer of the CNN. These activation values ​​reflect fixed structural features of the physical and data link layers, such as MAC address distribution patterns and start-of-frame delimiters. In the transport layer, features are extracted from the attention weight distribution of the Transformer. The attention mechanism automatically identifies key transport layer fields such as port numbers and assigns high attention weights to these fields. For example, high weights are given to port "80" for HTTP or port "443" for HTTPS, thus identifying port number contextual features. In the application layer, the CLS vector output by the Transformer is directly used as application layer features. This vector encodes the semantic summary of the entire message at the application layer, such as the HTTP request method type, request path, header fields, and other complete application layer semantic information. The features of the different protocol layers mentioned above are organized hierarchically to form a structured hierarchical feature set HFS. This feature set comprehensively describes the complete feature spectrum of the message from the underlying physical transmission to the higher-level application semantics, providing rich feature inputs for subsequent protocol identification, message parsing and semantic understanding.

[0055] In an optional implementation, the processing of non-text protocols in step S200 can also employ a structured parsing method based on protocol specifications. By pre-constructing a syntax rule base for power communication protocols, such as the ASN.1 syntax rules of the IEC 61850 protocol family and the frame structure rules of the IEC 60870-5-104 protocol, a syntax parser automatically parses the structural fields of the binary message, extracting key information such as protocol type, service primitives, object identifiers, and data values, and directly generating a structured intermediate representation. This approach is particularly suitable for standard protocols with well-defined specifications and fixed structures, providing higher parsing accuracy and interpretability.

[0056] In another optional implementation, the dual-stream feature fusion in step S200 can also employ a fusion method based on a cross-attention mechanism. When fusing CNN output features and Transformer output features, a simple concatenation operation is not performed; instead, a cross-attention module is constructed, where CNN features serve as query vectors and Transformer features serve as key-value pairs. Through cross-attention calculation, CNN features can actively focus on semantic information related to them within Transformer features; simultaneously, Transformer features serve as query vectors and CNN features serve as key-value pairs, achieving bidirectional feature interaction. This bidirectional cross-attention fusion method can more fully exploit the complementary relationship between binary features and semantic features, further improving the quality of feature representation and the accuracy of protocol recognition.

[0057] In this embodiment of the application, the step of outputting the structured syntax tree in step S300 includes B1 to B4: B1. Use the hierarchical feature set to obtain the application layer protocol type, select the corresponding parsing method according to the application layer protocol type, and extract the request line or status line, header fields, and message body text layer by layer, retaining the delimiter as syntax anchor point.

[0058] Specifically, the application layer features in the hierarchical feature set HFS constructed in step S200 are used to identify the application layer protocol type of the message through a feature matching algorithm. The application layer features contain semantic summary information of the message. By calculating similarity with preset protocol feature templates, it is possible to accurately determine whether the message belongs to the HTTP, DNS, SMTP, or other power-specific protocols such as MMS or GOOSE. Once the application layer protocol type is determined, the corresponding parsing method is selected according to the standard specifications of that protocol.

[0059] Taking the HTTP protocol as an example, the parsing method first extracts the request line or status line, such as the request line "GET / api / v1 / data HTTP / 1.1" or the status line "HTTP / 1.1 200 OK"; then it extracts header fields, such as key-value pairs like "Content-Type: application / json" and "Host: 192.168.1.100"; finally, it extracts the message body text, such as JSON-formatted data like "{"device": "IEC61850", "status": "online"}". During the extraction process, special attention is paid to delimiters such as colons, equal signs, semicolons, quotation marks, and commas. These delimiters serve as syntax anchors, identifying the boundaries and hierarchical relationships between different fields.

[0060] For power-specific protocols such as MMS, the parsing method extracts data layer by layer based on its specific frame structure. For example, it extracts the service type field "Confirmed-Request-PDU", the object reference field "IEC61850Device.LLN0STSTSTModstVal", and the data value field from the MMS protocol data unit PDU, while retaining "stVal" and the data value field.

[0061] B2. Select the appropriate word segmentation method according to the application layer protocol type, and quickly match the protocol-specific dictionary according to the Trie tree.

[0062] In this embodiment, customized word segmentation methods are adopted for different application layer protocol types to adapt to the syntactic characteristics of each protocol. For text containing URL paths, such as the HTTP request path " / api / v1 / device / status", a slash-based splitting strategy is used to decompose the path into sub-path units such as "api", "v1", "device", and "status". For key-value pair data, such as the HTTP header "Content-Type: application / json", a mechanism is adopted to retain the key as a whole and intelligently segment the value. That is, "Content-Type" is retained as a complete key, while "application / json" is split into two sub-words, "application" and "json", based on slashes. For JSON format message bodies, a complete key retention strategy is applied, for example, "device" and "status" are retained as complete key names, while the value part is segmented according to data type. String values ​​may be further segmented, while numeric and boolean values ​​remain intact. For English text, Byte-Pair Encoding (BPE) sub-word segmentation technology is applied to decompose the text into common sub-word units.

[0063] After selecting the perceptual word segmentation method, a Trie tree data structure is used to quickly match the protocol-specific dictionary. The protocol-specific dictionary includes a request method dictionary, storing HTTP request methods such as "GET", "POST", "PUT", "DELETE", and "PATCH"; a status code dictionary, storing HTTP status codes such as "200", "404", and "500"; and a MIME type dictionary, storing content types such as "application / json", "text / html", and "image / png". For power-specific protocols, the dictionary also includes MMS service primitives such as "Read", "Write", and "GetNameList". As an efficient prefix tree data structure, the Trie tree can complete matching in O(m) time complexity, where m is the length of the string to be matched, improving the dictionary lookup efficiency during word segmentation. The Trie tree quickly identifies protocol keywords in the text, ensuring that these keywords are preserved as complete word units and avoiding incorrect segmentation.

[0064] B3. Input the word segmentation sequence and application layer protocol type features, and use the sequence labeling model and protocol-specific part-of-speech tag set for part-of-speech tagging. The sequence labeling model uses 128-dimensional word vectors.

[0065] Specifically, the word segmentation sequence generated in step B2, along with the application layer protocol type features, is used as input to the sequence labeling model for part-of-speech tagging. The sequence labeling model adopts an architecture based on Conditional Random Fields and a Bidirectional Long Short-Term Memory (CRF-BiLSTM) network. First, each word in the word segmentation sequence is mapped to a 128-dimensional word vector representation through a word embedding layer. The word vector captures the semantic information of the word. The application layer protocol type features are represented using one-hot encoding, for example, HTTP protocol is encoded as [1, 0, 0, 0], and MMS protocol is encoded as [0, 1, 0, 0]. These features are then converted into protocol type vectors through the embedding layer and concatenated with the word vectors as input to the Bidirectional Long Short-Term Memory (BiLSTM) network.

[0066] The Bidirectional Long Short-Term Memory (BiLSTM) network has a hidden layer dimension of 256, comprising two directions: a forward LSTM and a backward LSTM. The forward LSTM processes the sequence from left to right, capturing the context information to the left of each word; the backward LSTM processes the sequence from right to left, capturing the context information to the right of each word. The hidden layer outputs from both directions are concatenated to form a 512-dimensional context representation vector, which simultaneously contains the semantic information of the context from both the left and right sides of the word.

[0067] Subsequently, the context representation vector is fed into a Conditional Random Field (CRF) layer for sequence labeling. The CRF layer can model the transition probabilities between labels. For example, the request method PROTO_VERB is usually followed by a resource path PROTO_PATH, rather than a boolean value PROTO_BOOL. By learning these label transition patterns, the CRF layer can output the globally optimal label sequence.

[0068] Part-of-speech tagging uses a protocol-specific part-of-speech tag set, which contains seven categories of protocol-specific parts of speech: Request method PROTO_VERB indicates a request method or operation command, such as "GET" or "Read"; Resource path PROTO_PATH identifies a resource path or data object identifier, and header field name PROTO_KEY corresponds to the header field name; Header field value PROTO_VALUE corresponds to the header field value; Separator PROTO_SEP marks the protocol separator; Numeric status code PROTO_NUM covers numeric protocol parameters; Boolean value PROTO_BOOL is used for Boolean value representation.

[0069] After processing by the sequence labeling model, each word in the segmented sequence is labeled with its corresponding part-of-speech tag. For example, in the HTTP request line “GET / api / v1 HTTP / 1.1”, “GET” is labeled as PROTO_VERB, “ / ” is labeled as PROTO_SEP, “ / api / v1” is labeled as PROTO_PATH, and “HTTP / 1.1” is labeled as the protocol version identifier.

[0070] B4. Using the protocol syntax rule engine, dependency relations are parsed based on graph neural network (GNN), and a structured syntax tree is output.

[0071] In this embodiment, the protocol syntax rule engine predefines syntax rules for various power communication protocols. For example, the HTTP protocol syntax rules define that the request line consists of the request method, resource path, and protocol version; header fields consist of field names, colon separators, and field values; and the message body can be a JSON object or an XML document, etc. The MMS protocol syntax rules define that a PDU consists of service type, call identifier, and service parameters; and object references are composed of namespaces, logical nodes, data objects, and data attributes, combined hierarchically through separators.

[0072] The dependency parsing module based on Graph Neural Networks (GNNs) constructs a graph structure from the part-of-speech tagged sequences. Each node in the graph represents a word and its part-of-speech tag, and the edges between nodes represent possible dependency relationships between words. Through a multi-layer message passing mechanism, the GNN allows each node to aggregate information from its neighbors and learn the strength of dependency relationships between nodes.

[0073] By combining the prior rule constraints provided by the protocol syntax rule engine, the dependency parsing results of GNN are further optimized and validated. For example, according to the HTTP protocol syntax rules, the request method PROTO_VERB must be the root node of the request line, and the resource path PROTO_PATH is a direct dependent child node of the request method. Through this rule constraint, it is ensured that the parsed dependency relationships conform to the protocol syntax specifications.

[0074] Finally, based on part-of-speech tagging information and dependency parsing results, a structured syntax tree T is constructed. The structured syntax tree represents the hierarchical syntactic relationships of a message in a tree structure. The root node is typically the main operation type of the message, such as the HTTP request method or MMS service type. Child nodes expand layer by layer according to dependency relationships, and leaf nodes represent specific field values. The structured syntax tree clearly expresses the syntactic structure of the message and the hierarchical relationships between fields, providing precise structured input for subsequent semantic analysis.

[0075] In an optional implementation, the word segmentation process in step S300 can also employ an end-to-end word segmentation method based on neural networks. This method directly processes the original character sequence using a Bidirectional Long Short-Term Memory (BiLSTM) network or a Transformer model, automatically learning segmentation boundaries through character-level sequence labeling and outputting the segmentation results. This approach does not rely on predefined dictionaries and segmentation rules, and can better adapt to new words and out-of-vocabulary (OV) words. It is particularly suitable for scenarios with frequent protocol version updates and a large number of new field names, improving the flexibility and adaptability of word segmentation.

[0076] In another optional implementation, the syntactic analysis in step S300 can also employ a transfer-based dependency parsing method. By defining a series of syntactic transfer operations, such as shift, reduction, left arc, and right arc, and utilizing stack and buffer data structures, dependency relationships can be constructed within linear time complexity. Combining this with neural network prediction of the optimal transfer operation at each step enables efficient parsing of the syntactic structure of long message sequences. This approach offers higher computational efficiency when processing large-scale message streams and is suitable for online monitoring scenarios with high real-time requirements.

[0077] In this embodiment of the application, step S400 involves semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree. The step of recognizing the message intent includes C1 to C4: C1. Construct a protocol-specific context vector to disambiguate polysemous words in the message and combine it with a domain knowledge graph to assist in semantic judgment.

[0078] Specifically, protocol-specific context vectors are used to represent the linguistic features and terminological meanings of power communication protocols within a specific domain. A 768-dimensional context vector representation is learned by training a deep learning model on massive amounts of substation network message data. This context vector can capture the semantics of specialized terms in the power communication field.

[0079] Simultaneously, session state information is maintained to ensure the consistency of semantic understanding. Session state records historical interaction information of the current communication session. For example, in an HTTP Keep-Alive long connection, multiple requests share the same TCP connection. Subsequent requests may omit certain header fields and use the configuration of the first request. By maintaining session state, missing context information can be obtained from historical requests, ensuring accurate understanding of the current message.

[0080] C2. The BiLSTM-CRF model is used for named entity recognition to identify key information entities in the protocol context; the relationship triples between entities are extracted to extract hierarchical data content in the nested structure.

[0081] In this embodiment, the Named Entity Recognition (NER) task aims to identify and classify key information entities from message text. Key information entities include equipment entities such as "220kV substation No. 1 main transformer", logical node entities such as "LLN0" and "MMXU1", data object entities such as "TotW" representing active power and "Vol" representing voltage, and data attribute entities such as "mag" representing magnitude and "stVal" representing state value. A BiLSTM-CRF model is used for named entity recognition. The BiLSTM layer is responsible for capturing contextual semantic information, and the CRF layer is responsible for modeling the transition constraints between labels to ensure the legality of the output label sequence. For example, for the message text "the state stVal of equipment LLN0 is true", the model identifies "LLN0" as a logical node entity, "stVal" as a data attribute entity, and "true" as a Boolean value entity.

[0082] After identifying key information entities, the relationship triples between entities are further extracted to construct semantic associations between entities. Relationship triples are represented in the form of "head entity-relation-tail entity". The head entity represents substation equipment, data objects, or measurement points; the relation represents the semantic connection between the head and tail entities, such as "has attributes"; and the tail entity represents a status value, measurement value, or operation result. For example, from the message "Circuit breaker 1 is in the open position", the relationship triple "Circuit breaker 1 - position attribute - open" is extracted.

[0083] C3. By integrating binary stream features and text stream semantic features, a hierarchical intent recognition model is adopted to identify message intent.

[0084] Specifically, message intent recognition requires comprehensive consideration of both the message's low-level structural features and high-level semantic features. Binary stream features are obtained from the hierarchical feature set constructed in step S200. These features contain structural information about the message's physical layer, data link layer, and transport layer, such as source MAC address, destination IP address, and port number. This information reflects the message's communication direction and protocol type. Text stream semantic features are obtained from the semantic analysis results of steps C1 and C2.

[0085] A hierarchical intent recognition model is employed to process the fused multimodal features. This model comprises two layers: a global intent recognition layer and a specific operation intent recognition layer. The global intent recognition layer determines the macro-level intent category of the message, such as "device status query," "measurement data reporting," "control command issuance," and "alarm information notification." It classifies the fused features using a multi-class neural network, outputting the global intent category and its confidence level. The specific operation intent recognition layer further refines the identification of specific operation types based on the global intent.

[0086] C4. Perform protocol compliance checks on the identified message intents, use anomaly detection algorithms to detect abnormal intent combinations, perform session consistency checks, filter misidentified results and correct semantic deviations, and output the verified message intents.

[0087] In this embodiment, protocol compliance checks are used to verify whether the message intent conforms to the definition and specifications of standard protocols. An RFC specification verifier is used to verify the compliance of identified message intents. For messages belonging to the IEC 61850 protocol family, the message structure is checked to ensure it conforms to the IEC 61850 standard. For example, messages using the GOOSE protocol must include required fields such as gocbRef, timeAllowedtoLive, and datSet; the service type for the MMS protocol must be a standard-defined service primitive such as Read, Write, or GetNameList. For HTTP protocol messages, the request method is checked to ensure it is a standard method, the status code is within the valid range, and the header field format is correct. If the message intent violates the protocol specifications, it is marked as an illegal intent, triggering an alarm or refusing processing.

[0088] In an optional implementation, the named entity recognition in step S400 can also employ a method based on a pre-trained language model. Utilizing the language representation capabilities learned by pre-trained models such as BERT and RoBERTa on large-scale general text corpora, the model is fine-tuned on labeled data of power communication protocols to adapt to the named entity recognition task specific to the protocol domain. Pre-trained models possess powerful semantic understanding and transfer learning capabilities, achieving good recognition results even with limited labeled data, making them particularly suitable for new protocols or scenarios with high labeling costs.

[0089] In another optional implementation, the anomaly detection in step S400 can also employ a deep learning-based autoencoder method. The autoencoder model learns the feature distribution of normal message intent by training. The autoencoder consists of an encoder and a decoder. The encoder compresses the input message intent features into a low-dimensional latent representation, and the decoder reconstructs the latent representation back into the original features. For normal samples, the autoencoder can reconstruct them well with small reconstruction errors; for anomalous samples, because their feature distribution differs from the training data, the autoencoder struggles to reconstruct them accurately, resulting in larger reconstruction errors. By setting a reconstruction error threshold, samples with reconstruction errors exceeding the threshold are identified as anomalous intents, enabling the detection of unknown types of anomalies and improving the system's generalization ability and robustness.

[0090] In summary, by employing a dual-stream hybrid architecture to simultaneously process the binary structural features and textual semantic features of messages, a hierarchical feature set from the physical layer to the application layer is constructed, achieving unified representation and accurate identification of multiple power communication protocols. Compared to traditional methods based on fixed rules or template matching, this invention can automatically learn message features, reducing reliance on manually predefined rules and significantly improving the accuracy of protocol identification and the efficiency of message parsing. It exhibits particularly strong adaptability when handling non-standard protocols and complex semantic scenarios.

[0091] By employing protocol-aware word segmentation, syntax-enhanced part-of-speech tagging, and structure-aware syntactic analysis, combined with multi-level semantic analysis techniques, accurate understanding of the deep semantics and intent of messages is achieved. Domain knowledge graph-assisted semantic disambiguation, named entity recognition for key information extraction, multi-modal intent recognition fusing multi-source features, and intent verification and correction mechanisms ensure the reliability of the results, forming a complete semantic understanding and verification closed loop. This method can not only accurately extract key information such as equipment status, measured values, and alarm signals, but also identify abnormal behaviors and potential security threats, providing strong support for real-time monitoring, fault diagnosis, and security protection of substation networks.

[0092] Example 3 illustrates a schematic scheme for a substation network packet parsing method based on semantic recognition. It should be noted that the technical solution of this substation network packet parsing system based on semantic recognition belongs to the same concept as the technical solution of the aforementioned substation network packet parsing method based on semantic recognition. Details not described in detail in the technical solution of the substation network packet parsing system based on semantic recognition in this embodiment can be found in the description of the technical solution of the aforementioned substation network packet parsing method based on semantic recognition.

[0093] This embodiment also provides a substation network message parsing system based on semantic recognition, including: The message collection module is used to capture communication messages in the smart substation network, form a raw message dataset, and preprocess them to obtain a preprocessed dataset. The protocol feature extraction module is used to extract features from the preprocessed dataset. It adopts a dual-stream hybrid architecture to fuse binary features and text features to construct a hierarchical feature set. The word segmentation and syntactic analysis module is used to segment and tag the part-of-speech tags of the text content in the message using the hierarchical feature set and the preprocessed dataset, perform syntactic analysis, and output a structured syntax tree. The semantic analysis module is used to perform semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree, and to identify the message intent. The parsing and output module is used to parse substation network messages based on message intent, extract key information, and generate structured output.

[0094] This embodiment also provides an electronic device suitable for semantic recognition-based substation network message parsing, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the semantic recognition-based substation network message parsing method proposed in the above embodiment.

[0095] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the substation network message parsing method based on semantic recognition as proposed in the above embodiments.

[0096] The storage medium proposed in this embodiment and the method for parsing substation network messages based on semantic recognition proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0097] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0098] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for parsing substation network messages based on semantic recognition, characterized in that, Includes the following steps: The communication messages in the smart substation network are captured to form a raw message dataset, and the raw message dataset is preprocessed to form a preprocessed dataset. Feature extraction is performed on the preprocessed dataset, and a dual-stream hybrid architecture is used to fuse binary features and text features to construct a hierarchical feature set; Using the hierarchical feature set and the preprocessed dataset, the text content in the message is segmented and labeled with part-of-speech tags, and syntactic analysis is performed to output a structured syntax tree. Based on the structured syntax tree, semantic disambiguation, information extraction, and intent recognition are performed to identify the message intent; The substation network messages are parsed based on the message intent to extract key information and generate structured output.

2. The substation network message parsing method based on semantic recognition as described in claim 1, characterized in that, The steps for preprocessing the original message dataset include: The original message dataset is subjected to noise reduction, removal of irrelevant information, formatting, protocol filtering, and abnormal traffic cleaning operations. The denoising operation is used to remove message errors caused by channel noise; The removal of irrelevant information is used to remove redundant fields that are only used for underlying communication verification or are irrelevant to protocol parsing; The formatting is used to convert message data from different sources or in different formats into a unified structured representation. The protocol filtering is used to filter out messages of a specific protocol; The abnormal traffic cleaning is used to identify and remove abnormal traffic packets that do not conform to network communication standards, have format errors, or are suspected of being generated by malicious attacks.

3. The substation network message parsing method based on semantic recognition as described in claim 2, characterized in that, The steps for constructing the hierarchical feature set include: Multimodal input preprocessing is performed on the preprocessed dataset, converting the preprocessed dataset into binary streams and text streams; A dual-stream deep learning model is used to process binary streams and text streams respectively. The first branch uses a convolutional neural network (CNN) to process the binary stream and extract fixed structure features; the second branch uses a Transformer to process the text stream and extract semantic features. The output features of the Convolutional Neural Network (CNN) and the Transformer are fused to form dual-stream output features; Key features of different protocol layers are extracted from the dual-stream output features, including physical layer features, data link layer features, transport layer features, and application layer features, forming a hierarchical feature set.

4. The substation network message parsing method based on semantic recognition as described in claim 3, characterized in that, Multimodal input preprocessing of the preprocessed dataset includes: The preprocessed dataset is converted into a fixed-length byte sequence to form a binary stream; Use a byte-level tokenizer to generate sub-word sequences for the text protocol; For non-text protocols, semantic units are extracted by parsing the binary structure to generate pseudo-text sequences.

5. The substation network message parsing method based on semantic recognition as described in claim 4, characterized in that, The steps to output a structured syntax tree include: The application layer protocol type is obtained using the hierarchical feature set. The corresponding parsing method is selected according to the application layer protocol type. The request line or status line, header fields, and message body text are extracted layer by layer, and the delimiter is retained as a syntax anchor. Select the appropriate word segmentation method based on the application layer protocol type, and quickly match the protocol-specific dictionary based on the Trie tree; Input the word segmentation sequence and application layer protocol type features, and perform part-of-speech tagging using a sequence labeling model and a protocol-specific part-of-speech tag set; The protocol syntax rule engine uses a graph neural network (GNN) to parse dependency relationships and output a structured syntax tree.

6. The substation network message parsing method based on semantic recognition as described in claim 5, characterized in that, The sequence labeling model uses 128-dimensional word vectors.

7. The substation network message parsing method based on semantic recognition as described in claim 6, characterized in that, Based on the structured syntax tree, semantic disambiguation, information extraction, and intent recognition are performed. The steps for recognizing the message intent include: Construct protocol-specific context vectors, disambiguate polysemous words in messages, and combine domain knowledge graphs to assist semantic judgment; The BiLSTM-CRF model is used for named entity recognition to identify key information entities in the protocol context; the relationship triples between entities are extracted to extract hierarchical data content in the nested structure; By integrating binary stream features and text stream semantic features, a hierarchical intent recognition model is used to identify message intent. The program performs protocol compliance checks on the identified message intents, uses anomaly detection algorithms to detect abnormal intent combinations, performs session consistency checks, filters out misidentified results and corrects semantic deviations, and outputs the verified message intents.

8. A substation network message parsing system based on semantic recognition, employing the method described in any one of claims 1-7, characterized in that, include: The message collection module is used to capture communication messages in the smart substation network, form a raw message dataset, and preprocess them to obtain a preprocessed dataset. The protocol feature extraction module is used to extract features from the preprocessed dataset. It adopts a dual-stream hybrid architecture to fuse binary features and text features to construct a hierarchical feature set. The word segmentation and syntactic analysis module is used to segment and tag the part-of-speech tags of the text content in the message using the hierarchical feature set and the preprocessed dataset, perform syntactic analysis, and output a structured syntax tree. The semantic analysis module is used to perform semantic disambiguation, information extraction, and intent recognition based on the structured syntax tree, and to identify the message intent. The parsing and output module is used to parse substation network messages based on message intent, extract key information, and generate structured output.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the substation network message parsing method based on semantic recognition as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the semantic recognition-based substation network message parsing method according to any one of claims 1 to 7.

Images