NiFi-based comprehensive energy system safety monitoring and real-time alarm method

Abstract

The invention provides a NiFi-based comprehensive energy system safety monitoring and real-time alarm method, and belongs to the technical field of comprehensive energy systems. The method comprises the following steps: continuously acquiring original data in different formats from the integrated energy system, preprocessing the original data, and outputting an integrated data stream in a unified format; generating a matching result including an illegal matching result through standardization processing and rule matching; triggering grading alarm according to the final violation grade, dynamically adjusting a response strategy, and issuing a control instruction when the final violation grade exceeds a threshold value; and adjusting coefficients are dynamically optimized through a NiFi data flow closed-loop feedback mechanism, so that adaptive optimization of the system is realized. According to the method, by constructing an automatic data assembly line based on NiFi data flow, unified processing and multi-level rule matching of comprehensive data flow are achieved, a dynamic level response mechanism is established, closed-loop optimization is formed, and the real-time performance, the accuracy and the self-adaptive evolution capacity of system monitoring are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of integrated energy systems, specifically a method for safety monitoring and real-time alarm of integrated energy systems based on NiFi. Background Technology

[0002] Integrated energy systems deeply integrate various energy forms such as electricity, heat, cooling, and gas. Their operation exhibits complex characteristics of multi-source heterogeneity and dynamic coupling. The system includes many subsystems such as power monitoring, thermal control, new energy power generation, and environmental sensing. These subsystems continuously generate massive amounts of real-time operational data with multiple protocols and high frequency. Therefore, it is necessary to build a technical system that can uniformly access, efficiently process, and intelligently respond to these data streams in order to manage the operation of this complex system.

[0003] The core bottlenecks of existing integrated energy system safety monitoring technologies are concentrated in three aspects: First, the protocols and frequencies of multi-source data differ significantly, and the lack of a unified clock reference for power, heat control, and new energy system data leads to insufficient spatiotemporal alignment accuracy, affecting the real-time performance of status perception. Second, traditional monitoring rules couple all parameters to a single threshold judgment layer, making it impossible to independently analyze different fault types such as voltage over-limit and electrothermal coupling conflicts, thus hindering the accurate identification of multi-dimensional safety risks. Third, existing alarm mechanisms use static thresholds and fixed evaluation cycles, making it difficult to dynamically upgrade response strategies for continuously deteriorating operating conditions.

[0004] Therefore, it is urgent to build an intelligent monitoring system that integrates unified processing of streaming data, parallel matching of multiple rules, and closed-loop adaptive optimization to achieve intelligent control of the entire process from data collection to hierarchical response. Summary of the Invention

[0005] To address the technical problems mentioned in the background section, this invention proposes a method for safety monitoring and real-time alarm of integrated energy systems based on NiFi.

[0006] Therefore, the technical solution adopted by the present invention is as follows:

[0007] A NiFi-based integrated energy system security monitoring and real-time alarm method is characterized by the following steps: S1. Continuously collect raw data of different formats from the integrated energy system using a data stream management tool, preprocess the raw data, and output a unified format integrated data stream; S2. Receive the integrated data stream, route it to a standardization processor via NiFi data stream, generate standardized data packets, and push the standardized data packets to a security rule base for basic and joint matching to obtain matching results for different states, including violation matching results; S3. Extract the final violation level from the violation matching results, and perform basic alarm response and dynamic level upgrade based on the final violation level. When the final violation level is greater than a preset level threshold, trigger the device control command issuance process, and obtain a safety verification report or status feedback signal through the device control command; S4, receive the safety verification report or status feedback signal, and transmit the safety verification report or status feedback signal to the dynamic optimization process through the feedback loop of the NiFi data stream. During the transmission of the safety verification report to the dynamic optimization process, regenerate the device control command through the voltage regulation coefficient or power regulation coefficient.

[0008] Furthermore, the data stream management tool is built on the Apache NiFi data stream framework, including a data acquisition module, a data buffer module, and a data preprocessing module. The data acquisition module directly interfaces with the integrated energy system to collect the raw data in parallel. The data buffer module receives and stores the raw data. The data preprocessing module performs protocol parsing, format conversion, and information integration on the raw data, and outputs the integrated data stream.

[0009] Furthermore, the standardization process for the integrated data stream is as follows: extract data from different sources in the integrated data stream, map the data from different sources to a predefined field mapping table to obtain standard field names, each standard field name corresponding to a parameter value, wherein the field mapping table stores the mapping relationship between field names in the data from different sources and standard field names; encapsulate the standardized integrated data stream according to a unified format to obtain a standardized data packet with standard field names and the corresponding parameter values ​​of the standard field names.

[0010] Furthermore, the basic matching process is as follows: The basic matching process involves extracting the standard field names and parameter values ​​from the standardized data packet; retrieving the corresponding basic threshold range from the security rule base based on the standard field names; calculating the deviation between the parameter values ​​and the basic threshold range to obtain the basic deviation degree; wherein the security rule base pre-stores target field names and joint threshold ranges; determining the basic violation level of the standardized data packet based on the basic deviation degree; extracting multiple standard field names and parameter values ​​from the standardized data packet; determining whether the multiple standard field names contain the target field name; when the target field name is contained, triggering joint matching and combining the multiple standard field names into a standard field set. ,in, For the first Standard field naming, Given a set of standard fields, the joint matching process is as follows: Substitute the parameter value corresponding to each standard field name in the set of standard fields into the Func function for joint calculation to obtain a joint result; calculate the joint deviation between the joint result and the joint threshold range; the formula for joint calculation is as follows: ,in, For the first Each standard field name corresponds to a parameter value. The result is a joint violation; based on the joint deviation, the joint violation level of the standardized data packet is determined, and the larger the joint deviation, the higher the joint violation level.

[0011] Furthermore, the highest value of the basic violation level and the combined violation level is taken as the final violation level;

[0012] When both the basic deviation value and the joint deviation value are at the set minimum level, a matching result containing only standardized data packets is generated, and the matching result is recorded as normal.

[0013] When the basic deviation value or joint deviation value is not at the set minimum level, a matching result containing standardized data packets and the final violation level is generated, and the matching result is recorded as a violation.

[0014] Furthermore, the basic alarm response process takes different interface warnings and message notifications based on different final violation levels. After the basic alarm response is triggered, dynamic level escalation is initiated, the process of which is as follows: continuously tracking the final violation level and final deviation in the basic alarm response event, as well as the parameter values ​​corresponding to the standard field names in the basic alarm response event, recording the parameter values ​​as real-time parameter values, and recording the duration of the basic alarm response event, wherein the final deviation is taken from the final violation level; if the duration exceeds a preset time threshold, and the violation in the basic alarm response event is not eliminated, it indicates that the parameter values ​​corresponding to the standard field names have not recovered to the required level. If the preset normal range is met, the final violation level of the basic alarm response event is automatically increased to obtain the latest violation level, which does not exceed the set maximum violation level. Based on the latest violation level, the basic alarm response process is retried. Based on the real-time parameter values, the real-time deviation is calculated as follows: when the source of the final violation level is the basic violation level, the calculation method of the basic deviation is used; when the source of the final violation level is a combined violation level, the calculation method of the combined deviation is used; when the real-time deviation is higher than the final deviation, the final violation level of the basic alarm response event is automatically increased to the maximum violation level, and the basic alarm response process is immediately triggered.

[0015] Furthermore, the device control command issuance process is as follows: When the final violation level is higher than the set trigger level, the NiFi processor is triggered to extract the standard field name from the standardized data packet, and based on the standard field name, the corresponding set of control strategies is retrieved from the preset control strategy library: Where F is the standard field name, For the j-th control strategy, A set of control strategies is defined. Based on different violation matching results, a specific control strategy is selected from the set of control strategies. The selected control strategy is used to specify the voltage regulation coefficient, rated voltage and power regulation coefficient, and maximum operating power. Based on the selected control strategy, the final deviation, and the standard field naming, the voltage regulation amount or power regulation amount is calculated. The standard field naming is used to distinguish parameter values. According to the voltage regulation amount or power regulation amount, combined with the selected control strategy, a device control command is generated. The device control command is subjected to safety verification to ensure that the voltage regulation amount or power regulation amount is within the safe operating range.

[0016] Furthermore, the security verification process is as follows: The voltage or power adjustment amount is compared with the allowable adjustment range defined in the existing technical specifications of the target device; if the voltage or power adjustment amount does not exceed the adjustment range, the security verification passes, and the device control command is sent to the target device; if the voltage or power adjustment amount exceeds the adjustment range, the security verification fails, the device control command is intercepted, and a security verification report is generated; after the device control command is sent, the command reception status and command execution status of the target device are determined; the command reception status determination process is as follows: after the device control command is sent, if the target device receives the command within the communication time... If the device receives a confirmation signal, the instruction reception status is determined to be successful; otherwise, the instruction reception status is determined to be unsuccessful. The instruction execution status determination process is as follows: After the instruction reception status is successful, the actual parameter values ​​of the target device are monitored in real time, and the actual parameter values ​​are compared with the expected effect range. If the actual parameter values ​​enter the expected effect range within the execution time, the instruction execution status is determined to be successful; otherwise, the instruction execution status is determined to be unsuccessful. If no valid actual parameter values ​​are detected within the execution time, it is determined to be a timeout. Finally, different instruction execution statuses are recorded as status feedback signals for dynamic optimization.

[0017] Furthermore, the dynamic optimization process is as follows: Upon receiving a security verification report, the voltage regulation coefficient or power regulation coefficient is conservatively optimized, and the conservatively optimized voltage regulation coefficient or power regulation coefficient is fed back to the control strategy set; upon receiving a status feedback signal, the actual parameter values ​​are extracted from the status feedback signal, and three different judgment states in the instruction execution state represented by the status feedback signal are obtained; when the instruction execution state represented by the status feedback signal is successful, the voltage regulation coefficient or power regulation coefficient in the selected control strategy is adaptively optimized, and the optimized voltage regulation coefficient or power regulation coefficient is fed back to the control strategy set, the calculation formula of which is as follows: ,in, To optimize the learning rate parameter, , Name the corresponding parameter values ​​for the standard fields, where k is the voltage regulation coefficient or power regulation coefficient before optimization. The optimized voltage regulation coefficient or power regulation coefficient is used. When the command execution status indicated by the status feedback signal is a failure, the voltage regulation coefficient or power regulation coefficient in the selected control strategy is conservatively optimized, and the conservative optimization calculation process is repeated until the command execution status indicated by the status feedback signal is a success. When the command execution status indicates a timeout, the execution time is extended again.

[0018] Compared with the prior art, the advantages of the present invention are as follows:

[0019] 1. This invention constructs an automated pipeline from data acquisition and data standardization processing to security rule matching through a visual data stream orchestration technology based on NiFi data streams. It realizes unified access and parallel processing of power, heat, new energy and environmental sensing systems, and solves the technical bottlenecks of difficult system integration and long development cycle in traditional systems.

[0020] 2. This invention constructs a multi-layered security rule engine that combines basic matching and joint matching. This not only enables threshold monitoring of individual device parameters but also allows for joint calculation and correlation analysis of multiple field sets, thereby accurately identifying complex operational hazards such as electrical-thermal coupling conflicts. This achieves a leap from isolated alarms to system-level security situation awareness.

[0021] 3. This invention introduces a closed-loop control mechanism that includes dynamic level enhancement and strategy parameter self-optimization. The system can dynamically adjust the response level according to the alarm duration and real-time deviation, and automatically optimize and adjust the strategy parameters based on the safety verification report and status feedback signal. This enables the system to have the adaptive capability from real-time response to continuous evolution, significantly improving the intelligence level and reliability of the monitoring system. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the overall workflow of the present invention;

[0024] Figure 2 This is a schematic diagram illustrating the hierarchical alarm and response mechanism of the present invention.

[0025] Figure 3 This is a schematic diagram illustrating the dynamic optimization of the monitoring strategy of the present invention. Detailed Implementation

[0026] To achieve the above objectives, the present invention provides a method for safety monitoring and real-time alarm of a NiFi-based integrated energy system, comprising the following steps:

[0027] S1. Multi-source data access and acquisition: Based on a data stream management tool, continuously acquire raw data of different formats from the integrated energy system, preprocess the raw data, and output a unified format integrated data stream; see [link / reference]. Figure 1 .

[0028] The integrated energy system includes a power monitoring system, a thermal control system, a new energy power generation system, and an environmental sensing system.

[0029] The data stream management tool is built on the Apache NiFi data stream framework, which includes a data acquisition module, a data buffering module, and a data preprocessing module.

[0030] The data acquisition module directly interfaces with the integrated energy system, collecting raw data in parallel from the power monitoring system, thermal control system, new energy power generation system, and environmental sensing system.

[0031] The data buffer module, connected to the data acquisition module, receives and stores the raw data to prevent data loss and ensure the continuity of data transmission.

[0032] The data preprocessing module extracts the raw data stored in the data buffer module, performs protocol parsing, format conversion, and information integration on the raw data, and outputs a comprehensive data stream.

[0033] S2. Multi-source data standardization: The integrated data stream is received and routed to the standardization processor via the NiFi data stream to generate standardized data packets. These standardized data packets are pushed to the security rule base by the NiFi data stream for basic and joint matching, yielding matching results for different states. These matching results include violations. (See...) Figure 1 .

[0034] The process of standardizing the integrated data stream is as follows:

[0035] Extract data from different sources in the integrated data stream, map the data from different sources to a predefined field mapping table to obtain standard field names, each of which corresponds to a parameter value; encapsulate the standardized integrated data stream in a unified format to obtain a standardized data packet with standard field names and corresponding parameter values.

[0036] The field mapping table stores the mapping relationship between field names and standard field names in data from different sources. For example, the "U" and "I" fields in the power monitoring system are uniformly mapped to "voltage" and "current", the "Temp" and "Press" fields in the thermal control system are uniformly mapped to "temperature" and "pressure", the "PW" field in the new energy power generation system is uniformly mapped to "power", and the "Humid" field in the environmental sensing system is uniformly mapped to "humidity".

[0037] The basic matching process is as follows:

[0038] Extract the standard field names and parameter values ​​from the standardized data packet;

[0039] Based on the standard field naming, the corresponding basic threshold range is retrieved from the security rule base. The deviation between the parameter value and the basic threshold range is calculated to obtain the basic deviation degree. The security rule base pre-stores target field names and joint threshold ranges. The formula for calculating the basic deviation degree is as follows:

[0040]

[0041] in, Name the corresponding parameter values ​​for the standard fields. The lower limit of the basic threshold, The upper limit of the basic threshold, Basic deviation;

[0042] Based on the basic deviation, the basic violation level of the standardized data packet is determined. The larger the basic deviation, the higher the basic violation level. The determination rules are as follows:

[0043]

[0044] in, Basic violation level;

[0045] Extract multiple standard field names and their corresponding parameter values ​​from the standardized data packet, and determine whether the target field name is included among the multiple standard field names.

[0046] When the target field name is included, a union match is triggered, and multiple standard field names are combined into a field set:

[0047]

[0048] in, For the first Standard field naming, A standard set of fields;

[0049] The joint matching process is as follows:

[0050] The parameter values ​​corresponding to each standard field name in the standard field set are substituted into the Func function for joint calculation, as shown in the following formula:

[0051]

[0052] in, For the first Each standard field name corresponds to a parameter value. For combined results;

[0053] The joint deviation between the joint result and the joint threshold range is calculated using the following formula:

[0054]

[0055] in, This is the lower limit of the joint threshold. The upper limit of the joint threshold, For joint deviation degree;

[0056] Based on the joint deviation, the joint violation level of the standardized data packet is determined. The larger the joint deviation, the higher the joint violation level. The determination rules are as follows:

[0057]

[0058] in, For joint violation levels;

[0059] The highest value of the basic deviation and the combined deviation is taken as the final deviation.

[0060] The highest value between the basic violation level and the combined violation level shall be taken as the final violation level.

[0061] Its value selection rules are as follows:

[0062]

[0063] in, The final violation level;

[0064] When both the basic deviation value and the joint deviation value are equal to 0, both the basic violation level and the joint violation level are equal to 1, the final violation level is equal to 1, a matching result containing only standardized data packets is generated, and the matching result is recorded as normal.

[0065] When the basic deviation value or joint deviation value is greater than 0, the basic violation level or joint violation level is greater than or equal to 2, the final violation level is greater than or equal to 2, a matching result containing the standardized data packet and the final violation level is generated, and the matching result is recorded as a violation and transmitted to S3.

[0066] S3. Tiered Alarm and Response: Extract the final violation level from the violation matching results, and perform basic alarm response and dynamic level escalation based on the final violation level. When the final violation level exceeds a preset level threshold, a device control command issuance process is triggered, and a security verification report or status feedback signal is obtained through the device control command. (See...) Figure 2 .

[0067] The basic alarm response process includes interface warnings and message notifications;

[0068] The interface warning triggering process is as follows:

[0069] When the final violation level equals 2, a yellow warning icon containing the violation matching result will be generated on the monitoring interface.

[0070] When the final violation level is greater than or equal to 3, a red warning icon containing the violation matching result will be generated on the monitoring interface and a warning window will pop up;

[0071] The message notification triggering process is as follows:

[0072] When the final violation level is 3, an internal message notification will be sent directly to the on-duty personnel.

[0073] When the final violation level is 4, an email notification will be sent directly to the relevant person in charge.

[0074] When the final violation level is 5, an emergency notification is sent directly to the technical team and management.

[0075] After the basic alarm response is triggered, dynamic alarm level escalation is initiated, and the process is as follows:

[0076] Continuously track the final violation level and final deviation in the basic alarm response event, as well as the parameter values ​​corresponding to the standard field names in the basic alarm response event, record the parameter values ​​as real-time parameter values, and record the duration of the basic alarm response event. The final deviation is taken from the final violation level. For example, when the basic violation level is higher than the combined violation level, the final violation level is the basic violation level. In this case, the final deviation is the basic deviation.

[0077] If the duration exceeds a preset time threshold and the violation in the basic alarm response event is not eliminated, it indicates that the parameter value corresponding to the standard field name has not returned to the preset normal range. In this case, the final violation level of the basic alarm response event is automatically increased to obtain the latest violation level, and the formula is as follows:

[0078]

[0079] in, The latest violation level is set at 5, meaning that even when the final violation level is 5, the latest violation level remains 5, and a basic alarm response process is initiated.

[0080] Based on the latest violation level, re-trigger the basic alarm response process;

[0081] Calculate the real-time deviation based on the real-time parameter values.

[0082] When the final violation level is derived from the base violation level, the formula is as follows:

[0083]

[0084] When the final violation level is derived from a combined violation level, the formula is as follows:

[0085]

[0086] in, These are real-time parameter values. For real-time deviation;

[0087] If the real-time deviation is higher than the final deviation, the final violation level of the event will be automatically increased to 5, and the basic alarm response process when the final violation level is equal to 5 will be triggered immediately.

[0088] The process for issuing equipment control commands is as follows:

[0089] When the final violation level is greater than or equal to 4, the NiFi processor is triggered to extract the standard field names from the standardized data packets. Based on the standard field names, the corresponding set of control strategies is retrieved from the preset control strategy library. Where F is the standard field name, For the j-th control strategy, A set of regulatory strategies;

[0090] Based on the different types of violation matching results, a specific control strategy is selected from the set of control strategies.

[0091] The selected control strategy explicitly specifies the voltage regulation coefficient, rated voltage and power regulation coefficient, and maximum operating power;

[0092] Using the data from the selected control strategy, and extracting the final deviation from the violation matching result and the standard field names from the standardized data packet, the voltage regulation or power regulation is calculated. When the standard field is named "voltage", its corresponding parameter value is the voltage value; when the standard field is named "power", its corresponding parameter value is the power value. The formula for calculating the voltage regulation is:

[0093]

[0094] in, This is the voltage regulation coefficient. Rated voltage, This is the voltage value. For the final deviation, For voltage regulation,

[0095] The formula for calculating the power regulation amount is:

[0096]

[0097] in, This is the power regulation coefficient. For maximum permissible power, This is the power value. This refers to the power regulation amount;

[0098] Based on the voltage or power regulation amount and the selected control strategy, a device control command is generated.

[0099] The device control commands are subjected to safety verification to ensure that the voltage or power regulation is within the safe operating range.

[0100] The security verification process is as follows:

[0101] The voltage or power regulation amount is compared with the allowable adjustment range defined in the existing technical specifications of the target equipment. The comparison logic is as follows:

[0102]

[0103] in, Minimum adjustment amount, The maximum adjustment amount, This refers to voltage regulation or power regulation.

[0104] If the voltage regulation or power regulation does not exceed this range, the safety check passes and the device control command is sent to the target device.

[0105] If the voltage or power regulation exceeds this range, the safety verification fails, the device control command is intercepted, and a safety verification report is generated.

[0106] After the device control command is issued, the command reception status and command execution status of the target device are determined;

[0107] The instruction reception status determination process is as follows:

[0108] If a confirmation signal from the target device is received within the communication time after the device control command is issued, the command reception status is determined to be successful.

[0109] If no confirmation signal is received from the target device within the communication time, the instruction reception status is determined to be a failure.

[0110] The instruction execution status determination process is as follows:

[0111] After the instruction is successfully received, the actual parameter values ​​of the target device are monitored in real time, and the actual parameter values ​​are compared with the expected effect range. The comparison logic is as follows:

[0112]

[0113] in, The allowable error in the selected control strategy, These are actual parameter values;

[0114] If the actual parameter value falls within the expected range within the execution time, the instruction execution status is determined to be successful.

[0115] If the actual parameter value fails to fall within the expected range during the execution time, the instruction execution status is determined to be a failure.

[0116] If no valid actual parameter value is detected within the execution time, it is determined to be a timeout.

[0117] Finally, the different instruction execution states are recorded as state feedback signals for dynamic optimization.

[0118] S4. Dynamic optimization of monitoring strategy: Receive the security verification report or status feedback signal, and transmit the security verification report or status feedback signal to the dynamic optimization process through the NiFi data stream feedback loop. During the transmission of the security verification report to the dynamic optimization process, device control commands are regenerated using voltage regulation coefficients or power regulation coefficients. See [link / reference needed] Figure 3 .

[0119] The dynamic optimization process is as follows:

[0120] Upon receiving a safety verification report, the selected control strategy fails due to excessive adjustment amount. The selected control strategy is extracted from this event, indicating that the voltage or power regulation coefficient in the selected strategy is too aggressive. Therefore, the voltage or power regulation coefficient is adjusted to be more conservative, and the conservatively adjusted voltage or power regulation coefficient is fed back into the control strategy set. The calculation formula is as follows:

[0121]

[0122] in, This refers to the voltage regulation coefficient or power regulation coefficient. This refers to the conservatively adjusted voltage regulation coefficient or power regulation coefficient.

[0123] When a status feedback signal is received, the actual parameter value is extracted from the status feedback signal to obtain three different judgment states in the instruction execution state represented by the status feedback signal.

[0124] When the command execution status indicated by the status feedback signal is successful, the voltage regulation coefficient or power regulation coefficient in the selected control strategy is adaptively optimized, and the optimized voltage regulation coefficient or power regulation coefficient is fed back to the control strategy set. The calculation formula is as follows:

[0125]

[0126] in, To optimize the learning rate parameter, This refers to the optimized voltage regulation coefficient or power regulation coefficient.

[0127] When the command execution status indicated by the status feedback signal is a failure, the voltage regulation coefficient or power regulation coefficient in the selected control strategy is conservatively optimized, and the conservative optimization calculation process is repeated until the command execution status indicated by the status feedback signal is a success.

[0128] When the status feedback signal indicates that the instruction execution status has timed out, this problem is unrelated to the content of the control instruction issued, but rather to the execution time. The execution time is then extended, and the calculation formula is as follows:

[0129]

[0130] in, For execution time, This refers to the extended execution time.

[0131] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for security monitoring and real-time alarm of integrated energy system based on NiFi, characterized in that, The method comprises the following steps: S1, based on a data flow management tool, continuously collecting raw data in different formats from the integrated energy system, preprocessing the raw data, and outputting integrated data flow in a unified format; S2, receiving the integrated data flow, routing the integrated data flow to a standardization processor through a NiFi data flow, generating a standardized data packet, and pushing the standardized data packet to a security rule library through a NiFi data flow for basic matching and joint matching to obtain matching results in different states, wherein the matching results include a rule violation matching result; S3, extracting the final rule violation level in the rule violation matching result, and performing basic alarm response and dynamic level promotion based on the final rule violation level, wherein when the final rule violation level is greater than a preset level threshold, a device control instruction issuing process is triggered, and a security verification report or a state feedback signal is obtained through the device control instruction; S4, receiving the security verification report or the state feedback signal, transmitting the security verification report or the state feedback signal to a dynamic optimization process through a feedback loop of the NiFi data flow, and regenerating the device control instruction through a voltage adjustment coefficient or a power adjustment coefficient during the transmission of the security verification report to the dynamic optimization process.

2. The method of claim 1, wherein the data flow management tool is based on an Apache NiFi data flow framework, which includes a data acquisition module, a data buffering module, and a data preprocessing module; the data acquisition module is directly connected to the integrated energy system and is used to acquire the raw data in parallel; the data buffering module is used to receive and store the raw data; the data preprocessing module is used to perform protocol analysis, format conversion, and information integration on the raw data, and output the integrated data flow.

3. The method of claim 2, wherein generating a standardized data packet comprises: extracting different source data in the integrated data flow, uniformly mapping the different source data to a predefined field mapping table to obtain a standard field name, each standard field name corresponding to a parameter value, wherein the field mapping table stores the mapping relationship between the field name in the different source data and the standard field name; packaging the integrated data flow after standardization processing according to a unified format to obtain a standardized data packet with a standard field name and a parameter value corresponding to the standard field name.

4. The method of claim 3, wherein the basic matching process comprises: extracting the standard field name and the parameter value from the standardized data packet, according to the standard field name, retrieving the corresponding basic threshold range from the security rule library, calculating the deviation between the parameter value and the basic threshold range to obtain a basic deviation degree, wherein the target field name and the joint threshold range are pre-stored in the security rule library; determining the basic rule violation level of the standardized data packet according to the basic deviation degree. ​ ​ ​ extracting a plurality of standard field names and parameter values from the standardized data packet, determining whether the plurality of standard field names contains a target field name, when the target field name is contained, triggering joint matching, and grouping the plurality of standard field names into a standard field set, ； wherein, is the th standard field name, is a set of standard field names; wherein the joint matching process is as follows: substituting the parameter values corresponding to each standard field name in the standard field set into a Func function for joint calculation, and the formula is as follows: ； wherein, is the th standard field name corresponding to the parameter value, is the joint result; calculating a joint deviation degree of the joint result and a joint threshold range; determining a joint violation level of the standardized data packet according to the joint deviation degree, and the higher the joint deviation degree, the higher the joint violation level.

5. The method of claim 4, wherein: taking the highest value of the basic violation level and the joint violation level as the final violation level; when the basic deviation value and the joint deviation value are both at a preset minimum level, generating a matching result containing only the standardized data packet, and recording the matching result as normal; when the basic deviation value or the joint deviation value is not at the preset minimum level, generating a matching result containing the standardized data packet and the final violation level, and recording the matching result as a violation.

6. The method of claim 5, wherein: the basic alarm response process takes different interface warnings and message notifications according to different final violation levels; after the basic alarm response is triggered, a dynamic level promotion is started, and the process is as follows: continuously tracking the final violation level and the final deviation degree in the basic alarm response event, and the parameter values corresponding to the standard field names in the basic alarm response event, recording the parameter values as real-time parameter values, and recording the duration of the basic alarm response event, wherein the final deviation degree is taken from the final violation level; if the duration exceeds a preset time threshold and the violation in the basic alarm response event has not been eliminated, indicating that the parameter values corresponding to the standard field names have not returned to a preset normal range, then the final violation level of the basic alarm response event is automatically promoted to obtain a latest violation level, and the latest violation level does not exceed a preset maximum violation level; retriggering the basic alarm response process according to the latest violation level; calculating a real-time deviation degree according to the real-time parameter values, and the process is as follows: when the source of the final violation level is the basic violation level, the calculation method of the basic deviation degree is used; when the source of the final violation level is the joint violation level, the calculation method of the joint deviation degree is used; when the real-time deviation degree is higher than the final deviation degree, the final violation level of the basic alarm response event is automatically promoted to the maximum violation level, and the basic alarm response process is immediately triggered.

7. The method of claim 6, wherein: the device control instruction issuing process is as follows: when the final violation level is higher than a preset trigger level, triggering a NiFi processor, extracting the standard field names in the standardized data packet, and retrieving a corresponding set of control strategies from a preset control strategy library based on the standard field names: ； Wherein, F is a standard field name, is the jth control strategy, is a set of control strategies; According to different violation matching results, a specific control strategy is selected from the control strategy set, and the selected control strategy is used to specify a voltage regulation coefficient, a rated voltage and a power regulation coefficient, and a maximum operating power; Based on the selected control strategy, the final deviation degree, and the standard field naming, a voltage regulation amount or a power regulation amount is calculated, and the standard field naming is used to distinguish parameter values; According to the voltage regulation amount or the power regulation amount, a device control instruction is generated in combination with the selected control strategy; The device control instruction is subjected to a safety check to ensure that the voltage regulation amount or the power regulation amount is within a safe operating range.

8. The method of claim 7, wherein the safety check procedure is as follows: The voltage regulation amount or the power regulation amount is compared with an allowable regulation range defined in an existing technical specification of the target device; When the voltage regulation amount or the power regulation amount does not exceed the regulation range, the safety check is passed, and the device control instruction is issued to the target device; When the voltage regulation amount or the power regulation amount exceeds the regulation range, the safety check fails, the device control instruction is intercepted, and a safety check report is generated; After the device control instruction is issued, the instruction receiving state and the instruction execution state of the target device are determined; The instruction receiving state determination procedure is as follows: after the device control instruction is issued, if an acknowledgement signal from the target device is received within a communication time, the instruction receiving state is determined to be successful, otherwise, the instruction receiving state is determined to be unsuccessful; The instruction execution state determination procedure is as follows: after the instruction receiving state is successful, the actual parameter values of the target device are monitored in real time, and the actual parameter values are compared with an expected effect range; if the actual parameter values enter the expected effect range within an execution time, the instruction execution state is determined to be successful; otherwise, the instruction execution state is determined to be unsuccessful; If no valid actual parameter values are monitored within the execution time, it is determined to be a timeout; Finally, different instruction execution states are recorded as state feedback signals for dynamic optimization.

9. The method of claim 8, wherein the dynamic optimization procedure is as follows: Upon receiving the safety check report, the voltage regulation coefficient or the power regulation coefficient is conservatively optimized, and the conservatively optimized voltage regulation coefficient or power regulation coefficient is fed back to the control strategy set; Upon receiving the state feedback signal, actual parameter values are extracted from the state feedback signal, and three different determination states of the instruction execution state represented by the state feedback signal are obtained; When the instruction execution state represented by the state feedback signal is successful, the voltage regulation coefficient or the power regulation coefficient in the selected control strategy is adaptively optimized, and the optimized voltage regulation coefficient or power regulation coefficient is fed back to the control strategy set, The calculation formula is as follows: ​ ​ ； wherein, to optimize the learning rate parameter, , the corresponding parameter value is named for the standard field, k is the voltage adjustment coefficient or power adjustment coefficient before optimization, is the voltage adjustment coefficient or power adjustment coefficient after optimization; When the instruction execution state indicated by the state feedback signal is failure, the voltage adjustment coefficient or the power adjustment coefficient in the selected regulation strategy is conservatively optimized, and the calculation process of the conservative optimization is repeated until the instruction execution state indicated by the state feedback signal is success; When the instruction execution state indicated by the state feedback signal is timeout, the execution time is re-extended.

Images