Big data-based remote control management method and system for thermal power plant

Abstract

The invention discloses a thermal power plant remote control management method and system based on big data, and particularly relates to the technical field of control management, and the method comprises the steps: S1, full-dimension big data collection and security encryption, S2, big data preprocessing and security level initial judgment, S3, dynamic multi-level security domain construction and authority division, S4, big data driven risk pre-judgment and management and control strategy generation, and S5, big data driven risk pre-judgment and management and control strategy generation. S5, grading authorization and instruction safe issuing, S6, instruction execution and real-time safety monitoring feedback, and S7, log analysis and strategy optimization: analyzing a whole-process log in a daily low-load period, and optimizing risk model parameters and safety management and control rules. According to the invention, a dynamic security domain construction and permission division mechanism driven by big data is adopted, and a flexible and strict multi-level linkage authentication basis is provided for a remote control instruction through dynamic permission adjustment and multi-level verification, so that the management security is greatly improved.

Description

Technical Field

[0001] This invention relates to the field of control and management technology, and more specifically, to a remote control and management method and system for thermal power plants based on big data. Background Technology

[0002] The big data-based remote control and management method for thermal power plants integrates data acquisition, analysis, prediction, and remote control technologies, which plays a significant role in improving operational efficiency, reducing maintenance costs, enhancing safety management, optimizing production decisions, and promoting sustainable development.

[0003] Among existing publicly available literature, patent publication number CN116581815A discloses a source-grid-load coordinated power distribution control system based on big data. This technology utilizes an optimization-based planning model, taking advantage of the correlation between wind power generation, photovoltaic power generation data, and load, as well as the predicted electricity consumption time curves of the areas to be regulated. It employs a multi-objective optimization method to obtain the power output decision vectors for wind power plants, photovoltaic power plants, and thermal power plants. This technology is applicable to source-grid-load coordinated power distribution control. However, the following problems still exist in its application.

[0004] The amount of data remotely controlled in thermal power plants is large, and much of this data requires hierarchical processing during management. However, this hierarchical processing can lead to a disconnect between security protection and unit operating conditions, making it difficult to dynamically adjust protection strategies based on real-time data. Consequently, the security verification process for remote control command transmission and execution is singular, lacking a multi-level linkage authentication mechanism, resulting in poor management security. Summary of the Invention

[0005] To achieve the above objectives, the present invention provides the following technical solution: a remote control and management method for thermal power plants based on big data, comprising the following specific steps: S1. Full-dimensional big data collection and security encryption: Deploy smart sensors in the core equipment and links of thermal power plants to collect operating parameters, which are then transmitted to edge nodes after being encrypted by the AES-256 algorithm, and the terminal retains local backup. S2. Big data preprocessing and initial security level assessment: After decrypting data at edge nodes, anomaly removal, standardization, deduplication and desensitization are performed. Based on the 3σ criterion and preset thresholds, the security levels L1, L2 and L3 are initially assessed. S3. Dynamic multi-level security domain construction and permission division: The cloud constructs a three-level dynamic security domain based on the initial judgment results, namely the core control domain, operation and maintenance monitoring domain, and information management domain, and adjusts the boundaries and divides the three levels of operation permissions according to the working conditions. S4. Big data-driven risk prediction and control strategy generation: The cloud uses LSTM neural network and decision tree algorithm to build a two-dimensional model to predict equipment and network risks and generate hierarchical control strategies. S5, hierarchical authorization and secure command issuance, control commands are verified by permission, policy and identity, encrypted by the national cryptographic SM4 algorithm and transmitted through dual-route optical cables, and the integrity is verified twice by edge nodes; S6, Command Execution and Real-time Security Monitoring and Feedback: The terminal executes commands and sends back status data. Edge nodes and the cloud monitor in real time, and any deviations are immediately alerted and processed. S7. Log analysis and strategy optimization: Analyze the entire process log during low-load periods each day to optimize risk model parameters and security control rules, forming a closed loop.

[0006] In a preferred embodiment, the operating parameters collected in S1 include boiler outlet temperature of 300-620℃, accuracy ±0.5-0.9℃, 5-15 times / second; turbine speed of 3000-5000r / min, accuracy 0.1-0.5r / min, 10-15 times / second; and generator output voltage of 20-30kV, 5-15 times / second. The data format is uniformly JSON with millisecond time and UUID identifier recorded 10-18 times. The AES-256 algorithm encryption is generated by the cloud platform using a unique 256-bit key generated by random number generation, distributed to the terminal security chip through an encrypted link, and then a 128-bit authentication tag is generated for subsequent data integrity verification. A 12-25 byte random number is used, and the key validity period is 25-30 days.

[0007] In a preferred embodiment, after receiving encrypted data, the edge node in S2 first decrypts it using the RSA-2048 algorithm, then uses an outlier removal algorithm based on the 3σ criterion to remove data that exceeds the mean by 3-5 times the standard deviation, standardizes the data to map parameters to the 0-1.5 range, and removes duplicate redundant data based on device identifiers and timestamps, retaining only unique valid data and desensitizing the identity information in personnel operation records. The preprocessed data is divided into two categories: operational data accounting for 75%-85% and security data accounting for 25%-45%. The initial security level is determined by a preset threshold: security level L1 is defined as normal operational parameters and no abnormal network access for 5-10 seconds; warning level L2 is defined as a single parameter exceeding the warning threshold or 3-5 invalid accesses; and risk level L3 is defined as multiple abnormal parameters or 5-15 suspicious access links. The initial judgment results and preprocessed data are uploaded to the cloud platform simultaneously.

[0008] In a preferred embodiment, S3 is adjusted according to operating conditions. The core control domain corresponds to L3 level risk, covering key control modules such as boiler combustion control, turbine speed regulation, and generator excitation regulation. It is only open to remote control center administrators with 5-10 access level 1 permissions and is prohibited from interacting with external networks. The operation and maintenance monitoring domain corresponds to L2 level risk, covering equipment status monitoring, parameter trend analysis, and routine operation and maintenance modules with 5-10 accesses. It is open to operation and maintenance engineers with 2 access permissions and is only allowed to receive data from the core control domain in one direction. Commands issued must be verified 5-15 times within 10-15 seconds. The information management domain corresponds to L1 level security, covering modules such as operation report generation, energy consumption statistics, and personnel scheduling. It is open to ordinary management personnel with 3 access permissions and is only allowed to access non-sensitive operation data 3-6 times.

[0009] In a preferred embodiment, in step S4, the cloud platform calls the analysis engine, inputs historical operating data from the past 3-6 months, including fault records, parameter fluctuation patterns, real-time preprocessed data, and security domain status, to construct a dual-dimensional risk prediction model. The equipment operation risk model, based on an LSTM neural network, predicts equipment fault trends. Input parameters include vibration and temperature time-series data from the past 1-2 hours, and the model outputs fault probability and warning time. The network security risk model, based on a decision tree algorithm, identifies abnormal access behavior. Input parameters include access IP, port, data transmission volume, and operation permissions, and the model outputs risk types such as brute-force attacks and data theft. After the model outputs risk levels L1, L2, and L3 and specific risk points, the cloud automatically generates targeted control strategies 5-10 times. At level L1, it executes the default rules of the conventional firewall and performs log audits periodically within 5-10 minutes. At level L2, it initiates enhanced protection by closing 5-15 unnecessary ports, requiring dual authorization for command issuance, and controlling the time to 15-25 seconds. At level L3, it triggers emergency protection by cutting off suspicious links, switching the core control domain to local backup control mode, and activating audible and visual alarms.

[0010] In a preferred embodiment, the control command in S5 needs to undergo three levels of security verification. The permission verification verifies whether the operator's permissions match the security domain corresponding to the command, with a matching rate of 98%-99.5%. The policy verification verifies the legality of the command in conjunction with the current control policy. In the case of L3 level risk, the issuance of commands to non-core control domains is rejected within 10-15ms. The identity verification uses a triple authentication of password + dynamic token + biometrics 5-10 times. The dynamic token is updated every 60-80 seconds, and the biometric accuracy rate is not less than 98.5%-99.9%. After the verification is passed, the cloud uses the national cryptographic SM4 algorithm to encrypt the command 10-25 times and transmits it to the edge node through dual-route independent optical cables. After receiving the command, the edge node decrypts it and verifies it again 10-30 times. After the verification is successful, it forwards it to the corresponding terminal device.

[0011] In a preferred embodiment, after receiving the instruction in S6, the terminal device performs the corresponding operation to adjust the boiler coal feed rate by 5%-11% every 3-10 minutes and adjust the turbine control valve opening by 10-15 degrees. At the same time, it collects execution status data in real time, including instruction execution progress, equipment response parameters, and post-execution operating status. This data is transmitted back to the edge node and cloud platform via an encrypted link. The edge node monitors the instruction execution process in real time. If the execution delay exceeds 50300-620ms or the adjustment range of the execution deviation parameter exceeds the instruction requirement by 5%-8%, a local alarm is immediately triggered and the instruction execution is suspended 5-10 times. The data is then simultaneously fed back to the cloud. The cloud platform analyzes the reasons for the execution deviation in real time based on big data, such as equipment jamming 2-5 times or network latency 2-4 times. It automatically generates correction instructions or prompts for manual intervention. The cloud performs full-process video linkage monitoring of the instruction execution process in the core control domain for 10-25 hours.

[0012] In a preferred embodiment, during the low-load period of the unit from 00:00 to 02:00 every day in S7, the cloud platform records the full-process log of the day, including the collection log, preprocessing log, security domain adjustment record, risk prediction result, instruction flow log, and execution feedback log. It also calculates the frequency of occurrence of each security level, the risk prediction accuracy target of 95%-98%, the instruction execution success rate target of 99.5%-99.9%, and the timeliness of handling safety incidents. The weight coefficients of the LSTM neural network are adjusted, and newly emerging risk case samples are added.

[0013] In a preferred embodiment, the daily full-process log includes 5-10 pages of collection log, 15-20 pages of preprocessing log, 5-15 pages of security domain adjustment record, 30-50 seconds of risk prediction result, 6-9 pages of instruction flow log, and 4-8 pages of execution feedback log.

[0014] In a preferred embodiment, the weight coefficients of the LSTM neural network are such that the historical data must contain at least 500 valid fault cases. When the prediction error rate of a certain type of fault is 8%-10%, the sample size of a single type of fault is 30-50 groups, or the warning time deviation is 30-50 seconds, the weights of the corresponding feature dimensions are adjusted. The weights of vibration and temperature time series features are increased by 5%-10%, the weights of flow and pressure features are finely adjusted by 3%-5%, and the weights of environmental parameter features are decreased by 3%-5%. The learning rate is set to 0.001, and the number of iterations is 50300-620 rounds, until the model prediction error rate is 2%-5% and the warning time deviation is 10-15 seconds. The initial weights are set to 0.4-0.6, and the environmental humidity parameter has the lowest contribution rate, with an initial weight set to 0.05-0.09.

[0015] A remote control and management system for thermal power plants based on big data includes a central processing unit and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the central processing unit, a remote control and management method for thermal power plants based on big data is implemented.

[0016] The technical effects and advantages of this invention are as follows: 1. This invention adopts a big data-driven dynamic security domain construction and permission division mechanism, constructing a three-level dynamic security domain consisting of a core control domain, an operation and maintenance monitoring domain, and an information management domain. Based on real-time operating data, the boundaries and permission status of each security domain are dynamically adjusted. When the system initially determines that the security level is upgraded, the protection of the core control domain can be quickly strengthened and unnecessary access can be restricted. This achieves real-time linkage between security protection strategies and unit operation risks, solving the problem of the disconnect between security strategies and operating conditions in traditional hierarchical management. Through dynamic permission adjustment and multi-level verification, this mechanism provides a flexible and rigorous multi-level linkage authentication foundation for remote control commands, significantly improving the proactive defense and adaptive capabilities of the management system and greatly enhancing management security.

[0017] 2. This invention employs a dual-dimensional risk prediction model based on LSTM neural networks and decision tree algorithms. It can integrate historical data and real-time operating parameters to accurately predict and classify equipment failure trends and network security risks. The model can dynamically output prediction results according to different risk scenarios and drive the generation of matching L1, L2, and L3 graded protection strategies, realizing a closed-loop strategy from anomaly warning to emergency response. By directly linking the risk prediction results to the strategy verification stage before the instruction is issued, the security protection strategy can be dynamically adjusted according to real-time data, effectively overcoming the shortcomings of traditional single static verification, enhancing the risk targeting of the instruction transmission and execution process, and significantly improving management security.

[0018] 3. This invention employs a multi-level linkage authentication and encrypted transmission mechanism that runs through the entire process. It integrates triple security verification of permissions, policies, and identity at the command issuance stage, supplemented by national cryptographic algorithms for encryption and dual-routing transmission. After the initial encryption and verification in the cloud, the command undergoes secondary decryption and high-number verification at the edge node, forming a cloud-edge collaborative verification. The command execution process is subject to real-time security monitoring and video linkage tracking. Any deviation can trigger alarms and automatic corrections. This end-to-end, multi-node, and multi-factor linkage authentication and monitoring chain greatly enriches the security verification process, forming a defense-in-depth system and fundamentally improving the overall security and reliability of remote control management. Attached Figure Description

[0019] Figure 1 This is a schematic diagram illustrating the operation steps of the big data-based remote control and management method for thermal power plants according to the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] As attached Figure 1 This illustrates a remote control and management method for thermal power plants based on big data.

[0022] The following three sets of examples were derived: Example 1: Low-risk scenario security level L1 routine operation and maintenance management.

[0023] This Example 1 is applied to the stable operation phase of a thermal power plant unit, where there are no abnormal parameter fluctuations or suspicious network access. Its core focus is on routine operation and maintenance security and data compliance management. The specific implementation steps are as follows: S1. Comprehensive Big Data Acquisition and Security Encryption: Smart sensors are deployed in core equipment and transmission links of boilers, steam turbines, and generators to collect data on boiler outlet temperature (350℃, accuracy 0.6℃, acquisition frequency 8 times / second), steam turbine speed (3000r / min, accuracy 0.2r / min, acquisition frequency 12 times / second), and generator output voltage (25kV, acquisition frequency 10 times / second). The data format is uniformly JSON, with millisecond-level timestamps and 16-bit UUID identifiers. After encryption using the AES-256 algorithm, the data is transmitted to edge nodes, with local backups retained at the terminals. The cloud platform generates an 18-byte random number and a unique 256-bit key, which is distributed to the terminal security chip through an encrypted link. A 128-bit authentication tag is generated simultaneously for data integrity verification. The key validity period is set to 28 days.

[0024] S2. Big Data Preprocessing and Preliminary Security Level Assessment: After the edge node decrypts the data using the RSA-2048 algorithm, it performs preprocessing operations. Based on the 3σ criterion, it removes outlier data that exceeds three times the standard deviation of the mean. It uses a standardized algorithm to map all parameters to the 1.2 interval, removes redundant data based on device identifiers and timestamps, and desensitizes the operator's identity information. After preprocessing, the proportion of running data is 82%, and the proportion of secure data is 18%. Since all running parameters are normal and there is no abnormal network access within 10 seconds, the preliminary security level is assessed as L1, and the data is simultaneously uploaded to the cloud platform.

[0025] S3. Dynamic Multi-Level Security Domain Construction and Permission Division: Based on the initial L1 assessment results, the cloud constructs a three-level dynamic security domain and divides permissions. The core control domain maintains a basic protection status and is only open to 5 remote control center administrators with permission level 1, prohibiting external network interaction. The operation and maintenance monitoring domain is open to 8 operation and maintenance engineers with permission level 2, allowing only one-way reception of data from the core control domain, and regular command issuance must complete 8 verifications within 12 seconds. The information management domain is open to ordinary management personnel with permission level 3, allowing only access to non-sensitive operational data, with a single access limit of 3 times.

[0026] S4. Big Data-Driven Risk Prediction and Control Strategy Generation: The cloud-based analysis engine is invoked, inputting historical operating data from the past three months and real-time preprocessed data. A two-dimensional model constructed using LSTM neural networks and decision tree algorithms is used to predict risks. The results show no equipment failure trends or network security risks. L1-level conventional protection strategies are executed, default firewall rules are enabled, and log audits are performed every 8 minutes.

[0027] S5. Hierarchical Authorization and Secure Command Issuance: For energy consumption statistics commands in the information management domain, triple security checks are performed. The permission check has a matching rate of 99.2%, the policy check confirms compliance with regular operation and maintenance rules, and the identity check uses a password + dynamic token updated every 70 seconds + biometric identification with an accuracy rate of 99.2% for triple authentication, completing a 6-step authentication process. After the verification is passed, the cloud uses the national cryptographic SM4 algorithm to encrypt the command 15 times and transmits it to the edge node through dual-route independent optical cables. After the edge node decrypts the command, it completes 18 secondary checks and forwards it to the terminal after it is correct.

[0028] S6. Command Execution and Real-time Security Monitoring Feedback: The terminal executes energy consumption statistics commands and synchronously transmits data collection progress and equipment operating status information. Edge nodes and the cloud monitor in real time. The command execution delay is 200ms, the parameter adjustment range is without deviation, and no alarm is triggered. The cloud performs 12-hour full-process video linkage monitoring of the core control domain execution process.

[0029] S7. Log Analysis and Strategy Optimization: During the low-load period from 00:30 to 01:50 on the same day, the cloud analysis collected 7 pages of full-process logs, 17 pages of preprocessing logs, 6 pages of security domain adjustment records, 40 seconds of risk prediction results, 7 pages of instruction flow logs, and 5 pages of execution feedback logs. The frequency of L1 level security status was 98%, the risk prediction accuracy was 97%, and the instruction execution success rate was 99.8%. The weight coefficients of the LSTM neural network were adjusted, 2 sets of regular fluctuation samples were added, the initial weight was maintained at 0.5, the environmental humidity parameter weight was set to 0.07, the learning rate was 0.001, 520 iterations were performed, the model prediction error rate was 3%, and the warning time deviation was 12 seconds.

[0030] Example 2: L2 anomaly warning and control for medium-risk scenarios.

[0031] This second embodiment is applied to a thermal power plant where the turbine speed exhibits slight abnormal fluctuations, and three invalid network accesses are detected simultaneously. The core focus is on anomaly warning, access control enhancement, and risk mitigation. The specific implementation steps are as follows: S1. Comprehensive Big Data Acquisition and Security Encryption: Intelligent sensors deployed on the steam turbine collect data at a speed of 3200 r / min (accuracy 0.3 r / min, acquisition frequency 14 times / second), boiler outlet temperature of 420℃ (accuracy 0.7℃, acquisition frequency 10 times / second), and generator output voltage of 22kV (acquisition frequency 13 times / second). The data is in JSON format, with a millisecond-level timestamp and a 14-bit UUID identifier. It is encrypted using the AES-256 algorithm and transmitted to the edge node, with a local backup stored on the terminal. A 22-byte random number and a 256-bit key are generated in the cloud, distributed to the terminal security chip, and a 128-bit authentication tag is generated. The key is valid for 26 days.

[0032] S2. Big Data Preprocessing and Preliminary Security Level Assessment: After edge nodes are decrypted using the RSA-2048 algorithm, abnormal speed data exceeding four times the standard deviation of the mean are removed. The parameters are standardized to the 1.3 range. Deduplication is performed based on equipment identifiers and timestamps, and operator identity information is anonymized. After preprocessing, the proportion of operational data is 78%, and the proportion of security data is 22%. Because the turbine speed parameter exceeds the warning threshold and there are three invalid accesses, the initial security level is assessed as L2, and the data is simultaneously uploaded to the cloud.

[0033] S3. Dynamic Multi-Level Security Domain Construction and Permission Division: The cloud adjusts the boundaries of the three-level security domain, and the operation and maintenance monitoring domain upgrades the early warning status, covering device status monitoring, parameter trend analysis and routine operation and maintenance modules. It grants 7 operation and maintenance engineers permission level 2, and the command issuance must complete 10 verifications within 13 seconds. The core control domain maintains basic control and grants 6 administrators permission level 1. The information management domain restricts non-essential access, and ordinary management personnel are limited to 4 accesses to non-sensitive data per visit.

[0034] S4. Big Data-Driven Risk Prediction and Control Strategy Generation: Inputting nearly 4 months of historical operating data from the cloud, including past speed fluctuation fault records and real-time data, the LSTM neural network model, based on nearly 1.5 hours of turbine vibration and temperature time series data, predicts a fault probability of 15% and an early warning time of 20 minutes. The decision tree algorithm identifies invalid access as non-malicious probing behavior, executes L2-level enhanced protection strategy, closes 12 unnecessary ports, and enables a dual-authorization mechanism for command issuance, with authorization time controlled within 20 seconds.

[0035] S5. Hierarchical Authorization and Secure Command Issuance: For turbine speed regulation commands, triple verification is performed: permission verification with a 98.8% matching rate, policy verification confirms compliance with L2-level control rules, and identity verification completes 8 authentications using password + dynamic token updated every 65 seconds + biometric identification with 99.0% accuracy. The cloud uses the national cryptographic SM4 algorithm to encrypt the command 20 times, transmits it to the edge node via dual-route optical cable, and the edge node performs 22 secondary verifications before forwarding it to the terminal.

[0036] S6. Command Execution and Real-time Safety Monitoring Feedback: The terminal executes the speed adjustment command, adjusting the turbine control valve opening by 12 degrees, making a minor adjustment of the speed every 6 minutes with an adjustment range of 7%, and synchronously transmitting the execution progress and equipment response parameters. Edge node monitoring detects an execution delay of 400ms, which does not exceed the threshold and no alarm is triggered. The cloud analyzes the cause of the speed fluctuation and determines that it is due to normal mechanical inertia, so no command correction is required. The core control domain command execution process is monitored by video linkage for 18 hours.

[0037] S7. Log Analysis and Strategy Optimization: During the low-load period from 00:10 to 01:40 on the same day, analyze the entire process log, collecting 8 pages of logs, 18 pages of preprocessing logs, 9 pages of security domain adjustment records, 35 seconds of risk prediction results, 8 pages of instruction flow logs, and 6 pages of execution feedback logs. The frequency of L2 level security status is 12%, the risk prediction accuracy is 96%, and the instruction execution success rate is 99.6%. Adjust the weights of the LSTM neural network, increasing the weights of vibration and temperature time series features by 7%, fine-tuning the weights of flow and pressure features by 4%, and decreasing the weights of environmental parameters by 4%. The learning rate is 0.001, with 550 iterations, the model prediction error rate is 4%, and the warning time deviation is 13 seconds.

[0038] Example 3: Emergency management and control at risk level L3 in high-risk scenarios.

[0039] This embodiment 3 is applied to a thermal power plant where the boiler outlet temperature rises abnormally and eight suspicious access links are detected, indicating a risk of data theft. The core focus is on emergency protection, link disconnection, and local backup control. The specific implementation steps are as follows: S1. Comprehensive Big Data Acquisition and Security Encryption: Boiler outlet temperature sensor collects data at 580℃ with an accuracy of 0.8℃, at a frequency of 15 times / second; turbine speed at 3800r / min with an accuracy of 0.4r / min, at a frequency of 15 times / second; generator output voltage at 28kV with a frequency of 14 times / second. The data format is JSON, with a millisecond-level timestamp and an 18-bit UUID identifier. The data is encrypted using the AES-256 algorithm and transmitted to the edge node. The terminal retains a local backup. The cloud generates a 25-byte random number and a 256-bit key, which is distributed to the terminal security chip and generates a 128-bit authentication tag. The key is valid for 25 days.

[0040] S2. Big Data Preprocessing and Preliminary Security Level Assessment: After edge nodes are decrypted using the RSA-2048 algorithm, abnormal temperature data exceeding five standard deviations from the mean is removed. Parameters are standardized to the 1.4 range, deduplication is performed based on device identifiers and timestamps, and operator identity information is anonymized. Preprocessed operational data accounts for 75%, and security data accounts for 25%. Due to abnormal boiler temperature and multiple auxiliary parameters, and the presence of eight suspicious access links, the preliminary security level is assessed as L3. Data is simultaneously uploaded to the cloud and an alert is triggered.

[0041] S3. Dynamic multi-level security domain construction and permission division: The cloud urgently adjusts the security domain boundaries, switches the core control domain to emergency status, and only grants permission level 1 to 8 remote control center administrators, completely cutting off interaction with the external network; the operation and maintenance monitoring domain suspends routine operations and retains permission level 2 to 3 core operation and maintenance engineers; the information management domain closes access permissions and prohibits all non-core personnel from operating it.

[0042] S4. Big Data-Driven Risk Prediction and Control Strategy Generation: Input nearly 6 months of historical operating data, including boiler over-temperature fault records and real-time data, into the cloud. The LSTM neural network, based on nearly 2 hours of boiler vibration and temperature time series data, predicts a fault probability of 85% and an early warning time of 10 minutes. The decision tree algorithm identifies suspicious links as data theft behaviors, executes L3 level emergency protection strategies, immediately cuts off suspicious access links, switches the core control domain to local backup control mode, and activates audible and visual alarms.

[0043] S5, Hierarchical Authorization and Secure Command Issuance: For boiler cooling and local control switching commands, triple strict verification is performed: permission verification has a matching rate of 99.5%; policy verification rejects all non-core control domain commands and completes the interception within 12ms; identity verification completes 10 authentications through password + dynamic token updated every 60s + biometric recognition with an accuracy rate of 99.8%; the cloud uses the national cryptographic SM4 algorithm to encrypt the command 25 times, transmits it to the edge node through dual-route optical cable, and the edge node performs 30 secondary verifications before forwarding it to the terminal.

[0044] S6. Command Execution and Real-time Safety Monitoring Feedback: The terminal executes the command, adjusting the boiler coal feed rate by 9% every 4 minutes, starting the cooling system, and simultaneously switching to local backup control. Data transmission shows that the initial execution delay is 550ms, and the parameter adjustment exceeds the command requirement by 6%. The edge node immediately triggers a local alarm and suspends command execution 6 times, synchronously feeding back to the cloud. The cloud analyzes the deviation and finds that the equipment is slightly stuck, automatically generating a correction command. After the terminal executes the command, normal operation is restored. The cloud provides 24-hour full-process video linkage monitoring of the core control domain execution process and tracks emergency response throughout the process.

[0045] S7. Log Analysis and Strategy Optimization: During the low-load period from 00:00 to 01:30 on the same day, analyze the full-process logs: 10 pages of collection logs, 20 pages of preprocessing logs, 15 pages of security domain adjustment records, 45 seconds of risk prediction results, 9 pages of instruction flow logs, and 8 pages of execution feedback logs. The frequency of L3-level security states was 3%, the risk prediction accuracy was 95%, and the instruction execution success rate was 99.5%. Adjust the weights of the LSTM neural network: increase the weights of vibration and temperature time-series features by 10%, fine-tune the weights of flow and pressure features by 5%, and decrease the weights of environmental parameters by 5%. Supplement with 10 sets of data to capture risk case samples. The learning rate was 0.001, and the model underwent 600 iterations. The prediction error rate was 2%, and the warning time deviation was 10 seconds.

[0046] The following experimental table is derived from the above three sets of examples: Note: 1. Percentage of secure data = (Amount of secure data after preprocessing / Total amount of data) × 100%; 2. Risk prediction accuracy = (Number of correct predictions / Total number of predictions) × 100%; 3. Instruction execution success rate = (Number of instructions executed without errors / Total number of instructions) × 100%; 4. Core monitoring time percentage = Actual monitoring time / 24h × 100%; The authentication verification enhancement coefficient is based on L1 (100%), L2 = (10 command verifications + 8 identity authentications) / (8 command verifications + 6 identity authentications) × 100% ≈ 133%, L3 = (30 command verifications + 10 identity authentications) / (8 command verifications + 6 identity authentications) × 100% ≈ 200%.

[0047] In summary, by adopting a big data-driven dynamic security domain construction and permission division mechanism, a three-level dynamic security domain was constructed, consisting of a core control domain, an operation and maintenance monitoring domain, and an information management domain. When the system initially determines that the security level is upgraded, real-time linkage between security protection strategies and unit operation risks is achieved. This mechanism provides a flexible and rigorous multi-level linkage authentication foundation for remote control commands through dynamic permission adjustment and multi-level verification, significantly improving the proactive defense and adaptive capabilities of the management system and greatly enhancing management security.

[0048] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A remote control and management method for thermal power plants based on big data, characterized in that: The specific steps are as follows: S1. Full-dimensional big data collection and security encryption: Deploy smart sensors in the core equipment and links of thermal power plants to collect operating parameters, which are then transmitted to edge nodes after being encrypted by the AES-256 algorithm, and the terminal retains local backup. S2. Big data preprocessing and initial security level assessment: After decrypting data at edge nodes, anomaly removal, standardization, deduplication and desensitization are performed. Based on the 3σ criterion and preset thresholds, the security levels L1, L2 and L3 are initially assessed. S3. Dynamic multi-level security domain construction and permission division: The cloud constructs a three-level dynamic security domain based on the initial judgment results, namely the core control domain, operation and maintenance monitoring domain, and information management domain, and adjusts the boundaries and divides the three levels of operation permissions according to the working conditions. S4. Big data-driven risk prediction and control strategy generation: The cloud uses LSTM neural network and decision tree algorithm to build a two-dimensional model to predict equipment and network risks and generate hierarchical control strategies. S5, hierarchical authorization and secure command issuance, control commands are verified by permission, policy and identity, encrypted by the national cryptographic SM4 algorithm and transmitted through dual-route optical cables, and the integrity is verified twice by edge nodes; S6, Command Execution and Real-time Security Monitoring and Feedback: The terminal executes commands and sends back status data. Edge nodes and the cloud monitor in real time, and any deviations are immediately alerted and processed. S7. Log analysis and strategy optimization: Analyze the entire process log during low-load periods each day to optimize risk model parameters and security control rules, forming a closed loop.

2. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: The operating parameters collected in S1 include boiler outlet temperature of 300-620℃, accuracy ±0.5-0.9℃, 5-15 times / second; turbine speed of 3000-5000r / min, accuracy 0.1-0.5r / min, 10-15 times / second; and generator output voltage of 20-30kV, 5-15 times / second. The data format is uniformly JSON with millisecond time and UUID identifier recorded 10-18 times. The AES-256 algorithm encryption is generated by the cloud platform using a unique 256-bit key generated by random number generation. This key is distributed to the terminal security chip through an encrypted link, and a 128-bit authentication tag is generated for subsequent data integrity verification. A 12-25 byte random number is used, and the key validity period is 25-30 days.

3. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: After receiving encrypted data, the edge node in S2 first decrypts it using the RSA-2048 algorithm. Then, it uses an outlier removal algorithm based on the 3σ criterion to remove data that exceeds the mean by 3-5 times the standard deviation. Data standardization maps parameters to the 0-1.5 range. Redundant data is deduplicated based on device identifiers and timestamps, retaining only unique valid data and desensitizing the identity information in personnel operation records. The preprocessed data is divided into two categories: operational data (75%-85%) and security data (25%-45%). The initial security level is determined by preset thresholds. Security level L1 is defined as normal operational parameters and no abnormal network access for 5-10 seconds. Warning level L2 is defined as a single parameter exceeding the warning threshold or 3-5 invalid accesses. Risk level L3 is defined as multiple abnormal parameters or 5-15 suspicious access links. The initial judgment results and preprocessed data are uploaded to the cloud platform simultaneously.

4. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: The S3 domain, adjusted according to operating conditions, corresponds to L3 level risk, covering key control modules such as boiler combustion control, turbine speed regulation, and generator excitation regulation. It is only open to remote control center administrators with 5-10 access level 1 sessions, and interaction with external networks is prohibited. The operation and maintenance monitoring domain corresponds to L2 level risk, covering equipment status monitoring, parameter trend analysis, and routine operation modules with 5-10 accesses. It is open to operation and maintenance engineers with 2 access levels, allowing only one-way reception of data from the core control domain. Command issuance requires 5-15 verifications within 10-15 seconds. The information management domain corresponds to L1 level security, covering modules such as operation report generation, energy consumption statistics, and personnel scheduling. It is open to ordinary management personnel with 3 access levels, allowing only 3-6 accesses to non-sensitive operation data.

5. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: In S4, the cloud platform calls the analysis engine, inputting historical operating data from the past 3-6 months, including fault records, parameter fluctuation patterns, real-time preprocessed data, and security domain status, to construct a two-dimensional risk prediction model. The equipment operation risk model, based on an LSTM neural network, predicts equipment fault trends. Input parameters include vibration and temperature time-series data from the past 1-2 hours, and the model outputs fault probability and warning time. The network security risk model, based on a decision tree algorithm, identifies abnormal access behavior. Input parameters include access IP, port, data transmission volume, and operation permissions, and the model outputs risk types such as brute-force attacks and data theft. After the model outputs risk levels L1, L2, and L3 and specific risk points, the cloud automatically generates targeted control strategies 5-10 times. At L1 level, it executes standard firewall default rules and performs log audits periodically every 5-10 minutes. At L2 level, it initiates enhanced protection by closing 5-15 unnecessary ports, requiring dual authorization for command issuance, and controlling the time to 15-25 seconds. At L3 level, it triggers emergency protection by cutting off suspicious links, switching the core control domain to local backup control mode, and activating audible and visual alarms.

6. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: In the S5, control commands undergo three levels of security verification. First, the cloud verifies whether the operator's permissions match the security domain corresponding to the command, with a matching rate of 98%–99.5%. Second, the policy verification verifies the legality of the command based on the current control policy. At L3 level risk, commands from non-core control domains are rejected within 10–15ms. Third, identity verification uses a triple authentication method of password + dynamic token + biometrics 5–10 times. The dynamic token is updated every 60–80 seconds, and the biometric accuracy is no less than 98.5%–99.9%. After successful verification, the cloud encrypts the command 10–25 times using the national cryptographic SM4 algorithm and transmits it to the edge node via dual-route independent optical cables. The edge node receives the command, decrypts it, and performs a second verification 10–30 times. If the verification is successful, the command is forwarded to the corresponding terminal device.

7. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: After receiving the instruction, the terminal device in S6 performs the corresponding operation, adjusting the boiler coal feed rate by 5%-11% every 3-10 minutes and adjusting the turbine control valve opening by 10-15 degrees. At the same time, it collects execution status data in real time, including instruction execution progress, equipment response parameters, and post-execution operating status. This data is transmitted back to the edge node and cloud platform via an encrypted link. The edge node monitors the instruction execution process in real time. If the execution delay exceeds 50300-620ms or the execution deviation parameter adjustment exceeds the instruction requirement by 5%-8%, a local alarm is immediately triggered and instruction execution is suspended 5-10 times. The data is then simultaneously fed back to the cloud. The cloud platform analyzes the reasons for the execution deviation in real time based on big data, such as equipment jamming 2-5 times or network latency 2-4 times. It automatically generates correction instructions or prompts for manual intervention. The cloud provides 10-25 hours of full-process video linkage monitoring of the instruction execution process in the core control domain.

8. The remote control and management method for thermal power plants based on big data according to claim 1, characterized in that: During the low-load period of the unit from 00:00 to 02:00 every day in S7, the cloud platform records the full-process log of the day, including the collection log, preprocessing log, security domain adjustment record, risk prediction result, instruction flow log, and execution feedback log. It also calculates the frequency of occurrence of each security level, the risk prediction accuracy target of 95%-98%, the instruction execution success rate target of 99.5%-99.9%, and the timeliness of security incident handling. The weight coefficients of the LSTM neural network are adjusted, and newly emerging risk case samples are added.

9. The remote control and management method for thermal power plants based on big data according to claim 8, characterized in that: The daily full-process log includes 5-10 pages of acquisition logs, 15-20 pages of preprocessing logs, 5-15 pages of security domain adjustment records, 30-50 seconds of risk prediction results, 6-9 pages of instruction flow logs, and 4-8 pages of execution feedback logs. The weight coefficients of the LSTM neural network are based on historical data containing at least 500 valid fault cases. When the prediction error rate of a certain type of fault is 8%-10%, the sample size of a single type of fault is 30-50 groups, or the warning time deviation is 30-50 seconds, the weights of the corresponding feature dimensions are adjusted. The weights of vibration and temperature time series features are increased by 5%-10%, the weights of flow and pressure features are fine-tuned by 3%-5%, and the weights of environmental parameter features are decreased by 3%-5%. The learning rate is set to 0.001, and the number of iterations is 50300-620 rounds until the model prediction error rate is 2%-5% and the warning time deviation is 10-15 seconds. The initial weights are set to 0.4-0.

6. The environmental humidity parameter has the lowest contribution rate, and its initial weight is set to 0.05-0.

09.

10. A remote control and management system for thermal power plants based on big data, characterized in that: It includes a central processing unit and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the central processing unit, the remote control and management method for thermal power plants based on big data as described in any one of claims 1-9 is implemented.

Images