Overhead line multi-dimensional state parameter monitoring system based on distributed edge calculation
By constructing a mapping relationship between line equipment and edge computing nodes and a global semantic knowledge graph in the overhead line monitoring system, the problem of misjudgment during network attacks is solved, and a deep integration assessment and collaborative response to network security status and physical operation status are realized, thereby improving the security and operation and maintenance efficiency of the monitoring system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-15
- Publication Date
- 2026-04-14
AI Technical Summary
In existing overhead line monitoring systems, the cybersecurity risks of edge computing facilities have not been fully considered, making it impossible to distinguish between physical faults and network anomalies during network attacks, which can easily lead to incorrect operation and maintenance scheduling.
A multi-dimensional status parameter monitoring system based on distributed edge computing establishes a mapping relationship between line equipment and edge computing nodes through an edge perception module, constructs local and global semantic knowledge graphs, performs deep fusion evaluation in conjunction with network operation data, generates security status level and operation status level, and triggers a collaborative response mechanism.
It has achieved accurate assessment of complex cross-domain risks, reduced false alarm rate, and realized precise separation of network defense and physical maintenance through collaborative response module, thereby improving the security and intelligent operation and maintenance efficiency of overhead line monitoring system.
Smart Images
Figure CN121864602A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of power Internet of Things and network security technology, and more specifically, to a multi-dimensional status parameter monitoring system for overhead lines based on distributed edge computing. Background Technology
[0002] With the deepening of smart grid construction, overhead lines, as the main artery of power transmission, are crucial for ensuring grid security through real-time perception of their operating status. Distributed edge computing technology, which integrates data acquisition and computing capabilities, is widely used in overhead line monitoring scenarios of the power Internet of Things due to its significant advantages of local processing, low latency, high bandwidth, and high efficiency.
[0003] Existing technologies typically employ an "edge-cloud" overhead line monitoring system. This system uses intelligent gateways deployed at the edge to aggregate micro-meteorological and conductor mechanical data collected from various sensors. Built-in edge algorithms perform threshold discrimination or trend analysis on the data, and once parameters exceed limits, alarm information is sent to the cloud to monitor the operational health of the overhead line. However, this existing technology overlooks the cybersecurity risks faced by edge computing facilities as digital terminals. Specifically, because physical monitoring data and network operation data from edge nodes are often stored and processed separately in the system architecture, there is a lack of semantic-level correlation analysis between the two. If an edge node suffers a cyberattack, the system, unable to detect any abnormal network security status, may misjudge the fault as an overheating fault based solely on tampered data, leading to incorrect on-site maintenance scheduling.
[0004] In view of this, the present invention proposes a multi-dimensional status parameter monitoring system for overhead lines based on distributed edge computing to solve the above problems. Summary of the Invention
[0005] To overcome the aforementioned shortcomings of the prior art and to achieve the above objectives, the present invention provides the following technical solution: a multi-dimensional status parameter monitoring system for overhead lines based on distributed edge computing, comprising: The edge awareness module is used to establish the mapping relationship between line equipment and edge computing nodes based on the collected multi-dimensional state parameters, and further construct the local semantic knowledge graph of each edge computing node; The global cognition module is used to construct a global entity and mapping index table based on the local semantic knowledge graph. Based on the mapping index table and the physical connection topology of the overhead line, the local semantic knowledge graphs are spliced together to form a global semantic knowledge graph covering the overhead line. The security situation assessment module is used to analyze the network security situation of each edge computing node based on network operation data and global semantic knowledge graph, obtain the network security situation level, and assess the operation status of each line device to obtain the operation status level. The collaborative response module is used to trigger corresponding processes based on the network security situation level and operational status level, and generate security access control policies for abnormal edge computing node entities or maintenance warning information for overhead lines.
[0006] Furthermore, establishing the mapping relationship between line equipment and edge computing nodes includes: Clock synchronization is performed on each edge computing node in the overhead line, and multi-dimensional status parameters of the corresponding line equipment in the overhead line and the network operation data of the edge computing node itself are collected based on the edge computing node. The multidimensional state parameters and network operation data are time-aligned to generate time-series data packets for each edge computing node. The unique identification code of each line device and the unique node ID of each edge computing node are extracted from the time-series data packets and bound to determine the mapping relationship table between each line device and the corresponding edge computing node.
[0007] Furthermore, a local semantic knowledge graph for each edge computing node is constructed, including: A pre-built ontology library for the power sector is constructed. This library contains entity type definitions for line equipment types, edge computing nodes, and multi-dimensional state parameters, as well as semantic logic rules for deployment relationships, attribute subordination relationships, and connection relationships. Based on the entity type definitions, entity extraction and instantiation operations are performed on time-series data packets to determine various entities in overhead lines. These entities include line equipment entities, edge computing node entities, and state attribute entities. Based on the mapping relationship table, the deployment affiliation relationship between line equipment entities and edge computing node entities is constructed. Based on the semantic logical relationship in the power domain ontology library, the attribute association relationship between each line equipment entity, edge computing node entity and status attribute entity is determined. Each entity and its corresponding deployment affiliation relationship and attribute association relationship are combined to form triple data, and then summarized to form a local semantic knowledge graph of each edge computing node.
[0008] Furthermore, a global entity and mapping index table is constructed, including: Based on the unique identification code of each line device and the unique node ID of the edge computing node, the local semantic knowledge graphs are matched, and line device entities with the same unique identification code or edge computing node entities with the same unique node ID in different local semantic knowledge graphs are determined as equivalent entities pointing to the same object. Retrieve state attribute entities that have attribute relationships with each equivalent entity; classify state attribute entities based on attribute type and calculate the confidence level of each type of state attribute entity; The numerical values of the state attribute entities with the highest confidence are selected as the authority values of the corresponding types. Based on the authority values of all types, global entities and attribute associations with global identifiers are constructed, and a mapping index table is established between the global identifiers and the unique identification codes or unique node IDs in each local semantic knowledge graph.
[0009] Furthermore, a global semantic knowledge graph covering overhead lines is formed, including: Based on the mapping index table, the relationships in each local semantic knowledge graph are spliced together, and based on the physical connection topology of the overhead lines, physical connection relationships are created between adjacent line equipment entities to form a global semantic knowledge graph covering the overhead lines.
[0010] Furthermore, the network security posture of each edge computing node is analyzed, including: The network operation data is associated with the corresponding edge computing node entities in the global semantic knowledge graph; graph embedding calculation is performed on the static topology structure determined based on the deployment affiliation and physical connection relationships in the global semantic knowledge graph to generate the structural feature vectors of each edge computing node entity; The embedded feature vector formed by splicing structural feature vectors with corresponding network operation data is analyzed to determine the network intrusion probability of each edge computing node entity. The network intrusion probability is compared with a preset risk threshold to determine the network security status level of each edge computing node entity.
[0011] Furthermore, the operational status of each line's equipment is assessed, including: Retrieve state attribute entities from the global semantic knowledge graph that have attribute relationships with line equipment entities; calculate the initial deviation of the state attribute entity's value relative to the standard operating range; identify line equipment entities adjacent to each line equipment entity based on physical connection relationships; perform a weighted calculation of its own initial deviation and the initial deviation of adjacent line equipment entities to determine the comprehensive deviation of the line equipment entity; compare the comprehensive deviation with a preset alarm threshold to determine the operating status level of the corresponding line equipment entity.
[0012] Furthermore, the corresponding processes are triggered, including: The network security status level and operational status level are compared with the preset network blocking threshold and preset physical alarm threshold, respectively. If the network security status level exceeds the network blocking threshold, the corresponding edge computing node entity is identified as an abnormal edge computing node entity, and the network defense response process is triggered. If the operational status level exceeds the physical alarm threshold, the physical maintenance response process for the corresponding line equipment entity is triggered.
[0013] Furthermore, the network defense response process is triggered, including: A pre-built defense policy library is constructed, which includes port access control templates and IP address filtering templates corresponding to each network security posture level. The defense policy library is matched based on the network security posture level corresponding to the abnormal edge computing node entity, and the security access control policy is determined by combining the Internet Protocol address of the abnormal edge computing node entity. The security access control policy is distributed to the underlying firewall driver corresponding to the abnormal edge computing node entity through an encrypted configuration channel, and the firewall rule table is updated in real time.
[0014] Furthermore, the physical maintenance response process for the corresponding line equipment entity is triggered, including: The global semantic knowledge graph is searched starting from the line equipment entity with the highest comprehensive deviation. The associated line equipment entities that have a physical connection with the search starting point are obtained. The timestamps of abnormal deviations in the state attribute entity values of each associated line equipment entity are extracted and compared. The line equipment entity with the earliest abnormal deviation time is identified as the abnormal source that caused the fault propagation. Based on the anomaly source, a k-hop neighbor node query operation is performed in the global semantic knowledge graph. The retrieved line equipment entities and edge computing node entities with cascading effects are identified as the affected associated range. The geographical attribute information of the anomaly source and the list of equipment in the affected associated range are extracted and encapsulated to form maintenance early warning information for overhead lines.
[0015] The technical effects and advantages of the multi-dimensional status parameter monitoring system for overhead lines based on distributed edge computing of this invention are as follows: 1. This invention breaks down the "data silos" that separate the physical monitoring domain from the network security domain in traditional monitoring by synchronously collecting multi-dimensional status parameters of overhead lines and network operation data of edge computing nodes in the edge sensing module, and constructing a global semantic knowledge graph containing the mapping relationship between line equipment entities and edge computing node entities using the global cognition module; by deeply integrating and evaluating the network security status of edge nodes with the physical operation status of line equipment, it effectively identifies and eliminates false data deviations caused by sensor failures or network attacks, thereby significantly reducing the false alarm rate and achieving accurate assessment of complex cross-domain risks.
[0016] 2. This invention achieves precise triage between network defense and physical maintenance by triggering a graded collaborative response mechanism based on network security situation level and operational status level. Through the collaborative response module, it can automatically generate and issue security access control policies for edge computing nodes identified as having network anomalies, achieving millisecond-level network risk isolation. For line equipment identified as having physical faults, it can generate maintenance early warning information based on graph tracing analysis, including anomaly source location, cascading impact range, and fault propagation path, guiding maintenance personnel to quickly carry out on-site repairs. Through a complete closed loop from "perception-assessment" to "decision-response," it upgrades the traditional passive single-point alarm to a proactive, collaborative cross-domain handling system, greatly improving the overall security and intelligent operation and maintenance efficiency of the overhead line monitoring system. Attached Figure Description
[0017] Figure 1 This is a system schematic diagram of the overhead line multi-dimensional status parameter monitoring system based on distributed edge computing of the present invention; Figure 2 This is a schematic diagram illustrating the working principle of the collaborative response module of the present invention. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example
[0019] Please see Figure 1 and Figure 2 As shown in the figure, the main design contents of the overhead line multi-dimensional status parameter monitoring system based on distributed edge computing described in this embodiment are as follows: Most existing overhead line monitoring systems focus on monitoring faults in the physical structure of the line, such as using edge nodes to analyze sensor data in real time to identify physical defects such as broken strands and overheating. However, they often treat the network security protection of edge computing facilities as an independent system, resulting in physical monitoring data and the network operation data of edge nodes (such as traffic, logs, and process status) being in a state of "information silos" with separate management.
[0020] For example, when edge nodes are subjected to network attacks (such as hackers infiltrating nodes through vulnerabilities and tampering with sensor readings), due to the lack of cross-domain fusion analysis mechanisms, the monitoring system has difficulty distinguishing the true source of data anomalies and is very likely to misjudge network attacks as physical line faults, thereby triggering incorrect operation and maintenance scheduling instructions. There is a lack of a comprehensive monitoring method that can collaboratively assess network security status and physical line operation status.
[0021] Based on this, a multi-dimensional status parameter monitoring system for overhead lines based on distributed edge computing is designed, including: The edge awareness module is used to establish the mapping relationship between line equipment and edge computing nodes based on the collected multi-dimensional state parameters, and further construct the local semantic knowledge graph of each edge computing node.
[0022] Establishing a mapping relationship between line equipment and edge computing nodes includes: Clock synchronization is performed on each edge computing node in the overhead line. Each edge computing node establishes a connection with the time synchronization server through the Network Time Protocol (NAT) to obtain the reference time and calibrate the local clock of each edge computing node, ensuring that the local clock error of each edge computing node in the overhead line remains within the calibrated time accuracy range.
[0023] The system collects multi-dimensional status parameters of corresponding line equipment in overhead power lines and network operation data of the edge computing nodes themselves. Each edge computing node periodically reads the multi-dimensional status parameters (including but not limited to conductor temperature, conductor sag, conductor vibration frequency, insulator leakage current, and tower tilt angle) of each line equipment physically connected to it via an industrial fieldbus interface; it synchronously calls the operating system kernel interface to obtain its own network operation data (including but not limited to CPU utilization, memory usage, network throughput, number of currently active transmission control protocol connections, and firewall log entries); it uses the current clock time when each edge computing node acquires the multi-dimensional status parameters and network operation data as a timestamp to mark the multi-dimensional status parameters and network operation data respectively; and it marks all collected raw data with the corresponding source identifier before packaging.
[0024] For example, the time accuracy range can be set to milliseconds, and the industrial fieldbus interface can be an RS485 interface.
[0025] Multidimensional state parameters and network operation data are time-series aligned (based on the same or similar timestamps). The aligned data is then encapsulated in time sequence to generate time-series data packets for each edge computing node. The time-series data packets contain a header and a data body. The header records the timestamp and the data source (the unique node ID of the edge computing node). The data body stores "unique identifier-parameter key-value pairs" and "network indicator key-value pairs" in time sequence.
[0026] The process involves parsing and extracting the unique identifiers of each line device and the unique node IDs of each edge computing node from time-series data packets, binding them together to determine the mapping relationship table between each line device and its corresponding edge computing node. The "unique node ID" is extracted from the header of the time-series data packet, and the "unique identifier" is extracted from each "unique identifier-parameter key-value pair" in the data body. Each extracted "unique identifier" is bound to a "unique node ID" to form a "key-value" pair. After traversing and parsing all time-series data packets of an edge computing node, the binding relationships between all "unique identifiers" and "unique node IDs" are summarized to generate an "edge computing node-line device" mapping relationship table.
[0027] Furthermore, it constructs local semantic knowledge graphs for each edge computing node, including: A pre-built power domain ontology library is constructed, containing entity type definitions for line equipment types, edge computing nodes, and multi-dimensional state parameters, as well as semantic and logical rules for deployment relationships, attribute subordination relationships, and connection relationships. The top-level architecture of the power domain ontology library is defined using a network ontology language, creating line equipment type classes, edge computing node classes, and state attribute classes within the library. Under the line equipment type class, transformer subclasses, insulator subclasses, and conductor subclasses are defined as entity type definitions for line equipment types. Under the edge computing node class, edge gateway subclasses and intelligent monitoring terminal subclasses are defined as entity type definitions for edge computing nodes. Under the state attribute class, temperature attribute subclasses, current attribute subclasses, and network flow attribute subclasses are defined as entity type definitions for multi-dimensional state parameters.
[0028] In the power domain ontology, object attributes are defined to establish semantic relationships between entities: The "Deployed at" object attribute is defined as a semantic logic rule for the deployment relationship between line equipment types and edge computing nodes, with its domain being the line equipment type class and its value domain being the edge computing node class. The "Has Attribute" object attribute is defined as a semantic logic rule for the attribute dependency relationship between line equipment types, edge computing nodes, and state attribute classes, with its domain being the union of the line equipment type class and the edge computing node class and its value domain being the state attribute class. The "Physical Connection" object attribute is defined as a semantic logic rule for the connection relationship between different line equipment types, with both its domain and value domain being the line equipment type class.
[0029] Based on entity type definitions, entity extraction and instantiation operations are performed on time-series data packets to identify various entities in overhead lines, including line equipment entities, edge computing node entities, and status attribute entities. The process involves traversing the "unique identifier-parameter key-value pairs" and "network indicator key-value pairs" in the time-series data packets. Each edge computing node, according to the entity type definitions in the power domain ontology library, maps the extracted unique identifier of the line equipment to an instance of the line equipment type class, generating a line equipment entity. Each edge computing node maps the extracted unique node ID to an instance of the edge computing node class, generating an edge computing node entity. Each edge computing node maps the extracted multidimensional status parameter values and network operation data values to instances of the status attribute class, generating a status attribute entity.
[0030] The deployment attribution relationship between line device entities and edge computing node entities is constructed based on the mapping relationship table. A link is established between the "deployed at" object attribute between the line device entities and the edge computing node entities based on the key-value pair association between the unique identifier and unique node ID of the line device in the mapping relationship table.
[0031] Based on the semantic and logical relationships in the power domain ontology, the attribute associations between each line equipment entity, edge computing node entity, and state attribute entity are determined. Each edge computing node utilizes the "having attributes" semantic and logical relationships in the power domain ontology to establish attribute dependency links, using the generated line equipment entity as the subject and the state attribute entity generated from the multi-dimensional state parameters corresponding to the unique identifier of the line equipment as the object. Simultaneously, the generated edge computing node entity is used as the subject, and the state attribute entity generated from the network operation data of the edge computing node is used as the object, establishing attribute dependency links, thereby determining the attribute associations between each line equipment entity, edge computing node entity, and state attribute entity.
[0032] Each entity is combined with its corresponding deployment affiliation and attribute association to form triplet data, which are then aggregated to form a local semantic knowledge graph for each edge computing node.
[0033] The triplet data format is a structure of <subject, predicate, object>, for example, <line device entity, deployed on, edge computing node entity> <line device entity, has temperature attribute, temperature entity>.
[0034] The global cognition module is used to construct a global entity and mapping index table based on the local semantic knowledge graph. Based on the mapping index table and the physical connection topology of the overhead line, the local semantic knowledge graphs are spliced together to form a global semantic knowledge graph covering the overhead line.
[0035] Construct a global entity and mapping index table, including: Based on the unique identifiers of each line device and the unique node IDs of edge computing nodes, the local semantic knowledge graphs are matched. Line device entities with the same unique identifier or edge computing node entities with the same unique node ID in different local semantic knowledge graphs are identified as equivalent entities pointing to the same object. The global cognition module queries each local semantic knowledge graph, extracting all resources and attribute values of type 'line device entity' or 'edge computing node entity'. A hash table is constructed in memory, using the retrieved 'unique identifier' and 'unique node ID' data attribute values as the keys of the hash table; the resource identifier of the corresponding entity resource and the source identifier of its local semantic knowledge graph are used as the value list of the hash table and stored in the hash table; the global cognition module traverses the hash table, searching for hash entries in the value list that contain multiple local semantic knowledge graph identifiers; multiple line device entity resources with the same unique identifier as the hash key are identified as equivalent entities pointing to the same physical object; multiple edge computing node entity resources with the same unique node ID as the hash key are identified as equivalent entities pointing to the same physical object.
[0036] Retrieve state attribute entities that have attribute relationships with each equivalent entity. For each group of equivalent entities, perform a subgraph query operation in each local semantic knowledge graph to retrieve all state attribute entities with the equivalent entity as the subject and the predicate as "have attribute" relationship as the candidate attribute set.
[0037] State attribute entities are classified based on attribute type, and the confidence level of each type of state attribute entity is calculated. Each state attribute entity in the candidate attribute set is traversed, the attribute type of each state attribute entity is read, and state attribute entities with the same attribute type are grouped into the same attribute classification group (such as "temperature attribute", "current attribute", "voltage attribute").
[0038] For each attribute classification group, the confidence level of each state attribute entity is calculated based on the reliability of the data source (such as the accuracy of historical data of nodes), the freshness of the timestamp (such as the decay relationship with the current time), and the consistency between values.
[0039] The value of the state attribute entity with the highest confidence level is selected as the authority value for the corresponding type. For example, the list of attribute type "conductor temperature" contains two entities: entity A (confidence level 0.804, value 65.2) and entity B (confidence level 0.809, value 66.0); then entity B has the highest confidence level, so the authority value of "conductor temperature" is 66.0, which comes from entity B.
[0040] Based on all types of authority values, a global entity and attribute association with global identifiers is constructed. The global cognition module generates a unique universal identifier for each group of equivalent entities as a global identifier and instantiates a new global entity node in the global semantic knowledge graph. For each authority value, a corresponding global state attribute entity is instantiated, and the newly instantiated global entity node is connected to each global state attribute entity using the "having attribute" association relationship, thus constructing a global entity and attribute association with global identifiers.
[0041] A mapping index table is established between the global identifier and the unique identification codes or unique node IDs in each local semantic knowledge graph. This mapping index table is created in an in-memory database, using the newly generated global identifier as the key and the list of unique identification codes or unique node IDs originating from the local semantic knowledge graphs contained in the group of equivalent entities as the value list.
[0042] A global semantic knowledge graph covering overhead power lines is formed, including: The relationships between local semantic knowledge graphs are concatenated based on a mapping index table. The process involves backtracking through the value list in the mapping index table to retrieve deployment affiliation triples associated with unique identifiers or unique node IDs. The local entity identifiers of these retrieved deployment affiliation triples are then replaced with their corresponding global identifiers using the mapping index table. The replaced deployment affiliation triples are then added to the global semantic knowledge graph, thus concatenating the relationships.
[0043] Based on the physical connection topology of overhead lines, physical connection relationships are created between adjacent line equipment entities, forming a global semantic knowledge graph covering overhead lines. The physical connection topology of overhead lines is determined based on the power grid geographic information system, and describes the geographic spatial adjacency order of each line equipment. Adjacent line equipment entity pairs with physical adjacency relationships are identified through the physical connection topology; the corresponding global entity nodes of these adjacent line equipment entity pairs are searched in the global semantic knowledge graph, and a new triple with the predicate "physical connection" is created between two adjacent global entity nodes, forming a global semantic knowledge graph covering overhead lines.
[0044] The security posture assessment module is used to analyze the network security posture of each edge computing node based on network operation data and global semantic knowledge graph, obtain the network security posture level, and assess the operating status of each line device to obtain the operating status level.
[0045] The network security posture of each edge computing node is analyzed, including: Each network operation data is associated with the corresponding edge computing node entity in the global semantic knowledge graph. The unique node ID contained in the network operation data is parsed, and the global identifier corresponding to the unique node ID is found based on the mapping index table. The corresponding edge computing node entity in the global semantic knowledge graph is located, and the network operation data is attached to the edge computing node entity as a temporary dynamic attribute.
[0046] The system performs graph embedding calculations on the static topology structure determined by deployment affiliation and physical connection relationships in the global semantic knowledge graph to generate structural feature vectors for each edge computing node entity. The security situation assessment module extracts all line equipment entities and edge computing node entities as graph nodes based on the deployment affiliation and physical connection relationships determined in the global semantic knowledge graph, and extracts all deployment affiliation edges and physical connection edges as graph edges to construct a static topology structure data object containing only graph skeleton information. The graph nodes are uniquely indexed using global identifiers.
[0047] Graph embedding computation is performed on the static topology graph: Parameters such as walk length, number of walks, and target vector dimension are set (e.g., walk length parameter is 80; number of walks parameter is 10; target vector dimension is 128). Multiple fixed-length random walks are performed starting from each node in the static topology graph, generating a node identifier sequence of the local neighborhood structure of the graph nodes. The vector representation of each node is learned by predicting the context of the nodes in the sequence. The generated node identifier sequence is processed using the Skip-gram algorithm. By maximizing the co-occurrence probability of context nodes in the node sequence, each global identifier is mapped to a fixed-dimensional real-valued vector. The calculated real-valued vectors are stored as the structural feature vectors of each edge computed node entity.
[0048] The network intrusion probability of each edge computing node entity is determined by analyzing the embedded feature vector formed by concatenating the structural feature vector with the corresponding network operation data. The values in the network operation data are arranged sequentially to form the network operation feature vector. The structural feature vector and the network operation feature vector are then concatenated sequentially (i.e., each array element of the network operation feature vector is appended to the array element of the structural feature vector in turn) to form the embedded feature vector of the corresponding edge computing node entity.
[0049] For example, the structural feature vector of the global identifier "Global_Node_001" is a 128-dimensional array [0.1, -0.2, ..., 0.05]. The network operation feature vector consists of three metrics: [65.0 (CPU utilization), 42.0 (memory utilization), 12.5 (network throughput)]. The embedded feature vector is a 131-dimensional array [0.1, -0.2, ..., 0.05, 65.0, 42.0, 12.5].
[0050] The isolated forest anomaly detection algorithm is used to construct multiple binary isolation trees to spatially segment the embedded feature vectors. The average path length of the embedded feature vectors in the binary isolation trees is calculated. Anomaly scores are calculated based on the average path length, and the anomaly scores are normalized to floating-point numbers between 0 and 1 as the network intrusion probability of each edge computing node entity.
[0051] The process of constructing the isolated forest anomaly detection algorithm is as follows: collect the embedded feature vectors of edge computing nodes under normal operating conditions in history as training samples; randomly select feature dimensions and split points, recursively cut the training sample space to construct a binary tree structure until each leaf node contains only one sample or the maximum depth of the tree is reached, and repeat the construction of multiple binary trees to form a forest. Save the constructed tree structure parameters as the isolated forest anomaly detection algorithm.
[0052] The network intrusion probability is compared with a preset risk threshold to determine the network security status level of each edge computing node entity. The risk threshold includes a low-risk threshold and a high-risk threshold. If the network intrusion probability is less than the low-risk threshold, the network security status level is determined to be Level 1 (e.g., "normal"). If the network intrusion probability is between the low-risk and high-risk thresholds, the network security status level is determined to be Level 2 (e.g., "suspicious"). If the network intrusion probability is greater than the high-risk threshold, the network security status level is determined to be Level 3 (e.g., "high-risk").
[0053] It should be explained that the risk thresholds are established based on the statistical distribution characteristics of historical network intrusion detection data. For example, based on network intrusion probability data within a month, the 90th percentile of the probability distribution is calculated as the low-risk threshold, and the 99th percentile is calculated as the high-risk threshold.
[0054] The operational status of each line's equipment was assessed, including: Retrieve state attribute entities from the global semantic knowledge graph that have attribute relationships with line equipment entities; calculate the initial deviation of the state attribute entity's value from the standard operating range. For each line equipment entity's Uniform Resource Identifier (URI), perform a query to obtain the URI of each state attribute entity associated with that "line equipment entity" and its current value. Read the standard operating range corresponding to each type of state attribute entity from the configuration file (e.g., the standard operating range for "conductor temperature" is [40.0, 70.0]).
[0055] If the current value is within the standard operating range, the initial deviation is 0; if the current value is below the lower limit of the standard operating range, the initial deviation is calculated as "(lower limit of the standard operating range - current value) ÷ lower limit of the standard operating range"; if the current value is above the upper limit of the standard operating range, the initial deviation is calculated as "(current value - upper limit of the standard operating range) ÷ upper limit of the standard operating range".
[0056] Based on physical connection relationships, the system identifies line equipment entities adjacent to each other. It then performs a weighted calculation of its own initial deviation and the initial deviations of adjacent line equipment entities to determine the overall deviation of each entity. This overall deviation is compared to preset alarm thresholds to determine the corresponding operating status level of the line equipment entity. Alarm thresholds include general alarm thresholds and critical alarm thresholds. If the overall deviation is less than the general alarm threshold, the operating status level of the corresponding line equipment entity is determined to be Level 1 (e.g., "Normal"). If the overall deviation is between the general alarm threshold and the critical alarm threshold, the operating status level is determined to be Level 2 (e.g., "General Defect"). If the overall deviation is greater than the critical alarm threshold, the operating status level is determined to be Level 3 (e.g., "Severe Fault").
[0057] It should be explained that if the initial deviation exceeds a critical alarm threshold, the state is considered to be clearly abnormal, and the initial deviation is given a larger weight; if the initial deviation is lower than a general alarm threshold, the state is considered to be in the critical or normal range, and the state of the neighbors needs to be referenced for comprehensive judgment, and the initial deviation is given a lower weight.
[0058] The collaborative response module is used to trigger corresponding processes based on the network security situation level and operational status level, and generate security access control policies for abnormal edge computing node entities or maintenance warning information for overhead lines.
[0059] Trigger the corresponding process, including: The network security situation level and operational status level are compared with the preset network blocking threshold and the preset physical alarm threshold, respectively.
[0060] It should be explained that the network blocking threshold is set based on a balance strategy between the requirements of power business continuity and the tolerance of network security risks, in order to define the trigger boundary of automatic defense; the physical alarm threshold is set based on the power industry equipment operation procedures and operation and maintenance cost-benefit analysis, in order to define the criteria for initiating on-site manual intervention.
[0061] If the network security situation level exceeds the network blocking threshold, the corresponding edge computing node entity will be judged as an abnormal edge computing node entity (the state attribute field of the edge computing node entity in the global semantic knowledge graph will be marked as "abnormal"), and the network defense response process will be triggered.
[0062] If the operating status level exceeds the physical alarm threshold, a physical maintenance response process for the corresponding line equipment entity will be triggered.
[0063] Triggering the network defense response process includes: A pre-built defense strategy library is provided, which includes port access control templates and IP address filtering templates corresponding to each network security posture level.
[0064] The defense strategy database is a data table containing three columns: network security status level (e.g., high risk, normal), port access control template (containing predefined actions (e.g., "DROP" or "ACCEPT"), protocols (e.g., TCP) and placeholders {IP_ADDR}), and IP address filtering template (containing predefined actions and placeholders).
[0065] The defense policy library is matched based on the network security posture level corresponding to the abnormal edge computing node entity, and the Internet Protocol address of the abnormal edge computing node entity is combined to determine the security access control policy. The defense policy library is matched using the network security posture level corresponding to the abnormal edge computing node entity to obtain the corresponding port access control template and IP address filtering template. The IP address placeholders in the templates are replaced with the Internet Protocol address of the abnormal edge computing node entity, and other policy parameters (such as specific port numbers) are replaced as needed to generate a specific security access control policy.
[0066] For example, the entity identifier of the abnormal edge computing node is "Global_Node_001". Querying its attributes reveals that its Internet Protocol address is "192.168.1.100", and its "Network Security Status Level" is "High Risk". Matching the "High Risk" level in the "Defense Policy Library" yields the port template "DROPtcp{IP_ADDR}any22" and the IP template "DROPipanyany{IP_ADDR}".
[0067] Enter the IP address "192.168.1.100" into the template.
[0068] The instantiated port rule is: "DROPtcp192.168.1.100any22"; The instantiated IP rule is: "DROPipanyany192.168.1.100"; The combined "Security Access Control Policy" text contains the two rules mentioned above.
[0069] Secure access control policies are distributed to the underlying firewall drivers corresponding to the abnormal edge computing node entities via an encrypted configuration channel, updating the firewall rule tables in real time. An encrypted network connection channel based on a transport layer security protocol is established between the line device and the abnormal edge computing node entity. The secure access control policy text is sent as a configuration command to the target line device through this encrypted network connection channel. Upon receiving the configuration command, the underlying firewall driver running on the target line device parses and executes the command. The execution action involves adding each rule in the secure access control policy to the kernel-level firewall rule table, which takes effect immediately.
[0070] The physical maintenance response process for the corresponding line equipment entity is triggered, including: Using the line equipment entity with the highest comprehensive deviation as the starting point, the global semantic knowledge graph is searched to obtain the associated line equipment entities that have a physical connection with the starting point.
[0071] For example, a comparison revealed that the "Overall Deviation" of the "Line Equipment Entity" "Global_Entity_LD_X001" was 0.85, the highest among all entities. Therefore, the "Search Starting Point" was determined to be "Global_Entity_LD_X001".
[0072] Extract the timestamps of abnormal deviations in the status attribute values of each associated line equipment entity and compare them. The line equipment entity with the earliest abnormal deviation time is identified as the abnormal source that caused the fault propagation.
[0073] For example: The earliest anomaly timestamp for Global_Entity_LD_X002 is "2025-12-27 10:05:00".
[0074] The earliest anomaly timestamp for “Global_Entity_LD_A001” is “2025-12-27 09:58:00”.
[0075] The comparison showed that "Global_Entity_LD_A001" occurred earlier. Therefore, the source of the exception was determined to be "Global_Entity_LD_A001".
[0076] It should be explained that if a line device entity has multiple abnormal status parameters, the earliest timestamp among them is taken as the earliest abnormal timestamp of the line device entity.
[0077] Based on the anomaly source, a k-hop neighbor node query operation is performed in the global semantic knowledge graph to identify the line equipment entities and edge computing node entities with cascading effects as the affected association range. Using the anomaly source as the central node, a graph traversal algorithm is initiated in the global semantic knowledge graph, expanding the search outward along "physical connection" edges and "deployed in" deployment affiliation edges, with the search depth limited to a preset number of hops k (the value of k is set according to the length of the overhead line segment and the equipment density, such as k=3 for regular road segments and k=5 for densely equipped hub road segments). All line equipment entities and edge computing node entities traversed along the search path are collected into a temporary list, and all entities in this temporary list are identified as the affected association range.
[0078] The geographic attribute information of the anomaly source and the list of equipment in the affected associated range are extracted and encapsulated to form maintenance early warning information for overhead lines. In the global semantic knowledge graph, the geographic attribute information of the "anomaly source" entity is queried to obtain its latitude and longitude coordinates and location description. By traversing each entity in the affected associated range, the name, type, and unique identifier of each entity are extracted, and the extracted information is organized into a equipment list in text list format. The geographic attribute information, equipment list, and fault type description field of the anomaly source are encapsulated into a JSON format data packet to generate maintenance early warning information for overhead lines. This generated maintenance early warning information is sent to the operation and maintenance terminal for management personnel to view and maintain.
[0079] In this embodiment, by synchronously collecting multi-dimensional status parameters of overhead lines and network operation data of edge computing nodes in the edge perception module, and using the global cognition module to construct a global semantic knowledge graph containing the mapping relationship between line equipment entities and edge computing node entities, the "data silos" that separate the physical monitoring domain and the network security domain in traditional monitoring are broken down. By deeply integrating and evaluating the network security status of edge nodes with the physical operation status of line equipment, false data deviations caused by sensor failures or network attacks are effectively identified and eliminated, thereby significantly reducing the false alarm rate and achieving accurate assessment of complex cross-domain risks.
[0080] By triggering a tiered collaborative response mechanism based on network security situation level and operational status level, precise separation of network defense and physical maintenance is achieved. Through the collaborative response module, security access control policies can be automatically generated and issued for edge computing nodes identified as having network anomalies, achieving millisecond-level network risk isolation. For line equipment identified as having physical faults, maintenance early warning information including anomaly source location, cascading impact range, and fault propagation path can be generated based on graph tracing analysis, guiding maintenance personnel to quickly carry out on-site repairs. Through a complete closed loop from "perception-assessment" to "decision-response," the traditional passive single-point alarm is upgraded to a proactive, collaborative cross-domain handling system, greatly improving the overall security and intelligent operation and maintenance efficiency of the overhead line monitoring system.
[0081] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0082] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only one method, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0083] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.
[0084] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A multi-dimensional status parameter monitoring system for overhead lines based on distributed edge computing, characterized in that, The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing includes: The edge awareness module is used to establish the mapping relationship between line equipment and edge computing nodes based on the collected multi-dimensional state parameters, and further construct the local semantic knowledge graph of each edge computing node; The global cognition module is used to construct a global entity and mapping index table based on the local semantic knowledge graph. Based on the mapping index table and the physical connection topology of the overhead line, the local semantic knowledge graphs are spliced together to form a global semantic knowledge graph covering the overhead line. The security situation assessment module is used to analyze the network security situation of each edge computing node based on network operation data and global semantic knowledge graph, obtain the network security situation level, and assess the operation status of each line device to obtain the operation status level. The collaborative response module is used to trigger corresponding processes based on the network security situation level and operational status level, and generate security access control policies for abnormal edge computing node entities or maintenance warning information for overhead lines.
2. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 1, characterized in that, The process of establishing the mapping relationship between line equipment and edge computing nodes includes: Clock synchronization is performed on each edge computing node in the overhead line, and multi-dimensional status parameters of the corresponding line equipment in the overhead line and the network operation data of the edge computing node itself are collected based on the edge computing node. The multidimensional state parameters and network operation data are time-aligned to generate time-series data packets for each edge computing node. The unique identification code of each line device and the unique node ID of each edge computing node are extracted from the time-series data packets and bound to determine the mapping relationship table between each line device and the corresponding edge computing node.
3. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 2, characterized in that, The process further involves constructing local semantic knowledge graphs for each edge computing node, including: A pre-built ontology library for the power sector is constructed. This library contains entity type definitions for line equipment types, edge computing nodes, and multi-dimensional state parameters, as well as semantic logic rules for deployment relationships, attribute subordination relationships, and connection relationships. Based on the entity type definitions, entity extraction and instantiation operations are performed on time-series data packets to determine various entities in overhead lines. These entities include line equipment entities, edge computing node entities, and state attribute entities. Based on the mapping relationship table, the deployment affiliation relationship between line equipment entities and edge computing node entities is constructed. Based on the semantic logical relationship in the power domain ontology library, the attribute association relationship between each line equipment entity, edge computing node entity and status attribute entity is determined. Each entity and its corresponding deployment affiliation relationship and attribute association relationship are combined to form triple data, and then summarized to form a local semantic knowledge graph of each edge computing node.
4. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 3, characterized in that, The construction of the global entity and mapping index table includes: Based on the unique identification code of each line device and the unique node ID of the edge computing node, the local semantic knowledge graphs are matched, and line device entities with the same unique identification code or edge computing node entities with the same unique node ID in different local semantic knowledge graphs are determined as equivalent entities pointing to the same object. Retrieve state attribute entities that have attribute relationships with each equivalent entity; classify state attribute entities based on attribute type and calculate the confidence level of each type of state attribute entity; The numerical values of the state attribute entities with the highest confidence are selected as the authority values of the corresponding types. Based on the authority values of all types, global entities and attribute associations with global identifiers are constructed, and a mapping index table is established between the global identifiers and the unique identification codes or unique node IDs in each local semantic knowledge graph.
5. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 4, characterized in that, The formation of the global semantic knowledge graph covering overhead lines includes: Based on the mapping index table, the relationships in each local semantic knowledge graph are spliced together, and physical connection relationships are created between adjacent line equipment entities based on the physical connection topology of overhead lines, forming a global semantic knowledge graph covering overhead lines.
6. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 5, characterized in that, The analysis of the network security posture of each edge computing node includes: The network operation data is associated with the corresponding edge computing node entities in the global semantic knowledge graph; graph embedding calculation is performed on the static topology structure determined based on the deployment affiliation and physical connection relationships in the global semantic knowledge graph to generate the structural feature vectors of each edge computing node entity; The embedded feature vector formed by splicing structural feature vectors with corresponding network operation data is analyzed to determine the network intrusion probability of each edge computing node entity. The network intrusion probability is compared with a preset risk threshold to determine the network security status level of each edge computing node entity.
7. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 6, characterized in that, The assessment of the operating status of each line device includes: Retrieve state attribute entities from the global semantic knowledge graph that have attribute relationships with line equipment entities; calculate the initial deviation of the state attribute entity's value relative to the standard operating range; identify line equipment entities adjacent to each line equipment entity based on physical connection relationships; perform a weighted calculation of its own initial deviation and the initial deviation of adjacent line equipment entities to determine the comprehensive deviation of the line equipment entity; compare the comprehensive deviation with a preset alarm threshold to determine the operating status level of the corresponding line equipment entity.
8. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 7, characterized in that, The triggering of the corresponding process includes: The network security status level and operational status level are compared with the preset network blocking threshold and preset physical alarm threshold, respectively. If the network security status level exceeds the network blocking threshold, the corresponding edge computing node entity is identified as an abnormal edge computing node entity, and the network defense response process is triggered. If the operational status level exceeds the physical alarm threshold, the physical maintenance response process for the corresponding line equipment entity is triggered.
9. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 8, characterized in that, The network defense response triggering process includes: A pre-built defense policy library is constructed, which includes port access control templates and IP address filtering templates corresponding to each network security posture level. The defense policy library is matched based on the network security posture level corresponding to the abnormal edge computing node entity, and the security access control policy is determined by combining the Internet Protocol address of the abnormal edge computing node entity. The security access control policy is distributed to the underlying firewall driver corresponding to the abnormal edge computing node entity through an encrypted configuration channel, and the firewall rule table is updated in real time.
10. The overhead line multi-dimensional status parameter monitoring system based on distributed edge computing according to claim 8, characterized in that, The process for triggering a physical maintenance response to the corresponding line equipment entity includes: The global semantic knowledge graph is searched starting from the line equipment entity with the highest comprehensive deviation. The associated line equipment entities that have a physical connection with the search starting point are obtained. The timestamps of abnormal deviations in the state attribute entity values of each associated line equipment entity are extracted and compared. The line equipment entity with the earliest abnormal deviation time is identified as the abnormal source that caused the fault propagation. Based on the anomaly source, a k-hop neighbor node query operation is performed in the global semantic knowledge graph. The retrieved line equipment entities and edge computing node entities with cascading effects are identified as the affected associated range. The geographical attribute information of the anomaly source and the list of equipment in the affected associated range are extracted and encapsulated to form maintenance early warning information for overhead lines.