Method, system, equipment and medium for real-time anomaly detection and active reporting of substation monitoring terminal based on electric red-ong

Abstract

The invention discloses a method, a system, equipment and a medium for real-time anomaly detection and active reporting of a substation monitoring terminal based on an electric red-ong, and belongs to the technical field of substation monitoring, and the method comprises the following steps: initializing electric red-ong chip adaptation, setting initial parameters, carrying out interface docking, collecting initial data of a substation, and sending the initial data to the substation monitoring terminal; performing normalization processing, effect correction and drift compensation to obtain an abnormal evaluation value, calculating an abnormal time sequence change rate and an environment comprehensive correction coefficient, generating a risk value grade, calculating a communication link quality index, performing normalization processing on abnormal diffusion pre-judgment time to obtain a reporting priority, and performing active reporting according to the reporting priority. The method solves the problems of high abnormality misjudgment rate, rigid risk judgment and unreasonable reporting opportunity in the prior art, realizes accurate detection and efficient reporting of the abnormality of the substation monitoring terminal, and is suitable for an intelligent operation and maintenance scene of substation modular monitoring equipment.

Description

Technical Field

[0001] This invention relates to the field of substation monitoring technology, specifically to a method, system, equipment, and medium for real-time anomaly detection and proactive reporting of substation monitoring terminals based on Dianhong. Background Technology

[0002] Existing substation monitoring terminals mostly adopt a modular hardware design, with each functional module working together through an interface, but the anomaly detection technology still has significant shortcomings.

[0003] Traditional detection methods only assess thresholds for independent parameters of a single module, failing to consider electromagnetic coupling interference between modules caused by modular deployment, nor the impact of operating temperature drift on detection accuracy, leading to frequent false positives. Furthermore, risk level assessments do not incorporate the temporal characteristics of anomaly propagation, and the reporting mechanism is not adapted to communication link quality, making it impossible to accurately distinguish the severity of anomalies and reporting priorities under complex operating conditions, thus affecting the operational efficiency and reliability of monitoring terminals. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by this invention is that traditional detection methods only perform threshold judgments on independent parameters of a single module, failing to consider electromagnetic coupling interference between modules caused by modular deployment, and also neglecting the impact of operating temperature drift on detection accuracy, leading to frequent false alarms. Furthermore, risk level determination does not incorporate the temporal characteristics of anomaly propagation, and the reporting mechanism is not adapted to communication link quality, making it impossible to accurately distinguish the severity of anomalies and reporting priorities under complex operating conditions, thus affecting the operational efficiency and reliability of monitoring terminals.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: a method for real-time anomaly detection and active reporting of a substation monitoring terminal based on Dianhong, comprising, Initialize the Dianhong chip adapter, set initial parameters and perform interface docking, and collect initial data from the substation; Based on the initial data of the substation, normalization, effect correction and drift compensation are performed to obtain the anomaly assessment value, calculate the anomaly time series change rate and environmental comprehensive correction coefficient, and generate the risk value level. Based on the risk level, the communication link quality index is calculated, the anomaly propagation prediction time is normalized, the reporting priority is obtained, and active reporting is carried out according to the reporting priority.

[0007] As a preferred embodiment of the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in this invention, the steps of initializing the Dianhong chip adaptation, setting initial parameters and performing interface docking, and collecting initial substation data include: Load the Elecchip hardware driver, adapt the communication protocol, and set the calibration parameters; Based on the set calibration parameters, the physical connection of the hardware modules and the establishment of the data link are completed; Based on the data link, through a synchronous acquisition mechanism, module anomaly characteristic data, electromagnetic interference data, operating temperature data, environmental parameter data, and communication link quality data are acquired as initial data for the substation.

[0008] As a preferred embodiment of the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong described in this invention, the method involves: based on initial substation data, performing normalization processing, effect correction, and drift compensation to obtain anomaly assessment values; calculating the anomaly time-series change rate and environmental comprehensive correction coefficient; and generating risk value levels, including... The abnormal feature data of the module are normalized, and combined with effect correction and drift compensation, the abnormal evaluation value is obtained through a first-level algorithm. The abnormal time series change rate is calculated based on the abnormal assessment values ​​of adjacent time points, and the comprehensive environmental correction coefficient is calculated in combination with environmental parameter data. Risk levels are generated based on anomaly assessment values, anomaly time-series change rates, and comprehensive environmental correction coefficients.

[0009] As a preferred embodiment of the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong described in this invention, the steps of calculating the communication link quality index based on the risk value level, normalizing the anomaly propagation prediction time, obtaining the reporting priority, and proactively reporting according to the reporting priority include: Based on the risk level, the communication link quality index is calculated, the anomaly propagation prediction time is obtained, and the anomaly propagation prediction time is normalized. Based on the risk level, communication link quality index, and normalized anomaly propagation prediction time, the reporting priority is determined. The communication interface is selected based on the reporting priority, and the report is proactively submitted to the superior business system.

[0010] As a preferred embodiment of the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong described in this invention, wherein: the anomaly evaluation value obtained through a first-level algorithm includes, The anomaly assessment value is calculated using the following expression: in, This is an abnormal assessment value. The normalized Euclidean modulus value for the abnormal features of the module. The electromagnetic interference coupling coefficient, This is the temperature drift compensation factor. This is the coupling adjustment coefficient. This refers to the actual operating temperature. This is the standard operating temperature.

[0011] As a preferred embodiment of the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong described in this invention, the generated risk value level includes: The expression for risk level is: in, Risk level, This is an abnormal assessment value. For abnormal time series change rate, These are the time-series weighting coefficients. This is the comprehensive environmental correction factor. This is the baseline anomaly assessment value.

[0012] This invention integrates static anomaly assessment values, dynamic time-series change trends, and comprehensive environmental impacts to ensure that the risk level not only reflects the absolute severity of the current anomaly but also quantifies the potential rate of deterioration over time and the development sensitivity under specific environmental conditions, thereby achieving a comprehensive risk assessment of the anomaly state from three dimensions: current status, trend, and external catalysts.

[0013] As a preferred embodiment of the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong described in this invention, the reporting priority is determined based on risk level, communication link quality index, and normalized anomaly propagation prediction time, including: The reporting priority is expressed as follows: in, To prioritize the reporting, Risk level, This is a communication link quality index. To predict the time of normalized anomaly diffusion, This represents the link adaptation coefficient.

[0014] This invention associates the square of the risk level with the communication link quality index, enabling high-risk anomalies to be prioritized when the link is good, ensuring rapid response in emergency situations. By introducing an exponential decay term, a non-linear penalty is applied to the decline in link quality, which increases the priority of anomalies with shorter propagation times. This achieves adaptive optimization of the reporting strategy under different communication conditions, avoiding the loss or delay of critical alarms due to channel congestion or quality fluctuations.

[0015] This invention provides a system for real-time anomaly detection and proactive reporting of substation monitoring terminals based on Dianhong.

[0016] To address the aforementioned technical problems, this invention provides the following technical solution: a system for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong, comprising: an initialization and data acquisition module, a risk value level generation module, and a proactive reporting module. The initialization and data acquisition module initializes the Dianhong chip adapter, sets initial parameters and performs interface docking, and acquires initial data of the substation. The setting of initial parameters and interface connection are based on the initial data of the substation. Normalization, effect correction and drift compensation are performed to obtain the anomaly assessment value, calculate the anomaly time series change rate and environmental comprehensive correction coefficient, and generate the risk value level. The proactive reporting module calculates the communication link quality index based on the risk value level, normalizes the anomaly propagation prediction time, obtains the reporting priority, and proactively reports according to the reporting priority.

[0017] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the method for real-time anomaly detection and active reporting of a substation monitoring terminal based on power supply.

[0018] The present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the method for real-time anomaly detection and active reporting of a substation monitoring terminal based on Dianhong.

[0019] The beneficial effects of this invention are as follows: This invention combines the abnormal time series change rate and the environmental comprehensive correction coefficient to construct a dynamic risk level model, so as to quantify the dynamic trend and severity of abnormal spread. Based on the risk level, communication link quality and abnormal spread prediction time, it realizes an active reporting strategy adapted to the communication status, improves the accuracy of abnormal identification and the timeliness of risk handling under complex working conditions, and improves the operation and maintenance efficiency of monitoring terminals and system reliability. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1The present invention provides an overall flowchart of a method for real-time anomaly detection and active reporting of a substation monitoring terminal based on Dianhong, as an embodiment of the present invention. Detailed Implementation

[0022] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0023] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides a method for real-time anomaly detection and proactive reporting based on a substation monitoring terminal of Dianhong, including: To address the shortcomings of traditional detection methods that rely solely on threshold judgments for individual module parameters, neglecting electromagnetic coupling interference between modules due to modular deployment and the impact of operating temperature drift on detection accuracy, leading to frequent false alarms, this invention provides a real-time anomaly detection and proactive reporting method for substation monitoring terminals based on Dianhong.

[0024] S1: Initialize the Dianhong chip adapter, set initial parameters and perform interface docking, and collect initial data from the substation; S2: Based on the initial data of the substation, normalization processing, effect correction and drift compensation are performed to obtain the anomaly assessment value, calculate the anomaly time series change rate and environmental comprehensive correction coefficient, and generate the risk value level. S3: Based on the risk value level, calculate the communication link quality index, normalize the anomaly propagation prediction time, obtain the reporting priority, and actively report according to the reporting priority.

[0025] Therefore, the original data is dimensionless and compensated for physical interference to generate a comprehensive evaluation value that represents the current abnormal state. Combining the time-series change characteristics and environmental parameters, a risk level that reflects both static severity and dynamic evolution trend is calculated. The risk level is coupled with the real-time communication link quality and the urgency of anomaly propagation for calculation, and a reporting priority that adapts to network conditions is dynamically output. This drives the terminal to select the optimal communication interface for proactive reporting. Multiple complex operating condition variables are incorporated into a unified calculation framework to achieve a synergistic improvement in the adaptability of anomaly detection and reporting strategies, thereby reducing the false alarm and missed alarm rates at the source and ensuring the reliable and timely uploading of critical alarms in complex field environments.

[0026] Example 2, an embodiment of the present invention, provides a method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong, based on the previous embodiment, including: In this embodiment of the application, step S1 initializes the Dianhong chip adapter, sets initial parameters and performs interface docking, and collects initial data from the substation, including the following steps A1-A3: A1: Load the Elec-Tech chip hardware driver, adapt the communication protocol, and set the calibration parameters.

[0027] As the core control unit, the Elecchip chip adapter module's initialization process includes hardware driver loading, communication protocol adaptation, and parameter calibration. The parameter calibration assigns initial values ​​to calibration parameters such as coupling adjustment coefficients and timing weight coefficients required for subsequent data processing, ensuring the initial validity of the calculation model.

[0028] The communication interfaces include interfaces based on the GB / T28181 protocol, interfaces based on the ONVIF protocol, and IoT interfaces based on the MQTT protocol. It proactively reports anomaly assessment values, risk levels, reporting priorities, and corresponding module anomaly characteristic data, electromagnetic interference data, operating temperature data, environmental parameter data, and communication link quality data to the superior business system through the communication interfaces. The Elec-Tech chip adapter module supports multi-threaded processing and data forwarding, and reduces electromagnetic interference through PCB layout and signal integrity design.

[0029] The choice of communication interface type is based on industry standards and actual application requirements of substation monitoring systems to ensure compatibility with higher-level business systems and reliability of data transmission.

[0030] The interface based on the GB / T28181 protocol is the national standard interface in the substation monitoring field. It supports functions such as device registration, signaling interaction, and media stream transmission. It uses the SIP protocol for signaling interaction and the RTP protocol to transmit media stream data, enabling standardized connection with the upper-level monitoring platform and ensuring cross-platform compatibility of reported data. The interface based on the ONVIF protocol is a general interface in the security monitoring field. It supports functions such as device discovery, capability query, device configuration, and PTZ operation. It achieves automatic device discovery through the WS-Discovery protocol, eliminating the need for manual configuration and improving the convenience of interface connection. It is suitable for connection with upper-level business systems of different brands. The IoT interface based on the MQTT protocol adopts a "publish-subscribe" communication mode, featuring low bandwidth consumption, low transmission latency, and low power consumption. It is suitable for connection with IoT platforms and can achieve efficient transmission of reported data, especially suitable for use in bandwidth-limited scenarios.

[0031] A2: Based on the set calibration parameters, complete the physical connection of the hardware module and establish the data link.

[0032] The interface connection process strictly follows the PCIe interface standard, completing the physical connection and data link establishment with each functional module of the substation monitoring terminal. The functional modules involved include the power supply module, communication module, lens mechanism module, motor control module, lighting control module, and camera mechanical module. Through this interface, high-speed data transmission and command interaction between the modules are realized, ensuring the real-time performance of data acquisition and control commands.

[0033] The design of calibration parameters comprehensively covers all key aspects of anomaly detection, risk assessment, and reporting priority calculation, ensuring that the parameters of each calculation model are clearly defined, providing reliable parameter support for the implementation of the technical solution.

[0034] The coupling adjustment coefficient is used to adjust the sensitivity of temperature deviation to the electromagnetic coupling effect and is a key parameter in the anomaly index calculation formula. The coupling coefficient is used to quantify the degree of electromagnetic coupling between modules and is a core parameter for correcting electromagnetic interference coupling effects. The linear coefficient of the temperature drift compensation factor is used to adjust the degree of influence of temperature deviation on anomaly assessment and is a key parameter for temperature drift compensation. The calculation coefficient of the anomaly time series change rate is used to correct the calculation deviation of the anomaly time series change rate to ensure that it can accurately reflect the anomaly diffusion rate. The relative humidity linear coefficient and dust concentration linear coefficient of the environmental comprehensive correction coefficient are used to adjust the influence weight of relative humidity and dust concentration on the environmental comprehensive correction coefficient, respectively, and are core parameters for generating the environmental comprehensive correction coefficient.

[0035] The time-series weighting coefficient is used to adjust the impact of the anomaly propagation speed on the risk level and is a key parameter in the dynamic risk level calculation formula; the baseline anomaly assessment value is the critical reference value between normal and anomaly and is a basic parameter in the dynamic risk level calculation formula; the standard operating temperature is the standard operating temperature of electronic components and is a basic parameter in the anomaly index calculation formula; the calculation coefficient of the communication link quality index is used to correct the calculation deviation of the communication link quality index to ensure that it can accurately reflect the link transmission performance; the standard delay is the reference value of the normal transmission delay of the link and is a basic parameter in the calculation of the communication link quality index; the preset standard propagation time is the critical time reference value of anomaly propagation and is a basic parameter in the normalization processing of anomaly propagation prediction time; the link adaptation coefficient is used to adjust the impact of link quality on reporting priority and is a key parameter in the reporting priority coefficient calculation formula.

[0036] The calibration parameters are obtained by fitting experimental data under multiple different operating conditions. The design of the experimental conditions fully covers the actual operating environment of the substation monitoring terminal, including combinations of different electromagnetic interference intensities, temperatures, humidity, dust concentrations, and link quality, to ensure that the calibration parameters can adapt to complex actual scenarios.

[0037] A3: Based on the data link, through a synchronous acquisition mechanism, module anomaly characteristic data, electromagnetic interference data, operating temperature data, environmental parameter data, and communication link quality data are acquired as initial data for the substation.

[0038] A multi-channel synchronous acquisition mechanism is adopted to ensure the time consistency of data across all dimensions. Module anomaly data is acquired through sensors and detection circuits built into each functional module. For example, image blur data from the lens module is calculated in real time using an image edge detection algorithm; position deviation data from the motor control module is acquired through a position sensor and processed by a signal conditioning circuit; and output voltage fluctuation data from the power supply module is acquired through a voltage sampling circuit. Electromagnetic interference data is acquired through electromagnetic sensors built into the terminal, deployed in electromagnetically sensitive areas between modules to capture changes in electric field strength caused by electromagnetic coupling between modules. Operating temperature data is acquired through temperature sensors built into each module, enabling independent monitoring of the operating temperature of different modules. Relative humidity and dust concentration data in environmental parameters are acquired through environmental sensors deployed around the monitoring terminal to ensure that the data reflects the external environmental conditions of the terminal. Communication link quality data is acquired through a link detection unit built into the communication interface, which calculates packet loss rate and communication latency in real time, providing data support for priority calculation of reporting.

[0039] In this embodiment of the application, step S2, based on the initial data of the substation, performs normalization processing, effect correction, and drift compensation to obtain anomaly assessment values, calculates the anomaly time-series change rate and environmental comprehensive correction coefficient, and generates risk value levels, including the following steps B1-B3: B1: Normalize the abnormal feature data of the module, combine effect correction and drift compensation, and obtain the abnormal evaluation value through the first-level algorithm.

[0040] The selection of abnormal features for each module is based on the core operating characteristics of each functional module of the substation monitoring terminal, ensuring a comprehensive reflection of the terminal's operating status. The lens module, as the core sensing component of the terminal, extracts image edge information using the Sobel operator to calculate the severity of grayscale changes in edge pixels; a smoother grayscale change indicates a more blurred image. Jitter amplitude data is obtained by collecting displacement changes of fixed feature points in consecutive frames of images and calculating the standard deviation of these displacements in the horizontal and vertical directions; a larger standard deviation indicates more severe jitter. Illumination deviation data is obtained by comparing the difference between the actual illumination brightness and the preset illumination brightness; a larger difference indicates a more severe illumination deviation.

[0041] The motor control module is responsible for driving the gimbal's movement. Its operating current data is collected by a current sensor, which collects the motor's current value during operation and compares it with the rated current value to obtain current deviation data. Position deviation data is collected by a position sensor, which collects the difference between the actual position of the gimbal and the target position, reflecting the accuracy of motor control. The power supply module provides stable power to all modules. Its output voltage fluctuation data is collected by a voltage sampling circuit, which collects the instantaneous value of the output voltage and calculates the voltage variance. The larger the variance, the more severe the fluctuation. Current stability data is collected by collecting the rate of change of the output current; the smaller the rate of change, the more stable the current.

[0042] The normalization process uses the Euclidean modulus calculation method. The specific calculation process is as follows: First, the abnormal features of each module are normalized to the interval, mapping the numerical range of different features to the 0-1 interval to eliminate the influence of the difference in feature dimensions; then, the sum of squares of all normalized features is calculated, and the square root of the sum of squares is taken to obtain the Euclidean modulus; finally, the ratio of the Euclidean modulus to the square root of the number of features is calculated to obtain the final normalized Euclidean modulus of the abnormal features of the module.

[0043] Electromagnetic interference coupling effect correction is achieved by calculating the difference between 1 and the exponential function of the product of electromagnetic interference intensity and coupling coefficient. Temperature drift compensation is obtained by summing the products of 1 and the linear coefficients of the operating temperature and standard temperature deviation.

[0044] The core of electromagnetic interference coupling effect correction is to quantify the nonlinear impact of inter-module electromagnetic coupling on anomaly detection. In the modular deployment scenario of substation monitoring terminals, various functional modules are closely connected through PCIe interfaces. The electromagnetic signals generated by the modules during operation will couple with each other, forming electromagnetic interference. This interference amplifies the abnormal characteristics of the modules, leading to an increased false positive rate in anomaly detection. Based on electromagnetic coupling theory, the amplification effect of electromagnetic interference on abnormal characteristics exhibits a nonlinear growth trend, that is, as the intensity of electromagnetic interference increases, the amplification effect gradually approaches saturation. Therefore, an exponential function model is used to describe this relationship.

[0045] Electromagnetic interference (EMI) intensity is acquired by an electromagnetic sensor, measured in V / m. The coupling coefficient, a parameter characterizing the degree of electromagnetic coupling between modules, is obtained by fitting experimental data on the terminal's hardware layout and module spacing, measured in m / V. The base of the exponential function is the natural constant e, and the exponent is the product of the EMI intensity and the coupling coefficient. This product has dimensions (V / m) × (m / V) = 1, ensuring that the input to the exponential function is dimensionless. The difference between 1 and the exponential function is the EMI coupling effect correction coefficient. When the EMI intensity is 0, the correction coefficient is 0, indicating no EMI coupling effect. As the EMI intensity increases, the correction coefficient gradually approaches 1, indicating that the amplification effect of EMI coupling on abnormal features reaches its maximum. This design conforms to the influence law of EMI in actual working conditions and can accurately quantify the degree of influence of EMI coupling on anomaly detection.

[0046] Temperature drift compensation is designed based on the temperature characteristics of semiconductor devices. The performance of electronic components in each module of the terminal will drift with temperature changes, resulting in a decrease in the detection accuracy of abnormal features of the module. This effect is more significant, especially in substation environments where the temperature variation range is large.

[0047] The standard temperature is set at 25℃, which is the standard operating temperature of electronic components. The deviation between the operating temperature and the standard temperature is the core influencing factor of temperature drift. The linear coefficient is a parameter characterizing the degree of influence of temperature drift on anomaly detection. Its value is obtained by fitting experimental data of module performance under different temperature environments, and the unit is 1 / ℃. The sum of 1 and the product of the deviation and the linear coefficient is the temperature drift compensation factor. When the operating temperature is equal to the standard temperature, the compensation factor is 1, indicating that there is no temperature drift effect; when the operating temperature is higher than the standard temperature, the compensation factor is greater than 1, indicating that the anomaly evaluation value needs to be amplified to correct the detection deviation caused by temperature drift; when the operating temperature is lower than the standard temperature, the compensation factor is less than 1, indicating that the anomaly evaluation value needs to be reduced to correct the detection deviation caused by temperature drift. This linear model can accurately correct the detection deviation under different temperature environments, ensuring that the accuracy of anomaly detection is not affected by temperature changes and improving the environmental adaptability of the detection model.

[0048] B2: Calculate the abnormal time series change rate based on the abnormal assessment values ​​of adjacent time points, and calculate the comprehensive environmental correction coefficient by combining environmental parameter data.

[0049] The purpose of the anomaly time-series change rate is to capture the spread rate of anomalies in real time, providing a dynamic basis for risk level determination. During the anomaly evolution process at substation monitoring terminals, the spread rates of different anomalies vary significantly. Sudden and rapidly spreading anomalies often have a higher risk level and require priority handling. The difference between anomaly assessment values ​​at adjacent times reflects the change in anomaly intensity; a positive difference indicates an increasing anomaly intensity, while a negative difference indicates a decreasing anomaly intensity. The time interval is the time difference between two adjacent acquisition cycles. The acquisition cycle is set according to the monitoring requirements of the terminal, typically in milliseconds, to ensure real-time capture of anomaly trends. The ratio of these two values ​​is the anomaly time-series change rate, expressed in 1 / s. A larger absolute value of this ratio indicates a faster anomaly spread rate, and the corresponding risk level should be higher.

[0050] For example, when the anomaly assessment value increases from 0.3 to 0.6 over a 1-second time interval, the anomaly time-series change rate is 0.31 / s, indicating that the anomaly intensity increased by 0.3 within 1 second, and the spread rate is relatively fast, requiring an increase in the risk level. Conversely, when the anomaly assessment value decreases from 0.5 to 0.4 over a 1-second time interval, the anomaly time-series change rate is -0.11 / s, indicating that the anomaly intensity is weakening and the spread rate is slow, allowing for an appropriate reduction in the risk level. This calculation method can accurately quantify the spread rate of anomalies, enabling the risk level to dynamically reflect the evolution trend of anomalies, overcoming the limitations of traditional static threshold determination.

[0051] The design of the environmental comprehensive correction coefficient is based on the environmental characteristics of the substation site. Relative humidity and dust concentration are key environmental factors affecting anomaly evolution and terminal operating status. High relative humidity environments exacerbate module corrosion and insulation performance degradation, accelerating anomaly evolution; high dust concentration environments clog module heat dissipation channels, affecting lens imaging quality and leading to decreased anomaly detection accuracy, while also accelerating anomaly propagation. Based on this principle, the environmental comprehensive correction coefficient adopts a linear combination model, integrating the effects of relative humidity and dust concentration.

[0052] The linear coefficients of relative humidity and dust concentration are parameters characterizing the degree of influence of the corresponding environmental factors. Their values ​​are obtained by fitting experimental data on abnormal evolution under different environmental conditions, with units of 1 / % and m³ / mg, respectively. The algebraic sum of 1 multiplied by relative humidity and its linear coefficient, and the product of dust concentration and its linear coefficient, is the comprehensive environmental correction coefficient. When this coefficient is greater than 1, it indicates that the environmental factor will accelerate the abnormal evolution, and the risk level needs to be increased; when the coefficient is equal to 1, it indicates that the environmental factor has no impact; when the coefficient is less than 1, it indicates that the environmental factor will inhibit the abnormal evolution, and the risk level can be appropriately reduced.

[0053] For example, when the relative humidity is 60% and its linear coefficient is 0.0031 / , and the dust concentration is 0.5 mg / m³ and its linear coefficient is 0.002 m³ / mg, the comprehensive environmental correction factor is 1 + 60 × 0.003 + 0.5 × 0.002 = 1.181. This indicates that the environmental conditions will accelerate the abnormal evolution, and the risk level needs to be increased by 18.1% on the original basis to ensure that the risk level can adapt to the impact of the external environment.

[0054] B3: Based on the abnormal assessment value, the abnormal time series change rate, and the comprehensive environmental correction coefficient, a risk value level is generated.

[0055] In this embodiment of the application, the generation of risk value levels in step S2 is specifically manifested as follows: The expression for risk level is: in, Risk level, This is an abnormal assessment value. For abnormal time series change rate, These are the time-series weighting coefficients. This is the comprehensive environmental correction factor. This is the baseline anomaly assessment value.

[0056] The specific definitions and values ​​of each parameter are as follows: The anomaly index is calculated using a formula, and its value ranges from 0 to 1. The closer the value is to 1, the more significant the current intensity of the anomaly. The value is obtained by the ratio of the difference between the abnormal assessment values ​​at adjacent time points to the time interval, with a range of -1 to 11 / s. A positive value and a larger absolute value indicate a faster rate of anomaly spread. A negative value and a larger absolute value indicate a faster rate of abnormal decay. The value range is 1-10s. A higher value indicates a greater weighting of the anomaly spread rate on the risk level. For monitoring scenarios requiring rapid response, this is particularly relevant. Larger values ​​are acceptable for monitoring scenarios where slow processing is permissible. The value is relatively small; This is achieved by the algebraic sum of the products of 1 and the linear coefficients of relative humidity and dust concentration, with values ​​ranging from 0.9 to 1.3. The closer the value is to 1.3, the more significant the accelerating effect of the environment on the abnormal evolution. The value ranges from 0.2 to 0.4, and is based on statistics from a large number of normal and abnormal sample data. The critical value for abnormal evaluation values, when Greater than This indicates an anomaly. Less than This indicates that there are no abnormalities.

[0057] In terms of dimensional verification, In some parts, The dimension of is (1 / s) × s = 1, which is a dimensionless quantity. The sum of 1 and this product is also a dimensionless quantity. Since it is a dimensionless quantity, this part is also a dimensionless quantity. In some parts, and Both are dimensionless quantities, the ratio of the two is a dimensionless quantity, and the sum of 1 and this ratio is a dimensionless quantity. (This is the natural logarithm function.) The input is a dimensionless quantity, and the output is also a dimensionless quantity. Since it is a dimensionless quantity, this part is also dimensionless. Both parts are dimensionless, therefore... It is a dimensionless quantity with correct dimensions, ensuring that the calculation formula can be used normally under different parameter values.

[0058] In an optional implementation, the risk level generation method in step S2 can also be adopted based on the time window anomaly evolution discrimination. During the operation of the system, a sliding time window is maintained for each monitoring terminal. The anomaly assessment values ​​of multiple collection cycles are continuously stored in the window. Within the time window, the system analyzes the following characteristics of the anomaly assessment values: whether they are continuously rising; whether the rise is continuous; and whether there are multiple rapid jumps in a short period of time. When the anomaly assessment value continues to rise in multiple consecutive collection cycles, and the anomaly time series change rate always remains in the growth range, and the environmental comprehensive correction coefficient is at a high level, the system determines that the anomaly has a continuous deterioration trend and directly outputs a high risk level. If the anomaly assessment value fluctuates but tends to be stable overall, a medium risk level is output. If the anomaly assessment value decreases overall or returns to the normal range, a low risk level is output.

[0059] In another optional implementation, the risk level generation in step S2 can also employ a risk level generation method based on historical anomaly sample mapping. The system pre-establishes a historical anomaly sample library, with each sample containing the following information: the anomaly assessment value range for each module; the anomaly's changing trend over multiple collection periods; the environmental parameter range at the time of the anomaly; and the risk level and processing results confirmed in actual operation and maintenance. During real-time operation, the system combines the current anomaly assessment value, the anomaly's temporal change characteristics, and the comprehensive environmental correction results to form a description of the current anomaly state. By comparing the similarity between the current anomaly state and each anomaly sample in the historical sample library, the system selects the set of historical anomaly records with the highest matching degree. The system directly adopts the risk level corresponding to this historical anomaly record, or selects the risk level with the highest frequency among multiple similar records as the current output result.

[0060] In this embodiment of the application, risk value level is generated in step S2. The current outlier is directly coupled with the time series change rate through a linear term, so that the risk assessment can immediately respond to the speed of anomaly spread or convergence. An environmental correction coefficient is introduced by using a logarithmic term, which is highly sensitive to environmental changes in the initial stage of anomaly, while avoiding over-correction during anomaly.

[0061] In this embodiment of the application, the anomaly evaluation value obtained through a first-level algorithm in step B1 is specifically manifested as follows: The anomaly assessment value is calculated using the following expression: in, This is an abnormal assessment value. The normalized Euclidean modulus value for the abnormal features of the module. The electromagnetic interference coupling coefficient, This is the temperature drift compensation factor. This is the coupling adjustment coefficient. This refers to the actual operating temperature. This is the standard operating temperature.

[0062] The specific definitions and values ​​of each parameter are based on the following: The value is obtained by calculating the Euclidean modulus of the normalized values ​​of the abnormal features from multiple modules and then comparing it to the square root of the number of features. The value ranges from 0 to 1. The closer the value is to 1, the more significant the abnormal characteristics of the module. The result is obtained by the exponential function difference between 1 and the product of electromagnetic interference intensity and coupling coefficient, with a value ranging from 0 to 1. The closer the value is to 1, the more significant the amplification effect of electromagnetic interference coupling on abnormal characteristics; It is obtained by summing the products of 1 and the linear coefficients of the operating temperature and standard temperature deviations, with a value ranging from 0.8 to 1.2. A value greater than 1 indicates that the abnormal assessment value needs to be increased to correct for the effects of high-temperature drift. A value less than 1 indicates that the abnormal assessment value needs to be reduced to correct the effects of low-temperature drift. The value range is 0.1-11 / ℃. A larger value indicates that the temperature deviation is more sensitive to the modulation effect of electromagnetic coupling. The temperature is fixed at 25℃, which is the standard operating temperature for electronic components. Temperature data are collected by the built-in temperature sensors in each module, with a range of -40℃ to 85℃, covering the extreme ambient temperature range of the substation.

[0063] Regarding dimensional verification, in the molecular part The square of a dimensionless quantity is still a dimensionless quantity; It is the product of two dimensionless quantities, and it is a dimensionless quantity. The product of three dimensionless quantities is itself dimensionless; therefore, the numerator as a whole is dimensionless. In the denominator... The dimensionless quantity is (1 / ℃) × ℃ = 1, and it is an exponential function. The output is dimensionless, and the sum of 1 and the exponential function is also dimensionless; therefore, the denominator as a whole is dimensionless. Since both the numerator and denominator are dimensionless, therefore... It is a dimensionless quantity with correct dimensions, ensuring that the calculation formula can be used normally under different unit systems.

[0064] In an optional implementation, the anomaly assessment value obtained in step B1 through the primary algorithm can also be generated using an anomaly assessment value generation method based on the cumulative rate of change of anomaly features. The system continuously tracks the changing trends of anomaly features in each module over multiple consecutive acquisition cycles. When the change in an anomaly feature is small in a single acquisition cycle but shows a unidirectional change over multiple consecutive cycles, the system accumulates and measures this change. Once the accumulated change value reaches a preset threshold, even if the current anomaly feature amplitude is still at a low to medium level, the system still determines a high degree of anomaly, merges the accumulated change results of each module, and corrects for electromagnetic interference and temperature drift factors to output an anomaly assessment value. For example, if the current harmonic distortion rate of a module continuously increases by only 0.2% per cycle for eight consecutive sampling cycles, although the single-cycle increase does not exceed the threshold, the cumulative increase reaches 1.6%, exceeding the preset threshold of 1.0%. The system determines a high degree of anomaly and, after correction based on the current electromagnetic interference intensity and temperature drift coefficient, outputs an anomaly assessment value.

[0065] In another optional implementation, the anomaly evaluation value obtained in step B1 through the primary algorithm can also employ an anomaly evaluation value generation method based on the degree of disruption of anomaly feature consistency. The system first analyzes the correlation between anomaly features of multiple modules under normal operating conditions, such as the correspondence between motor operating status and lens image stability. During real-time operation, the system detects whether the coordination consistency between current anomaly features is disrupted, where a module's anomaly feature changes significantly while related modules remain normal. When the degree of consistency disruption is high, the system determines the existence of a potential anomaly and increases the anomaly evaluation value. Based on the consistency analysis results, electromagnetic interference coupling and temperature drift compensation are introduced to correct the anomaly degree, resulting in the final anomaly evaluation value.

[0066] In this embodiment, step B1 uses a first-level algorithm to obtain an anomaly evaluation value, which constitutes a comprehensive evaluation function that can simultaneously reflect the anomaly characteristics themselves, the electromagnetic interference coupling strength, the influence of temperature drift, and the interaction between the three. This solves the technical deficiency of traditional detection methods in handling multi-physics field coupling interference. It should be noted that by using a feature normalization method based on Euclidean modulus, and integrating the abnormal information of multi-source modules, an electromagnetic interference coupling correction term and a temperature drift compensation term are designed. These terms are based on exponential functions and linear models, respectively, to counteract the nonlinear effects of electromagnetic coupling between modules and the temperature drift of semiconductor devices from a physical mechanism perspective.

[0067] In this embodiment of the application, step S3 calculates the communication link quality index based on the risk value level, normalizes the anomaly propagation prediction time, obtains the reporting priority, and actively reports according to the reporting priority, including the following steps C1-C3: C1: Based on the risk level, calculate the communication link quality index, obtain the anomaly propagation prediction time, and normalize the anomaly propagation prediction time.

[0068] The design goal of the anomaly propagation prediction time normalization process is to convert the actual anomaly propagation prediction time into a unified dimensionless indicator, facilitating its integration into the reporting priority calculation model. The actual anomaly propagation prediction time is obtained through an AI prediction model trained on historical anomaly propagation data. This model can predict the time, in seconds, for an anomaly to propagate from its current state to the point of affecting the core functions of the terminal, based on the current anomaly assessment value, the anomaly time series change rate, and environmental parameters. The preset standard propagation time is a critical time set based on the terminal's security operation requirements, also in seconds, typically set at 30 seconds. That is, when the anomaly propagation time is less than 30 seconds, it indicates that the anomaly is extremely urgent and needs to be reported immediately.

[0069] The normalization process involves using the ratio of the actual predicted anomaly spread time to the preset standard spread time as the normalized predicted anomaly spread time, with a value ranging from 0.1 to 1. When the actual predicted anomaly spread time is 30 seconds, the normalized value is 1, indicating a moderate anomaly spread rate; when the actual predicted anomaly spread time is 3 seconds, the normalized value is 0.1, indicating an extremely urgent anomaly spread; when the actual predicted anomaly spread time is greater than 30 seconds, the normalized value remains 1, indicating a slow anomaly spread rate that does not require priority reporting. This processing method can normalize the predicted anomaly spread time to a unified range, ensuring the comparability of the impact of the urgency of the anomaly spread in the calculation of reporting priority and avoiding weight imbalance caused by differences in the actual predicted time range.

[0070] C2: Based on the risk level, communication link quality index, and normalized anomaly propagation prediction time, the reporting priority is determined.

[0071] C3: Select the communication interface according to the reporting priority and actively report to the superior business system.

[0072] The selection logic for each communication interface is based on reporting priority. High-priority reported data selects communication interfaces with fast transmission rates and high stability, such as interfaces based on the GB / T28181 protocol or the ONVIF protocol, ensuring that high-risk, high-urgency anomalies can be reported quickly and reliably to the upper-level business system. Medium-priority reported data can select any communication interface, dynamically adjusted according to link quality. Low-priority reported data can select communication interfaces with low bandwidth consumption, such as IoT interfaces based on the MQTT protocol, to avoid consuming excessive link resources. This selection logic enables optimized allocation of reporting resources, improving the overall efficiency and reliability of the reporting system.

[0073] The proactively reported data transmission content is designed to comprehensively cover all key aspects of anomaly assessment, risk determination, and reporting decision-making, ensuring that the superior business system can fully grasp the terminal's operational status and anomalies. Anomaly assessment values ​​and risk levels reflect the severity of the anomaly, while reporting priorities reflect the urgency of the anomaly and the suitability of the reporting method. Module anomaly characteristic data provides the superior business system with the specific source and characteristics of the anomaly, facilitating subsequent troubleshooting. Electromagnetic interference data, operating temperature data, and environmental parameter data provide the superior business system with environmental background information on the evolution of the anomaly, facilitating the analysis of its causes. Communication link quality data provides the superior business system with transmission status information of the reported data, facilitating the assessment of the reliability of the reported data.

[0074] In this application's implementation, the reporting priority determined in step S3 is specifically manifested as follows: The reporting priority is expressed as follows: in, To prioritize the reporting, Risk level, This is a communication link quality index. To predict the time of normalized anomaly diffusion, This represents the link adaptation coefficient.

[0075] The specific definitions and values ​​of each parameter are based on the following: The value is obtained through a dynamic risk level calculation formula, and its range is 0-2. The closer the value is to 2, the more severe the anomaly risk. The value is obtained by dividing the square root of the sum of 1 and the square of the packet loss rate, and the square root of the ratio of communication delay to standard delay, by the ratio of √2. The value ranges from 0 to 1. The closer the value is to 1, the better the communication link quality. This is achieved by comparing the actual predicted diffusion time with the preset standard diffusion time, with a value ranging from 0.1 to 1. The closer the value is to 0.1, the more urgent the abnormal spread. The value range is 1-5. A higher value indicates that the link quality is more sensitive to the adjustment of reporting priority. For scenarios with high requirements for reporting stability, The value is relatively large, which is not suitable for scenarios with high requirements for timely reporting. The value is relatively small.

[0076] In terms of dimensional verification, In some parts, The square of a dimensionless quantity is still a dimensionless quantity. Since it is a dimensionless quantity, this part is also a dimensionless quantity. In some parts, Since it is a dimensionless quantity, its square root is also a dimensionless quantity, and the reciprocal of the square root is also a dimensionless quantity. and Both are dimensionless quantities, 1 and The difference is a dimensionless quantity. The product of this difference is a dimensionless quantity, an exponential function. The output is dimensionless, therefore this part is dimensionless. Both parts are dimensionless, therefore... It is a dimensionless quantity with correct dimensions, ensuring that the calculation formula can be used normally under different parameter values.

[0077] In an optional implementation, the reporting priority in step S3 can also be determined using a risk-level-based hierarchical reporting priority determination method. First, based on the risk level, the anomaly is divided into multiple risk ranges, such as general risk, high risk, and severe risk. For different risk ranges, a fixed reporting priority level is pre-configured. When the anomaly is determined to be severe risk, the system directly assigns the highest reporting priority to ensure that the anomaly information takes priority in reporting communication resources. When the anomaly is at medium risk, it is assigned a medium reporting priority. When the anomaly is at low risk, it is assigned a low priority or reported with a delay.

[0078] In another optional implementation, the reporting priority in step S3 can also be determined using a reporting priority determination method based on reporting reliability requirements. The system determines whether the anomaly requires complete data reporting or only key feature reporting based on the module to which it belongs and its risk level. For anomalies requiring complete data reporting, the system assigns a higher priority when the communication link quality meets the requirements; when the link quality is insufficient to guarantee reliable transmission, the system postpones complete reporting, only reporting a summary of the anomaly, and delays the complete reporting task.

[0079] In the implementation of this application, the reporting priority is determined in step S3. When the link is good, the global optimal strategy dominated by risk level is followed. When the link deteriorates, the system automatically switches to a survival strategy dominated by the urgency of abnormal spread, so as to ensure that the most critical alarm information is reliably reported under various complex working conditions.

[0080] In this embodiment of the application, the calculation of the communication link quality index in step C1 is specifically manifested as follows: The design of the communication link quality index is based on an in-depth analysis of the transmission characteristics of the communication link. Its core objective is to integrate the two core link parameters, packet loss rate and communication delay, into a unified dimensionless index that comprehensively reflects the transmission stability and speed of the link.

[0081] Packet loss rate is a key indicator reflecting the reliability of link transmission. It refers to the ratio of the number of data packets lost during transmission to the total number of data packets within a certain period of time. The value ranges from 0 to 1. The closer the packet loss rate is to 0, the more reliable the link transmission is. Communication delay is a key indicator reflecting the link transmission rate. It refers to the total time from when a data packet is sent from the sender to when it is received by the receiver, and the unit is ms. Standard delay is a preset normal transmission delay of the link, which is set based on the communication protocol and transmission distance, and the unit is ms. It is usually set to 100ms.

[0082] The calculation process is as follows: First, calculate the square of the packet loss rate to highlight the impact of packet loss rate on link quality, because an increase in packet loss rate will lead to a decrease in the integrity of reported data, and the impact on the effectiveness of reporting will be more significant; then calculate the ratio of communication delay to standard delay, normalize the communication delay to the 0-∞ range, and then square this ratio to again highlight the impact of communication delay on link quality; next, calculate the sum of the square of the packet loss rate and the square of the ratio of communication delay, and then take the square root of the sum to obtain the comprehensive deviation value of link quality; finally, the ratio of this comprehensive deviation value to the square root of 2 is used as the normalized deviation of link quality, and the difference between 1 and this normalized deviation is the communication link quality index, with a value range of 0-1.

[0083] For example, when the packet loss rate is 0.02%, the communication delay is 80ms, and the standard delay is 100ms, the squared packet loss rate is 0.0004, the communication delay ratio is 0.8, the squared ratio is 0.64, the overall deviation is √(0.0004+0.64)=√0.6404≈0.80025, the normalized deviation is 0.80025 / √2≈0.5659, and the communication link quality index is 1-0.5659≈0.4341. This indicates that the link quality is average and suitable for transmitting low-priority reported data. According to the data, when the packet loss rate is 0.001 and the communication delay is 50ms, the square of the packet loss rate is 0.000001, the communication delay ratio is 0.5, the square of the ratio is 0.25, the comprehensive deviation is √(0.000001+0.25)=√0.250001≈0.500001, the normalized deviation is 0.500001 / √2≈0.3535, and the communication link quality index is 1-0.3535≈0.6465, indicating that the link quality is good and suitable for transmitting high-priority reported data.

[0084] In an optional implementation, the communication link quality index in step C1 can also be calculated using a communication link quality index calculation method based on effective data transmission capability. The system counts the number of successfully received data frames and their transmission time within a fixed time window. When the amount of data successfully transmitted per unit time is large and the transmission time is stable, the system determines that the link quality is high. When the amount of successfully transmitted data decreases or the transmission time increases significantly, the system lowers the communication link quality index.

[0085] In another alternative implementation, the calculation of the communication link quality index in step C1 can also employ a dynamic benchmark comparison method. This involves continuously collecting packet loss rate and latency data for all links to determine the current link's packet loss rate and latency ranking among all links. Finally, the average of these two percentage rankings is taken as the quality index.

[0086] In the embodiments of this application, the communication link quality index is calculated in step C1. This integrates two parameters with different dimensions and different influencing mechanisms into a dimensionless index, quantifies the instantaneous transmission performance of the link, and ensures that a consistent and reasonable evaluation can be performed under different network fluctuation scenarios.

[0087] In summary, a multi-protocol compatible and interference-resistant data acquisition foundation was established to ensure the time synchronization and reliability of multi-source heterogeneous data. Comprehensive compensation for complex interference was achieved, and a dynamically evolving risk level was generated by combining the time series change rate and environmental parameters. The risk level was nonlinearly coupled with real-time communication quality and the urgency of anomaly propagation to form a reporting priority mechanism that can adapt to network conditions and optimize channel resource allocation. Multi-physics interference, dynamic evolution characteristics, and communication constraints were systematically incorporated into the calculation framework to improve the accuracy of anomaly detection and the reliability and timeliness of the reporting strategy in complex field environments.

[0088] Example 3 is an embodiment of the present invention. This embodiment provides a system for real-time anomaly detection and proactive reporting based on a substation monitoring terminal of Dianhong, including an initialization and data acquisition module, a risk value level generation module, and a proactive reporting module. The initialization and data acquisition module initializes the Dianhong chip adapter, sets initial parameters, performs interface docking, and acquires initial data from the substation. Setting initial parameters and interface connection is based on the initial data of the substation. Normalization, effect correction and drift compensation are performed to obtain the anomaly assessment value, calculate the anomaly time series change rate and environmental comprehensive correction coefficient, and generate the risk value level. The proactive reporting module calculates the communication link quality index based on the risk value level, normalizes the anomaly propagation prediction time, derives the reporting priority, and proactively reports according to the reporting priority.

[0089] This embodiment also provides an electronic device applicable to a method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as proposed in the above embodiment.

[0090] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements a method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong, as proposed in the above embodiment.

[0091] The storage medium proposed in this embodiment and the method for real-time anomaly detection and active reporting of a substation monitoring terminal based on Dianhong proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0092] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0093] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong, characterized in that: include, Initialize the Dianhong chip adapter, set initial parameters and perform interface docking, and collect initial data from the substation; Based on the initial data of the substation, normalization, effect correction and drift compensation are performed to obtain the anomaly assessment value, calculate the anomaly time series change rate and environmental comprehensive correction coefficient, and generate the risk value level. Based on the risk level, the communication link quality index is calculated, the anomaly propagation prediction time is normalized, the reporting priority is obtained, and active reporting is carried out according to the reporting priority.

2. The method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in claim 1, characterized in that: The initialization of the Dianhong chip adapter, setting initial parameters and interface docking, and collecting initial data from the substation include... Load the Elecchip hardware driver, adapt the communication protocol, and set the calibration parameters; Based on the set calibration parameters, the physical connection of the hardware modules and the establishment of the data link are completed; Based on the data link, through a synchronous acquisition mechanism, module anomaly characteristic data, electromagnetic interference data, operating temperature data, environmental parameter data, and communication link quality data are acquired as initial data for the substation.

3. The method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in claim 2, characterized in that: Based on the initial data from the substation, normalization, effect correction, and drift compensation are performed to obtain anomaly assessment values. The anomaly time-series change rate and environmental comprehensive correction coefficient are calculated to generate risk value levels, including... The abnormal feature data of the module are normalized, and combined with effect correction and drift compensation, the abnormal evaluation value is obtained through a first-level algorithm. The abnormal time series change rate is calculated based on the abnormal assessment values ​​of adjacent time points, and the comprehensive environmental correction coefficient is calculated in combination with environmental parameter data. Risk levels are generated based on anomaly assessment values, anomaly time-series change rates, and comprehensive environmental correction coefficients.

4. The method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in claim 3, characterized in that: The process of calculating the communication link quality index based on risk level, normalizing the anomaly propagation prediction time, determining the reporting priority, and actively reporting according to the reporting priority includes... Based on the risk level, the communication link quality index is calculated, the anomaly propagation prediction time is obtained, and the anomaly propagation prediction time is normalized. Based on the risk level, communication link quality index, and normalized anomaly propagation prediction time, the reporting priority is determined. The communication interface is selected based on the reporting priority, and the report is proactively submitted to the superior business system.

5. The method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in claim 4, characterized in that: The anomaly assessment value obtained through the first-level algorithm includes, The anomaly assessment value is calculated using the following expression: in, This is an abnormal assessment value. The normalized Euclidean modulus value for the abnormal features of the module. The electromagnetic interference coupling coefficient, This is the temperature drift compensation factor. This is the coupling adjustment coefficient. This refers to the actual operating temperature. This is the standard operating temperature.

6. The method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in claim 5, characterized in that: The generated risk value levels include, The expression for risk level is: in, Risk level, This is an abnormal assessment value. For abnormal time series change rate, These are the time-series weighting coefficients. This is the comprehensive environmental correction factor. This is the baseline anomaly assessment value.

7. The method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in claim 6, characterized in that: The reporting priorities, derived based on risk level, communication link quality index, and normalized anomaly propagation prediction time, include: The reporting priority is expressed as follows: in, To prioritize the reporting, Risk level, This is a communication link quality index. To predict the time of normalized anomaly diffusion, This represents the link adaptation coefficient.

8. A system for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong, employing the method for real-time anomaly detection and proactive reporting of a substation monitoring terminal based on Dianhong as described in any one of claims 1 to 7, characterized in that, It includes an initialization and data acquisition module, a risk value level generation module, and an active reporting module. The initialization and data acquisition module initializes the Dianhong chip adapter, sets initial parameters and performs interface docking, and acquires initial data of the substation. The setting of initial parameters and interface connection are based on the initial data of the substation. Normalization, effect correction and drift compensation are performed to obtain the anomaly assessment value, calculate the anomaly time series change rate and environmental comprehensive correction coefficient, and generate the risk value level. The proactive reporting module calculates the communication link quality index based on the risk value level, normalizes the anomaly propagation prediction time, obtains the reporting priority, and proactively reports according to the reporting priority.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method for real-time anomaly detection and active reporting of a substation monitoring terminal based on Dianhong, as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for real-time anomaly detection and active reporting of a substation monitoring terminal based on Dianhong, as described in any one of claims 1 to 7.

Images