Asset operation baseline line-crossing detection method and system for power monitoring

Abstract

The invention discloses an asset operation baseline line-crossing detection method and system for power monitoring, relates to the technical field of line-crossing detection, ensures accurate description of a baseline on a service normal state by dynamically adjusting a statistical period and automatically modeling, avoids model lag, fundamentally eliminates artificial configuration errors, and improves the accuracy of line-crossing detection. A detection result is completely driven by real data, the accuracy and objectivity are remarkably improved, meanwhile, multi-dimensional analysis models of statistical distribution, sequence rules and relation topology are integrated on the detection level, composite threats from numerical value anomalies and process violation to relation intrusion can be deeply recognized, a periodic behavior template and refined feature processing are combined, and the detection efficiency is improved. According to the method, environmental noise is effectively filtered, false alarms are greatly reduced, the operation and maintenance burden is relieved, once behavior deviation is detected, the system immediately generates a structured cross-line label fused with multi-dimensional evidence, a preset response is automatically triggered, and the defense capability of intelligent response is provided for power key infrastructures.

Description

Technical Field

[0001] This invention relates to the field of baseline crossing detection technology, specifically to a method and system for detecting baseline crossing of asset operation in power monitoring. Background Technology

[0002] Currently, power monitoring systems are facing severe cybersecurity challenges. Traditional defense systems mainly rely on boundary protection based on fixed rules and intrusion detection based on matching known features. These systems are unable to cope with advanced persistent threats that use legitimate protocols and mimic normal behavior, as well as internal violations. These attacks often lurk in massive amounts of business data. Traditional methods suffer from low detection rates, high false alarm rates, and delayed responses due to a lack of accurate understanding of the system's own normal behavior patterns. With the advancement of smart grid construction, the types of devices connected to the monitoring network are numerous, the protocols are proprietary, and the interactions are complex. Their security situation is dynamic and covert. Most existing security products are general-purpose designs that do not fully consider the periodic operation modes, strict operation sequence logic, and established communication topologies between devices that are unique to power industrial control scenarios, making it difficult to achieve effective scenario-based adaptation. Therefore, there is an urgent need for an intelligent detection system that can deeply understand the characteristics of power monitoring business and has adaptive learning capabilities. This system needs to be able to automatically learn the behavior patterns of various assets under normal operating conditions, form an accurate operating baseline, and detect abnormal behaviors that deviate from the baseline in real time, thereby achieving accurate early warning of unknown threats, abnormal operations and potential risks. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for detecting baseline crossings in asset operation for power monitoring, in order to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a method for detecting baseline crossing of asset operation in power monitoring, comprising the following steps: S1. Connect the system device traffic acquisition port to the switch mirror port, acquire the behavior data of various assets in the network through the acquisition port, receive the operation data reported by various assets using Syslog logs, and parse the various data into a behavior event stream with a fixed field structure. S2. After reading the behavioral event streams of various assets in the network, analyze the event data within the statistical period and store the generated baseline data in JSON format; S3. When a real-time event occurs, the rule analysis engine is used to compare the real-time event with the generated baseline data. When a line is crossed, a corresponding line-crossing label is generated. S4. Send the event content and boundary crossing label to the monitoring platform through the security channel, and send corresponding notification prompts according to the configuration.

[0005] Preferably, step S1 specifically includes the following steps: S101. After connecting the mirror port of the network switch where the critical system equipment is located to the traffic acquisition port, a non-intrusive bypass monitoring method is adopted to obtain network communication behavior data of all assets in the network through the acquisition port. S102. Obtain operation and status event data of various assets by receiving Syslog logs actively reported by various assets; S103. After preprocessing the network communication behavior data and operation and status event data, multi-source heterogeneous data is obtained. Using a deep packet inspection engine, according to the standard specifications of the power monitoring system's dedicated protocol, the data packets in the heterogeneous data are disassembled layer by layer to accurately extract the core fields in the protocol frames. For the received Syslog logs, the unstructured log text is pattern matched using a pre-set regular expression to extract key attributes such as time, host, user, operation object, and result status.

[0006] Preferably, step S1 further includes the following steps: S104. Integrate all underlying data fields and key attributes of heterogeneous data, combine them into high-level behavioral events with clear business semantics through the behavior abstraction engine, use session reorganization and causal reasoning technology to reconstruct discrete events into behavioral sequences, and automatically query and supplement the relevant asset business dimension metadata from the asset library, thereby outputting behavioral event tuples with business context. S105. Serialize and encapsulate all behavioral events in the event tuple, and clearly define the corresponding fixed field structure for each type of event, including a globally unique event ID, a standard timestamp accurate to milliseconds, detailed information of the initiator and receiver of the behavior, behavior type, involved protocol, specific operation action, key parameters, and execution result.

[0007] Preferably, step S2 specifically includes the following steps: S201. Read the continuously collected and standardized behavioral event stream, and periodically segment the behavioral event stream. Divide the event stream into independent observation time windows according to a predefined statistical period (e.g., the default 7×24 hours). The data in this window is used as training samples to characterize the steady-state operation of the system. S202. Perform multi-scale sliding window segmentation on the training samples and establish three parallel processing channels: millisecond-level channel, job-level channel, and session-level channel. The millisecond-level channel receives events and uses the PrefixSpan algorithm to mine atomic-level operation sequences. The job-level channel identifies the operation units aggregated from atomic-level operation sequences and derives complete job chains. The session-level channel receives the complete job chain set, analyzes the temporal distribution pattern of operation modes, and finally outputs a set of frequent pattern rules with temporal causal constraints. S203. Perform a Fast Fourier Transform on the timestamp sequence of each behavioral event to identify significant periodic components in the frequency domain. For each periodic component, calculate the phase distribution of the event occurrence, fit the distribution of the time interval of continuous periodic events, and describe the statistical characteristics of the interval, thereby outputting a periodic behavior template.

[0008] Preferably, step S2 further includes the following steps: S204. Extract continuous feature vectors from the event stream and establish a multivariate statistical baseline for them. This baseline describes the normal range and correlation constraints of each feature. S205. After aggregating the event stream, discrete and graph structure data are obtained. Embedding learning is performed through a temporal graph neural network. The node features integrate the static attributes of the device with the behavioral patterns dynamically extracted from the event stream. The edge weight matrix quantifies the interaction intensity and pattern under multiple time dimensions, thereby automatically identifying asset communities with tight functional coupling and outputting graph structure parameters including node embedding vectors, edge weight tensors and community division results. S206. The original identifiers in the event stream are transformed into multi-layer semantic vectors containing physical location, business role and security level using an adaptive feature encoder. The intent of the protocol instructions is encoded through an attention mechanism to distinguish the key levels of the operation and output the feature vector after time-series smoothing and normalization. S207. Encapsulate all output results and store the generated baseline data in JSON format in the baseline library.

[0009] Preferably, step S3 specifically includes the following steps: S301. Perform online anomaly detection on the real-time collected asset behavior events, extract the multi-dimensional feature vectors of the events, and input them into the rule analysis engine; S302. The engine performs multi-level comparison analysis to check whether the real-time feature vector falls within the reference interval preset by the statistical baseline. If it does not fall within the interval, the event is determined to be statistically abnormal in the current continuous feature dimension, and an over-line label is immediately generated. The label will record the specific features of the deviation, the direction of the deviation, and the degree of deviation. If it falls within the interval, the event is determined to be statistically normal in the current continuous feature dimension.

[0010] Preferably, step S3 further includes the following steps: S303. Place the current event in a short sequence of recent events and verify whether it conforms to the frequent patterns and causal constraints mined from the baseline library. If it does, the event is considered logically normal in the context of the current sequence. If it does not, the event is considered logically abnormal, and a cross-line label is immediately generated to clearly indicate the specific pattern and constraint violated. S304. Calculate the abnormal score of the asset node involved in the event in the current interaction mode in real time through graph neural network, and determine whether it deviates from the learned normal communication community and connection mode. If it does not deviate from the normal communication community and connection mode, the event is determined to be structurally normal at the relational topology level. If it deviates from the normal communication community and connection mode, the event is determined to be topologically abnormal, and a cross-line label is generated. The label records the deviation point that is precisely described.

[0011] The asset operation baseline crossing detection system for power monitoring includes a data acquisition unit, a baseline generation unit, a crossing detection unit, and a response processing unit. The data acquisition unit connects the system device traffic acquisition port to the switch mirror port, acquires behavioral data of various assets in the network through the acquisition port, receives operation data reported by various assets using Syslog logs, and parses various data into behavioral event streams with fixed field structures. After reading the behavioral event streams of various assets in the network, the baseline generation unit analyzes the event data within the statistical period and stores the generated baseline data in JSON format. When a real-time event occurs, the line crossing detection unit uses a rule analysis engine to compare the real-time event with the generated baseline data, and generates a corresponding line crossing label when a line crossing occurs. The response processing unit sends the event content and the boundary crossing label to the monitoring platform through a secure channel, and sends corresponding notification prompts according to the configuration.

[0012] Compared with the prior art, the beneficial effects of the present invention are: This invention ensures accurate depiction of normal business operations by dynamically adjusting the statistical period and automating modeling, avoiding model lag and fundamentally eliminating human configuration errors. This makes the detection results entirely driven by real data, significantly improving accuracy and objectivity. At the detection level, it integrates a multi-dimensional analysis model of statistical distribution, sequence rules, and relationship topology, which can deeply identify complex threats ranging from numerical anomalies and process violations to relationship intrusions. Combined with periodic behavior templates and refined feature processing, it effectively filters environmental noise, significantly reduces false alarms, and alleviates the burden of operation and maintenance. Once a behavioral deviation is detected, the system immediately generates a structured boundary violation label that integrates multi-dimensional evidence and automatically triggers a preset response, providing power critical infrastructure with an adaptive defense capability from passive alarm to proactive prediction and intelligent response. Attached Figure Description

[0013] Figure 1 An overall method flowchart is provided for embodiments of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Example 1: Please see Figure 1 This invention provides a technical solution: a method for detecting baseline crossing of asset operation in power monitoring, comprising the following steps: S1. Connect the system device traffic acquisition port to the switch mirror port, acquire the behavior data of various assets in the network through the acquisition port, receive the operation data reported by various assets using Syslog logs, and parse the various data into a behavior event stream with a fixed field structure. S2. After reading the behavioral event streams of various assets in the network, analyze the event data within the statistical period and store the generated baseline data in JSON format; S3. When a real-time event occurs, the rule analysis engine is used to compare the real-time event with the generated baseline data. When a line is crossed, a corresponding line-crossing label is generated. S4. Send the event content and boundary crossing label to the monitoring platform through the security channel, and send corresponding notification prompts according to the configuration.

[0016] S1 specifically includes the following steps: S101. After connecting the mirror port of the network switch where the critical system equipment is located to the traffic acquisition port, a non-intrusive bypass monitoring method is adopted to obtain network communication behavior data of all assets in the network through the acquisition port. S102. Obtain operation and status event data of various assets by receiving Syslog logs actively reported by various assets; S103. After preprocessing the network communication behavior data and operation and status event data, multi-source heterogeneous data is obtained. Using a deep packet inspection engine, according to the standard specifications of the power monitoring system dedicated protocol, the data packets in the heterogeneous data are disassembled layer by layer to accurately extract the core fields in the protocol frame. For the received Syslog logs, the unstructured log text is pattern matched using a preset regular expression to extract key attributes such as time, host, user, operation object, and result status. S1 further includes the following steps: S104. Integrate all underlying data fields and key attributes of heterogeneous data, combine them into high-level behavioral events with clear business semantics through the behavior abstraction engine, use session reorganization and causal reasoning technology to reconstruct discrete events into behavioral sequences, and automatically query and supplement the relevant asset business dimension metadata from the asset library, thereby outputting behavioral event tuples with business context. S105. Serialize and encapsulate all behavioral events in the event tuple, and clearly define the corresponding fixed field structure for each type of event, including a globally unique event ID, a standard timestamp accurate to milliseconds, detailed information of the initiator and receiver of the behavior, behavior type, involved protocol, specific operation action, key parameters and execution result. S2 specifically includes the following steps: S201. Read the continuously collected and standardized behavioral event stream, and periodically segment the behavioral event stream. Divide the event stream into independent observation time windows according to a predefined statistical period (e.g., the default 7×24 hours). The data in this window is used as training samples to characterize the steady-state operation of the system. S202. Perform multi-scale sliding window segmentation on the training samples and establish three parallel processing channels: millisecond-level channel, job-level channel, and session-level channel. The millisecond-level channel receives events and uses the PrefixSpan algorithm to mine atomic-level operation sequences. The job-level channel identifies the operation units aggregated from atomic-level operation sequences and derives complete job chains. The session-level channel receives the complete job chain set, analyzes the temporal distribution pattern of operation modes, and finally outputs a set of frequent pattern rules with temporal causal constraints. S203. Perform a fast Fourier transform on the timestamp sequence of each behavioral event, identify significant periodic components in the frequency domain, calculate the phase distribution of the event occurrence for each periodic component, fit the distribution of the time interval of continuous periodic events, and describe the statistical characteristics of the interval, thereby outputting a periodic behavior template. S2 further includes the following steps: S204. Extract continuous feature vectors from the event stream and establish a multivariate statistical baseline for them. This baseline describes the normal range and correlation constraints of each feature. S205. After aggregating the event stream, discrete and graph structure data are obtained. Embedding learning is performed through a temporal graph neural network. The node features integrate the static attributes of the device with the behavioral patterns dynamically extracted from the event stream. The edge weight matrix quantifies the interaction intensity and pattern under multiple time dimensions, thereby automatically identifying asset communities with tight functional coupling and outputting graph structure parameters including node embedding vectors, edge weight tensors and community division results. S206. The original identifiers in the event stream are transformed into multi-layer semantic vectors containing physical location, business role and security level using an adaptive feature encoder. The intent of the protocol instructions is encoded through an attention mechanism to distinguish the key levels of the operation and output the feature vector after time-series smoothing and normalization. S207. Encapsulate all output results and store the generated baseline data in JSON format in the baseline library; S3 specifically includes the following steps: S301. Perform online anomaly detection on the real-time collected asset behavior events, extract the multi-dimensional feature vectors of the events, and input them into the rule analysis engine; S302. The engine performs multi-level comparison analysis to check whether the real-time feature vector falls within the reference interval preset by the statistical baseline. If it does not fall within the interval, the event is determined to be statistically abnormal in the current continuous feature dimension, and an over-line label is immediately generated. The label will record the specific features of the deviation, the direction of the deviation, and the degree of deviation. If it falls within the interval, the event is determined to be statistically normal in the current continuous feature dimension. S3 also includes the following steps: S303. Place the current event in a short sequence of recent events and verify whether it conforms to the frequent patterns and causal constraints mined from the baseline library. If it does, the event is considered logically normal in the context of the current sequence. If it does not, the event is considered logically abnormal, and a cross-line label is immediately generated to clearly indicate the specific pattern and constraint violated. S304. Calculate the abnormal score of the asset node involved in the event in the current interaction mode in real time through graph neural network, and determine whether it deviates from the learned normal communication community and connection mode. If it does not deviate from the normal communication community and connection mode, the event is determined to be structurally normal at the relational topology level. If it deviates from the normal communication community and connection mode, the event is determined to be topologically abnormal, and a cross-line label is generated. The label records the deviation point that is precisely described.

[0017] Example 2: The present invention also provides an asset operation baseline crossing detection system for power monitoring, including a data acquisition unit, a baseline generation unit, a crossing detection unit, and a response processing unit; The data acquisition unit connects the system device traffic acquisition port to the switch mirror port, acquires behavioral data of various assets in the network through the acquisition port, receives operation data reported by various assets using Syslog logs, and parses various data into behavioral event streams with fixed field structures. After reading the behavioral event streams of various assets in the network, the baseline generation unit analyzes the event data within the statistical period and stores the generated baseline data in JSON format. When a real-time event occurs, the line crossing detection unit uses a rule analysis engine to compare the real-time event with the generated baseline data, and generates a corresponding line crossing label when a line crossing occurs. The response processing unit sends the event content and the boundary crossing label to the monitoring platform through a secure channel, and sends corresponding notification prompts according to the configuration.

[0018] Example 3: The specific process of this invention is as follows: I. Data Acquisition Process: 1) Connect the system device traffic acquisition port to the switch mirror port. The traffic acquisition module obtains behavioral data of various assets in the network through the acquisition port. 2) Operational data reported by various assets can be received via syslog; 3) Parse various types of data into behavioral data in a specific format; II. Baseline Generation Process 1) Baseline generation rules: Statistical period: The time from the start of behavior analysis to the generation of a complete baseline. The default statistical period is 7 days. 24 hours, adjustable according to configuration (e.g., 2) (24 hours). The new baseline statistics will replace the old results to ensure the timeliness of the baseline.

[0019] Data source: The baseline is based on behavioral model data (such as network access, application business operations, etc.). The system collects the behavioral logs of assets, and extracts key features (such as protocol type, IP address, port number, etc.) through aggregation and normalization to form the baseline.

[0020] Automated Algorithms: The device uses statistical methods to automatically calculate the thresholds and ranges of the baseline. For example, for a network port monitoring baseline, the system statistically analyzes the normal open status of the port and protocol usage to generate baseline entries.

[0021] 2) Baseline type and content: Server-side network access baseline: Triggering behavior: Network access (accessed as a server) Statistical period: 7 24 hours, configurable Data format: including protocol, client IP, server IP, server port, etc.

[0022] Process network access baseline: Triggering behavior: Network access (accessing other assets as a client).

[0023] Statistical period: 7 24 hours, configurable Data format: includes the executable file name, path, client IP, and server IP.

[0024] Network port listening baseline: Triggering behavior: Switching the listening port on and off.

[0025] Statistical period: 7 24 hours.

[0026] Data format: includes process file name, IP address, port, protocol, etc.

[0027] Other baseline types: These include ARP information baselines, host process baselines, and critical file access baselines. Each baseline targets specific asset behaviors, such as ARP table changes, process start / stop, and file access.

[0028] 3) Baseline detection process Behavior Collection: The data acquisition module collects asset behavior data in real time (such as network access logs, process operations, etc.).

[0029] Baseline comparison: Matching behavioral data against the corresponding baseline. For example, for network access behavior, checking whether the source IP, destination IP, port, and protocol are within the baseline's allowed range.

[0030] Cross-line determination: If behavior deviates from the baseline (such as accessing ports or using protocols not included in the baseline), it is marked as a cross-line violation. The determination is based on a rule engine and supports logical operators (such as AND and OR) and comparison operators (such as NOT DOI).

[0031] Tag generation: When a line is crossed, the system generates a line crossing tag, including the baseline number, timestamp, behavior details, etc.

[0032] Priority rules: Baseline analysis follows a priority order. For example, process network access baselines take precedence over server network access baselines to ensure that critical behaviors are detected first.

[0033] Response mechanism: Cross-limit detection can trigger alarms, log entries, or automatic responses. The system supports custom response strategies, such as notifying administrators or executing scripts.

[0034] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0035] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting baseline crossing of asset operation in power monitoring, characterized in that, The method includes the following steps: S1. Connect the system device traffic acquisition port to the switch mirror port, acquire the behavior data of various assets in the network through the acquisition port, receive the operation data reported by various assets using Syslog logs, and parse the various data into a behavior event stream with a fixed field structure. S2. After reading the behavioral event streams of various assets in the network, analyze the event data within the statistical period and store the generated baseline data in JSON format; S3. When a real-time event occurs, the rule analysis engine is used to compare the real-time event with the generated baseline data. When a line is crossed, a corresponding line-crossing label is generated. S4. Upload the event content and boundary crossing label to the monitoring platform through the secure channel, and send corresponding notification prompts according to the configuration.

2. The method for detecting baseline crossing of asset operation in power monitoring according to claim 1, characterized in that: S1 specifically includes the following steps: S101. After connecting the mirror port of the network switch where the critical system equipment is located to the traffic acquisition port, a non-intrusive bypass monitoring method is adopted to obtain network communication behavior data of all assets in the network through the acquisition port. S102. Obtain operation and status event data of various assets by receiving Syslog logs actively reported by various assets; S103. After preprocessing the network communication behavior data and operation and status event data, multi-source heterogeneous data is obtained. Using a deep packet inspection engine, according to the standard specifications of the power monitoring system's dedicated protocol, the data packets in the heterogeneous data are disassembled layer by layer to accurately extract the core fields in the protocol frames. For the received Syslog logs, the unstructured log text is pattern matched using a pre-set regular expression to extract key attributes such as time, host, user, operation object, and result status.

3. The method for detecting baseline crossing of asset operation in power monitoring according to claim 2, characterized in that: S1 further includes the following steps: S104. Integrate all underlying data fields and key attributes of heterogeneous data, combine them into high-level behavioral events with clear business semantics through the behavior abstraction engine, use session reorganization and causal reasoning technology to reconstruct discrete events into behavioral sequences, and automatically query and supplement the relevant asset business dimension metadata from the asset library, thereby outputting behavioral event tuples with business context. S105. Serialize and encapsulate all behavioral events in the event tuple, and clearly define the corresponding fixed field structure for each type of event, including a globally unique event ID, a standard timestamp accurate to milliseconds, detailed information of the initiator and receiver of the behavior, behavior type, involved protocol, specific operation action, key parameters, and execution result.

4. The method for detecting baseline crossing of asset operation in power monitoring according to claim 1, characterized in that: S2 specifically includes the following steps: S201. Read the continuously collected and standardized behavioral event stream, periodically segment the behavioral event stream, divide the event stream into independent observation time windows according to a predefined statistical period, and use the data in the window as training samples to characterize the steady-state operation of the system. S202. Perform multi-scale sliding window segmentation on the training samples and establish three parallel processing channels: millisecond-level channel, job-level channel, and session-level channel. The millisecond-level channel receives events and uses the PrefixSpan algorithm to mine atomic-level operation sequences. The job-level channel identifies the operation units aggregated from atomic-level operation sequences and derives complete job chains. The session-level channel receives the complete job chain set, analyzes the temporal distribution pattern of operation modes, and finally outputs a set of frequent pattern rules with temporal causal constraints. S203. Perform a Fast Fourier Transform on the timestamp sequence of each behavioral event to identify significant periodic components in the frequency domain. For each periodic component, calculate the phase distribution of the event occurrence, fit the distribution of the time interval of continuous periodic events, and describe the statistical characteristics of the interval, thereby outputting a periodic behavior template.

5. The method for detecting baseline crossing of asset operation in power monitoring according to claim 4, characterized in that: S2 further includes the following steps: S204. Extract continuous feature vectors from the event stream and establish a multivariate statistical baseline for them. This baseline describes the normal range and correlation constraints of each feature. S205. After aggregating the event stream, discrete and graph structure data are obtained. Embedding learning is performed through a temporal graph neural network. The node features integrate the static attributes of the device with the behavioral patterns dynamically extracted from the event stream. The edge weight matrix quantifies the interaction intensity and pattern under multiple time dimensions, thereby automatically identifying asset communities with tight functional coupling and outputting graph structure parameters including node embedding vectors, edge weight tensors and community division results. S206. The original identifiers in the event stream are transformed into multi-layer semantic vectors containing physical location, business role and security level using an adaptive feature encoder. The intent of the protocol instructions is encoded through an attention mechanism to distinguish the key levels of the operation and output the feature vector after time-series smoothing and normalization. S207. Encapsulate all output results and store the generated baseline data in JSON format in the baseline library.

6. The method for detecting baseline crossing of asset operation in power monitoring according to claim 1, characterized in that: S3 specifically includes the following steps: S301. Perform online anomaly detection on the real-time collected asset behavior events, extract the multi-dimensional feature vectors of the events, and input them into the rule analysis engine; S302. The engine performs multi-level comparison analysis to check whether the real-time feature vector falls within the reference interval preset by the statistical baseline. If it does not fall within the interval, the event is determined to be statistically abnormal in the current continuous feature dimension, and an over-line label is immediately generated. The label will record the specific features of the deviation, the direction of the deviation, and the degree of deviation. If it falls within the interval, the event is determined to be statistically normal in the current continuous feature dimension.

7. The method for detecting baseline crossing of asset operation in power monitoring according to claim 6, characterized in that: S3 further includes the following steps: S303. Place the current event in a short sequence of recent events and verify whether it conforms to the frequent patterns and causal constraints mined from the baseline library. If it does, the event is considered logically normal in the context of the current sequence. If it does not, the event is considered logically abnormal, and a cross-line label is immediately generated to clearly indicate the specific pattern and constraint violated. S304. Calculate the abnormal score of the asset node involved in the event in the current interaction mode in real time through graph neural network, and determine whether it deviates from the learned normal communication community and connection mode. If it does not deviate from the normal communication community and connection mode, the event is determined to be structurally normal at the relational topology level. If it deviates from the normal communication community and connection mode, the event is determined to be topologically abnormal, and a cross-line label is generated. The label records the deviation point that is precisely described.

8. An asset operation baseline crossing detection system for power monitoring, characterized in that, The asset operation baseline crossing detection system is applicable to the asset operation baseline crossing detection method for power monitoring as described in any one of claims 1-7, and includes a data acquisition unit, a baseline generation unit, a crossing detection unit, and a response processing unit; The data acquisition unit connects the system device traffic acquisition port to the switch mirror port, acquires behavioral data of various assets in the network through the acquisition port, receives operation data reported by various assets using Syslog logs, and parses various data into behavioral event streams with fixed field structures. After reading the behavioral event streams of various assets in the network, the baseline generation unit analyzes the event data within the statistical period and stores the generated baseline data in JSON format. When a real-time event occurs, the line crossing detection unit uses a rule analysis engine to compare the real-time event with the generated baseline data, and generates a corresponding line crossing label when a line crossing occurs. The response processing unit sends the event content and the boundary crossing label to the monitoring platform through a secure channel, and sends corresponding notification prompts according to the configuration.

Images