A multi-modal based power system security situation awareness method

Abstract

This invention discloses a multimodal power system security situation awareness method. The aforementioned awareness method includes: acquiring multimodal security data in the power system and preprocessing the multimodal security data; fusing the preprocessed multimodal security data into a unified spatiotemporal representation through a multimodal heterogeneous topology data fusion mechanism; determining the deployment positions of the execution subject at the edge layer and the main control layer based on end-to-end latency constraints, and having the execution subject perform inference operations based on the spatiotemporal representation to obtain node-level anomaly probability and system-level situation score; judging the anomaly probability and situation score according to a discrimination threshold, outputting the awareness result, and triggering a linkage response process based on the awareness result.

Description

Technical Field

[0001] This invention relates to the field of power grid security situation awareness technology, and in particular to a multimodal power system security situation awareness method. Background Technology

[0002] The power system is a critical infrastructure vital to the national economy and people's livelihood, and its safe and stable operation is of paramount importance. Traditional power system security situation awareness technologies mainly rely on energy management systems and wide-area measurement systems deployed at the main substation side. These systems collect measurement data such as voltage, current, frequency, and phase angle to perform state estimation and power flow calculations to monitor the system's operating status. For anomaly detection, alarm mechanisms based on fixed thresholds or systems based on expert rule bases are typically used for fault diagnosis. In recent years, with the development of machine learning technology, some solutions have begun to use models such as Long Short-Term Memory (LSTM) networks to model the time-series data of the power system in order to discover potential anomaly patterns. These technologies have historically played a crucial role in ensuring power grid security and form the basic framework for current power system security monitoring.

[0003] However, with the expansion of the power grid, the large-scale grid connection of new energy sources, and the deep integration of network information technology, existing technologies have gradually revealed many shortcomings in addressing new security challenges. First, most existing technologies rely on single physical measurement data, making it difficult to effectively correlate physical information with network security information, and failing to accurately identify cascading failures in the physical system caused by network attacks, resulting in a "data silo" problem. Second, traditional models typically treat each monitoring point as an independent unit or only consider simple electrical connections, failing to fully utilize the inherent graph topology of the power system, leading to insufficient perception of complex events with strong spatiotemporal correlations, such as fault propagation and disturbance diffusion. Furthermore, the power system topology changes dynamically due to line maintenance, switching operations, etc., while existing models are mostly based on static topology construction; their accuracy decreases significantly after topology changes. In addition, traditional centralized processing architectures face bottlenecks in communication bandwidth and decision latency, making it difficult to meet the needs of rapid edge-side response; simultaneously, alarm methods based on fixed thresholds cannot adapt to the dynamic changes in power grid operating conditions, easily leading to high false alarm or false negative rates, reducing the accuracy of situational awareness and the timeliness of response. Summary of the Invention

[0004] In view of the above-mentioned prior art, the present invention provides a multimodal power system security situation awareness method, which mainly solves the technical problems existing in the background art.

[0005] To achieve the above objectives, the technical solution of this invention is implemented as follows: This invention discloses a multimodal power system security situation awareness method, the aforementioned awareness method comprising: Acquire multimodal security data from the power system and preprocess the multimodal security data; The preprocessed multimodal security data is fused into a unified spatiotemporal representation through a multimodal heterogeneous topology data fusion mechanism; Based on end-to-end latency constraints, the deployment positions of the execution entity at the edge layer and the main control layer are determined, and the execution entity performs inference operations based on the spatiotemporal representation to obtain the node-level anomaly probability and the system-level situational score. The system determines the probability of anomalies and the situation score based on the discrimination threshold, outputs the perception results, and triggers a coordinated response process based on the perception results.

[0006] Preferably, the multimodal security data includes topology information, runtime sequence data, sensor measurement data, and network security logs, and the preprocessing includes time synchronization and formatting.

[0007] Preferably, the preprocessed multimodal security data is fused into a unified spatiotemporal representation through a multimodal heterogeneous topology data fusion mechanism, specifically including: For the preprocessed topology data, a graph embedding algorithm is used to extract features and construct a node-edge feature matrix to characterize the physical connection relationships between power system equipment. For the preprocessed runtime sequence data, a temporal convolutional network is used to extract dynamic operation features and form a temporal feature matrix to capture the temporal variation pattern of the power system. For the preprocessed security log data, a language model is used to generate semantic embeddings, and the semantic embeddings associated with the same node are aggregated to obtain a node-level semantic feature matrix in order to mine security association information in the logs. Using the node-edge feature matrix as the query, and the temporal feature matrix and node-level semantic feature matrix as the key and value, a multimodal fusion feature matrix is ​​obtained through a cross-modal attention mechanism; The multimodal fusion feature matrix is ​​aligned with the output of the graph neural network to ultimately generate a unified spatiotemporal representation.

[0008] Preferably, the multimodal fusion feature matrix is ​​aligned with the output of the graph neural network to ultimately generate a unified spatiotemporal representation, specifically including: The multimodal fusion feature matrix is ​​used as the initial node input of the graph attention network. The graph attention network performs spatial domain message passing and aggregation operations on the power system topology graph and outputs a single-step spatial feature representation. Within a preset discrete time window, spatial feature representations of multiple consecutive time steps are collected, stacked in chronological order to form a temporal feature sequence, and time-dimensional positional encoding is added to the sequence. The temporal feature sequence containing position encoding is input into the transformer encoder, and the output node-level integrated spatiotemporal representation at the current moment is the unified spatiotemporal representation.

[0009] Preferably, based on end-to-end latency constraints, the deployment locations of the execution entity at the edge layer and the main control layer are determined, specifically including: The components of end-to-end latency are clearly defined, including acquisition and synchronization latency, preprocessing and encoding latency, upload latency from the edge layer to the main control layer, model inference latency related to deployment location, and threshold calibration and linkage latency. Based on the aforementioned constituent components, an optimization function is determined to minimize the total end-to-end delay. The expression of the optimization function is as follows:

[0010] In the formula, It is a decision variable. This indicates that the executing entity is at the control level. This indicates that the executing entity is at the edge layer. It is the acquisition and synchronization latency. It is the preprocessing and encoding delay. It refers to the upload latency from the edge to the main control layer. It is the inference latency related to the deployment location. It involves threshold calibration and linkage delay. Total delay; Solve the optimization function, and based on the solution, determine whether the execution entity is deployed at the edge layer or at the main control layer.

[0011] Preferably, the executing entity performs inference operations based on the spatiotemporal representation to obtain node-level anomaly probabilities and system-level situational scores, specifically including: The execution entity inputs a unified spatiotemporal representation into a preset multilayer perceptron, performs inference operations through a two-layer neural network mapping in the multilayer perceptron, and outputs the node-level anomaly probability corresponding to each node. Node importance weights are set, and the node-level anomaly probabilities of all nodes are weighted and summed using the node importance weights as weighting coefficients to obtain the system-level situational score.

[0012] Preferably, the first layer of the two-layer neural network has a learnable weight matrix, a bias term, and an element-wise linear rectified function. The first layer neural network performs feature transformation on the unified spatiotemporal representation. The second neural network has a sigmoid activation function and the same learnable weight matrix and bias term as the first layer neural network. The feature transformation result is mapped to the [0,1] interval through the second neural network as the node-level anomaly probability corresponding to each node.

[0013] Preferably, before the executing entity performs inference operations based on the spatiotemporal representation, the method further includes: implementing version management and consistency verification for power grid topology changes based on a topology versioning and consistency mechanism, specifically including: When the power grid topology changes due to switching operations, line switching, or operation mode adjustments, the system captures the complete node connection relationships and edge information of the current power grid in real time, generates a topology snapshot containing all topology data, and performs serialization processing on the snapshot. A hash encryption algorithm is used to calculate the serialized topology snapshot and generate a hash signature, which is then used as the unique identifier for the corresponding topology version. Generate a binary tree-structured topology version library by ordering the hash signatures of all historical topology versions; Based on the precise timestamp of the input multimodal security data, the topology snapshot version that strictly matches the timestamp is retrieved from the topology version library. The topology snapshot version is then verified against the actual power grid topology at the time the data was generated. If the verification is consistent, the topology snapshot version is input into the multilayer sensor as a spatial topology benchmark.

[0014] Preferably, the discrimination threshold includes a node-level anomaly probability threshold and a system-level segmentation discrimination threshold, and the process of determining the discrimination threshold includes: Statistical analysis of historical node-level anomaly probability sequences is performed within a preset time window to form a distribution estimate; Based on the distribution, a node-level anomaly probability threshold is estimated and a minimum and maximum limit is set; System-level segmentation thresholds are generated based on the historical distribution of system-level situational scores.

[0015] Preferably, during the execution of the coordinated handling process, the upstream load of the corresponding power supply path is redistributed and the associated communication channel is isolated, the affected equipment is switched and a manual intervention prompt is generated for the operation and maintenance terminal, the cross-regional power command and the zone operation mode are adjusted and the handling trajectory is recorded.

[0016] The beneficial effects of this invention are as follows: by collecting multimodal data such as power system topology, operation sequence, sensor and network security logs, and using a graph neural network and converter fusion model to carry out feature encoding and spatiotemporal feature alignment, it effectively breaks through the limitation of "data silos" caused by single physical measurement data in traditional technologies, realizes the deep integration of multi-source heterogeneous information, and fully explores the inherent graph topology association and spatiotemporal dynamic laws of the power system, significantly improving the comprehensiveness and accuracy of security situation awareness; By constructing an edge-coordinated latency budget model and combining end-to-end latency constraints to optimize the allocation of sensing and handling tasks between the edge layer and the main control layer, the bottlenecks of communication bandwidth and decision-making latency faced by traditional centralized processing architecture are effectively overcome. It takes into account the advantages of rapid response on the edge side and global judgment on the main control layer, and significantly improves the real-time handling capability of the system. The established topology versioning and consistency mechanism can accurately adapt to the dynamic changes in the power grid topology caused by switching actions and line switching, which solves the analysis distortion problem caused by traditional static topology modeling, ensures that the model inference is based on the real power grid state at the time of data generation, and further enhances the reliability of the perception results. In summary, this invention can effectively integrate multi-source heterogeneous information, significantly improving the accuracy, robustness, and real-time handling capabilities of power system security situation awareness. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only preferred embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the power system security situation awareness method based on multimodal operation in an embodiment of this application. Figure 2 This is a schematic diagram of the multimodal heterogeneous data fusion model structure in the embodiments of this application. Detailed Implementation

[0019] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. In the following description, the expression "some embodiments" refers to a subset of all possible embodiments; however, it should be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with each other without conflict.

[0020] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0021] It should be understood that the present invention can be embodied in various forms and should not be construed as being limited to the embodiments set forth herein. Rather, providing these embodiments will make the disclosure thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Furthermore, the terminology used herein is intended only to describe particular embodiments and is not intended to limit the invention. When used herein, the singular forms “a,” “an,” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “compose” and / or “comprising,” when used in this specification, identify the presence of the stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups. When used herein, the term “and / or” includes any and all combinations of the associated listed items.

[0022] It should also be noted that when an element is referred to as being "fixed to" another element, it can be directly attached to the other element or there may be an intervening element. When an element is referred to as being "connected to" another element, it can be directly connected to the other element or there may be an intervening element. The terms "vertical," "horizontal," "inner," "outer," "left," "right," and similar expressions used herein are for illustrative purposes only and do not represent the only possible implementation.

[0023] To fully understand this invention, a detailed structure will be presented in the following description to illustrate the technical solution proposed by this invention. Optional embodiments of the invention are described in detail below; however, in addition to these detailed descriptions, the invention may have other embodiments.

[0024] Please refer to the attached document. Figures 1 to 2 This application provides a multimodal power system security situation awareness method. This method can be applied to a regional smart grid covering key substations, transmission corridors, distributed energy access points, and corresponding network security protection equipment. For this smart grid, the steps of the aforementioned awareness method include: S1. Acquire multimodal security data from the power system and preprocess the multimodal security data; Specifically, to comprehensively capture system status, this layer integrates multiple data sources: firstly, by parsing and following... The General Information Modeling Standard (GIMS) document periodically and event-triggered (e.g., switch changes) acquires the global static topology of the power grid, accurately describing the physical connections between primary equipment such as buses, transformers, and circuit breakers. Secondly, it utilizes phasor measurement units deployed at key nodes to... High sampling frequency synchronously acquires dynamic phasor data such as voltage, current, frequency, and phase angle, and supplements with The system collects traditional measurement data such as second-level active / reactive power and switch status. Thirdly, IoT sensors are deployed near key equipment such as transformers and circuit breakers, and... Lightweight protocols, with The frequency acquisition equipment collects non-electrical physical quantities such as temperature, partial discharge, and dissolved gases in oil. Fourthly, through... The protocol aggregates security logs from network firewalls, intrusion detection systems, and routers in real time, including abnormal traffic alerts, configuration change records, and denial-of-service attack attempts. In other words, the multimodal security data includes topology information, runtime sequence data, sensor measurement data, and network security logs.

[0025] In some optional implementations, the preprocessing includes time synchronization and formatting. Specifically, to ensure the effectiveness of subsequent spatiotemporal analysis, all acquisition nodes achieve millisecond-level time synchronization via a network time protocol. The acquired heterogeneous data is then formatted and uniformly encapsulated into standardized objects containing precise timestamps, device source identifiers, data types, and payload content. Outliers are removed using statistical methods, missing data is filled using linear interpolation, and finally, numerical features are mapped to the interval [0,1] using a min-max normalization algorithm to eliminate dimensional differences.

[0026] S2. The preprocessed multimodal security data is fused into a unified spatiotemporal representation through a multimodal heterogeneous topology data fusion mechanism, which specifically includes: For the preprocessed topology data, a graph embedding algorithm is used to extract features and construct a node-edge feature matrix to characterize the physical connection relationships between power system equipment. For the preprocessed runtime sequence data, a temporal convolutional network is used to extract dynamic operation features and form a temporal feature matrix to capture the temporal variation pattern of the power system. For the preprocessed security log data, a language model is used to generate semantic embeddings, and the semantic embeddings associated with the same node are aggregated to obtain a node-level semantic feature matrix in order to mine security association information in the logs. Using the node-edge feature matrix as the query, and the temporal feature matrix and node-level semantic feature matrix as the key and value, a multimodal fusion feature matrix is ​​obtained through a cross-modal attention mechanism; The multimodal fusion feature matrix is ​​aligned with the output of the graph neural network to ultimately generate a unified spatiotemporal representation.

[0027] Specifically, suppose the power system topology is a directed or undirected graph. ,in For a set of nodes, For the number of nodes, For the set of edges, and for topological data, the following approach is adopted: The graph embedding algorithm performs each node... The characterization process, through iteration, is as follows:

[0028] in Represents a node The set of neighbors; Indicates the first Layer after node Embedding; For the first Neighborhood aggregation function of the layer; For feature splicing operators; For the first Layer-learnable weight matrix; For element-wise nonlinear activation functions, after Layer iteration yields the topological feature matrix ,in For the final embedding dimension.

[0029] For runtime sequence data, a signal sequence stacked by time step is constructed for each node and input into a temporal convolutional network. The temporal convolutional network uses causal convolution and dilated convolution. Given the kernel size, dilation rate sequence, and number of channels, the time sequence of each node can be mapped to a fixed-length vector to form a temporal feature matrix. ,in This defines the output dimension of the temporal convolutional network. For security log data, it uses... The model encodes node-related logs; it embeds logs belonging to the same node into the time dimension or sample dimension and obtains node-level semantic vectors according to the set aggregation operators, which are then aggregated. ,in Using log semantic embedding as the query dimension, and time-series and log embeddings as keys and values, we compute a fusion representation of cross-modal attention:

[0030] in , , ; square brackets This indicates a concatenation operation along the feature dimension; , , For learnable projection matrix; For key / query feature dimensions, The feature dimension of the value; Normalization is performed along the row dimension to obtain attention weights, resulting in the fused feature matrix. As the initial node input for subsequent graph neural networks, in the node index dimension and Maintaining alignment relationships enables the mapping and alignment of node-level multimodal features in a unified space.

[0031] In some optional implementations, the multimodal fusion feature matrix is ​​aligned with the output of the graph neural network to ultimately generate a unified spatiotemporal representation, specifically including: The multimodal fusion feature matrix is ​​used as the initial node input of the graph attention network. The graph attention network performs spatial domain message passing and aggregation operations on the power system topology graph and outputs a single-step spatial feature representation. Within a preset discrete time window, spatial feature representations of multiple consecutive time steps are collected, stacked in chronological order to form a temporal feature sequence, and time-dimensional positional encoding is added to the sequence. The temporal feature sequence containing position encoding is input into the transformer encoder, and the output node-level integrated spatiotemporal representation at the current moment is the unified spatiotemporal representation.

[0032] Specifically, with As input, a graph attention network is used in the graph. The graph attention network performs message passing and aggregation in the spatial domain, and updates node embeddings layer by layer to reflect the impact of adjacency relationships and edge connections; let the single-step output of the graph attention network be... Collect continuous data within a discrete time window. The node representations at each time step are stacked and input into the transformer encoder, with position encoding added in the time dimension to distinguish the sequence order. The transformer's self-attention module performs a weighted combination and feedforward transformation on the representation vector sequence of each node on the time axis, outputting the node-level comprehensive spatiotemporal representation of the current time step. ,in For nodes The final characteristic representation, The output dimension is determined by the number of hidden channels in the last layer of the transformer. In the above process, the graph attention network is used to perform spatial propagation on the graph structure, and the transformer encoder is used to process the length in the time dimension. The sequence is modeled, and the fusion model formed by concatenating the two is used to... For input, with This is the output.

[0033] S3. Based on the end-to-end latency constraints, determine the deployment location of the execution entity in the edge layer and the main control layer, and have the execution entity perform inference operations based on the spatiotemporal representation to obtain the node-level anomaly probability and the system-level situational score.

[0034] Specifically, in order to optimize system resources while meeting strict latency constraints, this method constructs an edge-coordinated latency budget and task allocation model, with the goal of minimizing the total end-to-end latency. First, the components of end-to-end latency are defined. These components include acquisition and synchronization latency, preprocessing and encoding latency, upload latency from the edge layer to the main control layer, model inference latency related to deployment location, and threshold calibration and linkage latency. Acquisition and synchronization latency refers to the latency generated during multimodal secure data acquisition and time synchronization via the Network Time Protocol (NAT). Preprocessing and encoding latency refers to the latency generated during feature encoding after multimodal data has undergone formatting, outlier removal, missing data filling, and normalization. Upload latency from the edge layer to the main control layer is the network transmission latency caused by network bandwidth limitations during data and feature transmission from edge nodes to the main control layer. Model inference latency related to deployment location is the computation latency of the execution entity performing inference operations. Threshold calibration and linkage latency refers to the latency generated during anomaly detection threshold calibration and triggering linkage handling processes. Based on these components, an optimization function is constructed with the objective of minimizing the total end-to-end latency. The expression of the optimization function is:

[0035] In the formula, It is a decision variable. This indicates that the executing entity is at the control level. This indicates that the executing entity is at the edge layer. It is the acquisition and synchronization latency. It is the preprocessing and encoding delay. It refers to the upload latency from the edge to the main control layer. It is the inference latency related to the deployment location. It involves threshold calibration and linkage delay. This represents the total delay.

[0036] When solving the above optimization function, constraint quantification analysis is performed by considering the real-time computing load of power system nodes, network bandwidth conditions, and task type characteristics. For disturbance analysis tasks with strong locality, the advantages of edge layer deployment—no data upload required and lower latency—are emphasized. For global system situation assessment tasks, the stronger computing power of the main control layer is relied upon to ensure computational accuracy. By quantifying the impact of each constraint on each latency component, the decision variable values ​​that minimize the total latency are obtained. If the solution result is... If the execution entity is deployed at the main control layer, it will rely on the computing power advantage of the main control layer to complete the global inference calculation; if the solution result is Then, the execution entity is determined to be deployed in the edge layer. Relying on the low latency characteristics of the edge layer, local inference operations are completed, and the optimal deployment position of the execution entity between the edge layer and the main control layer is finally determined.

[0037] For example, to ensure timely processing, strict constraints are placed on the latency of the entire process, and each step is tested and optimized to ensure that the following typical configurations are met: data acquisition and synchronization latency. Preprocessing and encoding delay Model inference latency Threshold calibration and linkage delay Total end-to-end delay During operation, the system continuously monitors the latency of each stage. If the latency exceeds the budget, a performance alert will be triggered, prompting the system to optimize or expand resources.

[0038] In some optional implementations, the executing entity performs inference operations based on the spatiotemporal representation to obtain node-level anomaly probabilities and system-level situational scores, specifically including: The execution entity inputs a unified spatiotemporal representation into a preset multilayer perceptron. Inference operations are then performed through a two-layer neural network mapping within the multilayer perceptron. The first layer of the two neural networks has a learnable weight matrix, a bias term, and an element-wise linear rectified function. The first layer performs feature transformation on the unified spatiotemporal representation. The second neural network has a sigmoid activation function and the same learnable weight matrix and bias term as the first layer. The second neural network maps the feature transformation result to the [0,1] interval, which serves as the node-level anomaly probability for each node. The calculation formula is as follows:

[0039] in and These are the learnable weight matrices for the first and second layers, respectively. and For the corresponding bias term, It is an element-wise linear rectified function. Mapping scalars to intervals , Given the width of the hidden layer, the obtained Represents a node The probability of being in an abnormal state.

[0040] Subsequently, node importance weights are set. These weights are determined based on graph structure and operational indicators such as the degree centrality, betweenness centrality, or load capacity of power system nodes, and all node importance weights satisfy normalization conditions. Using these node importance weights as weighting coefficients, a weighted summation of the node-level anomaly probabilities of all nodes is performed. The calculation formula is as follows:

[0041] in For nodes The importance weights can be set based on graphs and business indicators such as degree centrality, betweenness centrality, or load capacity; the denominator Used for normalization to ensure In the above definition, all parameters Gradient descent methods are used during training. study, The higher the score, the greater the overall security risk of the system.

[0042] S4. Determine the anomaly probability and situation score based on the discrimination threshold, output the perception result, and trigger the linkage and handling process based on the perception result.

[0043] Its discrimination thresholds include node-level anomaly probability thresholds and system-level segmentation discrimination thresholds. The process of determining the discrimination thresholds includes: Statistical analysis of historical node-level anomaly probability sequences is performed within a preset time window to form a distribution estimate; Based on the distribution, a node-level anomaly probability threshold is estimated and a minimum and maximum limit is set; System-level segmentation thresholds are generated based on the historical distribution of system-level situational assessment scores. Specifically, in calculating the node-level anomaly probability threshold, a dynamic threshold generation mechanism based on historical normal operation data is adopted to achieve adaptive discrimination: firstly, the node-level anomaly probability threshold is... For each node In recent Within an hour, select the normal operating time period during which no coordinated response was triggered, and extract the historical anomaly probability sequence for that node. ; calculate its first percentile And add a fixed bias term Then the limiting operator is executed. Truncate the result to the interval To avoid exceeding the limit, a node-level anomaly probability threshold is obtained. :

[0044] in Indicates the first Percentile statistics Interval endpoints and These represent the lower and upper limits of the threshold.

[0045] Subsequently, the system-level segmentation thresholds were determined based on the historical system status score sequence. Calculate the first Percentile and th Percentiles are set as attention thresholds. With alarm threshold Its expression is as follows:

[0046]

[0047] in and They represent the first With the Percentile statistic, satisfying The aforementioned thresholds are incrementally updated at a fixed pace during operation. During updates, new samples are added to the database in parallel. and The quantiles are recalculated using a sliding window and then applied again before writing back the configuration. Maintain a stable numerical range.

[0048] In some alternative implementations, when a node Satisfies the condition in two consecutive decision windows. When this occurs, it is marked as "node-level persistent anomaly". When the system has a "node-level persistent anomaly" flag, and the system-level situational score is... When this happens, the coordinated response process will be automatically triggered.

[0049] The coordinated response process includes: automatically invoking the optimal power flow calculation module to adjust generator output and load shedding strategies in relevant areas to alleviate pressure on faulty nodes and their associated lines; if the anomaly is related to a network attack, flow table rules are issued to logically isolate the communication ports of affected intelligent electronic devices or controllers; and instructions are automatically sent to the execution mechanism to switch the primary equipment to the backup equipment. The abnormal node and affected area are graphically highlighted on the large screen in the dispatch center and on the mobile terminals of maintenance personnel, along with handling suggestions and operation confirmation prompts.

[0050] As a preferred embodiment of this application, in order to accurately adapt to the dynamic changes in the power grid operation mode and ensure that the topology benchmark on which the subsequent inference calculation is based is consistent with the actual state of the power grid at the time of data generation, the method further includes: implementing version management and consistency verification for power grid topology changes based on the topology versioning and consistency mechanism, which specifically includes: When the power grid topology changes due to switching operations, line switching, or operation mode adjustments, the system captures the complete node connection relationships and edge information of the current power grid in real time. This comprehensively covers the physical connection status and associated attributes of primary equipment such as buses, transformers, and circuit breakers, generating a topology snapshot containing all topology data. This ensures that the snapshot can completely replicate the topology structure of the changed power grid. Subsequently, the generated topology snapshot is serialized, converting the complex topology data into a standardized byte stream format, providing a foundation for subsequent hash calculations and storage management.

[0051] Then, a hash encryption algorithm is used to encrypt the serialized topology snapshot, generating a unique and immutable hash signature. This hash signature serves as a unique identifier for the corresponding topology version, accurately distinguishing the topology state at different time points and avoiding topology version confusion. The hash signatures of all historical topology versions are organized into a Merkle tree (binary tree) structure according to the time sequence of topology evolution, forming a topology version library. This Merkle tree structure can not only efficiently record the complete evolution path of the topology from the initial state to each changed state, but also quickly verify the structural integrity of any historical topology version through the root hash of the tree, ensuring that the topology data has not been tampered with or damaged during storage and transmission.

[0052] Based on the precise timestamp carried by the input multimodal security data, a topology snapshot version that strictly matches the timestamp is retrieved from the aforementioned topology version library. The consistency verification of the topology snapshot version is completed by comparing the hash signature corresponding to the retrieved topology snapshot version with the hash record of the corresponding node in the Merkle tree, ensuring that the retrieved topology snapshot is completely consistent with the actual power grid topology at the time the data was generated. If the consistency verification result is qualified, the topology snapshot version is parsed into standardized graph structure data recognizable by the multilayer perceptron, including node sets, edge sets, and node-edge association matrix. This data serves as a spatial topology benchmark input to the multilayer perceptron, providing accurate topology association support for subsequent inference operations based on spatiotemporal representations. This fundamentally eliminates the distortion of inference results caused by topology mismatch, ensuring the accuracy of node-level anomaly probability and system-level situational assessment calculations.

[0053] As a preferred embodiment of this application, in order to improve the transparency, credibility and operational resilience of the power system security situation awareness and response system, this application also establishes an interpretability and security redundancy mechanism. Interpretability refers to the fact that, for the expression of the final result, this application uses an integral gradient algorithm to trace and analyze the model decision-making process. With the node-level anomaly probability as the output target, it calculates the contribution of each input feature (including topological features, time-series operation features, security log semantic features, etc. in multimodal data) to the final anomaly probability result. A positive contribution indicates that the feature promotes the increase of the anomaly probability, while a negative contribution indicates that the anomaly probability is suppressed.

[0054] After sorting the contribution of each input feature by absolute value, a preset number of core features with the highest contribution are selected and presented intuitively in the form of visual charts such as feature contribution rate bar charts, topology node-feature correlation heatmaps, and time-series feature contribution trend charts. At the same time, a structured decision explanation report is generated based on feature contribution correlation analysis using a causal graph model to identify the core causes of increased anomaly probability or increased system status risk, helping operation and maintenance personnel to quickly understand the model's decision logic, thereby improving the transparency of system operation and the credibility of decisions.

[0055] The safety redundancy mechanism refers to a redundant deployment scheme of two sets of data acquisition units and edge computing units, one for primary and one for backup, for key nodes such as power system hub substations, key nodes for distributed energy access, and core transmission channel monitoring points. The primary and backup units are simultaneously connected to the power system monitoring network and collect data in real time and in parallel. At the same time, data consistency verification is carried out to ensure that the data acquisition accuracy and timeliness of the two sets of units are consistent. The primary unit, as the default operating unit, undertakes data processing and inference calculation tasks. The system monitors the operating status of the primary unit in real time, such as the equipment heartbeat signal, data transmission integrity, and the validity of calculation results. When the main unit detects a heartbeat timeout within a preset timeout threshold, a data acquisition anomaly where the data missing rate exceeds the threshold or the data value exceeds the reasonable range, an inference result anomaly, or a computational failure where the computational latency exceeds the limit, the system immediately triggers an automatic switching mechanism. Without interrupting business operations, the system switches to the backup unit, which takes over the data acquisition, processing, and inference computation tasks. This ensures the continuous and stable monitoring and computation functions of key nodes and avoids system perception interruption due to single-point equipment failure.

[0056] Furthermore, a lightweight backup monitoring model with voltage, current, frequency, and power factor as core input indicators is pre-constructed. This backup model differs from the aforementioned backup unit, whose architecture is completely identical to the main unit. However, this backup model is a lightweight backup monitoring model, which does not require complex multimodal feature fusion backup model and spatiotemporal modeling process. It only monitors the core indicators in real time through preset safety threshold ranges. When the complex model fails due to extreme situations such as hardware failure, software anomalies, or insufficient computing power caused by sudden massive data, the system automatically initiates a degradation operation strategy, suspends the operation of the complex model, and switches to the backup monitoring model. By comparing the core indicators with the preset safety thresholds in real time, it quickly determines whether the power system is in a safe operating state. When the core indicators exceed the threshold range, basic alarms and simplified handling prompts are immediately triggered to ensure that the system can still maintain the most basic safety status monitoring capability in extreme scenarios where the complex model fails, without breaching the bottom line of safe operation of the power system. After the complex model failure is resolved or the computing power is restored, the system can switch back to the original complex model operation mode manually or automatically.

[0057] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for power system security situation awareness based on multimodal approaches, characterized in that, The aforementioned sensing methods include: Acquire multimodal security data from the power system and preprocess the multimodal security data; The preprocessed multimodal security data is fused into a unified spatiotemporal representation through a multimodal heterogeneous topology data fusion mechanism; Based on the end-to-end latency constraints, the deployment positions of the execution entity at the edge layer and the main control layer are determined, and the execution entity performs inference operations based on the spatiotemporal representation to obtain the node-level anomaly probability and the system-level situational score. The system determines the probability of anomalies and the situation score based on the discrimination threshold, outputs the perception results, and triggers a coordinated response process based on the perception results.

2. The method for power system security situation awareness based on multimodal operation according to claim 1, characterized in that, The multimodal security data includes topology information, runtime sequence data, sensor measurement data, and network security logs. The preprocessing includes time synchronization and formatting.

3. The method for power system security situation awareness based on multimodal operation according to claim 2, characterized in that, The preprocessed multimodal security data is fused into a unified spatiotemporal representation through a multimodal heterogeneous topology data fusion mechanism, specifically including: For the preprocessed topology data, a graph embedding algorithm is used to extract features and construct a node-edge feature matrix to characterize the physical connection relationships between power system equipment. For the preprocessed runtime sequence data, a temporal convolutional network is used to extract dynamic operation features and form a temporal feature matrix to capture the temporal variation pattern of the power system. For the preprocessed security log data, a language model is used to generate semantic embeddings, and the semantic embeddings associated with the same node are aggregated to obtain a node-level semantic feature matrix in order to mine security association information in the logs. Using the node-edge feature matrix as the query, and the temporal feature matrix and node-level semantic feature matrix as the key and value, a multimodal fusion feature matrix is ​​obtained through a cross-modal attention mechanism; The multimodal fusion feature matrix is ​​aligned with the output of the graph neural network to ultimately generate a unified spatiotemporal representation.

4. The method for power system security situation awareness based on multimodal operation according to claim 3, characterized in that, Aligning the multimodal fusion feature matrix with the output of the graph neural network to ultimately generate a unified spatiotemporal representation, specifically including: The multimodal fusion feature matrix is ​​used as the initial node input of the graph attention network. The graph attention network performs spatial domain message passing and aggregation operations on the power system topology graph and outputs a single-step spatial feature representation. Within a preset discrete time window, spatial feature representations of multiple consecutive time steps are collected, stacked in chronological order to form a temporal feature sequence, and time-dimensional positional encoding is added to the sequence. The temporal feature sequence containing position encoding is input into the transformer encoder, and the output node-level integrated spatiotemporal representation at the current moment is the unified spatiotemporal representation.

5. The method for power system security situation awareness based on multimodal operation according to claim 4, characterized in that, Based on end-to-end latency constraints, the deployment locations of the execution entity at the edge layer and the main control layer are determined, specifically including: The components of end-to-end latency are clearly defined, including acquisition and synchronization latency, preprocessing and encoding latency, upload latency from the edge layer to the main control layer, model inference latency related to deployment location, and threshold calibration and linkage latency. Based on the aforementioned constituent components, an optimization function is determined to minimize the total end-to-end delay. The expression of the optimization function is as follows: In the formula, It is a decision variable. This indicates that the executing entity is at the control level. This indicates that the executing entity is at the edge layer. It is the acquisition and synchronization latency. It is the preprocessing and encoding delay. It refers to the upload latency from the edge to the main control layer. It is the inference latency related to the deployment location. It involves threshold calibration and linkage delay. Total delay; Solve the optimization function, and based on the solution, determine whether the execution entity is deployed at the edge layer or at the main control layer.

6. The method for power system security situation awareness based on multimodal operation according to claim 5, characterized in that, The executing entity performs inference operations based on the spatiotemporal representation to obtain node-level anomaly probabilities and system-level situational scores, specifically including: The execution entity inputs a unified spatiotemporal representation into a preset multilayer perceptron, performs inference operations through a two-layer neural network mapping in the multilayer perceptron, and outputs the node-level anomaly probability corresponding to each node. Node importance weights are set, and the node-level anomaly probabilities of all nodes are weighted and summed using the node importance weights as weighting coefficients to obtain the system-level situational score.

7. A method for power system security situation awareness based on multimodal operation according to claim 6, characterized in that, The first layer of the two-layer neural network has a learnable weight matrix, a bias term, and an element-wise linear rectified function. The first layer of the neural network performs feature transformation on the unified spatiotemporal representation. The second neural network has a sigmoid activation function and the same learnable weight matrix and bias term as the first layer of the neural network. The feature transformation result is mapped to the [0,1] interval through the second neural network, which serves as the node-level anomaly probability for each node.

8. The method for power system security situation awareness based on multimodal operation according to claim 7, characterized in that, Before the executing entity performs inference operations based on the spatiotemporal representation, the method further includes: implementing version management and consistency verification for power grid topology changes based on a topology versioning and consistency mechanism, specifically including: When the power grid topology changes due to switching operations, line switching, or operation mode adjustments, the system captures the complete node connection relationships and edge information of the current power grid in real time, generates a topology snapshot containing all topology data, and performs serialization processing on the snapshot. A hash encryption algorithm is used to calculate the serialized topology snapshot and generate a hash signature, which is then used as the unique identifier for the corresponding topology version. Generate a binary tree-structured topology version library by ordering the hash signatures of all historical topology versions; Based on the precise timestamp of the input multimodal security data, the topology snapshot version that strictly matches the timestamp is retrieved from the topology version library. The topology snapshot version is then verified against the actual power grid topology at the time the data was generated. If the verification is consistent, the topology snapshot version is input into the multilayer sensor as a spatial topology benchmark.

9. The method for power system security situation awareness based on multimodal operation according to claim 1, characterized in that, The discrimination thresholds include node-level anomaly probability thresholds and system-level segmentation discrimination thresholds. The process of determining the discrimination thresholds includes: Statistical analysis of historical node-level anomaly probability sequences is performed within a preset time window to form a distribution estimate; Based on the distribution, a node-level anomaly probability threshold is estimated and a minimum and maximum limit is set; System-level segmentation thresholds are generated based on the historical distribution of system-level situational scores.

10. A method for power system security situation awareness based on multimodal operation according to claim 9, characterized in that, During the execution of the coordinated response process, the upstream load of the corresponding power supply path is redistributed and the associated communication channel is isolated. The affected equipment is switched and a manual intervention prompt is generated for the operation and maintenance terminal. The cross-regional power command and the zone operation mode are adjusted and the response trajectory is recorded.

Images