Rectifier substation cluster centralized control system and method based on heterogeneous network fusion
The centralized control system for rectifier substation clusters, which utilizes a dual-network redundancy architecture and multi-protocol integration, solves the problems of low communication reliability, difficult data integration, fragmented security protection, and insufficient time synchronization in traditional rectifier substation control systems. It achieves efficient data interaction and security monitoring, thereby improving operation and maintenance efficiency and automation levels.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BAOTOU ALUMINUM CO LTD
- Filing Date
- 2025-04-21
- Publication Date
- 2026-07-07
AI Technical Summary
Traditional rectifier substation control systems suffer from problems such as low communication reliability, difficulty in data integration, fragmented security protection, insufficient time synchronization accuracy, and wasted bandwidth resources, leading to system failures and low operation and maintenance efficiency.
By adopting a dual-network redundancy architecture, multi-protocol fusion, layered security strategy and spatiotemporal synchronization technology, the centralized control of multiple rectifier substations is achieved through a dual-network heterogeneous communication layer, protocol conversion layer, layered security system and spatiotemporal synchronization subsystem.
It improves the system's communication reliability and data interaction efficiency, enhances security protection capabilities, ensures time synchronization, supports accurate recording of fault waveform data and comprehensive monitoring by the centralized control center, and improves operation and maintenance efficiency and automation level.
Smart Images

Figure CN122348619A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of power system automation technology, and in particular to a centralized control system and method for rectifier substation clusters based on heterogeneous network integration. Background Technology
[0002] Traditional rectifier substation control systems suffer from the following drawbacks: a single-network architecture leads to low communication reliability, and network failures can easily cause system paralysis; multiple voltage level devices use different communication protocols, making data integration difficult; there is a lack of centralized control capabilities across substations, resulting in low operation and maintenance efficiency; the security protection system is fragmented, failing to form a three-dimensional defense with vertical encryption and horizontal isolation; mixed transmission of real-time and non-real-time data leads to wasted bandwidth resources; and insufficient time synchronization accuracy affects the correlation analysis of fault recording data. Summary of the Invention
[0003] The purpose of this application is to provide a centralized control system and method for rectifier substation clusters based on heterogeneous network integration, which can realize centralized control of multiple rectifier substations through multi-protocol integration, dual-network redundancy architecture and hierarchical security strategy.
[0004] To achieve the above objectives, this application provides the following solution:
[0005] In a first aspect, this application provides a centralized control system for a rectifier substation cluster, comprising:
[0006] A dual-network heterogeneous communication layer is deployed in each rectifier substation; the dual-network heterogeneous communication layer includes a redundant A / B communication network;
[0007] A protocol conversion layer is used for converting DNP, MODBUS, and OPC protocols to IEC104 / 61850; the protocol conversion layer includes at least three communication management units;
[0008] A layered security system, including vertical encryption devices, firewalls, and network security monitoring devices;
[0009] The time-space synchronization subsystem adopts a BeiDou / GPS dual-mode time synchronization device;
[0010] A fault recording device is used to record the electrical waveforms when a fault occurs.
[0011] The centralized control center receives real-time / non-real-time data from multiple rectifier substations via optical transceivers.
[0012] Optionally, the network transmission path of the A / B communication network in the dual-network heterogeneous communication layer of the rectifier substation specifically includes:
[0013] The network transmission path of communication network A is 220kV server - core switch - vertical encryption device - firewall;
[0014] The network transmission path of the B communication network is 10kV server - communication management machine - protocol conversion layer - redundant switch.
[0015] Optionally, the protocol conversion layer specifically includes:
[0016] FPGA-accelerated DNP-IEC104 converter, MODBUS-OPC UA converter with semantic mapping support, and programmable protocol adaptation engine.
[0017] Optionally, the layered security system specifically includes:
[0018] Firewalls are used for VLAN isolation and application layer filtering.
[0019] The network security monitoring module is used to monitor and analyze network traffic in real time and detect potential network threats and abnormal behaviors.
[0020] Optionally, the spatiotemporal synchronization subsystem is a precise clock synchronization scheme using the PTP protocol.
[0021] Optionally, the centralized control center specifically includes:
[0022] The digital twin modeling module is used to synchronize the status of equipment in each substation;
[0023] A multi-station collaborative control algorithm is used for cross-station power balancing.
[0024] Optionally, the fault recording subsystem specifically includes:
[0025] A 10kV fault recording device is used to transmit the operating data of the rectifier substation to a 10kV server and a data acquisition server via the 104 protocol; the operating data of the rectifier substation is the electrical waveform of the fault occurring.
[0026] The 220kV fault recording device is used to transmit the operating data of the rectifier substation to the 220kV server and data acquisition server via the 104 protocol.
[0027] The transformer fault recording device is used to transmit the operating data of the rectifier substation to the 220kV server and data acquisition server via the 104 protocol.
[0028] Secondly, this application provides a control method based on the aforementioned centralized control system for a rectifier substation cluster, comprising:
[0029] Real-time / non-real-time data transmission is achieved through a dual-network heterogeneous communication network;
[0030] Perform protocol conversion operations to uniformly convert DNP, MODBUS, and OPC protocols to the IEC104 / 61850 standard protocol, and use at least three communication management units to achieve redundancy.
[0031] Deploy layered security protection; layered security protection includes vertical encryption, firewall isolation, and real-time monitoring of network traffic threats.
[0032] Based on the BeiDou / GPS dual-mode time synchronization device, the entire network achieves time and space synchronization;
[0033] Trigger the fault recording device to record the electrical quantity waveform data at the time of the fault;
[0034] The main station monitors the management team to perform data collection, equipment status monitoring, and remote control command issuance.
[0035] The central control center receives data from multiple stations via optical transceivers and completes cross-station power balance control based on digital twin modeling and multi-station collaborative algorithms.
[0036] Optionally, the protocol conversion operation specifically includes:
[0037] The DNP-IEC104 converter using FPGA acceleration improves protocol parsing efficiency;
[0038] The MODBUS-OPC UA converter, which supports semantic mapping, enables the conversion of unstructured data into a standard information model.
[0039] The protocol conversion rules are dynamically configured using a programmable protocol adaptation engine.
[0040] Optionally, the layered security protection specifically includes:
[0041] Deploy vertical encryption devices and firewalls in the A communication network path to achieve secure isolation between the 220kV side server and the core switch;
[0042] In the B communication network path, application layer filtering of 10kV side data is performed through redundant switches and protocol conversion layers.
[0043] A network security monitoring module is used to analyze traffic behavior in real time and to block and alert on abnormal data packets.
[0044] According to the specific embodiments provided in this application, the following technical effects are disclosed:
[0045] This application provides a centralized control system and method for a rectifier substation cluster based on heterogeneous network integration. First, by deploying a dual-network heterogeneous communication layer in each rectifier substation, high data reliability and redundancy are achieved. Even if one network fails, the other network can continue transmitting data, ensuring the continuity and stability of system operation. Second, the protocol conversion layer can flexibly convert various protocols such as DNP, MODBUS, and OPC to the IEC104 / 61850 standard protocol, improving the efficiency and accuracy of data interaction and facilitating interconnection between different devices, reducing the difficulty and cost of system integration. Third, the layered security system, through multiple protections including vertical encryption devices, firewalls, and network security monitoring devices, effectively resists the risks of external network attacks and internal data leakage, providing a solid guarantee for the safe operation of the system. Furthermore, the spatiotemporal synchronization subsystem adopts a BeiDou / GPS dual-mode time synchronization device to ensure the time synchronization of all devices in the system. The fault waveform recording device can accurately record the electrical waveforms at the time of a fault, providing data support for fault analysis and processing, helping to quickly locate the cause of the fault and take corresponding repair measures. Finally, the centralized control center receives real-time / non-real-time data from multiple rectifier substations via optical transceivers, enabling comprehensive monitoring and management of the system's operating status and improving the system's automation level and operation and maintenance efficiency. Attached Figure Description
[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0047] Figure 1 This is a schematic diagram of the communication connection relationship within a single rectifier substation in one embodiment of this application;
[0048] Figure 2 This is a schematic diagram of the connection relationship of a centralized control system for a rectifier substation cluster based on heterogeneous network fusion, provided as an embodiment of this application. Detailed Implementation
[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0050] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0051] Example 1
[0052] This embodiment provides a centralized control system for a rectifier substation cluster, including:
[0053] A dual-network heterogeneous communication layer is deployed in each rectifier substation; the dual-network heterogeneous communication layer includes a redundant A / B communication network;
[0054] A protocol conversion layer is used for converting DNP, MODBUS, and OPC protocols to IEC104 / 61850; the protocol conversion layer includes at least three communication management units;
[0055] A layered security system, including vertical encryption devices, firewalls, and network security monitoring devices;
[0056] The time-space synchronization subsystem adopts a BeiDou / GPS dual-mode time synchronization device;
[0057] A fault recording device is used to record the electrical waveforms when a fault occurs.
[0058] The centralized control center receives real-time / non-real-time data from multiple rectifier substations via optical transceivers.
[0059] The control system provided in this embodiment is located on the power production control center side: there are five rectifier substations, each using the following... Figure 1 The same network structure configuration is shown to enable data to be forwarded to the data acquisition server and then further forwarded to the power production control center.
[0060] The power production control center is equipped with two optical transceivers to receive data from five rectifier substations. Among them, optical transceiver 1 is responsible for receiving real-time data, and the optical fibers for real-time data transmission from the five substations A, B, C, D, and E are respectively connected to interfaces 1, 2, 3, 4, and 5 of optical transceiver 1.
[0061] Optical transceiver 2 is used to receive non-real-time data. Non-real-time data transmission optical fibers from five substations A, B, C, D, and E are respectively connected to interfaces 1, 2, 3, 4, and 5 of optical transceiver 2.
[0062] The data collected by optical transceiver 1 is transmitted to data acquisition server 3 through router 3, real-time vertical encryption device, and real-time switch. (Optical transceiver 1 and router 3 are connected by optical fiber, and router 3, real-time vertical encryption device, real-time switch, and data acquisition server 3 are connected by network cable).
[0063] The data collected by optical transceiver 2 is transmitted to data acquisition server 4 via router 4, non-real-time vertical encryption device, and non-real-time switch. (Optical transceiver 2 and router 4 are connected by optical fiber, and router 4, non-real-time vertical encryption device, non-real-time switch, and data acquisition server 4 are connected by network cable).
[0064] Data acquisition server 3 transmits the acquired data to the 10kV server, 220kV server and current stabilization control workstation.
[0065] The 10kV server and the 220kV server access the data in data acquisition server 4 through a firewall.
[0066] In this embodiment, within the rectifier substation, the network is divided into two networks, A and B. These two networks are completely independent and have no connection to each other. They transmit the same data and serve as backups for each other. Both networks A and B transmit data in real-time to several monitoring machines and workstations in the control layer. If network A fails, network B continues to transmit data in real-time, without affecting the operation of the entire system. Conversely, if network B fails, network A continues to transmit data in real-time, without affecting the operation of the entire system.
[0067] Specifically, the network transmission path of the A / B communication network in the dual-network heterogeneous communication layer of the rectifier substation includes:
[0068] The network transmission path of communication network A is 220kV server - core switch - vertical encryption device - firewall;
[0069] The network transmission path of the B communication network is 10kV server - communication management machine - protocol conversion layer - redundant switch.
[0070] In this embodiment, the protocol conversion layer specifically includes:
[0071] FPGA-accelerated DNP-IEC104 converter, MODBUS-OPC UA converter with semantic mapping support, and programmable protocol adaptation engine.
[0072] The layered security system specifically includes:
[0073] Firewalls are used for VLAN isolation and application layer filtering.
[0074] The network security monitoring module is used to monitor and analyze network traffic in real time and detect potential network threats and abnormal behaviors.
[0075] The spatiotemporal synchronization subsystem is a precise clock synchronization scheme using the PTP protocol.
[0076] The centralized control center specifically includes:
[0077] The digital twin modeling module is used to synchronize the status of equipment in each substation;
[0078] A multi-station collaborative control algorithm is used for cross-station power balancing.
[0079] The fault recording subsystem specifically includes:
[0080] A 10kV fault recording device is used to transmit the operating data of the rectifier substation to a 10kV server and a data acquisition server via the 104 protocol; the operating data of the rectifier substation is the electrical waveform of the fault.
[0081] The 220kV fault recording device is used to transmit the operating data of the rectifier substation to the 220kV server and data acquisition server via the 104 protocol.
[0082] The transformer fault recording device is used to transmit the operating data of the rectifier substation to the 220kV server and data acquisition server via the 104 protocol.
[0083] Specifically, such as Figure 2 As shown, the 220kV line protection, 220kV line monitoring and control, public monitoring and control, and 220kV bus protection devices transmit data to the 220kV server and data acquisition server 1 via the 61850 protocol.
[0084] The 10kVA and 10kV B segments transmit data via a switch using the DNP protocol to the communication management unit 3 (connected by network cable). The communication management unit converts the collected data from the 10kVA and 10kV B segments into the IEC104 protocol (IEC 60870-5-104 protocol). The data then passes through a switch, vertical encryption, the system core switch, and a firewall before being transmitted to the 10kV server and data acquisition server 1.
[0085] The UPS system and DC system are connected to the communication management unit via the MODBUS protocol (485 communication line connection). The communication management unit converts the collected data from the UPS system and DC system into IEC104 protocol and transmits the data to the 220kV server and data acquisition server 1.
[0086] The power transformer monitoring and control system, rectifier unit monitoring and control system, and reactive power compensation system transmit data to the communication management unit 4 via the switch using the DNP communication protocol. The communication management unit converts the collected power transformer data into the IEC104 protocol and then transmits the data to the 220kV server and data acquisition server 1 via the switch, vertical encryption device 1, core switch 1, and firewall 1.
[0087] The temperature measurement system and rectifier cabinet monitoring system transmit data to PLC1. PLC1 is connected to the switch, vertical encryption 2, system core switch 2, and firewall 2. The data is transmitted to the 220kV server and data acquisition server 1 through the OPC communication protocol.
[0088] The current stabilization system transmits data to PLC2. PLC2 is connected to the switch, vertical encryption 2, system core switch 2, and firewall 2. The data is transmitted to the current stabilization control workstation and data acquisition server 1 through the OPC communication protocol.
[0089] The network security monitoring device uses the 61850 communication protocol to upload the collected information to the 220kV server and data acquisition server 1.
[0090] The power acquisition device 1 and power acquisition device 2 transmit the acquired power information to the communication management unit 2 using the IEC 60870-5-102 protocol. The communication management unit 2 then converts the data into the IEC 60870-5-102 protocol and uploads it to the 220kV server and the data acquisition server 2.
[0091] The 10kV fault recording device transmits data to the 10kV server and data acquisition server 2 via the 104 protocol. The 220kV fault recording device transmits data to the 220kV server and data acquisition server 2 via the 104 protocol. The transformer fault recording device transmits data to the 220kV server and data acquisition server 2 via the 104 protocol. Only the 10kV server, 220kV server, and data acquisition server 1 can access the lower-level data through firewall 1.
[0092] The system includes a 220kV server, a current stabilization control workstation, and data acquisition server 1, all of which can access lower-level data through firewall 2. The 220kV server and 10kV server can also access lower-level data through firewalls 3 and 4. A time synchronization device is used to synchronize the time of all devices within the system, ensuring complete time consistency across all devices.
[0093] The centralized control center receives real-time and non-real-time data from multiple rectifier substations via optical transceivers. The specific process is as follows: Figure 2 As shown. The real-time system is responsible for transmitting the data in the data acquisition server 1 through the real-time switch, the real-time vertical encryption device and the router 1 (the data acquisition server 1, the real-time switch, the real-time vertical encryption device and the router 1 are connected by a network cable, and the data is converted from electrical signal to optical signal at the router 1 and sent to the power production control center through optical fiber).
[0094] The non-real-time system is responsible for transmitting the data in the data acquisition server 2 through the non-real-time switch, the non-real-time vertical encryption device, and the router 2 (the data acquisition server 2, the non-real-time switch, the non-real-time vertical encryption device, and the router 2 are connected by a network cable, and the data is converted from electrical signals to optical signals at the router 2 and sent to the power production control center through optical fiber).
[0095] Real-time systems ensure the immediate transmission of data, continuously sending data to the power production control center. In contrast, non-real-time systems send data to the power production control center at 15-minute intervals, rather than continuously updating in real time (since this data is not critical, it does not require real-time transmission).
[0096] Example 2
[0097] This embodiment provides a control method based on the aforementioned centralized control system for a rectifier substation cluster, including:
[0098] Real-time / non-real-time data transmission is achieved through a dual-network heterogeneous communication network;
[0099] Perform protocol conversion operations to uniformly convert DNP, MODBUS, and OPC protocols to the IEC104 / 61850 standard protocol, and use at least three communication management units to achieve redundancy.
[0100] Deploy layered security protection; layered security protection includes vertical encryption, firewall isolation, and real-time monitoring of network traffic threats.
[0101] Based on the BeiDou / GPS dual-mode time synchronization device, the entire network achieves time and space synchronization;
[0102] Trigger the fault recording device to record the electrical quantity waveform data at the time of the fault;
[0103] The main station monitors the management team to perform data collection, equipment status monitoring, and remote control command issuance.
[0104] The central control center receives data from multiple stations via optical transceivers and completes cross-station power balance control based on digital twin modeling and multi-station collaborative algorithms.
[0105] Specifically, the protocol conversion operation includes:
[0106] The DNP-IEC104 converter using FPGA acceleration improves protocol parsing efficiency;
[0107] The MODBUS-OPC UA converter, which supports semantic mapping, enables the conversion of unstructured data into a standard information model.
[0108] The protocol conversion rules are dynamically configured using a programmable protocol adaptation engine.
[0109] Specifically, the layered security protection includes:
[0110] Deploy vertical encryption devices and firewalls in the A communication network path to achieve secure isolation between the 220kV side server and the core switch;
[0111] In the B communication network path, application layer filtering of 10kV side data is performed through redundant switches and protocol conversion layers.
[0112] A network security monitoring module is used to analyze traffic behavior in real time and to block and alert on abnormal data packets.
[0113] In summary, this application has the following technical effects:
[0114] 1) Unified dispatch: Centralized control can realize unified dispatch and coordination of multiple substations, optimize power distribution, and reduce resource waste.
[0115] 2) Rapid response: The centralized control system can monitor the operating status of multiple substations in real time, quickly identify and handle problems, and improve response speed.
[0116] 3) High degree of automation: Centralized control usually adopts advanced automation technology to reduce manual intervention and improve operating efficiency.
[0117] 4) Rapid fault location: The centralized control system can monitor the operating data of multiple substations in real time, quickly locate the fault point, and shorten the fault handling time.
[0118] 5) Data sharing: Data from multiple substations can be centrally analyzed and processed, which helps to identify potential problems in advance and avoid large-scale failures.
[0119] 6) Reduced manpower requirements: Centralized control can reduce the need for on-site maintenance personnel at individual substations, thereby reducing labor costs.
[0120] 7) Centralized data management: Data from multiple substations can be centrally stored and analyzed, providing a scientific basis for decision-making.
[0121] 8) Remote monitoring: Managers can remotely monitor the operating status of multiple substations through a centralized control system, thereby improving management efficiency.
[0122] 9) Collaborative processing: Multiple substations can work together to respond to emergencies and improve the overall emergency response capability.
[0123] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0124] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A centralized control system for a rectifier substation cluster, characterized in that, include: A dual-network heterogeneous communication layer deployed in each rectifier substation; The dual-network heterogeneous communication layer includes redundant A / B communication networks; A protocol conversion layer is used for converting DNP, MODBUS, and OPC protocols to IEC104 / 61850; the protocol conversion layer includes at least three communication management units; A layered security system, including vertical encryption devices, firewalls, and network security monitoring devices; The time-space synchronization subsystem adopts a BeiDou / GPS dual-mode time synchronization device; A fault recording device is used to record the electrical waveforms when a fault occurs. The centralized control center receives real-time / non-real-time data from multiple rectifier substations via optical transceivers.
2. The centralized control system for a rectifier substation cluster according to claim 1, characterized in that, The network transmission path of the A / B communication network in the dual-network heterogeneous communication layer of the rectifier substation specifically includes: The network transmission path of communication network A is 220kV server - core switch - vertical encryption device - firewall; The network transmission path of the B communication network is 10kV server - communication management machine - protocol conversion layer - redundant switch.
3. The centralized control system for a rectifier substation cluster according to claim 1, characterized in that, The protocol conversion layer specifically includes: FPGA-accelerated DNP-IEC104 converter, MODBUS-OPC UA converter with semantic mapping support, and programmable protocol adaptation engine.
4. The centralized control system for a rectifier substation cluster according to claim 1, characterized in that, The layered security system specifically includes: Firewalls are used for VLAN isolation and application layer filtering. The network security monitoring module is used to monitor and analyze network traffic in real time, and to detect potential network threats and abnormal behaviors.
5. A centralized control system for a rectifier substation cluster according to claim 1, characterized in that, The spatiotemporal synchronization subsystem is a precise clock synchronization scheme using the PTP protocol.
6. A centralized control system for a rectifier substation cluster according to claim 1, characterized in that, The centralized control center specifically includes: The digital twin modeling module is used to synchronize the status of equipment in each substation; A multi-station collaborative control algorithm is used for cross-station power balancing.
7. A centralized control system for a rectifier substation cluster according to claim 1, characterized in that, The fault recording subsystem specifically includes: A 10kV fault recording device is used to transmit the operating data of the rectifier substation to a 10kV server and a data acquisition server via the 104 protocol; the operating data of the rectifier substation is the electrical waveform of the fault occurring. The 220kV fault recording device is used to transmit the operating data of the rectifier substation to the 220kV server and data acquisition server via the 104 protocol. The transformer fault recording device is used to transmit the operating data of the rectifier substation to the 220kV server and data acquisition server via the 104 protocol.
8. A control method for a centralized control system of a rectifier substation cluster according to any one of claims 1-7, characterized in that, include: Real-time / non-real-time data transmission is achieved through a dual-network heterogeneous communication network; Perform protocol conversion operations to uniformly convert DNP, MODBUS, and OPC protocols to the IEC104 / 61850 standard protocol, and use at least three communication management units to achieve redundancy. Deploy layered security protection; layered security protection includes vertical encryption, firewall isolation, and real-time monitoring of network traffic threats. Based on the BeiDou / GPS dual-mode time synchronization device, the entire network achieves time and space synchronization; Trigger the fault recording device to record the electrical quantity waveform data at the time of the fault; The main station monitors the management team to perform data collection, equipment status monitoring, and remote control command issuance. The central control center receives data from multiple stations via optical transceivers and completes cross-station power balance control based on digital twin modeling and multi-station collaborative algorithms.
9. A centralized control method for a rectifier substation cluster according to claim 8, characterized in that, The protocol conversion operation specifically includes: The DNP-IEC104 converter using FPGA acceleration improves protocol parsing efficiency; The MODBUS-OPC UA converter, which supports semantic mapping, enables the conversion of unstructured data into a standard information model. The protocol conversion rules are dynamically configured using a programmable protocol adaptation engine.
10. A centralized control method for a rectifier substation cluster according to claim 8, characterized in that, The layered security protection specifically includes: Deploy vertical encryption devices and firewalls in the A communication network path to achieve secure isolation between the 220kV side server and the core switch; In the B communication network path, application layer filtering of 10kV side data is performed through redundant switches and protocol conversion layers. A network security monitoring module is used to analyze traffic behavior in real time and to block and alert on abnormal data packets.