Method and system for detecting and handling goose message exception

Abstract

The embodiment of the application provides a GOOSE message exception detection and fault handling method and system, which comprises the following steps: a subscription end continuously receives GOOSE messages sent by a publishing end in real time, and performs message analysis processing on the GOOSE messages received in a current frame to obtain a sequence number SqNum and a state number StNum of the GOOSE messages in the current frame; the subscription end uses a plurality of preset check rules and the sequence number SqNum and the state number StNum of the GOOSE messages in the current frame to perform exception detection on the GOOSE messages in the current frame to obtain a detection result of the GOOSE messages in the current frame; and the subscription end performs corresponding fault handling according to the detection result of the GOOSE messages in the current frame.

Description

Technical Field

[0001] This application relates to the field of power system management technology, and in particular to a method and system for detecting and handling GOOSE (Generic ObjectOriented Substation Event) message anomalies. Background Technology

[0002] In smart substations, GOOSE communication technology is a core component of the IEC 61850 standard. The health status detection of GOOSE messages by the subscriber is typically quite simple: when the value of a data object in the device changes, StNum is incremented by 1 to identify a new event or state change. Between two StNum changes (i.e., during the steady-state period), the device repeatedly sends GOOSE messages at a fixed period, incrementing SqNum by 1 with each frame sent to indicate message continuity and detect packet loss. However, existing GOOSE message detection mechanisms rely solely on changes in StNum (status number) to determine events, ignoring the "missed detections" and "false detections" caused by the continuity of SqNum (sequence number) during the steady-state period.

[0003] • Missed Reports: During steady-state conditions, if the network intermittently loses packets (e.g., a frame is lost, but the next frame arrives successfully), the subscriber may not be aware of the packet loss because StNum remains unchanged. Long-term accumulation of hidden packet loss can reduce the accuracy of communication reliability assessments and may affect some advanced applications that rely on packet continuity (such as accurate time synchronization and traffic analysis).

[0004] • False alarm: When the device restarts abnormally, StNum may roll over from its maximum value to zero or be reset. If the receiving device only sees StNum increase (from a large number to a small number), it may mistakenly interpret this as a new state transition, potentially triggering incorrect protection or logic actions, leading to serious consequences.

[0005] Therefore, how to deeply mine the information contained in SqNum and StNum and design a more accurate and intelligent anomaly detection and fault tolerance mechanism has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] In view of this, embodiments of this application provide a method for GOOSE message anomaly detection and fault tolerance processing. One or more embodiments of this application also relate to a system for GOOSE message anomaly detection and fault tolerance processing, a computing device, a computer-readable storage medium, and a computer program, to address the technical deficiencies existing in the prior art.

[0007] According to a first aspect of the embodiments of this application, a method for GOOSE message anomaly detection and fault tolerance processing is provided, including: The subscriber continuously receives GOOSE messages sent by the publisher in real time, and obtains the sequence number SqNum and status number StNum of the GOOSE message received in the current frame by parsing the GOOSE message received in the current frame. The subscriber uses a variety of preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message and obtain the detection result of the current frame GOOSE message. The subscriber performs corresponding fault-tolerance processing based on the detection result of the current frame GOOSE message.

[0008] Preferably, the multiple verification rules include steady-state continuity verification rules, event jump verification rules, and coupling reset verification rules.

[0009] Preferably, the subscriber uses preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection result of the current frame GOOSE message including: The subscriber obtains the sequence number SqNum and status number StNum of the previous GOOSE message. The subscriber uses a preset steady-state continuity check rule to compare the status number StNum of the previous frame GOOSE message with the status number StNum of the current frame GOOSE message. If the comparison result between the status number StNum of the previous frame GOOSE message and the status number StNum of the current frame GOOSE message is equal, the subscriber further determines whether the sequence number SqNum of the current frame GOOSE message is strictly equal to the sequence number SqNum+1 of the previous frame GOOSE message. If the subscriber further determines that the sequence number SqNum of the current frame GOOSE message is not equal to the sequence number SqNum+1 of the previous frame GOOSE message, then the detection result of the current frame GOOSE message is the first abnormal state.

[0010] Preferably, the subscriber uses preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection result of the current frame GOOSE message including: If the comparison result between the status number StNum of the previous frame GOOSE message and the status number StNum of the current frame GOOSE message is not equal, or if it is further determined that the sequence number SqNum of the current frame GOOSE message is equal to the sequence number SqNum+1 of the previous frame GOOSE message, then the subscriber uses the preset event transition verification rules to further determine whether the status number StNum of the current frame GOOSE message is strictly equal to the status number StNum+1 of the previous frame GOOSE message. If the subscriber further determines that the status number StNum of the current frame GOOSE message is not equal to the status number StNum+1 of the previous frame GOOSE message, then the detection result of the current frame GOOSE message is the second abnormal state.

[0011] Preferably, the subscriber uses preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection result of the current frame GOOSE message including: If it is further determined that the status number StNum of the current frame GOOSE message is equal to the status number StNum+1 of the previous frame GOOSE message, then the subscriber uses the preset coupling reset verification rule to further determine whether the sequence number SqNum of the current frame GOOSE message is reset to 0. If the subscriber determines that the sequence number SqNum of the current frame GOOSE message is reset to 0, then the detection result of the current frame GOOSE message is normal. If the subscriber determines that the sequence number SqNum of the current frame GOOSE message is not reset to 0, then the detection result of the current frame GOOSE message is the third abnormal state.

[0012] Preferably, the fault-tolerance processing performed by the subscriber based on the detection result of the current frame GOOSE message includes: When the detection result of the current frame GOOSE message is the first abnormal state of packet loss or out-of-order delivery, the subscriber starts the packet loss compensation logic, performs interpolation or maintenance based on historical data, and issues a low-level alarm. When the detection result of the current frame GOOSE message is the second abnormal state of system restart or serious communication abnormality, the subscriber starts the state freeze and confirmation logic, discards the suspicious message, requests the publisher to resend all data, and issues an advanced alarm. When the detection result of the current frame GOOSE message is a message structure abnormality or a forged third abnormal state, the subscriber starts the abnormal handling strategy and issues a corresponding alarm.

[0013] According to a second aspect of the embodiments of this application, a system for GOOSE message anomaly detection and fault tolerance processing is provided, including a subscriber and a publisher, wherein the subscriber includes: The acquisition module is configured to continuously receive GOOSE messages sent by the publishing end in real time, and obtain the sequence number SqNum and status number StNum of the GOOSE message in the current frame by parsing the GOOSE message received in the current frame. The anomaly detection module is configured to use a variety of preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message and obtain the detection result of the current frame GOOSE message. The fault tolerance module is configured to perform corresponding fault tolerance processing based on the detection result of the current frame GOOSE message.

[0014] Preferably, the multiple verification rules include steady-state continuity verification rules, event jump verification rules, and coupling reset verification rules.

[0015] According to a third aspect of the embodiments of this application, a computing device is provided, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement any of the steps of the method for GOOSE message anomaly detection and fault tolerance processing.

[0016] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of any one of the methods for GOOSE message anomaly detection and fault-tolerant processing.

[0017] According to a fifth aspect of the embodiments of this application, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described method for detecting and handling GOOSE message anomalies.

[0018] The GOOSE message anomaly detection and fault tolerance processing scheme provided in this application has the following beneficial effects: 1) High detection sensitivity: By monitoring the continuity of SqNum, it can detect hidden packet loss that is ignored by traditional methods under steady state, achieving subtle perception of communication link quality. 2) Strong fault differentiation capability: It can clearly distinguish different types of faults such as "network packet loss" (only SqNum anomaly), "device restart" (StNum abnormal jump), and "message anomaly" (coupling relationship error), providing accurate guidance for operation and maintenance. 3) Enhanced security: It can effectively identify abnormal StNum jumps caused by device restart, preventing erroneous actions caused by this, and can identify potential forged message attacks, improving system security resilience. 4) Intelligent fault tolerance strategy: Different fault tolerance strategies are matched for different fault types, from simple alarms to proactive data requests and status confirmations, enabling the system to maintain correct operation or security lockout to the maximum extent in abnormal situations. Attached Figure Description

[0019] Figure 1 This is a flowchart of a method for GOOSE message anomaly detection and fault tolerance processing provided in one embodiment of this application; Figure 2 This is an overall flowchart of a method for GOOSE message anomaly detection and fault tolerance processing provided in one embodiment of this application; Figure 3 This is a schematic diagram of a system for GOOSE message anomaly detection and fault tolerance processing provided in one embodiment of this application; Figure 4 This is a structural block diagram of a computing device provided in one embodiment of this application. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the purpose of illustrative purposes and have no inherent meaning. Therefore, "module," "part," or "unit" may be used interchangeably.

[0021] This application addresses the issue of "false alarms" and "missed alarms" caused by existing GOOSE message detection mechanisms that rely solely on changes in StNum (status number) to determine events, while ignoring the continuity of SqNum (sequence number) during steady-state conditions. It proposes a two-dimensional method for GOOSE message anomaly detection and fault tolerance, jointly analyzing both SqNum and StNum. This method monitors the incremental continuity of SqNum in steady-state conditions and the compliance of StNum transitions during event triggering in real time, and establishes a coupling verification rule between the two. This enables accurate identification of various hidden faults such as message loss, network duplication, and abnormal device resets, significantly improving the reliability of the GOOSE communication link.

[0022] This application provides a method for GOOSE message anomaly detection and fault tolerance processing. This application also relates to a system for GOOSE message anomaly detection and fault tolerance processing, a computing device, a computer-readable storage medium, and a computer program, which will be described in detail in the following embodiments.

[0023] Figure 1 A flowchart of a method for GOOSE message anomaly detection and fault tolerance processing according to an embodiment of this application is shown, which specifically includes the following steps.

[0024] Step S101: The subscriber continuously receives GOOSE messages sent by the publisher in real time, and obtains the sequence number SqNum and status number StNum of the GOOSE message in the current frame by parsing the GOOSE message received in the current frame. Step S102: The subscriber uses a variety of preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message and obtain the detection result of the current frame GOOSE message. In one specific embodiment of this application, the multiple verification rules include steady-state continuity verification rules, event jump verification rules, and coupling reset verification rules.

[0025] In one specific embodiment of this application, the subscriber uses multiple preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection result of the current frame GOOSE message, including: The subscriber obtains the sequence number SqNum and status number StNum of the previous GOOSE message. The subscriber uses a preset steady-state continuity check rule to compare the status number StNum of the previous frame GOOSE message with the status number StNum of the current frame GOOSE message. If the comparison result between the status number StNum of the previous frame GOOSE message and the status number StNum of the current frame GOOSE message is equal, the subscriber further determines whether the sequence number SqNum of the current frame GOOSE message is strictly equal to the sequence number SqNum+1 of the previous frame GOOSE message. If the subscriber further determines that the sequence number SqNum of the current frame GOOSE message is not equal to the sequence number SqNum+1 of the previous frame GOOSE message, then the detection result of the current frame GOOSE message is the first abnormal state.

[0026] In one specific embodiment of this application, the subscriber uses multiple preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection result of the current frame GOOSE message, including: If the comparison result between the status number StNum of the previous frame GOOSE message and the status number StNum of the current frame GOOSE message is not equal, or if it is further determined that the sequence number SqNum of the current frame GOOSE message is equal to the sequence number SqNum+1 of the previous frame GOOSE message, then the subscriber uses the preset event transition verification rules to further determine whether the status number StNum of the current frame GOOSE message is strictly equal to the status number StNum+1 of the previous frame GOOSE message. If the subscriber further determines that the status number StNum of the current frame GOOSE message is not equal to the status number StNum+1 of the previous frame GOOSE message, then the detection result of the current frame GOOSE message is the second abnormal state.

[0027] In one specific embodiment of this application, the subscriber uses multiple preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection result of the current frame GOOSE message, including: If it is further determined that the status number StNum of the current frame GOOSE message is equal to the status number StNum+1 of the previous frame GOOSE message, then the subscriber uses the preset coupling reset verification rule to further determine whether the sequence number SqNum of the current frame GOOSE message is reset to 0. If the subscriber determines that the sequence number SqNum of the current frame GOOSE message is reset to 0, then the detection result of the current frame GOOSE message is normal. If the subscriber determines that the sequence number SqNum of the current frame GOOSE message is not reset to 0, then the detection result of the current frame GOOSE message is the third abnormal state.

[0028] Step S103: The subscriber performs corresponding fault tolerance processing based on the detection result of the current frame GOOSE message.

[0029] In one specific embodiment of this application, the fault-tolerance processing performed by the subscriber based on the detection result of the current frame GOOSE message includes: When the detection result of the current frame GOOSE message is the first abnormal state of packet loss or out-of-order delivery, the subscriber starts the packet loss compensation logic, performs interpolation or maintenance based on historical data, and issues a low-level alarm. When the detection result of the current frame GOOSE message is the second abnormal state of system restart or serious communication abnormality, the subscriber starts the state freeze and confirmation logic, discards the suspicious message, requests the publisher to resend all data, and issues an advanced alarm. When the detection result of the current frame GOOSE message is a message structure abnormality or a forged third abnormal state, the subscriber starts the abnormal handling strategy and issues a corresponding alarm.

[0030] This application, by real-time monitoring of the incremental continuity of SqNum in steady state and the transition compliance of StNum when an event is triggered, and by establishing a coupling verification rule between the two, can accurately identify various hidden faults such as message loss, network duplication, and abnormal device reset, and significantly improves the reliability of the GOOSE communication link.

[0031] Figure 2 The diagram illustrates a process flowchart of a method for detecting and handling GOOSE message anomalies according to an embodiment of this application, which specifically includes the following steps.

[0032] Step 1: Subscribe to and parse GOOSE messages in real time, and extract the sequence number SqNum and status number StNum of the message; Step 2: Condition assessment and handling measures; A. Steady-state continuity rule: The continuity of SqNum is checked. When the SqNum of consecutive packets is equal, the SqNum of subsequent packets is monitored to see if it is strictly equal to the SqNum of the previous packet + 1. If the SqNum is not continuous, it is determined that packet loss or out-of-order packet loss has occurred. The "packet loss compensation" logic is activated, which interpolates or maintains the data based on historical data and issues a low-level alarm. B. Event Jump Rules: Verify the compliance of StNum changes. When a change in StNum is detected, verify whether it satisfies StNum_new = StNum_old + 1. If StNum jumps non-incrementally, it is determined to be a device restart or a serious communication anomaly. For the case of an unexpected jump in StNum, the "Status Freeze and Confirmation" logic is activated, suspicious messages are discarded, the peer device is requested to resend all data, and an advanced alarm is issued. C. Coupling Reset Rule: Verify the logical coupling relationship between SqNum and StNum. When StNum undergoes a normal increment jump, the accompanying SqNum should be reset to 0 or start incrementing again from 0. Verify whether this reset action has occurred. If StNum jumps but SqNum is not reset as expected, it is determined that the message structure is abnormal or the message is forged.

[0033] Step 3: Establish a message status tracking model based on two dimensions: SqNum and StNum; I. Model Structure Two-dimensional state matrix: SqNum is the row index and StNum is the column index. Each cell stores the processing status of the corresponding message in the current "sequence position - state stage" (such as pending, verified, responded, timed out, retransmitted, etc.).

[0034] State transition controller: Based on the (SqNum, StNum) combination of the received message and the current session context, it triggers state transition logic and maintains a sliding window or watermark on each dimension.

[0035] Dual index caching and timeout management: Maintain the mapping from SqNum to message entities and from StNum to status nodes, and set up sequential checks based on sequence numbers and business phase checks based on status numbers respectively, and use timers to handle out-of-order issues, packet loss, and duplication.

[0036] II. Model Input The model's input is a single GOOSE message and its context information, specifically including: SqNum: sequence number, used to identify the message's sequential position (usually monotonically increasing, reflecting the sending order); StNum: status number, used to identify the message's service status or interaction stage (such as handshake, transmission, acknowledgment, termination, etc.). Optional auxiliary information may also be included: ① message payload; ② timestamp; ③ session ID; ④ retransmission flag; ⑤ checksum.

[0037] III. Intermediate Processing Flow The model processes the input data in four stages: 1. Legality verification; Check if SqNum is within the expected window range (to prevent interference from old messages). Check if StNum conforms to the legal transitions allowed by the current session state machine. If SqNum is too small or StNum does not match the current stage, discard the data or trigger exception handling.

[0038] 2. Two-dimensional index positioning; Using (SqNum, StNum) as the key, search for the state of the corresponding cell in the two-dimensional state matrix. If the cell does not exist (first arrival), initialize the state of that position to "pending processing" and record the arrival time.

[0039] 3. State transition and business processing; Update the sub-state machine under the current SqNum based on the StNum to which the message belongs. If all StNum states of a SqNum are completed, mark the SqNum as "completed" and slide the acknowledgment window based on the SqNum forward. If the same (SqNum, StNum) arrives repeatedly, perform deduplication or trigger a retransmission response according to the policy.

[0040] 4. Consistency maintenance and timeout control.

[0041] Maintain the expected StNum order for each SqNum. If the received StNum jumps too much, temporarily store the message and request the missing state.

[0042] Set two levels of timeout: Single (SqNum, StNum) timeout: If a cell is not completed within a long time, trigger a partial retransmission or state rollback. Global SqNum timeout: If a sequence number is not completed for a long time, trigger session exception handling.

[0043] IV. Model Output The model outputs the processing results of the GOOSE message and the maintained state view, specifically including: 1. Responses to the current message: 1) Acknowledgment (Ack): Indicates that (SqNum, StNum) has been correctly received and processed. 2) Status response: Returns the latest water level information of the current session in a two-dimensional coordinate system (such as the expected SqNum and StNum). 3) Reject / Retransmission request: Requests the sender to adjust or retransmit when the message is invalid or the status is missing.

[0044] 2. Updated internal state of the model (for use by upper-layer services or subsequent messages); 3. Changes to the two-dimensional state matrix; 4. Updating the sliding window; 5. Global status of the current session (e.g., last_completed_sqnum, current_stnum_phase); 6. External output (encapsulated as events or callbacks): When a certain (SqNum, StNum) status is completed, trigger the "message processed" event; when all statuses of a certain SqNum are completed, trigger the "message delivery completed" event; when an exception occurs (timeout, serious out-of-order, illegal status), output an alarm or an error code.

[0045] Take the example of the publisher sending a GOOSE message to the subscriber. The message parsing module of the subscriber continuously receives messages and extracts (SqNum, StNum). The two-dimensional status tracking module maintains the current status (Sq_old, St_old). Assume the current status is (5, 12), and the next frame of the message (Sq_new, St_new) is received.

[0046] Scenario A: The next frame of the message is (7, 12) Steady-state continuity rule check: St_new == St_old (12 == 12), but Sq_new != Sq_old + 1 (7 != 5 + 1). Judgment: Continuity exception, one frame of the message is lost (the message numbered 6 is lost).

[0047] Decision: Trigger the "packet loss compensation" strategy, record the packet loss event, issue a "slight network exception" alarm, and the application logic adopts the previous valid status.

[0048] Scenario B: The next frame of the message is (0, 2) Event jump rule check: St_new (2) < St_old (12) and not rolling over (12 is not close to the maximum value). Judgment: Status jump exception, the sending device may have restarted.

[0049] Decision: Trigger the "status freezing and confirmation" strategy, immediately freeze the protection output related to this GOOSE signal, and send a "device abnormal reset" high-level alarm to the superior system, requesting the intelligent terminal to resend the complete status.

[0050] Scenario C: The next frame of the message is (8, 13) Event jump rule check: St_new (13) == St_old (12) + 1, passed.

[0051] Coupling reset rule check: StNum has jumped, but Sq_new (8) != 0. Judgment: Coupling relationship exception.

[0052] Decision: Mark the message as suspicious, discard the frame, issue a "message format or source abnormal" security alarm, and wait for the next legitimate message frame.

[0053] Compared with the prior art, the present invention has the following significant advantages: • High detection sensitivity: By monitoring the continuity of SqNum, it can detect hidden packet loss that is ignored by traditional methods under steady state, and realize subtle perception of the quality of communication link.

[0054] • Strong fault differentiation capability: It can clearly distinguish different types of faults such as "network packet loss" (only SqNum is abnormal), "device restart" (StNum abnormal jump) and "packet abnormality" (coupling relationship error), providing accurate guidance for operation and maintenance.

[0055] • Enhanced security: It can effectively identify abnormal StNum jumps caused by device restarts, prevent erroneous actions caused by this, and identify potential forged message attacks, thereby improving system security resilience.

[0056] • Intelligent fault tolerance strategy: Different fault tolerance strategies are matched for different fault types, from simple alarms to proactive data requests and status confirmations, so that the system can maintain correct operation or safety lockout to the greatest extent possible in abnormal situations.

[0057] This application also provides a system embodiment for GOOSE message anomaly detection and fault tolerance processing. Figure 3 This illustration shows a schematic diagram of a system for GOOSE message anomaly detection and fault tolerance processing according to an embodiment of this application. The system includes: a subscriber and a publisher, wherein the subscriber includes: The acquisition module is configured to continuously receive GOOSE messages sent by the publishing end in real time, and obtain the sequence number SqNum and status number StNum of the GOOSE message in the current frame by parsing the GOOSE message received in the current frame. The anomaly detection module is configured to perform anomaly detection on the current frame GOOSE message using a variety of preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message, and obtain the detection result of the current frame GOOSE message; further, the variety of verification rules include steady-state continuity verification rules, event transition verification rules and coupling reset verification rules.

[0058] The fault tolerance module is configured to perform corresponding fault tolerance processing based on the detection result of the current frame GOOSE message.

[0059] The above is an illustrative scheme of a GOOSE message anomaly detection and fault tolerance system according to this embodiment. It should be noted that the technical solution of this GOOSE message anomaly detection and fault tolerance system belongs to the same concept as the technical solution of the aforementioned GOOSE message anomaly detection and fault tolerance method. Details not described in detail in the technical solution of the GOOSE message anomaly detection and fault tolerance system can be found in the description of the technical solution of the aforementioned GOOSE message anomaly detection and fault tolerance method.

[0060] Figure 4 A structural block diagram of a computing device 400 according to an embodiment of this application is shown. The components of the computing device 400 include, but are not limited to, a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and a database 450 is used to store data.

[0061] The computing device 400 also includes an access device 440, which enables the computing device 400 to communicate via one or more networks 460. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 440 may include one or more of any type of wired or wireless network interface (e.g., a Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0062] In one embodiment of this application, the aforementioned components of the computing device 400 and Figure 4 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 4 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this application. Those skilled in the art can add or replace other components as needed.

[0063] The computing device 400 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 400 can also be a mobile or stationary server.

[0064] The processor 420 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described method for detecting and handling GOOSE message anomalies.

[0065] An embodiment of this application also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described method for detecting and handling GOOSE message anomalies.

[0066] An embodiment of this application also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described method for detecting and handling GOOSE message anomalies.

[0067] The above are illustrative schemes of a computing device, a computer-readable storage medium, and a computer program according to this embodiment. It should be noted that each technical solution belongs to the same concept as the above-described method for GOOSE message anomaly detection and fault tolerance processing. Details not described in detail for each technical solution can be found in the description of the above-described method for GOOSE message anomaly detection and fault tolerance processing.

[0068] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the present invention.

Claims

1. A method for GOOSE message anomaly detection and fault tolerance processing, characterized in that, include: The subscriber continuously receives GOOSE messages sent by the publisher in real time, and obtains the sequence number SqNum and status number StNum of the GOOSE message received in the current frame by parsing the GOOSE message received in the current frame. The subscriber uses a variety of preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message and obtain the detection result of the current frame GOOSE message. The subscriber performs corresponding fault-tolerant processing based on the detection result of the current frame GOOSE message; Here, GOOSE refers to substation events oriented towards general objects.

2. The method according to claim 1, characterized in that, The various verification rules include steady-state continuity verification rules, event jump verification rules, and coupled reset verification rules.

3. The method according to claim 2, characterized in that, The subscriber uses multiple preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection results of the current frame GOOSE message, including: The subscriber obtains the sequence number SqNum and status number StNum of the previous GOOSE message. The subscriber uses a preset steady-state continuity check rule to compare the status number StNum of the previous frame GOOSE message with the status number StNum of the current frame GOOSE message. If the comparison result between the status number StNum of the previous frame GOOSE message and the status number StNum of the current frame GOOSE message is equal, the subscriber further determines whether the sequence number SqNum of the current frame GOOSE message is strictly equal to the sequence number SqNum+1 of the previous frame GOOSE message. If the subscriber further determines that the sequence number SqNum of the current frame GOOSE message is not equal to the sequence number SqNum+1 of the previous frame GOOSE message, then the detection result of the current frame GOOSE message is the first abnormal state.

4. The method according to claim 3, characterized in that, The subscriber uses multiple preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection results of the current frame GOOSE message, including: If the comparison result between the status number StNum of the previous frame GOOSE message and the status number StNum of the current frame GOOSE message is not equal, or if it is further determined that the sequence number SqNum of the current frame GOOSE message is equal to the sequence number SqNum+1 of the previous frame GOOSE message, then the subscriber uses the preset event transition verification rules to further determine whether the status number StNum of the current frame GOOSE message is strictly equal to the status number StNum+1 of the previous frame GOOSE message. If the subscriber further determines that the status number StNum of the current frame GOOSE message is not equal to the status number StNum+1 of the previous frame GOOSE message, then the detection result of the current frame GOOSE message is the second abnormal state.

5. The method according to claim 4, characterized in that, The subscriber uses multiple preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message, and obtains the detection results of the current frame GOOSE message, including: If it is further determined that the status number StNum of the current frame GOOSE message is equal to the status number StNum+1 of the previous frame GOOSE message, then the subscriber uses the preset coupling reset verification rule to further determine whether the sequence number SqNum of the current frame GOOSE message is reset to 0. If the subscriber determines that the sequence number SqNum of the current frame GOOSE message is reset to 0, then the detection result of the current frame GOOSE message is normal. If the subscriber determines that the sequence number SqNum of the current frame GOOSE message is not reset to 0, then the detection result of the current frame GOOSE message is the third abnormal state.

6. The method according to claim 5, characterized in that, The subscription end performs corresponding fault-tolerance processing based on the detection result of the current frame GOOSE message, including: When the detection result of the current frame GOOSE message is the first abnormal state of packet loss or out-of-order delivery, the subscriber starts the packet loss compensation logic, performs interpolation or maintenance based on historical data, and issues a low-level alarm. When the detection result of the current frame GOOSE message is the second abnormal state of system restart or serious communication abnormality, the subscriber starts the state freeze and confirmation logic, discards the suspicious message, requests the publisher to resend all data, and issues an advanced alarm. When the detection result of the current frame GOOSE message is a message structure abnormality or a forged third abnormal state, the subscriber starts the abnormal handling strategy and issues a corresponding alarm.

7. A system for GOOSE message anomaly detection and fault tolerance processing, characterized in that, It includes a subscription end and a publishing end, wherein the subscription end includes: The acquisition module is configured to continuously receive GOOSE messages sent by the publishing end in real time, and obtain the sequence number SqNum and status number StNum of the GOOSE message in the current frame by parsing the GOOSE message received in the current frame. The anomaly detection module is configured to use a variety of preset verification rules and the sequence number SqNum and status number StNum of the current frame GOOSE message to perform anomaly detection on the current frame GOOSE message and obtain the detection result of the current frame GOOSE message. The fault tolerance processing module is configured to perform corresponding fault tolerance processing based on the detection result of the current frame GOOSE message; Here, GOOSE refers to substation events oriented towards general objects.

8. The system according to claim 7, characterized in that, The various verification rules include steady-state continuity verification rules, event jump verification rules, and coupled reset verification rules.

9. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the method for GOOSE message anomaly detection and fault tolerance processing as described in any one of claims 1 to 6.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the method for GOOSE message anomaly detection and fault-tolerant processing as described in any one of claims 1 to 6.

Images