Method and system for data traffic collection in a power communication network

Abstract

The application discloses a kind of collection method and system of data flow in electric power communication network.The method is applied to electric power side edge gateway, comprising: the intercepted heterogeneous electric power message is determined as current real-time message, and the unique logic mark of current logic stream to which current real-time message belongs is determined;According to the unique logic mark, the flow state context cache table is inquired, the historical flow state information of current logic stream is determined, and the reference period deviation of current logic stream is determined according to the historical flow state information;Current real-time message is processed according to the mask template in the associated operator template, the current message state fingerprint of current real-time message is generated, and the fingerprint change factor of current logic stream is determined according to flow state context cache table and current message state fingerprint;Fusion reference period deviation and fingerprint change factor, current real-time message is uploaded and handled.The application can improve the real-time response capability of data flow collection, and at the same time, avoid redundant transmission and leakage.

Description

Technical Field

[0001] This invention relates to the field of computer processing technology, and in particular to a method and system for collecting data traffic in a power communication network. Background Technology

[0002] As smart grids continue to extend to the edge, edge IoT agents and smart gateway devices have been deployed on a large scale in scenarios such as substation process layers and distribution rooms. These edge nodes need to collect and mirror the traffic of their connected devices in real time to support core business functions such as power system security monitoring, fault diagnosis, and situation analysis.

[0003] Currently, data traffic in power communication networks exhibits significant heterogeneity: on the one hand, there are Layer 2 dedicated protocol messages without Internet Protocol (IP) addresses, directly encapsulated within the Ethernet layer, such as Sampled Value (SV) messages, Generic Object Oriented Substation Event (GOOSE) messages, and Precision Time Protocol (PTP) synchronization messages; on the other hand, there are application-layer scheduling protocol messages based on the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol stack, such as IEC 104 messages and Modbus Transmission Control Protocol (Modbus TCP) messages. Simultaneously, power services have extremely high real-time requirements, needing to meet microsecond-level synchronization requirements, and exhibit high traffic density; for example, the transmission frequency of SV messages typically reaches 4000Hz-12800Hz. This places stringent demands on the performance, accuracy, and real-time performance of edge-side traffic acquisition and mirroring algorithms.

[0004] Existing data traffic collection methods have the following drawbacks: conflicts between computational latency and real-time performance, redundant transmission caused by fingerprint failure, and missed data collection due to logical black boxes. Summary of the Invention

[0005] This invention provides a method and system for collecting data traffic in a power communication network, which can improve the real-time response capability of data traffic collection, while avoiding redundant transmission and missed collection.

[0006] According to a first aspect of the present invention, a data traffic acquisition method in a power communication network is provided, the method being applied to a power-side edge gateway, comprising: The intercepted heterogeneous power packets are identified as current real-time packets, and a unique logical identifier for the current logical flow to which the current real-time packet belongs is determined. The flow state context cache table is queried based on the unique logical tag to determine the historical flow state information of the current logical flow, and the baseline cycle deviation of the current logical flow is determined based on the historical flow state information. The current real-time message is processed according to the mask template in the associated operator template, the current message state fingerprint of the current real-time message is generated, and the fingerprint change factor of the current logical flow is determined according to the flow state context cache table and the current message state fingerprint. The current real-time message is sent up by integrating the baseline period deviation and the fingerprint change factor.

[0007] According to a second aspect of the present invention, a data traffic acquisition system in a power communication network is provided, the system being deployed at a power-side edge gateway, comprising: The message acquisition and tag determination module is used to identify the intercepted heterogeneous power messages as current real-time messages and determine the unique logical tag of the current real-time message to which the current logical flow belongs. The deviation determination module is used to query the flow state context cache table based on the unique logical tag, determine the historical flow state information of the current logical flow, and determine the baseline period deviation of the current logical flow based on the historical flow state information. The change factor determination module is used to process the current real-time message according to the mask template in the associated operator template, generate the current message state fingerprint of the current real-time message, and determine the fingerprint change factor of the current logical flow according to the flow state context cache table and the current message state fingerprint. The uploading processing module is used to integrate the baseline period deviation and the fingerprint change factor to perform uploading processing on the current real-time message.

[0008] The technical solution of this invention identifies intercepted heterogeneous power packets as current real-time packets and determines a unique logical marker for the current logical flow to which the current real-time packet belongs. Then, it queries the flow state context cache table based on the unique logical marker to determine the historical flow state information of the current logical flow and, based on the historical flow state information, determines the baseline period deviation of the current logical flow. Next, it processes the current real-time packet according to the mask template in the associated operator template, generating a current packet state fingerprint. It also determines the fingerprint change factor of the current logical flow based on the flow state context cache table and the current packet state fingerprint. Finally, it fuses the baseline period deviation and the fingerprint change factor to send the current real-time packet for processing. Therefore, this invention, by pre-setting the flow state context cache table and operator templates to determine the baseline period deviation and fingerprint change factor, not only achieves lightweight real-time perception, significantly reducing the computational overhead of edge nodes and reducing computational latency, but also implements a dual-driven acquisition strategy based on timing and business judgment, ensuring accurate capture of abnormal traffic and avoiding missed acquisition problems caused by logical black boxes. Furthermore, the noise fields in the current real-time message can be masked using a mask template, thus avoiding redundant transmission problems caused by fingerprint failure.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of a data traffic acquisition method in a power communication network according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of a data traffic acquisition method in a power communication network according to Embodiment 2 of the present invention; Figure 3 This is a flowchart of a data traffic acquisition method in a power communication network according to Embodiment 3 of the present invention. Figure 4 This is a schematic diagram of the structure of a data traffic system in a power communication network according to Embodiment 3 of the present invention. Detailed Implementation

[0012] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0013] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0014] Example 1 Figure 1 This is a flowchart illustrating a data traffic method in a power communication network according to Embodiment 1 of the present invention. This embodiment is applicable to the automatic collection of heterogeneous traffic in a power communication network, and the method can be applied to power-side edge gateways. Figure 1 As shown, the method includes: S101. The intercepted heterogeneous power message is identified as the current real-time message, and the unique logical identifier of the current logical flow to which the current real-time message belongs is determined.

[0015] Heterogeneous power messages can be messages with different protocol encapsulation formats in the power communication network, including Layer 2 dedicated protocol messages without IP addresses and directly encapsulated in the Ethernet layer (such as SV messages, GOOSE messages, PTP synchronization messages, etc.), and application layer scheduling protocol messages based on the TCP / IP protocol stack (such as IEC 104 messages, Modbus TCP messages, etc.). Current real-time messages can be messages that are currently being processed and intercepted in real-time from the aggregated traffic of the edge gateway.

[0016] A logical flow can be a data stream consisting of consecutive messages with the same unique logical tag. A unique logical tag can be a unique identifier used to distinguish different logical flows.

[0017] For example, heterogeneous power packets in a power communication network can be intercepted in real time to obtain the currently pending packet as the current real-time packet. Then, based on this current real-time packet, certain fields are extracted using pre-set flow identifier extraction rules to determine the unique logical identifier of the current logical flow to which the current real-time packet belongs.

[0018] S102. Query the flow state context cache table according to the unique logical tag to determine the historical flow state information of the current logical flow, and determine the baseline cycle deviation of the current logical flow according to the historical flow state information.

[0019] The flow state context cache table can be a pre-maintained cache data structure used to record the historical flow state information of each logical flow. This flow state context cache table can use a unique logical tag as the index key, and the data content corresponding to each index key includes the historical flow state information of the logical flow.

[0020] Historical flow status information can be status data related to the current logical flow at a historical moment, and may include at least the arrival time of the previous message, the status fingerprint of the previous message, and a reference period. The arrival time of the previous message can be the timestamp information of the arrival time of the previous message recorded for the current real-time message. The status fingerprint of the previous message can be the service status information of the previous message recorded for the current real-time message. The reference period can be understood as the interval between the arrival times of adjacent messages in the logical flow, reflecting the transmission frequency of the logical flow in a stable state, and thus serving as a basis for judging whether the current real-time message has deviated.

[0021] Based on this, the reference period deviation can be understood as the degree of offset between the arrival time of the current logic flow and the reference period of the logic flow. The larger the reference period deviation, the greater the difference between the timing of the current logic flow and the normal timing of the logic flow.

[0022] For example, a lookup can be performed in the flow state context cache table using the generated unique logical tag as an index. If the lookup is successful, the historical flow state information of the current logical flow can be read from the flow state context cache table, the arrival time of the previous message and the learned baseline period can be extracted, and then the degree of deviation of the arrival time of the current logical flow relative to the baseline period of the logical flow can be determined as the baseline period deviation of the current logical flow.

[0023] If the search fails, it indicates that the current logic flow is appearing for the first time and its base period has not yet been initialized. In this case, the base period deviation can be set to an initial value that represents infinite deviation.

[0024] S103. Process the current real-time message according to the mask template in the associated operator template, generate the current message state fingerprint of the current real-time message, and determine the fingerprint change factor of the current logical flow according to the flow state context cache table and the current message state fingerprint.

[0025] The operator template can be a pre-configured processing method used to guide the differentiated fingerprint calculation of messages of different protocol types. It should be noted that different protocol types of messages can be configured with corresponding operator templates.

[0026] The mask template can be a masking rule defined in the operator template, which specifically specifies the location of dynamic fields in the message that need to be masked (such as the sequence number field, timestamp field, etc., which change periodically but do not contribute to the judgment of business status), and is used to remove the interference of these noisy fields before fingerprint calculation.

[0027] The current message status fingerprint can be the essential feature related to the business status in the current real-time message. It's understandable that the current message status fingerprint excludes the influence of dynamic noise fields.

[0028] The fingerprint change factor can be a value that represents whether the current message state fingerprint has changed relative to the state fingerprint of the previous message.

[0029] For example, after determining the baseline period deviation, an operator template that matches and is associated with the current real-time message protocol type can be determined. Then, a mask template is extracted from the operator template, and the noise field in the current real-time message is masked using the mask template. Based on the masked message, fingerprint calculation is performed to obtain the current message state fingerprint.

[0030] Furthermore, the unique logical marker can be used to query the flow state context cache table, read the state fingerprint of the previous message of the current logical flow, and compare the current message state fingerprint with the previous message state fingerprint bit by bit. If the two are exactly the same, it means that the business state has not changed. If the two are different, it means that the business state has changed, thus the corresponding fingerprint change factor can be determined.

[0031] If the state fingerprint of the previous message does not exist in the flow state context cache table (i.e., the current message is the first message of the logical flow), then the fingerprint change factor can be assigned a value that represents the change.

[0032] S104. The current real-time message is sent up by integrating the baseline period deviation and the fingerprint change factor.

[0033] It should be noted that the upload process can include two methods: full upload and low-frequency sampling upload. Full upload means uploading the message with 100% probability. Low-frequency sampling upload means selectively uploading the message with a sampling probability of less than 100%.

[0034] For example, after determining the baseline period deviation and fingerprint change factor, the sampling score value of the current real-time message can be generated by fusion calculation of the baseline period deviation and fingerprint change factor. Then, based on the comparison result of the sampling score value and the preset threshold, it can be determined whether to send the full message or send it by low-frequency sampling.

[0035] The technical solution of this embodiment can identify intercepted heterogeneous power packets as current real-time packets, determine the unique logical marker of the current logical flow to which the current real-time packet belongs, then query the flow state context cache table based on the unique logical marker to determine the historical flow state information of the current logical flow, and determine the reference period deviation of the current logical flow based on the historical flow state information. Next, process the current real-time packet according to the mask template in the associated operator template to generate the current packet state fingerprint of the current real-time packet, and determine the fingerprint change factor of the current logical flow based on the flow state context cache table and the current packet state fingerprint. Finally, fuse the reference period deviation and the fingerprint change factor, and upload the current real-time packet for processing. It can be seen that the present invention, by pre-setting the flow state context cache table and operator template to determine the reference period deviation and fingerprint change factor, not only achieves lightweight real-time perception, significantly reduces the computational overhead of edge nodes, and reduces computational latency, but also implements a dual-driven acquisition strategy based on time sequence judgment and business judgment, ensuring accurate capture of abnormal traffic and avoiding the problem of missed acquisition caused by logic black boxes. Furthermore, the noise fields in the current real-time message can be masked using a mask template, thus avoiding redundant transmission problems caused by fingerprint failure.

[0036] Based on the above embodiments, as one implementation, determining the baseline cycle deviation of the current logical flow according to the historical flow state information may include: The message time interval is determined based on the current arrival time of the current real-time message and the arrival time of the previous message; The deviation of the reference period of the current logical flow is determined based on the message time interval and the reference period.

[0037] The current arrival time of the current real-time message can be the timestamp information recorded by the system at the arrival time of the current real-time message.

[0038] Specifically, based on the unique logical identifier of the current logical flow to which the current real-time message belongs, the flow state context cache table can be queried to obtain the arrival time of the previous message. and the benchmark period Then, the current arrival time of the current real-time message can be retrieved. And calculate the current arrival time. Time of arrival with the previous message The difference is used to obtain the message time interval. .

[0039] Then, the deviation of the current logic flow from the base period can be obtained by first calculating the absolute value of the difference between the message time interval and the base period, and then comparing this absolute value with the base period. The details are as follows: ; It should be noted that if the baseline period for the current logical flow does not exist in the flow state context cache table (i.e., the baseline period is not initialized), the retrieved data will be affected. If the value is empty, the baseline period deviation can be set to infinity to trigger a full upload.

[0040] Based on the above embodiments, as one implementation, the step of processing the current real-time message according to the mask template in the associated operator template to generate the current message state fingerprint of the current real-time message includes: Extract the corresponding mask template based on the matched operator template; The mask template is filled into a mask matrix of the same length as the current real-time message, and the corresponding bits are set to zero according to the preset mask position; Perform a bitwise AND operation between the mask matrix and the current real-time message, and hash the result to obtain the current message status fingerprint of the current real-time message.

[0041] The mask matrix can be a binary mask data of the same length as the current real-time message, generated based on a mask template. Bits corresponding to the positions to be masked (the positions corresponding to dynamic fields) are set to zero, while the bits at the remaining positions are set to one. The bitwise AND operation can be understood as performing a logical AND operation between the mask matrix and the current real-time message bit by bit to mask the data processing operations of the dynamic fields.

[0042] Specifically, based on the operator template obtained from the matching, the corresponding mask template is extracted from the operator template. .Will Fill in with the current real-time message A mask matrix of the same length is obtained by setting the bits at corresponding positions to 0 according to the mask positions defined by the mask template. This mask matrix is ​​denoted as... .

[0043] Then, a bitwise AND operation can be performed between the mask matrix and the current real-time message, and its digest can be calculated to obtain the current message state fingerprint of the current real-time message. The calculation method is as follows: ; in, It can represent hash calculation.

[0044] Based on the above embodiments, as one implementation, determining the fingerprint change factor of the current logical flow according to the historical flow state information and the current message state fingerprint may include: When the historical packet state fingerprint does not exist in the flow state context cache table, the fingerprint change factor is set to 1; When a historical packet state fingerprint exists in the flow state context cache table, the current packet state fingerprint is XORed with the historical packet state fingerprint. If the calculation result is 0, then the fingerprint change factor is assigned a value of 0; If the result of the calculation is not 0, then the fingerprint change factor is assigned a value of 1.

[0045] For example, when the current logical flow appears for the first time, there is no corresponding historical message state fingerprint in the flow state context cache table. At this time, fingerprint comparison cannot be performed. The fingerprint change factor can be assigned to 1 to indicate that the business state has changed, so as to trigger the full transmission of the first message and ensure that the first packet of the new flow is not lost.

[0046] When historical message state fingerprints exist, an XOR operation can be used to determine whether the current fingerprint matches a historical fingerprint. For example, if the XOR result is 0, it indicates that the two fingerprints are identical bit-by-bit, meaning the service state has not changed, and the fingerprint change factor can be set to 0. If the XOR result is not 0, it indicates that at least one bit is different, meaning the service state has changed, and the fingerprint change factor can be set to 1.

[0047] Based on the above embodiments, as one implementation, the process of fusing the baseline period deviation and the fingerprint change factor to send the current real-time message may include: Based on time-sensitive weights and business-sensitive weights, the deviation of the baseline period and the fingerprint change factor are weighted and calculated to obtain the sampling score value of the current logic flow. The sampled score value is compared with a preset threshold for changing the acquisition strategy. If the sampling score is less than the preset acquisition strategy change threshold, the current real-time message is sampled and sent up according to the preset low-frequency sampling probability. If the sampling score value is greater than or equal to the preset acquisition strategy change threshold, the current real-time message is fully uploaded.

[0048] The time sequence sensitivity weight can be used to adjust the contribution proportion of the reference period deviation degree in the sampling score, and the service sensitivity weight can be used to adjust the contribution proportion of the fingerprint change factor in the sampling score. The sampling score value can comprehensively reflect the anomaly degree of the current real-time message in the two dimensions of time sequence feature and service state. A higher score value indicates that the current logical flow is more likely to be in a key feature state, and the acquisition intensity needs to be increased. The preset acquisition strategy change threshold can be used to determine whether the current logical flow is in a key feature state.

[0049] For example, the time sequence sensitivity weight can be denoted as K1, the service sensitivity weight can be denoted as K2, and K1+K2=1, the sampling score value can be: ； wherein, may represent the reference period deviation degree, may represent the fingerprint change factor.

[0050] The preset acquisition strategy change threshold can be denoted as , if < , it can be determined that the current logical flow is in a steady state, the current real-time message meets the low-frequency sampling upload condition, then the upload probability of the current real-time message can be set to a preset low-frequency sampling probability p, where 0<p≤1. A random number r with a value range of 0 to 1 is generated. When r<p, the current real-time message can be sent to the traffic analysis system, otherwise the current real-time message is not sent to the traffic analysis system. It should be noted that regardless of whether it is sent or not, the current real-time message will continue to participate in subsequent flow state cache updates.

[0051] If , it can be determined that the current logical flow is in a key feature state (that is, the time sequence deviation is large or the service state changes), the current real-time message meets the full upload condition, then the upload probability of the current real-time message is set to 100%, and it is directly sent to the traffic analysis system. When multiple consecutive real-time messages in the current logical flow all meet the full upload condition, the multiple consecutive real-time messages can all be sent packet by packet, so as to form full acquisition of the current logical flow.

[0052] It should be noted that whenever the current logical flow arrives at a new real-time message, the sampling score of the message can be recalculated and the uploading rules of the message can be redefined. It is not necessary to record whether the current logical flow is in full-volume collection or low-frequency collection state, thus ensuring that the collection strategy can make independent decisions for each message and has fine-grained dynamic adjustment capabilities.

[0053] Example 2 Figure 2 This is a flowchart of a data traffic acquisition method in a power communication network according to Embodiment 2 of the present invention. This embodiment can further optimize and explain the method for determining the unique logical marker of the current logical flow to which the current real-time message belongs in Embodiment 1. Figure 2 As shown, the method includes: S201. The intercepted heterogeneous power packets are identified as current real-time packets, and the bearer type of the current real-time packets is determined based on the Ethernet type field in the current real-time packets.

[0054] The Ethernet type field can be a field in the Ethernet frame header used to indicate the type of upper-layer protocol. Its value can identify what protocol the current message carries. For example, 0x0800 represents the IPv4 protocol, 0x86DD represents the IPv6 protocol, 0x88BA represents the SV protocol, and 0x88B8 represents the GOOSE protocol.

[0055] The bearer type can be the message transmission bearer method determined by the value of the Ethernet type field, including at least two types: link layer direct connection protocol traffic and IP class traffic.

[0056] For example, after intercepting a current real-time packet, the Ethernet type field in the Ethernet frame header of the current real-time packet can be read. If the current real-time packet carries a VLAN tag, the VLAN tag field can be skipped, and the Ethernet type field corresponding to the actual bearer protocol can be read.

[0057] After obtaining the value of the Ethernet type field, the value can be matched with a preset set of protocol types. If the value matches the dedicated protocol type set of the link layer direct connection protocol (such as the EtherType value corresponding to SV, GOOSE, PTP, etc.), it can be determined that the current packet carries link layer direct connection protocol traffic. If the value is the protocol type value corresponding to IPv4 or IPv6, it can be determined that the current packet carries IP class traffic. If the value cannot be identified, it can be determined that the current packet does not support an unsupported protocol type.

[0058] S202. Based on the bearer type, perform operator template matching on the current real-time message in the operator template library.

[0059] It should be noted that this embodiment can pre-configure and maintain an operator template library, storing multiple operator templates corresponding to different bearer types. Each operator template can include at least information such as protocol type identifier, application marker location, and mask template, used to guide flow identifier extraction and fingerprint calculation for packets of a specific protocol. Each protocol type identifier can correspond to a unique operator template.

[0060] For example, after determining the bearer type of the current real-time message, the operator template matching the current real-time message can be obtained by searching the operator template library for the protocol type identifier corresponding to the bearer type of the current real-time message.

[0061] S203. When a unique operator template is matched, the flow identifier field is extracted from the current real-time message according to the unique operator template, and the flow identifier field is merged to generate a unique logical tag of the current logical flow to which the current real-time message belongs.

[0062] The flow identifier field can be a message feature field used to distinguish different logical flows.

[0063] For example, after determining the corresponding matching operator template, if the matching operator template is a unique operator template, the flow identifier extraction and fingerprint calculation of the message of a specific protocol can be performed according to the operator template. At least two flow identifier fields can be extracted from the current real-time message respectively, and the at least two flow identifier fields can be merged to generate a unique logical tag of the current logical flow to which the current real-time message belongs.

[0064] S204. Query the flow state context cache table according to the unique logical tag to determine the historical flow state information of the current logical flow, and determine the reference cycle deviation of the current logical flow according to the historical flow state information.

[0065] S205. Process the current real-time message according to the mask template in the associated operator template, generate the current message state fingerprint of the current real-time message, and determine the fingerprint change factor of the current logical flow according to the flow state context cache table and the current message state fingerprint.

[0066] S206. The current real-time message is sent up by integrating the baseline period deviation and the fingerprint change factor.

[0067] The technical solution of this embodiment can further determine the bearer type of the current real-time message through the Ethernet type field, and then match the corresponding operator template. Based on the operator template, the flow identifier field is extracted and a unique logical tag is generated, realizing the protocol adaptive identification and template matching of heterogeneous power messages.

[0068] Based on the above embodiments, as one possible implementation, the step of matching the current real-time message with an operator template in the operator template library according to the bearer type may include: When the bearer type is link layer direct connection protocol traffic, the Ethernet type field of the current real-time message is used as the protocol type, and operator template matching is performed on the current real-time message in the operator template library according to the protocol type; When the bearer type is IP traffic, read the upper-layer protocol type from the IP header; If the current packet is an IPv6 packet, skip the extension header and determine the actual upper-layer protocol corresponding to the upper-layer protocol type; If the actual layer protocol is TCP or UDP, then read the source port number and the destination port number, and take the combination of the actual layer protocol and the source port number, and the combination of the actual layer protocol and the destination port number as candidate matching items respectively; If the actual underlying protocol is not TCP or UDP, then the actual underlying protocol is used as a candidate match. Based on the candidate matching items, the current real-time message is matched with an operator template in the operator template library.

[0069] Among them, the bearer types include at least two major types: link layer direct connection protocol traffic and IP traffic.

[0070] Specifically, if the current message is determined to be a link-layer direct connection protocol traffic, the value of the Ethernet type field can be directly used as the protocol type identifier. Then, an operator template with the same protocol type identifier can be searched in the operator template library, and that operator template is selected as the matching operator template for the current message. For example, when the Ethernet type field is 0x88BA, the SV operator template can be matched; when the Ethernet type field is 0x88B8, the GOOSE operator template can be matched.

[0071] If the current packet is determined to be carrying IP traffic, the IP header can be further parsed. For IPv6 packets, if extension headers exist, they can be skipped sequentially until the actual upper-layer protocol is determined. After determining the upper-layer protocol, its type can be further identified. If the upper-layer protocol is TCP or UDP, the source and destination port numbers in the packet can be read. "Upper-layer protocol type + source port number" and "Upper-layer protocol type + destination port number" are then used as candidate matches in the operator template library. The operator template corresponding to the successfully matched candidate match is then determined as the operator template for the current packet.

[0072] If the upper-layer protocol is not TCP or UDP (i.e., an IP upper-layer protocol that does not use port numbers), then the upper-layer protocol type can be directly used as a candidate match. It should be noted that the condition for a successful match is that a unique operator template is found in the operator template library. If multiple different operator templates are matched simultaneously or no operator template is matched, it is considered that no matching operator template has been determined.

[0073] Preferably, if, based on the bearer type, no operator template matching the current real-time message is found, or multiple operator templates matching the current real-time message are found, the current real-time message can be directly uploaded, and processing of the current real-time message can be terminated. The advantage of this setting is that by directly uploading the message when no matching operator template is found, data loss due to protocol incompatibility is avoided, ensuring the integrity of traffic collection.

[0074] Based on the above embodiments, as one possible implementation, the step of extracting the flow identifier field from the current real-time message according to the operator template, merging the flow identifier field, and generating a unique logical identifier for the current logical flow to which the current real-time message belongs may include: Based on the operator template, extract the primary identifier and the secondary identifier from the current real-time message; The first-level identifier and the second-level identifier are concatenated, and the concatenation result is hashed to obtain the unique logical identifier of the current logical flow; Wherein, when the current real-time message is a link layer direct connection protocol traffic, the first-level identifier is a combination of source MAC address, destination MAC address and protocol type; When the current real-time message is TCP or UDP-type IP traffic, the first-level identifier is a combination of source IP address, destination IP address, transport layer protocol identifier, source port number and destination port number; When the current real-time packet is traffic from other IP upper-layer protocols that does not use port numbers, the first-level identifier is a combination of the source IP address, the destination IP address, and the IP upper-layer protocol type; The secondary identifier is an application tag read from the protocol payload of the current real-time message based on the application tag position defined in the operator template.

[0075] The flow identifier field can include at least a primary identifier and a secondary identifier. The primary identifier can be used to locate the physical channel to which the message belongs; the secondary identifier can be used to locate the logical entity under that physical channel.

[0076] It should be noted that when the current real-time packet is a link layer direct connection protocol traffic, the first-level identifier can be a combination of the source MAC address, destination MAC address and protocol type. Specifically, "source MAC address + destination MAC address + protocol type" can be extracted as the first-level identifier.

[0077] When the current real-time packet is TCP or UDP-type IP traffic, the first-level identifier can be a combination of the source IP address, destination IP address, transport layer protocol identifier, source port number, and destination port number. Specifically, "source IP + destination IP + transport layer protocol identifier + source port number + destination port number" can be extracted as the first-level identifier.

[0078] When the current real-time packet is traffic from other IP upper-layer protocols that do not use port numbers, the primary identifier can be a combination of the source IP address, destination IP address, and IP upper-layer protocol type. Specifically, for other IP upper-layer protocols that do not use port numbers, "source IP + destination IP + IP upper-layer protocol type" is extracted as the primary identifier.

[0079] The secondary identifier can be obtained by reading the application tag from the protocol payload of the current real-time message based on the application tag position defined in the operator template. For example, since a physical device may send multiple SV streams for different purposes (such as current and voltage at different intervals) at the same time, and the application tag APPID in the protocol payload is the key to distinguishing these logical service streams, for SV protocol traffic directly connected to the link layer, the application tag APPID extracted from the 14th-15th bytes of the application tag position in the Ethernet payload can be used as the secondary identifier.

[0080] For three-layer protocols such as IEC 104, we can start from the TCP payload start bit, skip the 6-byte APCI control field and the 4-byte ASDU function field, and extract the ASDU public address in bytes 10-11 as the secondary identifier. The reason is that when the scheduling gateway proxies multiple RTU terminals, this address is the core basis for distinguishing different logical sites of the physical IP backend.

[0081] For example, a first-level identifier can be extracted from the corresponding position of the current real-time message according to the first-level identifier extraction rules defined in the operator template, and a second-level identifier can be read from the specified offset position in the protocol payload of the current real-time message according to the second-level identifier extraction rules (i.e., application marker position) defined in the operator template. Then, the two can be concatenated, and a hash operation can be performed on the concatenated string. The hash result is used as the unique logical marker of the current logical stream. The hash algorithm can use any standard hash function and must be capable of handling hash collisions.

[0082] Example 3 Figure 3This is a flowchart of a data traffic acquisition method in a power communication network according to Embodiment 3 of the present invention. This embodiment can be further optimized and explained based on Embodiment 1 above. Figure 3 As shown, the method includes S301. The intercepted heterogeneous power message is identified as the current real-time message, and the unique logical marker of the current logical flow to which the current real-time message belongs is determined.

[0083] S302. Query the flow state context cache table according to the unique logical tag to determine the historical flow state information of the current logical flow, and determine the baseline cycle deviation of the current logical flow according to the historical flow state information.

[0084] S303. Process the current real-time message according to the mask template in the associated operator template, generate the current message state fingerprint of the current real-time message, and determine the fingerprint change factor of the current logical flow according to the flow state context cache table and the current message state fingerprint.

[0085] S304. The current real-time message is sent up by integrating the baseline period deviation and the fingerprint change factor.

[0086] S305. Update the current arrival time of the current real-time message and the current message status fingerprint to the flow state context cache table.

[0087] For example, after completing the uploading process of the current real-time message, the arrival time of the current real-time message can be used as the new arrival time of the previous message, and the state fingerprint of the current message can be used as the new state fingerprint of the previous message, using a unique logical identifier as the index, to update the corresponding entry in the flow state context cache table. If this logical flow is appearing for the first time (and there is no corresponding entry in the cache table), a new entry can be created and the above information written in.

[0088] S306. Obtain the preset length of the circular observation buffer and the current buffer data volume. Based on the preset length and the current buffer data volume, update the current logic flow time interval and the fingerprint change factor as a record to the circular observation buffer corresponding to the current logic flow.

[0089] The circular observation buffer can be a fixed-length circular queue pre-maintained independently for each logical flow. It can store observation records of the time intervals and fingerprint change factors of the most recent messages from each logical flow, providing a data foundation for the learning and updating of the baseline period. The buffer length can be the maximum number of records the circular observation buffer can hold. The current buffer data volume can be the number of records currently stored in the circular observation buffer.

[0090] For example, the present invention can maintain a pre-defined circular observation buffer for each logical flow. After calculating the time interval and fingerprint change factor of the current message, the capacity parameters and current storage status of the pre-configured circular observation buffer for the current logical flow can be obtained. Then, the message time interval and fingerprint change factor obtained in this processing are combined into an observation record and written into the circular observation buffer corresponding to the logical flow. If the buffer has reached its capacity limit, the earliest record can be overwritten in a first-in-first-out manner to keep the buffer length constant and realize the rolling accumulation of historical observation data.

[0091] S307. If the reference period of the current logic flow is not initialized, then the reference period learning of the current logic flow is performed based on the historical data in the circular observation buffer.

[0092] Among them, baseline period learning can refer to the process of determining the baseline value of the message transmission time interval of a logical flow under normal conditions by analyzing historical observation data of the logical flow.

[0093] For example, after updating the circular observation buffer, it can be determined whether the reference period of the current logic flow has been initialized.

[0094] If not initialized, the accumulated historical observation records in the circular observation buffer can be read to extract the valid time interval data. When the number of accumulated valid time intervals meets the preset requirements, the initial reference period of the logical flow is determined through statistical operations based on the valid time interval data, and the initial reference period is written to the flow state context cache table to complete the initialization of the reference period.

[0095] S308. Otherwise, when the fingerprint change factors corresponding to the most recent preset number of observation records in the annular observation buffer are all 0 and the deviation of the reference period corresponding to the most recent preset number of observation records is within the preset threshold range, the median filtering update process of the reference period is triggered.

[0096] If the current logic flow's baseline period has been initialized, then the most recent observation records in the circular observation buffer can be monitored. It is determined whether the fingerprint change factors of the most recent preset number of observation records are all values ​​representing stable business status (i.e., 0), and whether the corresponding baseline period deviations of these most recent preset number of observation records are all within a preset normal fluctuation range (i.e., within a preset threshold range). If both conditions are met, the median filtering update process for the baseline period can be triggered. This median filtering update process can adaptively adjust the baseline period based on historical time interval data in the circular observation buffer through median filtering and smoothing operations.

[0097] Based on the above embodiments, this embodiment can continuously track and maintain the flow state by updating the processing result of the current real-time message to the flow state context cache table. By writing the time interval and fingerprint change factor into the circular observation buffer, the cyclic accumulation and management of historical observation data can be realized. By performing benchmark period learning when it is not initialized and triggering median filtering update when the business state is stable and the period deviates from the normal, the online initialization and adaptive smooth update of the benchmark period can be realized.

[0098] Based on the above embodiments, as one possible implementation, the step of performing baseline periodic learning of the current logic flow based on historical data in the circular observation buffer may include: The effective time interval of the current logical flow is accumulated in the circular observation buffer; When the number of valid time intervals reaches a preset number, the valid time intervals are sorted. The time interval at the middle position after sorting is determined as the initial reference period of the current logic flow.

[0099] The effective time interval can be observational data reflecting the time interval between adjacent messages in the logical flow, determined based on the arrival time difference between the current real-time message and the previous message. The preset quantity can be a pre-set minimum number of effective time intervals required to trigger the initialization of the reference period.

[0100] Specifically, a circular observation buffer can be maintained for the logical flow corresponding to each unique logical tag. Whenever a new message is received and the time interval is calculated, this time interval is added to the buffer as a valid time interval. When the number of valid time intervals accumulated in the buffer reaches a preset number, the valid time intervals are sorted in ascending order, and the time interval in the middle position is extracted as the initial reference period. For example, if the preset number is 11, the 6th value after sorting the 11 valid time intervals is taken as the initial reference period.

[0101] Based on the above embodiments, the median filtering update process for the reference period may include: All time intervals in the annular observation buffer are sorted, and the value at the middle position after sorting is extracted as a candidate reference period. Using a preset learning rate, the reference period of the current logic flow is smoothly updated based on the candidate reference period.

[0102] Median filtering effectively eliminates maximum jitter caused by network congestion, ensuring that the candidate reference reflects the true frequency of the power secondary equipment. The candidate reference period can be a reference value used to update the current reference period, obtained by performing median filtering on all time intervals in the circular observation buffer. The preset learning rate is a parameter used to control the magnitude of the reference period update, typically ranging from greater than 0 to less than 1.

[0103] Specifically, when the baseline period update is triggered, all time intervals currently stored in the circular observation buffer can be sorted in ascending order, and the value in the middle position can be extracted as a candidate baseline period.

[0104] Then, a preset learning rate can be used. The smoothing formula updates the current base period, and the update formula is as follows: ; in, Indicates the updated base period. Indicates the baseline period before the update. Indicates the candidate baseline period. This indicates the preset learning rate.

[0105] The advantage of this setting is that it ensures the smoothness of the baseline period update and prevents frequent fluctuations in traffic collection.

[0106] It should be noted that the baseline period update is only executed when specific triggering conditions are met, namely, when the service status fingerprint update factors corresponding to the X most recent messages in the circular observation buffer (X is a preset number, X < K, such as X = K / 3) are all in a stable state and the corresponding period deviations are all within the preset baseline period update range, the update calculation is triggered.

[0107] Example 4 Figure 4 This is a schematic diagram of a data traffic acquisition system in a power communication network according to Embodiment 4 of the present invention. Figure 4 As shown, the system includes: The message acquisition and marking determination module 401 can be used to determine the intercepted heterogeneous power messages as current real-time messages, and determine the unique logical marker of the current real-time message to which the current logical flow belongs; The deviation determination module 402 can be used to query the flow state context cache table according to the unique logical tag, determine the historical flow state information of the current logical flow, and determine the reference period deviation of the current logical flow according to the historical flow state information. The change factor determination module 403 can be used to process the current real-time message according to the mask template in the associated operator template, generate the current message state fingerprint of the current real-time message, and determine the fingerprint change factor of the current logical flow according to the flow state context cache table and the current message state fingerprint. The uploading processing module 404 can be used to integrate the reference period deviation and the fingerprint change factor to perform uploading processing on the current real-time message.

[0108] The technical solution of this invention identifies intercepted heterogeneous power packets as current real-time packets and determines a unique logical marker for the current logical flow to which the current real-time packet belongs. Then, it queries the flow state context cache table based on the unique logical marker to determine the historical flow state information of the current logical flow and, based on the historical flow state information, determines the baseline period deviation of the current logical flow. Next, it processes the current real-time packet according to the mask template in the associated operator template, generating a current packet state fingerprint. It also determines the fingerprint change factor of the current logical flow based on the flow state context cache table and the current packet state fingerprint. Finally, it fuses the baseline period deviation and the fingerprint change factor to send the current real-time packet for processing. Therefore, this invention, by pre-setting the flow state context cache table and operator templates to determine the baseline period deviation and fingerprint change factor, not only achieves lightweight real-time perception, significantly reducing the computational overhead of edge nodes and reducing computational latency, but also implements a dual-driven acquisition strategy based on timing and business judgment, ensuring accurate capture of abnormal traffic and avoiding missed acquisition problems caused by logical black boxes. Furthermore, the noise fields in the current real-time message can be masked using a mask template, thus avoiding redundant transmission problems caused by fingerprint failure.

[0109] Optionally, the message acquisition and marking determination module 401 may include: The type determination unit can be used to determine the bearer type of the current real-time message based on the Ethernet type field in the current real-time message; The template determination unit can be used to perform operator template matching on the current real-time message in the operator template library according to the bearer type; The tag generation unit can be used to extract the flow identifier field from the current real-time message according to the unique operator template when a unique operator template is matched, and to merge the flow identifier field to generate a unique logical tag of the current logical flow to which the current real-time message belongs.

[0110] Optionally, the template determines the unit, which can be used specifically for: When the bearer type is link layer direct connection protocol traffic, the Ethernet type field of the current real-time message is used as the protocol type, and operator template matching is performed on the current real-time message in the operator template library according to the protocol type; When the bearer type is IP traffic, read the upper-layer protocol type from the IP header; If the current packet is an IPv6 packet, skip the extension header and determine the actual upper-layer protocol corresponding to the upper-layer protocol type; If the actual layer protocol is TCP or UDP, then read the source port number and the destination port number, and take the combination of the actual layer protocol and the source port number, and the combination of the actual layer protocol and the destination port number as candidate matching items respectively; If the actual underlying protocol is not TCP or UDP, then the actual underlying protocol is used as a candidate match. Based on the candidate matching items, the current real-time message is matched with an operator template in the operator template library.

[0111] Optionally, the template determination unit can also be used to directly send the current real-time message and end the processing of the current real-time message if, according to the bearer type, no operator template matching the current real-time message is determined or multiple operator templates matching the current real-time message are determined.

[0112] Optionally, the marker generation unit can be used for: Based on the operator template, extract the primary identifier and the secondary identifier from the current real-time message; The first-level identifier and the second-level identifier are concatenated, and the concatenation result is hashed to obtain the unique logical identifier of the current logical flow; Wherein, when the current real-time message is a link layer direct connection protocol traffic, the first-level identifier is a combination of source MAC address, destination MAC address and protocol type; When the current real-time message is TCP or UDP-type IP traffic, the first-level identifier is a combination of source IP address, destination IP address, transport layer protocol identifier, source port number and destination port number; When the current real-time packet is traffic from other IP upper-layer protocols that does not use port numbers, the first-level identifier is a combination of the source IP address, the destination IP address, and the IP upper-layer protocol type; The secondary identifier is an application tag read from the protocol payload of the current real-time message based on the application tag position defined in the operator template.

[0113] Optionally, the historical flow status information may include the arrival time of the previous message, the status fingerprint of the previous message, and the reference period.

[0114] Correspondingly, the deviation determination module 402 can be specifically used to determine the message time interval based on the current arrival time of the current real-time message and the arrival time of the previous message; and to determine the reference period deviation of the current logical flow based on the message time interval and the reference period.

[0115] Optionally, the change factor determination module 403 can be used to extract the corresponding mask template according to the matched operator template; fill the mask template into a mask matrix of the same length as the current real-time message, and set the corresponding bits to zero according to the preset mask position; perform a bitwise AND operation between the mask matrix and the current real-time message, perform a hash calculation on the operation result, and obtain the current message status fingerprint of the current real-time message.

[0116] Optionally, the change factor determination module 403 can also be used to: assign the fingerprint change factor to 1 when there is no historical packet state fingerprint in the flow state context cache table; and perform an XOR operation between the current packet state fingerprint and the historical packet state fingerprint when there is a historical packet state fingerprint in the flow state context cache table; if the operation result is 0, then assign the fingerprint change factor to 0; if the operation result is not 0, then assign the fingerprint change factor to 1.

[0117] Optionally, the upload processing module 404 can be specifically used to perform a weighted calculation of the baseline period deviation and the fingerprint change factor based on time-sensitive weight and business-sensitive weight to obtain the sampling score value of the current logical flow; compare the sampling score value with a preset acquisition strategy change threshold; if the sampling score value is less than the preset acquisition strategy change threshold, then sample and upload the current real-time message according to a preset low-frequency sampling probability; if the sampling score value is greater than or equal to the preset acquisition strategy change threshold, then upload the current real-time message in its entirety.

[0118] Optionally, the system may further include a benchmark period management module.

[0119] The benchmark cycle management module is used for: Update the current arrival time of the current real-time message and the current message status fingerprint to the flow state context cache table; Obtain the preset length of the circular observation buffer and the current data volume of the buffer. Based on the preset length and the current data volume of the buffer, update the time interval of the current logical flow and the fingerprint change factor as a record to the circular observation buffer corresponding to the current logical flow. If the baseline period of the current logic flow is not initialized, then the baseline period learning of the current logic flow is performed based on the historical data in the circular observation buffer; Otherwise, when the fingerprint change factors corresponding to the most recent preset number of observation records in the circular observation buffer are all 0 and the deviation of the reference period corresponding to the most recent preset number of observation records is within the preset threshold range, the median filtering update process of the reference period is triggered.

[0120] Optional, the benchmark period management module can be used for: The effective time interval of the current logical flow is accumulated in the circular observation buffer; When the number of valid time intervals reaches a preset number, the valid time intervals are sorted. The time interval at the middle position after sorting is determined as the initial reference period of the current logic flow.

[0121] Optionally, the median filter update process for the baseline period may include: All time intervals in the annular observation buffer are sorted, and the value at the middle position after sorting is extracted as a candidate reference period. Using a preset learning rate, the reference period of the current logic flow is smoothly updated based on the candidate reference period.

[0122] The data traffic acquisition system in the power communication network provided in this embodiment of the invention can execute the data traffic acquisition method in the power communication network provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

Claims

1. A method for collecting data traffic in a power communication network, characterized in that, The method is applied to power-side edge gateways and includes: The intercepted heterogeneous power packets are identified as current real-time packets, and a unique logical identifier for the current logical flow to which the current real-time packet belongs is determined. The flow state context cache table is queried based on the unique logical tag to determine the historical flow state information of the current logical flow, and the baseline cycle deviation of the current logical flow is determined based on the historical flow state information. The current real-time message is processed according to the mask template in the associated operator template, the current message state fingerprint of the current real-time message is generated, and the fingerprint change factor of the current logical flow is determined according to the flow state context cache table and the current message state fingerprint. The current real-time message is sent up by integrating the baseline period deviation and the fingerprint change factor.

2. The method according to claim 1, characterized in that, The unique logical identifier used to determine the current logical flow to which the current real-time message belongs includes: The bearer type of the current real-time message is determined based on the Ethernet type field in the current real-time message. Based on the bearer type, the current real-time message is matched with an operator template in the operator template library; When a unique operator template is matched, the flow identifier field is extracted from the current real-time message according to the unique operator template, and the flow identifier field is merged to generate a unique logical tag of the current logical flow to which the current real-time message belongs.

3. The method according to claim 2, characterized in that, The step of matching the current real-time message with an operator template in the operator template library according to the bearer type includes: When the bearer type is link layer direct connection protocol traffic, the Ethernet type field of the current real-time message is used as the protocol type, and operator template matching is performed on the current real-time message in the operator template library according to the protocol type; When the bearer type is IP traffic, read the upper-layer protocol type from the IP header; If the current packet is an IPv6 packet, skip the extension header and determine the actual upper-layer protocol corresponding to the upper-layer protocol type; If the actual layer protocol is TCP or UDP, then read the source port number and the destination port number, and take the combination of the actual layer protocol and the source port number, and the combination of the actual layer protocol and the destination port number as candidate matching items respectively; If the actual underlying protocol is not TCP or UDP, then the actual underlying protocol is used as a candidate match. Based on the candidate matching items, the current real-time message is matched with an operator template in the operator template library.

4. The method according to claim 2, characterized in that, Also includes: If, based on the bearer type, no operator template matching the current real-time message is found, or multiple operator templates matching the current real-time message are found, then the current real-time message is sent directly, and the processing of the current real-time message ends.

5. The method according to claim 2, characterized in that, The step of extracting the flow identifier field from the current real-time message according to the operator template, merging the flow identifier field, and generating a unique logical identifier for the current logical flow to which the current real-time message belongs includes: Based on the operator template, extract the primary identifier and the secondary identifier from the current real-time message; The first-level identifier and the second-level identifier are concatenated, and the concatenation result is hashed to obtain the unique logical identifier of the current logical flow; Wherein, when the current real-time message is a link layer direct connection protocol traffic, the first-level identifier is a combination of source MAC address, destination MAC address and protocol type; When the current real-time message is TCP or UDP-type IP traffic, the first-level identifier is a combination of source IP address, destination IP address, transport layer protocol identifier, source port number and destination port number; When the current real-time packet is traffic from other IP upper-layer protocols that does not use port numbers, the first-level identifier is a combination of the source IP address, the destination IP address, and the IP upper-layer protocol type; The secondary identifier is an application tag read from the protocol payload of the current real-time message based on the application tag position defined in the operator template.

6. The method according to claim 1, characterized in that, The historical stream status information includes the arrival time of the previous message, the status fingerprint of the previous message, and the reference period; The step of determining the baseline cycle deviation of the current logical flow based on the historical flow state information includes: The message time interval is determined based on the current arrival time of the current real-time message and the arrival time of the previous message; The deviation of the reference period of the current logical flow is determined based on the message time interval and the reference period.

7. The method according to claim 1, characterized in that, The step of processing the current real-time message according to the mask template in the associated operator template to generate the current message state fingerprint of the current real-time message includes: Extract the corresponding mask template based on the matched operator template; The mask template is filled into a mask matrix of the same length as the current real-time message, and the corresponding bits are set to zero according to the preset mask position; Perform a bitwise AND operation between the mask matrix and the current real-time message, and hash the result to obtain the current message status fingerprint of the current real-time message.

8. The method according to claim 1, characterized in that, The step of determining the fingerprint change factor of the current logical flow based on the historical flow state information and the current message state fingerprint includes: When the historical packet state fingerprint does not exist in the flow state context cache table, the fingerprint change factor is set to 1. When a historical packet state fingerprint exists in the flow state context cache table, the current packet state fingerprint is XORed with the historical packet state fingerprint. If the calculation result is 0, then the fingerprint change factor is assigned a value of 0; If the result of the calculation is not 0, then the fingerprint change factor is assigned a value of 1.

9. The method according to claim 1, characterized in that, The process of fusing the baseline period deviation and the fingerprint change factor to send the current real-time message includes: Based on time-sensitive weights and business-sensitive weights, the deviation of the baseline period and the fingerprint change factor are weighted and calculated to obtain the sampling score value of the current logic flow. The sampled score value is compared with a preset threshold for changing the acquisition strategy. If the sampling score is less than the preset acquisition strategy change threshold, the current real-time message is sampled and sent up according to the preset low-frequency sampling probability. If the sampling score is greater than or equal to the preset acquisition strategy change threshold, then the current real-time message is sent in full.

10. The method according to claim 1, characterized in that, Also includes: Update the current arrival time of the current real-time message and the current message status fingerprint to the flow state context cache table; Obtain the preset length of the circular observation buffer and the current data volume of the buffer. Based on the preset length and the current data volume of the buffer, update the time interval of the current logical flow and the fingerprint change factor as a record to the circular observation buffer corresponding to the current logical flow. If the baseline period of the current logic flow is not initialized, then the baseline period learning of the current logic flow is performed based on the historical data in the circular observation buffer; Otherwise, when the fingerprint change factors corresponding to the most recent preset number of observation records in the circular observation buffer are all 0 and the deviation of the reference period corresponding to the most recent preset number of observation records is within the preset threshold range, the median filtering update process of the reference period is triggered.

11. The method according to claim 10, characterized in that, The step of performing baseline periodic learning of the current logical flow based on historical data in the circular observation buffer includes: The effective time interval of the current logical flow is accumulated in the circular observation buffer; When the number of valid time intervals reaches a preset number, the valid time intervals are sorted. The time interval at the middle position after sorting is determined as the initial reference period of the current logic flow.

12. The method according to claim 10, characterized in that, The median filtering update process for the reference period includes: All time intervals in the annular observation buffer are sorted, and the value at the middle position after sorting is extracted as a candidate reference period. Using a preset learning rate, the reference period of the current logic flow is smoothly updated based on the candidate reference period.

13. A data traffic acquisition system in a power communication network, the system being deployed at a power-side edge gateway, comprising: The message acquisition and tag determination module is used to identify the intercepted heterogeneous power messages as current real-time messages and determine the unique logical tag of the current real-time message to which the current logical flow belongs. The deviation determination module is used to query the flow state context cache table based on the unique logical tag, determine the historical flow state information of the current logical flow, and determine the baseline period deviation of the current logical flow based on the historical flow state information. The change factor determination module is used to process the current real-time message according to the mask template in the associated operator template, generate the current message state fingerprint of the current real-time message, and determine the fingerprint change factor of the current logical flow according to the flow state context cache table and the current message state fingerprint. The uploading processing module is used to integrate the baseline period deviation and the fingerprint change factor to perform uploading processing on the current real-time message.

14. The system according to claim 13, characterized in that, The system also includes: a baseline period management module. The benchmark period management module is used for: Update the current arrival time of the current real-time message and the current message status fingerprint to the flow state context cache table; Obtain the preset length of the circular observation buffer and the current data volume of the buffer. Based on the preset length and the current data volume of the buffer, update the time interval of the current logical flow and the fingerprint change factor as a record to the circular observation buffer corresponding to the current logical flow. If the baseline period of the current logic flow is not initialized, then the baseline period learning of the current logic flow is performed based on the historical data in the circular observation buffer; Otherwise, when the fingerprint change factors corresponding to the most recent preset number of observation records in the circular observation buffer are all 0 and the deviation of the reference period corresponding to the most recent preset number of observation records is within the preset threshold range, the median filtering update process of the reference period is triggered.

Images