A distributed photovoltaic inverter network security monitoring method

Abstract

The application discloses a kind of distributed photovoltaic inverter network security monitoring methods, comprising: S1, the communication message of inverter in target distributed photovoltaic power station, operating state data and control instruction data are acquired, asset image table is established, equipment association, time alignment and window division are completed;S2, network layer feature and photovoltaic service semantic feature are extracted, and current feature vector is formed;S3, identify operating condition, and form operating condition identification;S4, form candidate group and same condition contrast group;S5, form individual history baseline and group real-time baseline;S6, the individual standard deviation and group standard deviation of inverter are calculated, and then form individual deviation and group deviation;S7, perform validity check, double threshold determination, abnormal duration determination and abnormal feature item positioning, output network exception event, return S1, and continuously monitor.The application reduces the false alarm caused by legal operating condition change, and identifies the network anomaly of single inverter.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring in power monitoring systems, and more particularly to a network security monitoring method for distributed photovoltaic inverters. Background Technology

[0002] As the operation mode of distributed photovoltaic power stations evolves from "all for self-consumption" to "self-generation and self-consumption with surplus power fed into the grid," the interaction between inverters, transformer substation monitoring and control devices, power control systems, and dispatch communication links increases. Inverters not only perform AC / DC energy conversion but also receive commands for start-up or shutdown, active power limiting (requiring the inverter's output active power to not exceed the limit), reactive power regulation, and parameter reading. If network anomalies occur in the inverter's communication link, such as denial-of-service, man-in-the-middle tampering, unauthorized write commands, or abnormal scanning, it may affect telemetry updates, power control, and grid-connected operation.

[0003] To avoid impacting production control operations, existing distributed photovoltaic power stations generally acquire communication messages in a bypass, read-only manner through the mirror port or equivalent message copy interface of the station control layer switch. Although this does not require changing the original control link, bypass acquisition alone cannot solve the problem of significant changes in communication modes caused by different legitimate operating conditions. Inverters exhibit different communication rhythms under different operating conditions, such as maximum power point tracking, active power limitation, nighttime standby, startup, reactive power regulation, and maintenance. If the same static threshold or a single historical model is used for all time periods, legitimate operating condition switching is easily judged as abnormal; if a wider threshold is set, the sensitivity to detecting attacks on individual inverters, configuration drift, or communication failures will be reduced.

[0004] Existing research has shown that by performing feature filtering, normalization, and machine learning classification on network packets between PLCs and controllers, denial-of-service and man-in-the-middle attacks can be detected, demonstrating the feasibility of using network packets for photovoltaic network security detection. However, this research is based on a PLC network packet dataset from a SCADA system, which is not a real-world photovoltaic power plant inverter field packet dataset. Furthermore, it does not utilize the engineering conditions that allow for cross-referencing among a large number of inverters of the same model in the same power plant under the same operating conditions.

[0005] Existing industrial control system security technologies already publicly disclose methods such as bypass traffic acquisition, protocol field parsing, historical communication profiling, traffic baseline analysis, and timing anomaly detection. Simply combining "mirror traffic acquisition" and "machine learning anomaly detection" is insufficient to distinguish between legitimate changes in the operating conditions of a power plant and single-device anomalies, and it also fails to meet the stability monitoring requirements of large-scale industrial and commercial distributed photovoltaic power plants.

[0006] Therefore, there is a need for a network security monitoring method for inverters that does not rely on a large number of attack tags, does not interfere with the control link, and can simultaneously utilize the historical patterns of the inverter itself and the group patterns of devices of the same model under the same operating conditions. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention provides a network security monitoring method for distributed photovoltaic inverters.

[0008] The present invention adopts the following technical solution: A network security monitoring method for distributed photovoltaic inverters includes the following steps: S1: Obtain communication messages, operating status data, and control command data of the inverters included in the detection range in the target distributed photovoltaic power station, establish an asset image table of the inverters, and complete device association, time alignment, and window division for the three types of data; S2, extract network layer features and photovoltaic service semantic features from the communication messages of each inverter under each sliding time window, form the current feature vector of each inverter under each sliding time window, and perform data quality marking; S3 identifies the operating conditions of each inverter based on its operating status data and control command data within each sliding time window, generates an operating condition identifier, and marks the stability of the operating condition. S4. Under each sliding time window, for each inverter, other inverters that meet the conditions are selected to form a candidate group. Further selection is performed to obtain a control group under the same operating conditions. S5. Based on the historical normal feature vector of the inverter with the same operating conditions as the current, an individual historical baseline is formed; and based on the current feature vector of each inverter in the same operating condition control group within the current sliding time window, a group real-time baseline is obtained. S6, based on the individual historical baseline and the group real-time baseline established in S5, calculates the individual standardized deviation and group standardized deviation of each feature item of the current feature vector of the inverter, and then forms the individual deviation and group deviation after truncation and weighted summation. S7, based on the individual bias and group bias obtained in S6, performs validity checks, dual threshold determination, anomaly persistence determination, and anomaly feature location, outputs network anomaly events, returns to S1, and performs continuous monitoring.

[0009] In step S1 above, the method for obtaining communication messages, running status data, and control command data is as follows: Let the inverter set D It includes all inverters within the target distributed photovoltaic power station that are included in the testing scope, with each inverter having a unique inverter identifier; By using a bypass acquisition device connected in a bypass, read-only manner to the mirror port or equivalent message copying interface of the station control layer switch in the safety zone I of the target distributed photovoltaic power station, the communication messages between all inverters and station control equipment are continuously acquired. Simultaneously, it acquires operating status data and control command data from monitoring servers, inverter data acquisition units, or power control systems; The communication message includes a message header containing source and destination communication addresses and a message payload carrying industrial communication protocol data; The operating status data includes status codes characterizing the inverter's operating status, output active power, output reactive power, fault markers, maintenance markers, communication status, clock synchronization status, equipment alarms, and irradiance corresponding to the inverter's operation. The control command data includes various control commands, including start-up and shutdown commands, active power limit commands, reactive power adjustment commands, power factor adjustment commands, and voltage adjustment commands issued by the station control equipment to the inverter.

[0010] In step S1 above: The asset image table is established based on the equipment list, nameplate, communication point table and asset ledger, and records the correspondence between inverter identifier, communication address, equipment model, rated power, grid connection point, grid connection topology branch, operating status data source identifier, control object identifier, industrial communication protocol version, firmware version and communication configuration identifier. Based on the communication address, operating status data source identifier, and controlled object identifier, these three types of data are associated with the corresponding inverters. Specifically: Based on the communication address, the communication message is divided to obtain the communication message for each inverter; Based on the operating status data source identifier, the operating status data is divided to obtain the operating status data of each inverter; Based on the controlled object identifier, the control command data is divided to obtain the control command data for each inverter; The communication messages, operating status data, and control command data are all recorded with timestamps. The clock of the unified time system or the calibrated monitoring system is used as a reliable time reference. The communication messages, operating status data, and control command data corresponding to each inverter are time-aligned according to the timestamps. Based on a unified window start time, a default sliding time window length T, and a sliding step size, the communication messages, operating status data, and control command data of each inverter after completion time alignment are processed into windows. The length T of the sliding time window is set to 10 seconds to 10 minutes according to the data sampling frequency and communication traffic; two adjacent sliding time windows can overlap each other with a sliding step size less than T.

[0011] The method for forming the current feature vector and performing data quality labeling in step S2 above is as follows: Based on inverter In the sliding time window The communication message is processed, and the feature values ​​of each feature item are calculated according to the corresponding feature template. This includes the feature items of the network layer features and the feature items of the photovoltaic service semantic features. The current feature vector is formed in the order of network layer features first and photovoltaic service semantic features second. : , In the formula, to The feature values ​​of each feature term representing the features of the network layer. The total number of feature terms in the network layer features; to The eigenvalues ​​of each feature item representing the semantic features of photovoltaic business. This represents the total number of feature items in the semantic features of photovoltaic business. When the number of missing feature items, the proportion of missing communication messages, or the proportion of message payload parsing failures reach the corresponding data quality threshold, the current feature vector is marked as unqualified data quality. In other cases, the current feature vector is marked as having acceptable data quality; The feature template, configured for different device models and industrial communication protocols, specifies the name, number, data source, and calculation rules for each feature item. Inverters with the same equipment model, compatible industrial communication protocol version, and compatible firmware or configuration that affect communication behavior use the same feature template; The network layer features include communication peer, communication direction, protocol type, port, number of messages, number of bytes, message length, message interval, number of sessions, number of connection establishments, transmission control flags, number of retransmissions, and request / response delay. The semantic features of the photovoltaic business include industrial communication protocol function code, register address or information body address, read / write type, number of consecutive addresses, exception response code, control command type, write command ratio per unit time, and request / response pairing ratio. Depending on the different characteristics, the corresponding calculation rule is selected to calculate the feature value, as follows: (1) Counting characteristics: The number of messages, the number of bytes, the number of sessions, the number of connection establishments, and the number of retransmissions are all count-type features. Each count-type feature corresponds to a feature item, and the feature value is the cumulative value within the current sliding time window. (2) Continuous characteristics: The message length, message interval, and request-response delay are continuous features, each corresponding to two feature terms, with the feature values ​​being the average and standard deviation of the valid observations, respectively. (3) Categorical characteristics: For categorical features, the feature values ​​of the feature terms are calculated in different cases, specifically: The communication peer, communication direction, protocol type, and port are categorical features that need to correspond to the counting features. Each category corresponds to one counting feature item, and the number of categories is the number of feature items corresponding to that feature. The communication counterparts are classified as monitoring hosts, data acquisition devices, power control systems, maintenance terminals, and other communication counterparts. The communication direction is divided into two categories: pointing to the inverter and being emitted by the inverter. The protocol type is determined according to the highest-level protocol obtained from message parsing; The ports are classified according to the service ports on the inverter side; The transmission control flag is set with characteristic items according to different flag bits, and the characteristic value of the characteristic item is the number of messages with the corresponding flag bit in the current sliding time window; The industrial communication protocol function code, register address or information body address, read / write type, exception response code, and control command category are categorical features whose feature values ​​are based on the frequency of occurrence of each category, and the number of categories is the number of feature items corresponding to that feature. (4) Number of contiguous addresses: The number of consecutive addresses represents the number of addresses that can be read or written consecutively by a single resolvable command, and the feature value of the corresponding feature item is the average of the number of consecutive addresses corresponding to each command within the current sliding time window; (5) Command writing ratio per unit time: The characteristic value of the proportion of write commands per unit time is determined by the ratio of the number of write commands to the total number of parseable commands within the current sliding time window; (6) Request-response matching ratio: The characteristic value of the request-response pairing ratio is determined by the ratio of the number of successfully paired requests to the total number of request messages that require a response. For count-type features where data collection is normal but the corresponding event has not occurred, the value is 0; For feature terms that have no valid observations and cannot be calculated, fill in the preset default values.

[0012] In step S3 above: The inverter's operating conditions are divided into: L0 nighttime standby, L1 startup, L2 maximum power point tracking, L3 active power limitation, L4a reactive power regulation, L4b power factor regulation, L4c voltage regulation, L5 shutdown or fault, and L6 maintenance. The operating condition is primarily determined based on the status codes, fault markers, and maintenance markers recorded in the operating status data, supplemented by the control commands recorded in the control command data, and is judged in the following order: When the maintenance mark is valid, the operating condition is determined to be L6; If the L6 condition is not met, the operating condition will be classified as L5 if the status code indicates a shutdown or fault, or if the fault flag is valid. If the L6 and L5 conditions are not met, when the status code indicates startup, the operating condition will be determined as L1. When the status code indicates operation, and the active power limit command and its corresponding set value are valid within the current sliding time window, the operating condition is determined to be L3. When the status code indicates that the system is running and the L3 condition is not met, the reactive power regulation, power factor regulation and voltage regulation are determined to be L4a, L4b and L4c respectively according to the currently valid regulation instructions. When the status code indicates operation and there is no valid power adjustment command as mentioned above, the operating condition is determined to be L2; when the status code indicates nighttime standby, the operating condition is determined to be L0. When multiple conditions are met, the inverter is determined in the order of L6, L5, L1, L3, L4a to L4c, L2, and L0. In the sliding time window The unique operating condition identifier within. ; When the status code or control command is missing or malfunctioning, making the above sequence determination impossible, the inverter's output active power is used. P out Available power estimate P avail Active power setpoint P set Irradiance G irr And auxiliary judgment of equipment alarms, as detailed below: When the irradiance G irr The output active power is below the irradiance threshold and the output active power P out When the power level is below the standby power threshold, the auxiliary determination of the operating condition is L0; When the available power estimate P avail Not lower than the minimum available power threshold P set / P avail Less than 1-δ and | P out-P set | When the tracking deviation threshold is not exceeded, the auxiliary determination of the operating condition is L3, where, δ Determined based on power measurement error and adjustment dead zone; when P out When the power level is below the shutdown power threshold, the auxiliary determination of the operating condition is L5; When multiple auxiliary conditions are met simultaneously, they are judged in the order of L5, L3 and L0; if a unique judgment cannot be made, a valid operating condition identifier is not generated and the operating condition stability flag is set to 0. Set the minimum stable residence time for the operating conditions. T stab And the T stab Not less than the length of the sliding time window T; Maintaining continuous operation under the same conditions T stab Furthermore, if no operating condition switch occurs within the current sliding time window, the operating condition stability flag will be set to 1; Not achieved T stab Alternatively, if a change in operating condition occurs within the current sliding time window, the operating condition stability flag will be set to 0; Only when the inverter In the sliding time window If the stability of the internal operating condition is marked as 1 and it does not belong to the L6 maintenance condition, continue to execute S4; The L6 maintenance mode only retains the operating status identifier and is not used for network anomaly event determination.

[0013] In step S4 above: Only when the inverter In the sliding time window When the stability flag of the operating condition within the inverter set is 1 and it does not belong to the L6 maintenance condition, based on the asset mapping table, in the inverter set D Other inverters that meet the selection criteria are selected from the list. ,and In order to construct candidate groups The filtering criteria include: Equipment model and inverter same; The industrial communication protocol version and firmware or configurations affecting communication behavior are compatible, and the same feature template is used; Sliding Time Window Internal operating condition indicators and inverter The same; The electrical connection conditions are met; The candidate group Represented as: , In the formula, and They represent inverters With inverter The equipment model, This indicates that the communication behavior is compatible. This indicates that the two satisfy the electrical association condition; the initial electrical association condition is with the inverter. Belonging to the same grid connection point; For the candidate group The inverters in the study were screened for inclusion validity to form a control group under the same operating conditions. : , In the formula, Indicates inverter In the sliding time window The entry validity flag is only valid if the inverter... When the operating conditions are stable, the current feature vector data quality is acceptable, it is not under maintenance, the communication and clock status are normal, the topology relationship has been confirmed, and there are no unrecovered abnormal states, let To bring it into the control group under the same working conditions; if any condition is not met, let And remove it; For inverters of the same model and with compatible communication behavior, set the minimum group size according to the model. ; when When this condition is met, the electrical association condition is changed to the electrical distance between the grid connection points of the inverters not exceeding a preset threshold, and the candidate group is reconstructed. Therefore, a new control group under the same working conditions was constructed to screen for enrollment effectiveness. ; The electrical distance is determined based on at least one of the following: shared bus level, number of branches in the grid topology, or equivalent impedance of the branches; if the requirement is still not met after reconstruction screening... At that time, mark the current control group under the same working condition as invalid; When inverter In the sliding time window The control group under the same working conditions within the range meets the requirements. At that time, S5 is executed.

[0014] In step S5 above: The historical normal feature vector is the inverter extracted using the same method as S2. The feature vector under the historical normal sliding time window; the historical normal sliding time window refers to the historical sliding time window that has been verified by historical operation records or manually reviewed and confirmed to be stable in operation, qualified in feature vector data quality, normal in communication and clock status, not under maintenance, confirmed in topology relationship and without abnormal status. The individual historical baseline includes the individual historical center and the individual discrete scale, wherein: No. Individual historical center of each characteristic item The calculation formula is: , Corresponding individual discrete scale The formula is: , In the formula: ; For inverter All operating conditions are identified as follows: The set of historical normal sliding time windows, This refers to the historical normal sliding time window; For inverter In the historical sliding time window Inner The eigenvalues ​​of each feature term; To take the median; The preset positive number; When the historical normal sliding time window set The number of historical normal sliding time windows included is less than the corresponding minimum number of historical normal sliding time windows. If this happens, inverter anomaly detection will not continue, and the system will be marked as baseline establishment in progress. The minimum number of historical normal sliding time windows Different values ​​are set according to different inverter-operating condition combinations; Based on the same working condition control group Each inverter in the sliding time window Given the current feature vector, calculate the real-time baseline of the population, including the real-time center of the population and the discrete scale of the population, where: No. Real-time center for groups with individual features The formula is: , Corresponding population discrete scale : , In the formula: Inverters in the same operating condition control group In the sliding time window The first The eigenvalues ​​of each feature term; This represents the lower bound of the discrete scale of the population.

[0015] In step S6 above: For the Individual characteristic terms, standardized deviation and group standardization bias They are represented as follows: , , To suppress the excessive dominance of a single extreme feature on the total bias, the individual standardized bias and the group standardized bias are truncated using truncation functions, the formulas of which are as follows: , In the formula, This is the preset truncation limit; The individual and population standardized deviations of the truncated feature terms are summed according to their feature weights to obtain the individual bias. and group bias The formula is as follows: , , In the formula, For the first Each feature term has a non-negative feature weight, and the sum of all feature weights is 1.

[0016] In step S7 above: (1) Validity check: For inverters A sliding time window that simultaneously meets the following validity conditions is determined as a valid decision window: Inverter The operating conditions are stable, it is not under maintenance, the communication and clock status are normal, and the topology has been confirmed. Inverter The current feature vector data is of acceptable quality; Inverter Individual historical baselines have been established; Inverter The control group under the same working conditions was effective; For sliding time windows deemed valid, a dual threshold determination is performed to check whether individual bias and group bias simultaneously exceed their respective thresholds, and the determination quantity is determined based on the determination results. The value of is given by the following formula: , in, This represents an indicator function, which takes the value 1 if the condition within the parentheses is true, and 0 otherwise. and These are the individual threshold and the group threshold, respectively. (2) Determination of Abnormal Persistence: When the number of consecutive valid decision windows reaches At that time, if at least one of them When an individual deviation exceeds the individual threshold and the group deviation exceeds the group threshold, an anomaly exists and the anomaly persists. In this case, the inverter... If the situation is abnormal, continue to locate the abnormal features. in, for Find the minimum number of windows that are equal to 1, and ; (3) Location of abnormal feature items: Calculate the first one respectively Individual contribution of each feature to individual bias and the group contribution to group bias : , , Characteristic items whose individual or group contribution exceeds the corresponding contribution threshold are identified as abnormal characteristic items; Further utilize communication messages to pinpoint abnormal features to at least one of the following: communication peer, industrial communication protocol function code, register address or information body address, read / write type, and request / response phase; If inverter If the inverter is not in an abnormal state before the test, but is in an abnormal state after the test, it will be marked as an abnormal state and a network abnormal event will be output. The output network abnormal event includes the inverter identifier, operating condition, and abnormal feature items. If the inverter is already in an abnormal state and is still in an abnormal state after the test, the abnormal state will be maintained to avoid repeatedly outputting events for the same persistent abnormality.

[0017] Self-inverter When individual and group biases first exceed the corresponding thresholds simultaneously, the inclusion of the corresponding sliding time window into the historical normal sliding time window set is suspended, and the updating of the individual historical baseline is suspended. If no network anomaly event has occurred, and the individual and group deviations of the subsequent effective judgment window do not exceed the corresponding thresholds, then the update will resume from the sliding time window that meets the conditions for updating the individual historical baseline. If a network anomaly event has already been reported, continue to suspend individual historical baseline updates until continuous updates are achieved. When the individual and group deviations of each valid decision window do not exceed the corresponding thresholds, the abnormal state is confirmed to be resolved, and the individual historical baseline update is resumed from the valid sliding time window after the abnormal state is resolved. The individual threshold Group threshold Contribution threshold , as well as The calibration is performed based on the corresponding inverter's equipment model and historical normal operating data.

[0018] Compared with the prior art, the present invention has the following beneficial effects: 1. By using operating conditions as the individual historical baseline selection and candidate group composition conditions, different operating conditions adopt corresponding references, reducing false alarms of network communication anomalies caused by natural changes in operating conditions.

[0019] 2. Simultaneously calculating the individual deviation of the inverter relative to its individual historical baseline and the group deviation relative to the group's real-time baseline, it is possible to identify network communication anomalies of a single inverter without relying on a large number of attack samples, and reduce the common-mode impact caused by unified scheduling and weather changes.

[0020] 3. The real-time baseline of the group excludes the inverters to be tested, and combined with the screening of the inclusion validity of the control group under the same operating conditions, the default minimum group size and the abnormal persistence conditions, the impact of outliers, short-term jitter and invalid data on the judgment results is reduced.

[0021] 4. By identifying abnormal features through individual and group contributions, and locating them to the communication peer, industrial communication protocol function code, register address or information body address, and request / response stage, the interpretability of network anomalies and the efficiency of operation and maintenance location are improved.

[0022] 5. Communication messages are collected in a bypass, read-only manner, without sending control commands to inverters or station control equipment, and without changing the production control communication path. This method is suitable for existing distributed photovoltaic power stations. Attached Figure Description

[0023] Figure 1 This is a flowchart of the distributed photovoltaic inverter network security monitoring method of the present invention; Figure 2 This is a schematic diagram illustrating the process of constructing the candidate group and the control group under the same working conditions in this invention. Detailed Implementation

[0024] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0025] like Figure 1 and Figure 2 As shown, a network security monitoring method for distributed photovoltaic inverters according to the present invention includes the following steps: S1: Obtain communication messages, operating status data, and control command data of the inverters included in the detection range in the target distributed photovoltaic power station, establish an asset image table of the inverters, and complete device association, time alignment, and windowing for these three types of data. The specific operations are as follows: S11, Obtain communication messages, operating status data, and control command data of the inverters included in the detection range in the target distributed photovoltaic power station: Let the inverter set D It includes all inverters within the target distributed photovoltaic power station that are included in the testing scope, with each inverter having a unique inverter identifier.

[0026] By using a bypass acquisition device connected in a bypass, read-only manner to the mirror port or equivalent message copy interface of the station control layer switch in the safety zone I of the distributed photovoltaic power station (target power station), all communication messages between the inverters and the station control equipment are continuously collected.

[0027] Simultaneously, it acquires inverter operating status data and control command data from monitoring servers, inverter data acquisition units, or power control systems.

[0028] The communication message includes a message header containing source and destination communication addresses and a message payload carrying industrial communication protocol data.

[0029] The operating status data includes status codes characterizing the inverter's operating status, output active power, output reactive power, fault markers, maintenance markers, communication status, clock synchronization status, equipment alarms, and irradiance corresponding to the inverter's operation.

[0030] The control command data includes various control commands such as start-up and stop commands, active power limit commands, reactive power adjustment commands, power factor adjustment commands, and voltage adjustment commands issued by the station control equipment to the inverter.

[0031] S12, Create the inverter asset mapping table: Based on the equipment list, nameplate, communication point list and asset ledger, establish an asset mapping table for the inverter, and record the correspondence between the inverter identifier, communication address, equipment model, rated power, grid connection point, grid connection topology branch, operating status data source identifier, controlled object identifier, industrial communication protocol version, firmware version and communication configuration identifier.

[0032] S13, perform device association, time alignment, and windowing on the communication messages, operating status data, and control command data: Based on the communication address, the operating status data source identifier, and the control object identifier, three types of data are associated with the corresponding inverters. Specifically: based on the communication address, the communication message is divided to obtain the communication message for each inverter; based on the operating status data source identifier, the operating status data is divided to obtain the operating status data for each inverter; based on the control object identifier, the control command data is divided to obtain the control command data for each inverter.

[0033] The communication messages, operating status data, and control command data are all timestamped. Using a unified time synchronization system or a calibrated monitoring system clock as a reliable time reference, the communication messages, operating status data, and control command data corresponding to each inverter are time-aligned according to the timestamps.

[0034] After time alignment is completed, the communication messages, operating status data and control command data of each inverter are processed in separate windows according to a unified window start time, default sliding time window length T and sliding step size.

[0035] The length T of the sliding time window can be set from 10 seconds to 10 minutes according to the data sampling frequency and communication traffic; two adjacent sliding time windows can overlap each other with a sliding step size less than T.

[0036] S2, extract network layer features and photovoltaic service semantic features from the communication messages of each inverter under each sliding time window to form the current feature vector, and perform data quality labeling: Based on inverter In the sliding time window The communication message is processed, and the feature values ​​of each feature item are calculated according to the corresponding feature template. This includes the feature items of the network layer features and the feature items of the photovoltaic service semantic features. The current feature vector is formed in the order of network layer features first and photovoltaic service semantic features second. : , In the formula, to The feature values ​​of each feature term representing the features of the network layer. The total number of feature terms in the network layer features; to The eigenvalues ​​of each feature item representing the semantic features of photovoltaic business. This represents the total number of feature items in the semantic features of photovoltaic business.

[0037] When the number of missing feature items, the proportion of missing communication messages, or the proportion of message payload parsing failures reach the corresponding data quality threshold, the current feature vector is marked as having unqualified data quality; otherwise, the current feature vector is marked as having qualified data quality.

[0038] The feature template specifies the name, number, data source, and calculation rules of each feature item for different device models and industrial communication protocol configurations; inverters with the same device model, industrial communication protocol version, and firmware or configuration compatible with the communication behavior use the same feature template.

[0039] The network layer features include the communication peer, communication direction, protocol type, port, number of messages, number of bytes, message length, message interval, number of sessions, number of connection establishments, transmission control flags, number of retransmissions, and request / response delay.

[0040] The semantic features of the photovoltaic business include industrial communication protocol function codes, register addresses or information body addresses, read / write types, number of consecutive addresses, exception response codes, control command categories, write command ratio per unit time, and request / response pairing ratio.

[0041] Depending on the different characteristics, the corresponding calculation rule is selected to calculate the feature value, as follows: (1) Counting characteristics: The number of messages, bytes, sessions, connection establishments, and retransmissions are all count-type features. Each count-type feature corresponds to a feature item, and the feature value is the cumulative value within the current sliding time window.

[0042] For example, when collecting 240 messages, the message count is set to 240.

[0043] (2) Continuous characteristics: The message length, message interval, and request-response delay are continuous features, each corresponding to two feature terms, with the feature values ​​being the average and standard deviation of the valid observations, respectively. For example, when the message length is 80 bytes, 100 bytes, 100 bytes, and 120 bytes respectively, the average value is 100 bytes, and the standard deviation is approximately 14.14 bytes.

[0044] (3) Categorical characteristics: For categorical features, the feature values ​​of the feature terms are calculated in different cases, specifically: The communication peer, communication direction, protocol type, and port are categorical features that need to correspond to the counting features. Each category corresponds to one counting feature item, and the number of categories is the number of feature items corresponding to that feature. The communication counterparts are classified as monitoring hosts, data acquisition devices, power control systems, maintenance terminals, and other communication counterparts.

[0045] The communication direction is divided into two categories: pointing to the inverter and being emitted by the inverter.

[0046] The protocol type is determined according to the highest-level protocol obtained from message parsing and is divided into categories such as Modbus / TCP, IEC104, other industrial communication protocols, and other protocols.

[0047] The ports are classified according to the service ports on the inverter side.

[0048] For example, if there are 200 messages associated with the inverter within the current sliding time window, of which 120, 50 and 30 are communicating with the monitoring host, data acquisition unit and power control system respectively, then the corresponding characteristic items of the communication peer end are 120, 50 and 30 respectively.

[0049] The transmission control flags are configured with characteristic items according to the SYN, ACK, FIN and RST flags, and the characteristic value of the characteristic item is the number of packets with the corresponding flag in the current sliding time window.

[0050] The industrial communication protocol function code, register address or information body address, read / write type, exception response code, and control command category are categorical features whose feature values ​​are determined by the frequency of occurrence of each category, and the number of categories is the number of feature items corresponding to that feature.

[0051] For example, when function code 03 and function code 16 appear 60 times and 5 times respectively, the corresponding feature terms take values ​​of 60 and 5 respectively.

[0052] (4) Number of contiguous addresses: The number of consecutive addresses represents the number of addresses that can be read or written consecutively by a single resolvable command, and the characteristic value of the corresponding feature item is the average number of consecutive addresses corresponding to each command within the current sliding time window.

[0053] For example, when three commands access 8, 10, and 12 addresses consecutively, respectively, the average number of consecutive addresses is 10.

[0054] (5) Command writing ratio per unit time: The characteristic value of the proportion of write commands per unit time is determined by the ratio of the number of write commands to the total number of parseable commands within the current sliding time window.

[0055] For example, when 20 out of 100 resolvable commands are write commands, the ratio is 0.2.

[0056] (6) Request-response matching ratio: The characteristic value of the request-response pairing ratio is determined by the ratio of the number of successfully paired requests to the total number of request messages that require a response.

[0057] For example, if 96 out of 100 request messages are matched with response messages within a preset response time, the ratio is 0.96.

[0058] For count-type features where data collection is normal but the corresponding event has not occurred, the value is 0; For feature terms that have no valid observations and cannot be calculated, fill in the preset default values.

[0059] S3, based on each inverter In the sliding time window The internal operating status data and control command data identify the operating conditions of each inverter, form the current operating condition identifier, and mark the stability of the operating condition: In this embodiment, the operating conditions of the inverter are divided into: L0 nighttime standby, L1 startup, L2 maximum power point tracking, L3 active power limitation, L4a reactive power regulation, L4b power factor regulation, L4c voltage regulation, L5 shutdown or fault, and L6 maintenance. The three types of regulation conditions are labeled as L4a, L4b, and L4c, respectively, so that inverters executing different regulation commands will not be classified into the same candidate group simply because they are all in regulation state.

[0060] The operating condition is primarily determined based on the status codes, fault markers, and maintenance markers recorded in the operating status data, supplemented by the control commands recorded in the control command data, and is judged in the following order: When the maintenance mark is valid, the operating condition is determined to be L6; If the L6 condition is not met, the operating condition will be classified as L5 if the status code indicates a shutdown or fault, or if the fault flag is valid. If the L6 and L5 conditions are not met, when the status code indicates startup, the operating condition will be determined as L1. When the status code indicates operation, and the active power limit command and its corresponding set value are valid within the current sliding time window, the operating condition is determined to be L3. When the status code indicates that the system is running and the L3 condition is not met, the reactive power regulation, power factor regulation and voltage regulation are determined to be L4a, L4b and L4c respectively according to the currently valid regulation instructions. When the status code indicates operation and there is no valid power adjustment command as mentioned above, the operating condition is determined to be L2; when the status code indicates nighttime standby, the operating condition is determined to be L0. When multiple conditions are met, the inverter is determined in the order of L6, L5, L1, L3, L4a to L4c, L2, and L0. In the sliding time window The unique operating condition identifier within. .

[0061] When the status code or control command is missing or malfunctioning, making the above sequence determination impossible, the inverter's output active power is used. P out Available power estimate P avail (Based on the irradiance G) irr (Determination of inverter rated power and historical normal operation data) Active power setpoint P set Irradiance G irr And auxiliary judgment of equipment alarms, as detailed below: When the irradiance G irr The output active power is below the irradiance threshold and the output active power P out When the power level is below the standby power threshold, the auxiliary determination of the operating condition is L0; When the available power estimate P avail Not lower than the minimum available power threshold P set / P avail Less than 1-δ and | P out -P set | When the tracking deviation threshold is not exceeded, the auxiliary judgment of the operating condition is L3, where δ is determined based on the power measurement error and the adjustment dead zone; when P out When the power level is below the shutdown power threshold, the auxiliary determination of the operating condition is L5; When multiple auxiliary conditions are met simultaneously, they are judged in the order of L5, L3, and L0; if a unique judgment cannot be made, a valid operating condition identifier is not generated, and the operating condition stability flag is set to 0.

[0062] Set the minimum stable residence time for the operating conditions. T stab And the T stabNot less than the sliding time window length T. Maintain continuously at the same operating condition to achieve... T stab If no operating condition switch occurs within the current sliding time window, the operating condition stability flag is set to 1; if not, the stability flag is not set. T stab Alternatively, when a change in operating condition occurs within the current sliding time window, the stability flag of the operating condition will be set to 0.

[0063] Only when the inverter In the sliding time window If the stability of the operating condition is marked as 1 and it does not belong to the L6 maintenance condition, continue to execute S4.

[0064] The L6 maintenance mode only retains the operating status identifier and is not used for network anomaly event determination.

[0065] S4, in the sliding time window Below, for each inverter Other inverters that meet the criteria are selected to form a candidate group; further screening yields a control group under the same operating conditions.

[0066] Only when the inverter In the sliding time window When the stability flag of the operating condition within the inverter set is 1 and it does not belong to the L6 maintenance condition, based on the asset mapping table, in the inverter set D Other inverters that meet the selection criteria are selected from the list. ,and In order to construct candidate groups The filtering criteria include: Equipment model and inverter same; The industrial communication protocol version and firmware or configurations affecting communication behavior are compatible, and the same feature template is used; Sliding Time Window Internal operating condition indicators and inverter The same; The electrical connection conditions are met.

[0067] The candidate group Represented as: , In the formula, and They represent inverters With inverter The equipment model, This indicates that the communication behavior is compatible. This indicates that the two satisfy the electrical association condition.

[0068] The initial electrical association condition is with the inverter. They belong to the same grid connection point.

[0069] For the candidate group The inverters in the study were screened for inclusion validity to form a control group under the same operating conditions. : , In the formula, Indicates inverter In the sliding time window The entry validity flag is only valid if the inverter... When the operating conditions are stable, the current feature vector data quality is acceptable, it is not under maintenance, the communication and clock status are normal, the topology relationship has been confirmed, and there are no unrecovered abnormal states, let To bring it into the control group under the same working conditions; if any condition is not met, let And remove it.

[0070] For inverters of the same model and with compatible communication behavior, set the minimum group size according to the model. Its value is determined based on the actual number of devices in the corresponding device model group and historical normal data.

[0071] when When this condition is met, the electrical association condition is changed to the electrical distance between the grid connection points of the inverters not exceeding a preset threshold, and the candidate group is reconstructed. Therefore, a new control group under the same working conditions was constructed to screen for enrollment effectiveness. The electrical distance is determined based on at least one of the following: shared bus level, number of branches in the grid topology, or equivalent impedance of the branches; if the requirement is still not met after reconstruction screening... At that time, the current control group under the same working conditions will be marked as invalid.

[0072] When inverter In the sliding time window The control group under the same working conditions within the range meets the requirements. At that time, S5 is executed.

[0073] S5. Based on the historical normal feature vector of the inverter with the same operating conditions as the current inverter, an individual historical baseline is formed; and based on the current feature vector of each inverter in the same operating condition control group within the current sliding time window, a group real-time baseline is obtained.

[0074] The historical normal feature vector is the inverter extracted using the same method as S2. Feature vectors within a historical normal sliding time window. The historical normal sliding time window refers to a historical sliding time window that has been verified through historical operation records or manual review, confirming stable operating conditions, qualified feature vector data quality, normal communication and clock status, no maintenance status, confirmed topology relationships, and the absence of abnormal conditions.

[0075] The individual historical baseline includes the individual historical center and the individual discrete scale, wherein: No. ( Individual historical center of 10 characteristic items The calculation formula is: , Corresponding individual discrete scale The formula is: , In the formula: For inverters All operating conditions are identified as follows: The set of historical normal sliding time windows, This refers to the historical normal sliding time window; For inverters In the historical sliding time window Inner The eigenvalues ​​of each feature term; To take the median; 1.4826 is used to convert the absolute deviation of the median to the order of standard deviation when the distribution is approximately normal; To prevent the discrete scale from being a preset positive number of zero.

[0076] When the historical normal sliding time window set The number of historical normal sliding time windows included is less than the corresponding minimum number of historical normal sliding time windows. If this occurs, inverter anomaly detection will not continue, and the system will be marked as baseline establishment in progress.

[0077] The minimum number of historical normal sliding time windows Different values ​​are set depending on the different inverter-operating condition combinations.

[0078] Based on the aforementioned control group under the same working conditions Each inverter in the sliding time window Given the current feature vector, calculate the real-time baseline of the population, including the real-time center of the population and the discrete scale of the population, where: No. Real-time center of a group with individual features The formula is: , Corresponding population discrete scale : , In the formula: Inverters in the same operating condition control group In the sliding time window The first The eigenvalues ​​of each feature term; The lower limit of the population discrete scale is a pre-calibrated lower limit of the population discrete scale based on historical normal population data under the same equipment model and operating conditions. It is used to prevent the population discrete scale from being too small when the control group is small or the current feature values ​​are too close.

[0079] The resulting individual historical baseline and group real-time baseline respectively reflect the inverter's... The historical normal characteristic levels under the same operating conditions and the common characteristic levels of the control group under the same operating conditions within the current sliding time window.

[0080] S6, based on the individual historical baseline and group real-time baseline established in S5, calculates the inverter respectively. The current feature vector The individual and group standardized deviations of each feature item are then truncated and weighted to form individual and group biases.

[0081] For the Individual characteristic terms, standardized deviation and group standardization bias They are represented as follows: , .

[0082] To suppress the excessive dominance of a single extreme feature on the total bias, the individual standardized bias and the group standardized bias are truncated using truncation functions, the formulas of which are as follows: , In the formula, This is the preset truncation limit; The individual and population standardized deviations of the truncated feature terms are summed according to their feature weights to obtain the individual bias. and group bias The formula is as follows: , , In the formula, For the first Each feature term has a non-negative feature weight, and the sum of all feature weights is 1.

[0083] In this embodiment, the feature weights are set according to the security importance of features such as industrial communication protocol function codes, the proportion of write commands per unit time, register addresses or information body addresses, and request-response delays, and are normalized after being calibrated based on the stability of each feature item in historical normal data.

[0084] S7, based on the individual bias and group bias obtained in S6, performs validity checks, double threshold determination, anomaly persistence determination, and anomaly feature location, and outputs network anomaly events, specifically: (1) Validity check: For inverters A sliding time window that simultaneously meets the following validity conditions is determined as a valid decision window: Inverter The operating conditions are stable, it is not under maintenance, the communication and clock status are normal, and the topology has been confirmed. Inverter The current feature vector data is of acceptable quality; Inverter Individual historical baselines have been established; Inverter The control group under the same working conditions was effective.

[0085] For sliding time windows deemed valid, a dual threshold determination is performed to check whether individual bias and group bias simultaneously exceed their respective thresholds, and the determination quantity is determined based on the determination results. The value of is given by the following formula: , in, This represents an indicator function, which takes the value 1 if the condition within the parentheses is true, and 0 otherwise. and These are the individual threshold and the group threshold, respectively.

[0086] (2) Determination of Abnormal Persistence: When the number of consecutive valid decision windows reaches At that time, if at least one of them When an individual deviation exceeds the individual threshold and the group deviation exceeds the group threshold within a window, an anomaly exists and the anomaly persistence condition is met. At this point, the inverter... If the situation is abnormal, continue to locate the abnormal features. in, for Find the minimum number of windows that are equal to 1, and .

[0087] (3) Location of abnormal feature items: Calculate the first one respectively Individual contribution of each feature to individual bias and the group contribution to group bias : , , Features whose individual or group contributions exceed the corresponding contribution threshold are identified as anomalous features.

[0088] Further utilize communication messages to pinpoint abnormal characteristics to at least one of the following: communication peer, industrial communication protocol function code, register address or information body address, read / write type, and request / response phase.

[0089] If inverter If the inverter is not in an abnormal state before the test, but is in an abnormal state after the test, it will be marked as an abnormal state and a network abnormal event will be output. The output network abnormal event includes the inverter identifier, operating condition, and abnormal feature items. If the inverter is already in an abnormal state and is still in an abnormal state after the test, the abnormal state will be maintained to avoid repeatedly outputting events for the same persistent abnormality.

[0090] After detection, return to S1 for continuous monitoring.

[0091] It should be noted that: Self-inverter When individual and group biases first exceed the corresponding thresholds simultaneously, the inclusion of the corresponding sliding time window into the historical normal sliding time window set is suspended, and the updating of the individual historical baseline is suspended. If no network anomaly event has occurred, and the individual and group deviations of the subsequent effective judgment window do not exceed the corresponding thresholds, then the update will resume from the sliding time window that meets the conditions for updating the individual historical baseline. If a network anomaly event has already been reported, continue to suspend individual historical baseline updates until continuous updates are achieved. When the individual and group deviations of each valid decision window do not exceed the corresponding thresholds, the abnormal state is confirmed to be resolved, and the individual historical baseline update is resumed from the valid sliding time window after the abnormal state is resolved. The individual threshold Group threshold Contribution threshold , as well as The calibration is performed based on the corresponding inverter's equipment model and historical normal operating data.

Claims

1. A network security monitoring method for distributed photovoltaic inverters, characterized in that, Includes the following steps: S1: Obtain communication messages, operating status data, and control command data of the inverters included in the detection range in the target distributed photovoltaic power station, establish an asset image table of the inverters, and complete device association, time alignment, and window division for the three types of data; S2, extract network layer features and photovoltaic service semantic features from the communication messages of each inverter under each sliding time window, form the current feature vector of each inverter under each sliding time window, and perform data quality marking; S3 identifies the operating conditions of each inverter based on its operating status data and control command data within each sliding time window, generates an operating condition identifier, and marks the stability of the operating condition. S4. Under each sliding time window, for each inverter, other inverters that meet the conditions are selected to form a candidate group. Further selection is performed to obtain a control group under the same operating conditions. S5. Based on the historical normal feature vector of the inverter with the same operating conditions as the current, an individual historical baseline is formed; and based on the current feature vector of each inverter in the same operating condition control group within the current sliding time window, a group real-time baseline is obtained. S6, based on the individual historical baseline and the group real-time baseline established in S5, calculates the individual standardized deviation and group standardized deviation of each feature item of the current feature vector of the inverter, and then forms the individual deviation and group deviation after truncation and weighted summation. S7, based on the individual bias and group bias obtained in S6, performs validity checks, dual threshold determination, anomaly persistence determination, and anomaly feature location, outputs network anomaly events, returns to S1, and performs continuous monitoring.

2. The network security monitoring method for distributed photovoltaic inverters according to claim 1, characterized in that, In S1, the methods for obtaining communication messages, running status data, and control command data are as follows: Let the inverter set D It includes all inverters within the target distributed photovoltaic power station that are included in the testing scope, with each inverter having a unique inverter identifier; By using a bypass acquisition device connected in a bypass, read-only manner to the mirror port or equivalent message copy interface of the target distributed photovoltaic power station switch, all communication messages between the inverters and the station control equipment are continuously acquired. Simultaneously, it acquires operating status data and control command data from monitoring servers, inverter data acquisition units, or power control systems; The communication message includes a message header containing source and destination communication addresses and a message payload carrying industrial communication protocol data; The operating status data includes status codes characterizing the inverter's operating status, output active power, output reactive power, fault markers, maintenance markers, communication status, clock synchronization status, equipment alarms, and irradiance corresponding to the inverter's operation. The control command data includes various control commands, including start-up and shutdown commands, active power limit commands, reactive power adjustment commands, power factor adjustment commands, and voltage adjustment commands issued by the station control equipment to the inverter.

3. The distributed photovoltaic inverter network security monitoring method according to claim 2, characterized in that, In S1: The asset image table is established based on the equipment list, nameplate, communication point table and asset ledger, and records the correspondence between inverter identifier, communication address, equipment model, rated power, grid connection point, grid connection topology branch, operating status data source identifier, control object identifier, industrial communication protocol version, firmware version and communication configuration identifier. Based on the communication address, operating status data source identifier, and controlled object identifier, three types of data are associated with the corresponding inverters. Specifically: Based on the communication address, the communication message is divided to obtain the communication message for each inverter; Based on the operating status data source identifier, the operating status data is divided to obtain the operating status data of each inverter; Based on the controlled object identifier, the control command data is divided to obtain the control command data for each inverter; The communication messages, operating status data, and control command data are all recorded with timestamps. The clock of the unified time system or the calibrated monitoring system is used as a reliable time reference. The communication messages, operating status data, and control command data corresponding to each inverter are time-aligned according to the timestamps. Based on a unified window start time, a default sliding time window length T, and a sliding step size, the communication messages, operating status data, and control command data of each inverter after completion time alignment are processed into windows. The length T of the sliding time window is set to 10 seconds to 10 minutes according to the data sampling frequency and communication traffic; two adjacent sliding time windows can overlap each other with a sliding step size less than T.

4. The distributed photovoltaic inverter network security monitoring method according to claim 3, characterized in that, The method for forming the current feature vector and performing data quality labeling in S2 is as follows: Based on inverter In the sliding time window The communication message is processed, and the feature values ​​of each feature item are calculated according to the corresponding feature template. This includes the feature items of the network layer features and the feature items of the photovoltaic service semantic features. The current feature vector is formed in the order of network layer features first and photovoltaic service semantic features second. : ， In the formula, to The feature values ​​of each feature term representing the features of the network layer. The total number of feature terms in the network layer features; to The eigenvalues ​​of each feature item representing the semantic features of photovoltaic business. The total number of feature items representing the semantic features of photovoltaic business; When the number of missing feature items, the proportion of missing communication messages, or the proportion of message payload parsing failures reach the corresponding data quality threshold, the current feature vector is marked as unqualified data quality. In other cases, the current feature vector is marked as having acceptable data quality; The feature template specifies the name, number, data source, and calculation rules for each feature item for different device models and industrial communication protocol configurations; Inverters with the same equipment model, compatible industrial communication protocol version, and compatible firmware or configuration that affect communication behavior use the same feature template; The network layer features include communication peer, communication direction, protocol type, port, number of messages, number of bytes, message length, message interval, number of sessions, number of connection establishments, transmission control flags, number of retransmissions, and request / response delay. The semantic features of the photovoltaic business include industrial communication protocol function code, register address or information body address, read / write type, number of consecutive addresses, exception response code, control command type, write command ratio per unit time, and request / response pairing ratio. Depending on the different characteristics, the corresponding calculation rule is selected to calculate the feature value, as follows: (1) Counting characteristics: The number of messages, the number of bytes, the number of sessions, the number of connection establishments, and the number of retransmissions are all count-type features. Each count-type feature corresponds to a feature item, and the feature value is the cumulative value within the current sliding time window. (2) Continuous characteristics: The message length, message interval, and request-response delay are continuous features, each corresponding to two feature terms, with the feature values ​​being the average and standard deviation of the valid observations, respectively. (3) Categorical characteristics: For categorical features, the feature values ​​of the feature terms are calculated in different cases, specifically: The communication peer, communication direction, protocol type, and port are categorical features that need to correspond to the counting features. Each category corresponds to one counting feature item, and the number of categories is the number of feature items corresponding to that feature. The communication counterparts are classified as monitoring hosts, data acquisition devices, power control systems, maintenance terminals, and other communication counterparts. The communication direction is divided into two categories: pointing to the inverter and being emitted by the inverter. The protocol type is determined according to the highest-level protocol obtained from message parsing; The ports are classified according to the service ports on the inverter side; The transmission control flag is set with characteristic items according to different flag bits, and the characteristic value of the characteristic item is the number of messages with the corresponding flag bit in the current sliding time window; The industrial communication protocol function code, register address or information body address, read / write type, exception response code, and control command category are categorical features whose feature values ​​are based on the frequency of occurrence of each category, and the number of categories is the number of feature items corresponding to that feature. (4) Number of contiguous addresses: The number of consecutive addresses represents the number of addresses that can be read or written consecutively by a single resolvable command, and the feature value of the corresponding feature item is the average of the number of consecutive addresses corresponding to each command within the current sliding time window; (5) Command writing ratio per unit time: The characteristic value of the proportion of write commands per unit time is determined by the ratio of the number of write commands to the total number of parseable commands within the current sliding time window; (6) Request-response matching ratio: The characteristic value of the request-response pairing ratio is determined by the ratio of the number of successfully paired requests to the total number of request messages that require a response. For count-type features where data collection is normal but the corresponding event has not occurred, the value is 0; For feature terms that have no valid observations and cannot be calculated, fill in the preset default values.

5. The distributed photovoltaic inverter network security monitoring method according to claim 4, characterized in that, In S3: The inverter's operating conditions are divided into: L0 nighttime standby, L1 startup, L2 maximum power point tracking, L3 active power limitation, L4a reactive power regulation, L4b power factor regulation, L4c voltage regulation, L5 shutdown or fault, and L6 maintenance. The operating condition is primarily determined based on the status codes, fault markers, and maintenance markers recorded in the operating status data, supplemented by the control commands recorded in the control command data, and is judged in the following order: When the maintenance mark is valid, the operating condition is determined to be L6; If the L6 condition is not met, the operating condition will be classified as L5 if the status code indicates a shutdown or fault, or if the fault flag is valid. If the L6 and L5 conditions are not met, when the status code indicates startup, the operating condition will be determined as L1. When the status code indicates operation, and the active power limit command and its corresponding set value are valid within the current sliding time window, the operating condition is determined to be L3. When the status code indicates that the system is running and the L3 condition is not met, the reactive power regulation, power factor regulation and voltage regulation are determined to be L4a, L4b and L4c respectively according to the currently valid regulation instructions. When the status code indicates that the system is running and there is no valid power regulation command as described above, the operating condition will be determined as L2. When the status code indicates nighttime standby, the operating condition is determined to be L0; When multiple conditions are met, the inverter is determined in the order of L6, L5, L1, L3, L4a to L4c, L2, and L0. In the sliding time window The unique operating condition identifier within. ; When the status code or control command is missing or malfunctioning, making the above sequence determination impossible, the inverter's output active power is used. P out Available power estimate P avail Active power setpoint P set Irradiance G irr And auxiliary judgment of equipment alarms, as detailed below: When the irradiance G irr Below the irradiance threshold and the output active power P out When the power level is below the standby power threshold, the auxiliary determination of the operating condition is L0; When the available power estimate P avail Not lower than the minimum available power threshold P set / P avail Less than 1-δ and |P out -P set | When the tracking deviation threshold is not exceeded, the auxiliary determination of the operating condition is L3, where, δ Determined based on power measurement error and adjustment dead zone; when P out When the power level is below the shutdown power threshold, the auxiliary determination of the operating condition is L5; When multiple auxiliary conditions are met simultaneously, they are judged in the order of L5, L3 and L0; if a unique judgment cannot be made, a valid operating condition identifier is not generated and the operating condition stability flag is set to 0. Set the minimum stable residence time for the operating conditions. T stab And the T stab Not less than the length of the sliding time window T; Maintaining continuous operation under the same conditions T stab Furthermore, if no operating condition switch occurs within the current sliding time window, the operating condition stability flag will be set to 1; Not achieved T stab Alternatively, if a change in operating condition occurs within the current sliding time window, the operating condition stability flag will be set to 0; Only when the inverter In the sliding time window If the stability of the internal operating condition is marked as 1 and it does not belong to the L6 maintenance condition, continue to execute S4; The L6 maintenance mode only retains the operating status identifier and is not used for network anomaly event determination.

6. The distributed photovoltaic inverter network security monitoring method according to claim 5, characterized in that, In S4: Only when the inverter In the sliding time window When the stability flag of the operating condition within the inverter set is 1 and it does not belong to the L6 maintenance condition, based on the asset mapping table, in the inverter set D Other inverters that meet the selection criteria are selected from the list. ,and Thus, candidate groups are constructed. The filtering criteria include: Equipment model and inverter same; The industrial communication protocol version and firmware or configurations affecting communication behavior are compatible, and the same feature template is used; Sliding Time Window Internal operating condition indicators and inverter The same; The electrical connection conditions are met; The candidate group Represented as: ， In the formula, and They represent inverters With inverter The equipment model, This indicates that the communication behavior is compatible. This indicates that the two satisfy the electrical association condition; the initial electrical association condition is with the inverter. Belonging to the same grid connection point; For the candidate group The inverters in the study were screened for inclusion validity to form a control group under the same operating conditions. : ， In the formula, Indicates inverter In the sliding time window The entry validity flag is only valid if the inverter... When the operating conditions are stable, the current feature vector data quality is acceptable, it is not under maintenance, the communication and clock status are normal, the topology relationship has been confirmed, and there are no unrecovered abnormal states, let To bring it into the control group under the same working conditions; if any condition is not met, let And remove it; For inverters of the same model and with compatible communication behavior, set the minimum group size according to the model. ; when When this condition is met, the electrical association condition is changed to the electrical distance between the grid connection points of the inverters not exceeding a preset threshold, and the candidate group is reconstructed. Therefore, a new control group under the same working conditions was constructed to screen for enrollment effectiveness. ; The electrical distance is determined based on at least one of the following: shared bus level, number of branches in the grid topology, or equivalent impedance of the branches; if the requirement is still not met after reconstruction screening... At that time, mark the current control group under the same working condition as invalid; When the inverter In the sliding time window The control group under the same working conditions within the range meets the requirements. At that time, S5 is executed.

7. The distributed photovoltaic inverter network security monitoring method according to claim 6, characterized in that, In S5: The historical normal feature vector is the inverter extracted using the same method as S2. The feature vector under the historical normal sliding time window; the historical normal sliding time window refers to the historical sliding time window that has been verified by historical operation records or manually reviewed and confirmed to be stable in operation, qualified in feature vector data quality, normal in communication and clock status, not under maintenance, confirmed in topology relationship and without abnormal status. The individual historical baseline includes the individual historical center and the individual discrete scale, wherein: No. Individual historical center of each characteristic item The calculation formula is: ， Corresponding individual discrete scale The formula is: ， In the formula: ； For inverters All operating conditions are identified as follows: The set of historical normal sliding time windows, This refers to the historical normal sliding time window; For inverters In the historical sliding time window Inner The eigenvalues ​​of each feature term; To take the median; The preset positive number; When the historical normal sliding time window set The number of historical normal sliding time windows included is less than the corresponding minimum number of historical normal sliding time windows. If this happens, inverter anomaly detection will not continue, and the system will be marked as baseline establishment in progress. The minimum number of historical normal sliding time windows Different values ​​are set according to different inverter-operating condition combinations; Based on the aforementioned control group under the same working conditions Each inverter in the sliding time window Given the current feature vector, calculate the real-time baseline of the population, including the real-time center of the population and the discrete scale of the population, where: No. Real-time center for groups with individual features The formula is: ， Corresponding population discrete scale : ， In the formula: Inverters in the same operating condition control group In the sliding time window The first The eigenvalues ​​of each feature term; This represents the lower bound of the discrete scale of the population.

8. The network security monitoring method for distributed photovoltaic inverters according to claim 7, characterized in that, In S6: For the Individual characteristic terms, standardized deviation and group standardization bias They are represented as follows: ， ， To suppress the excessive dominance of a single extreme feature on the total bias, the individual standardized bias and the group standardized bias are truncated using truncation functions, the formulas of which are as follows: ， In the formula, This is the preset truncation limit; The individual and population standardized deviations of the truncated feature terms are summed according to their feature weights to obtain the individual bias. and group bias The formula is as follows: ， ， In the formula, For the first Each feature term has a non-negative feature weight, and the sum of all feature weights is 1.

9. The network security monitoring method for distributed photovoltaic inverters according to claim 8, characterized in that, In S7: (1) Validity check: For inverters A sliding time window that simultaneously meets the following validity conditions is determined as a valid decision window: Inverter The operating conditions are stable, it is not under maintenance, the communication and clock status are normal, and the topology has been confirmed. Inverter The current feature vector data is of acceptable quality; Inverter Individual historical baselines have been established; Inverter The control group under the same working conditions was effective; For sliding time windows deemed valid, a dual threshold determination is performed to check whether individual bias and group bias simultaneously exceed their respective thresholds, and the determination quantity is determined based on the determination results. The value of is given by the following formula: ， in, This represents an indicator function, which takes the value 1 if the condition within the parentheses is true, and 0 otherwise. and These are the individual threshold and the group threshold, respectively. (2) Determination of Abnormal Persistence: When the number of consecutive valid decision windows reaches At that time, if at least one of them When an individual deviation exceeds the individual threshold and the group deviation exceeds the group threshold, an anomaly exists and the anomaly persists. In this case, the inverter... If the situation is abnormal, continue to locate the abnormal features. in, for Find the minimum number of windows that are equal to 1, and ; (3) Location of abnormal feature items: Calculate the first one respectively Individual contribution of each feature to individual bias and the group contribution to group bias : ， ， Characteristic items whose individual or group contribution exceeds the corresponding contribution threshold are identified as abnormal characteristic items; Further utilize communication messages to pinpoint abnormal features to at least one of the following: communication peer, industrial communication protocol function code, register address or information body address, read / write type, and request / response phase; If inverter If the inverter is not in an abnormal state before the test, but is in an abnormal state after the test, it will be marked as an abnormal state and a network abnormal event will be output. The output network abnormal event includes the inverter identifier, operating condition, and abnormal feature items. If the inverter is already in an abnormal state and is still in an abnormal state after the test, the abnormal state will be maintained to avoid repeatedly outputting events for the same persistent abnormality.

10. The network security monitoring method for distributed photovoltaic inverters according to claim 9, characterized in that: Self-inverter When individual and group biases first exceed the corresponding thresholds simultaneously, the inclusion of the corresponding sliding time window into the historical normal sliding time window set is suspended, and the updating of the individual historical baseline is suspended. If no network anomaly event has occurred, and the individual and group deviations of the subsequent effective judgment window do not exceed the corresponding thresholds, then the update will resume from the sliding time window that meets the conditions for updating the individual historical baseline. If a network anomaly event has already been reported, continue to suspend individual historical baseline updates until continuous updates are achieved. When the individual and group deviations of each valid decision window do not exceed the corresponding thresholds, the abnormal state is confirmed to be resolved, and the individual historical baseline update is resumed from the valid sliding time window after the abnormal state is resolved. The individual threshold Group threshold Contribution threshold , as well as The calibration is performed based on the corresponding inverter's equipment model and historical normal operating data.

Images