Campus microgrid anomaly monitoring method and system

Abstract

The application discloses a kind of park microgrid abnormal monitoring method and system, the method first acquires equipment attribute, interactive behavior and operating state data, and multiple source messages are converted into uniform business intent event sequence by protocol analysis;Second, respectively construct device interactive behavior chart and business operating state chart;Then, generate intent response constraint unit, realize double chart mutual proof by forward response verification and reverse reason tracing, calculate business intent response residual error and double chart consistency residual error;At the same time, combined with source net load storage physical constraint, calculate physical constraint residual error;Finally, according to the current operating mode, the adaptive fusion of multiple types of residual error is carried out, and the abnormal risk value, type and evidence chain containing cause-effect chain are output.The application can effectively find business intent response abnormality, state forgery and source net load storage collaborative out of control, and through cloud edge collaborative mechanism, edge side real-time and cloud model generalization ability are considered.

Description

Technical Field

[0001] This invention relates to the field of microgrid operation monitoring technology, specifically to a method and system for monitoring anomalies in a park microgrid. Background Technology

[0002] Industrial park microgrids typically connect to various devices, including photovoltaic inverters, energy storage devices, electric vehicle charging piles, V2G equipment, flexible loads, smart meters, edge gateways, and energy management systems. With the development of source-grid-load-storage collaborative interaction, edge-side autonomy, and cloud-edge-device collaborative services, the relationships between devices are no longer simply about sending status updates, but involve complex interactions such as scheduling commands, status feedback, service calls, demand response, grid connection / off-grid control, and power coordination.

[0003] Existing anomaly detection methods mainly include rule-based protocol detection, network traffic-based anomaly detection, device profiling-based anomaly detection, time-series model-based single-device state anomaly detection, and machine learning-based classification or clustering detection. These methods can identify some unauthorized access, abnormal traffic, bursty communication, and single-point state violation issues, but they still have shortcomings in the context of collaborative interaction between microgrid sources, networks, loads, and storage in industrial parks.

[0004] First, existing methods typically treat communication messages as network traffic characteristics and operational states as time-series characteristics, modeling these two separately and lacking the ability to correlate and judge whether "device interaction behavior leads to a reasonable business state response." Second, many control messages in campus microgrids may be legal in terms of protocol format, communication objects, ports, and function codes, but their business timing, control objects, parameter amplitudes, or state responses may be unreasonable; traditional traffic anomaly detection methods struggle to identify such hidden anomalies. Third, campus microgrids have physical operational constraints such as power balance, energy storage SOC boundaries, charging and discharging mutual exclusion, charging pile electrical parameter consistency, and grid connection point power constraints; existing network security detection methods typically do not treat these constraints as evidence of anomalies. Fourth, complex cloud-based models struggle to meet the real-time detection needs of the edge side, while simple edge-side rule models are ill-suited to different operating modes and device types. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0006] The purpose of this invention is to provide a method and system for monitoring anomalies in a campus microgrid, in order to solve the problems that existing technologies cannot simultaneously characterize device interaction behavior, business operation status and source-network-load-storage physical constraints, cannot identify hidden anomalies with legal message formats but unreasonable business responses, and cannot balance real-time performance at the edge and generalization ability of cloud models.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] A method for monitoring anomalies in a park microgrid includes the following steps:

[0009] S1. Obtain device attribute information, device interaction behavior data, control log data, and business operation status data of multiple devices in the park micronet;

[0010] S2. Construct a device service role library and a service intent library based on the device attribute information;

[0011] S3. Perform protocol parsing and business semantic conversion on the device interaction behavior data and control log data to obtain a unified business intent event sequence;

[0012] S4. Construct a device interaction behavior diagram based on the unified business intent event sequence, and construct a business operation status diagram based on the business operation status data and the source-grid-load-storage coupling relationship;

[0013] S5. For each business intent event, generate an intent response constraint unit, and compare the actual state change of the target device with the intent response constraint unit to obtain the business intent response residual.

[0014] S6. Perform dual-graph mutual verification based on the device interaction behavior graph and the service operation status graph, and calculate the dual... Figure 1 Consistency residuals;

[0015] S7. Calculate physical constraint residuals based on the operational constraints of the microgrid source-grid-load-storage system in the park.

[0016] S8. Based on the current operating mode, analyze the protocol state constraint residuals, interaction behavior anomaly residuals, business intent response residuals, and dual... Figure 1 At least three types of residuals, including consistency residuals and physical constraint residuals, are adaptively fused to output anomaly risk values, anomaly types, and anomaly evidence chains. Among them, when a device communication message is legal at the protocol level but unreasonable at the business level, it is judged as an anomaly of unreasonable business behavior under a legal message.

[0017] As a preferred embodiment of the campus microgrid anomaly monitoring method described in this invention, the device attribute information includes device number, device type, IP address, port number, communication protocol, microgrid area, rated capacity, rated power, set of operating status variables, set of control commands, control permission level, and set of allowed interactive objects;

[0018] The business intent event includes the source device, occurrence time, protocol type, business action, action parameters, business intent tag, and intent confidence level.

[0019] As a preferred embodiment of the campus microgrid anomaly monitoring method described in this invention, the business semantic conversion includes: parsing the function codes, register addresses, topics, service names, data payloads, or control parameters in Modbus, IEC 61850, MQTT, OPC UA, CAN, RS485, HTTP, or HTTPS protocols, and converting them into unified business intent events according to preset mapping rules;

[0020] The business intent tags include at least one of the following: photovoltaic power transmission, photovoltaic power limiting control, energy storage charging setting, energy storage discharging setting, charging pile start-up, charging pile stop-up, V2G discharge request, flexible load reduction, grid connection point power control, and equipment alarm transmission.

[0021] As a preferred embodiment of the abnormal monitoring method for park microgrids described in this invention, the device interaction behavior graph is a dynamic graph, where nodes represent park microgrid devices, edges represent data transmission, control commands, status feedback or alarm notification relationships between devices, and edge weights are determined by at least two of the following: interaction frequency, control command sensitivity, business importance and historical interaction stability.

[0022] The business operation status diagram is a dynamic diagram. Nodes represent microgrid equipment or business units in the park, and edges represent source-storage coupling, source-load coupling, storage-load coupling, V2G bidirectional power coupling, grid connection point coupling, or topological adjacency relationships. Node characteristics include at least one of the following: photovoltaic power, voltage, current, energy storage SOC, energy storage charging and discharging power, charging pile charging status, charging current, charging voltage, V2G reverse power, grid connection point power, load power, and power quality parameters.

[0023] As a preferred embodiment of the microgrid anomaly monitoring method for parks described in this invention, the intention response constraint unit includes a set of target state variables, a desired change direction, a response amplitude range, a response time window, and constraint triggering conditions.

[0024] The response time window is adaptively determined based on at least two of the following: business intent type, target device type, device action lag time, communication delay, state sampling period, and current operating mode. When the business intent event is an energy storage charging setting event, an energy storage discharging setting event, a charging pile start event, or a charging pile stop event, the intent response constraint unit constrains the corresponding power change, SOC change trend, and state switching logic, respectively.

[0025] As a preferred embodiment of the microgrid anomaly monitoring method for parks described in this invention, the dual-image mutual verification includes:

[0026] Positive response verification: Using the business intent event in the device interaction behavior graph as an index, the corresponding target state response is retrieved in the business operation state graph. If the intent response constraint unit is not satisfied, a positive response verification residual is formed.

[0027] Reverse cause tracing: Using the state change node in the business operation status diagram as an index, backtrack the matching business intent event or control link in the device interaction behavior diagram. If no matching link exists, a reverse cause tracing residual is formed.

[0028] Calculate the dual [results] based on the positive response verification residual and the reverse cause tracing residual. Figure 1 Consistency residuals.

[0029] As a preferred embodiment of the microgrid anomaly monitoring method described in this invention, the physical constraint residuals include at least one of the following: power balance residuals, energy storage SOC over-limit residuals, energy storage charge-discharge mutual exclusion residuals, charging pile electrical parameter consistency residuals, V2G power direction consistency residuals, and cross-metering anchor point consistency residuals; wherein, the cross-metering anchor point consistency residuals are used to characterize the consistency deviation between the grid-connected point measured power, the smart meter aggregated power, and the equivalent power calculated from photovoltaic, energy storage, charging piles, V2G, and load status.

[0030] As a preferred embodiment of the abnormal monitoring method for microgrids in the park described in this invention, the current operating mode includes at least one of the following: photovoltaic power generation mode, peak load mode, energy storage charging mode, energy storage discharging mode, demand response mode, grid-connected operation mode, off-grid operation mode, grid-connected / off-grid switching mode, and fault recovery mode.

[0031] Under different operating modes, different weights and different anomaly thresholds are configured for various residuals according to the characteristics of the operating mode, so as to form an adaptive anomaly risk value for the operating mode;

[0032] The anomaly types include at least one of the following: illegal device interaction anomaly, abnormal control command, abnormal service intent response anomaly, status forgery anomaly, source-storage coordination anomaly, storage-load coordination anomaly, V2G response anomaly, scheduling link anomaly, and unreasonable service behavior anomaly under legitimate messages.

[0033] As a preferred embodiment of the abnormal monitoring method for park microgrids described in this invention, the abnormal evidence chain includes abnormal equipment, abnormal interaction path, abnormal business intent, abnormal time window, abnormal state variable, triggered operation constraints, various residual values, contribution of various residuals to abnormal risk value, abnormal risk value, abnormal confidence level, and handling suggestions.

[0034] The proposed microgrid anomaly monitoring method is deployed on edge computing nodes. The edge computing nodes perform relevant calculations in real time and upload anomaly feature summaries to the cloud. The cloud updates the response templates, operating mode weights, anomaly thresholds, and model parameters for different parks and distributes them to the edge computing nodes.

[0035] A campus microgrid anomaly monitoring system is configured to execute a campus microgrid anomaly monitoring method, including a device business role management module, a multi-source data acquisition module, a business semantic protocol parsing module, a device interaction behavior graph construction module, a business operation status graph construction module, a business intent response constraint module, a dual-graph mutual verification anomaly identification module, a physical constraint residual calculation module, an anomaly risk fusion module, and an anomaly evidence chain generation module.

[0036] Compared with the prior art, the beneficial effects of the present invention are:

[0037] 1. This invention does not directly use communication traffic, protocol fields, or single device status as the object of anomaly detection. Instead, it converts multi-protocol communication messages and control logs into unified business intent events and generates intent response constraint units based on business intent, target device role, action parameters, and current operating mode. This enables the determination of whether "the message corresponds to a reasonable business action" and "whether the business action causes a reasonable status response", thus enhancing the ability to identify anomalies in campus microgrid services.

[0038] 2. This invention can identify hidden anomalies where the message format is legal, the communication object is legal, and the port number and function code meet the allowed conditions, but the timing of the service, the control direction, the status response, or the physical constraints are unreasonable. It is especially suitable for scenarios such as reverse control of energy storage, spoofing of charging pile status, abnormal V2G response, and abnormal power at the grid connection point. It makes up for the shortcomings of traditional protocol rule detection and traffic threshold detection, which can only identify obvious illegal messages or abnormal traffic.

[0039] 3. This invention simultaneously constructs a device interaction behavior diagram and a business operation status diagram, and performs mutual verification between the two diagrams through positive response verification and reverse cause tracing. Among them, positive response verification is used to determine whether a business intent event causes a change in the state of the target device and its coupled devices within the response time window, and reverse cause tracing is used to determine whether a sudden change in business state has a corresponding business intent event, control link, or feedback link, thereby improving the accuracy and interpretability of anomaly monitoring.

[0040] 4. This invention introduces physical constraint residuals of source-grid-load-storage, and uses power balance, energy storage SOC boundary, charging and discharging mutual exclusion, charging pile electrical parameter consistency, V2G power direction consistency and cross-metering anchor point consistency as evidence of anomalies. It can identify state forgery, data acquisition anomalies or control response anomalies that are inconsistent with the grid connection point metering, smart meter aggregate metering or source-grid-load-storage equivalent power calculation results when a single device reports a normal status.

[0041] 5. This invention adaptively adjusts the fusion weights and anomaly thresholds of various residuals according to the current operating mode of the microgrid in the park, so that anomaly monitoring can adapt to various operating scenarios such as large-scale photovoltaic power generation, peak load, energy storage charging, energy storage discharging, demand response, grid-connected operation, off-grid operation, and grid-connected-off-grid switching, thereby reducing the risk of false alarms or missed alarms caused by the fixed threshold method under different operating modes.

[0042] 6. This invention outputs abnormal devices, abnormal interaction paths, abnormal business intentions, abnormal state variables, trigger constraints, various residual values, residual contribution, abnormal confidence levels, and handling suggestions through an abnormal evidence chain. It can not only provide abnormal alarms, but also explain the main causes of abnormalities and auxiliary evidence, which facilitates maintenance personnel to quickly locate, manually review, and adjust control strategies.

[0043] 7. This invention adopts a deployment method that combines real-time edge detection with cloud-based collaborative updates. The edge side performs protocol parsing, business intent identification, dual-graph construction, residual calculation, and local alarms, while the cloud side performs cross-campus updates of response templates, operating mode weights, anomaly thresholds, and model parameters. This balances the low-latency monitoring requirements of the microgrid edge side and the cloud-based cross-scenario generalization optimization capabilities. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and detailed embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0045] Figure 1 This is a hierarchical structure distribution diagram of the microgrid anomaly monitoring method for parks according to the present invention;

[0046] Figure 2 The flowchart for business intent parsing and response constraint generation provided by this invention;

[0047] Figure 3 A schematic diagram illustrating the construction of a dual-graph system, namely a device interaction behavior diagram and a business operation status diagram, provided by the present invention.

[0048] Figure 4 The flowchart for calculating the integrated physical constraint residuals provided by this invention;

[0049] Figure 5 The present invention provides a flowchart for anomaly risk fusion and evidence chain generation;

[0050] Figure 6 The present invention provides a flowchart for cloud-edge collaborative model updates and real-time edge alarms. Detailed Implementation

[0051] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0052] like Figure 1 As shown, this invention provides a method for monitoring anomalies in a park microgrid, the steps of which are as follows:

[0053] Step S1: Build a device business role library and a business intent library

[0054] Obtain the set of device objects in the park's microgrid. These device objects include at least one of the following: photovoltaic inverters, energy storage devices, AC / DC charging piles, V2G equipment, flexible load control terminals, smart meters, edge gateways, energy management systems, aggregator platform interfaces, and grid connection point monitoring devices. Establish a device business role record for each device, denoted as:

[0055] ;

[0056] in, Indicates the equipment number. Indicates the device type. Indicates the communication address. Indicates the communication protocol. Indicates business role, Indicates control permissions. Represents the set of device state variables. Indicates the set of control commands that are allowed. Represents the set of rated parameters. This indicates the set of objects that can be interacted with.

[0057] The business intent library is used to describe the mapping relationship between protocol field combinations and business intent events. Each type of business intent corresponds to an intent template, which includes at least the applicable device type, protocol field constraints, business action, action parameters, target state variables, response time window, and operational constraints.

[0058] An example business intent template is shown in the table below.

[0059] Photovoltaic inverter Photovoltaic power transmission / power limiting control Modbus register, IEC 61850 telemetry / remote control Changes in active power, voltage, current, or grid connection status Energy storage devices Charging settings / Discharging settings / Stop control Power setting register, BMS status field Changes in SOC, charge / discharge power, temperature, or alarm status charging pile Start charging / stop charging / power adjustment MQTT topic, HTTP interface, charging status code Changes in charging current, voltage, power, duration, and state. V2G devices Vehicle discharge / vehicle charging / power response V2G control commands, bidirectional power field Power direction, vehicle battery status and grid connection point power changes Energy Management System Scheduling instructions / demand response / peak shaving and valley filling Scheduling service call, policy number Multiple devices change status in tandem

[0060] Step S2: Multi-source data acquisition and time alignment

[0061] See Figure 2 Through edge gateways, switch mirroring, protocol adapters, device interfaces, log collection agents, and operation monitoring terminals, device interaction behavior data, control log data, and service operation status data are collected. Device interaction behavior data includes source device, target device, timestamp, protocol type, function code, register address, topic, service name, data length, communication frequency, control parameters, and response results. Service operation status data includes photovoltaic power, voltage, current, energy storage SOC, energy storage charge / discharge power, battery temperature, charging pile charging status, charging current, charging voltage, V2G reverse power, grid connection point power, load curve, and power quality parameters.

[0062] By uniformly timestamping and slicing time windows on data from different sources, a time window is obtained. The system includes interaction sequences and state sequences. For data with inconsistent sampling periods, synchronization is achieved using nearest neighbor alignment, linear interpolation, or event-triggered alignment.

[0063] Step S3: Protocol Field Parsing and Business Intent Mapping

[0064] See Figure 2 It parses function codes, register addresses, topics, service names, payload fields, and control parameters from protocols such as Modbus, IEC 61850, MQTT, OPC UA, CAN, RS485, HTTP, or HTTPS into protocol field vectors.

[0065] ;

[0066] in, Indicates the protocol type. Indicates function code, Indicates a register address or object address. Indicates the message subject. Indicates the service name. Indicates data payload, Indicates the direction of communication, Indicates the time of occurrence.

[0067] Based on the protocol field vector, source device, target device, and service intent library, service intent is identified to obtain service intent events:

[0068] ;

[0069] in, Indicates the source device. Indicates the target device. Indicates business operations. Indicates action parameters, Indicates business intent tags, Indicates the confidence level of the intent. Business intent tags can include photovoltaic power transmission, photovoltaic power curtailment control, energy storage charging settings, energy storage discharging settings, charging pile startup, charging pile shutdown, V2G discharge request, flexible load reduction, grid connection point power control, and equipment alarm transmission.

[0070] Business intent identification can be achieved by combining rule matching, dictionary mapping, and similarity calculation:

[0071] ;

[0072] in, Represents a set of business intentions. The semantic representation of the protocol field vector. Indicate business intent The template represents, Indicates whether the source and target devices meet the business intent. Interactive permission relationships, This indicates the weight for matching permissions.

[0073] Step S4: Construct a device interaction behavior graph

[0074] See Figure 3 Within each time window, construct a device interaction behavior graph based on the sequence of business intent events:

[0075] ;

[0076] in, Represents a set of device nodes. Represents the set of device interaction edges. Represents the interaction behavior feature matrix. This represents the interaction adjacency matrix. Interaction edges represent the relationships between devices in data transmission, control commands, status feedback, service calls, or alarm notifications.

[0077] equipment With equipment The interaction edge weights between them can be represented as:

[0078] ;

[0079] in, Indicates the frequency of interaction. Indicates the sensitivity of control commands. Indicates business importance, Indicates the stability of historical interactions. to These are the weighting coefficients.

[0080] Step S5: Construct a business operation status diagram

[0081] See Figure 3 Based on the physical coupling relationships, service collaboration relationships, and topological adjacency relationships among the source, network, load, storage, and charging components, a service operation status diagram is constructed:

[0082] ;

[0083] in, Represents the set of business coupling edges. The matrix represents the characteristic matrix of business operation status. This represents the adjacency matrix of the state diagram. Service coupling edges include source-storage coupling, source-load coupling, storage-load coupling, V2G bidirectional power coupling, grid connection point coupling, and topological adjacency relationships.

[0084] Step S6: Establish business intent response constraints and calculate response residuals

[0085] To establish a calculable constraint relationship between business intent events and changes in device operating status, this invention further converts business intent events into intent response constraint units. These intent response constraint units describe the state variable changes, response time windows, and constraint triggering conditions that should be triggered for a given business intent under specific target devices, current operating modes, and action parameters.

[0086] The intent response constraint unit is represented as follows:

[0087] ;in, This represents the intent response constraint unit corresponding to the k-th business intent event; Tags indicating business intent; Indicates the target device; Represents the set of target state variables; Indicates the response time window; Indicates the expected direction of change and the range of response magnitude; This indicates the state constraints, physical constraints, or operating mode constraints related to the business intent.

[0088] The response time window is represented as follows: ;

[0089] in, Indicates the time when the business intent event occurred. Indicates the minimum response delay. The maximum response delay is represented by the minimum response delay and the maximum response delay, which can be expressed as:

[0090]

[0091] ;

[0092] in, Indicates communication transmission delay. This indicates the edge-side protocol resolution latency. This indicates that the execution delay is controlled. and These represent the minimum and maximum hysteresis times of the target device's action response, respectively. Indicates the sampling period for business status.

[0093] For business intent events The system is based on business intent tags Target equipment Action parameters Current operating mode and intent response constraint unit Generate the desired state response of the target device within the response time window:

[0094] ;

[0095] in, Indicates the target device exist The expected state response at any given moment; This represents the state response prediction function corresponding to the business intent tag; Indicates the current status of the target device; Indicates the current operating mode. Indicates action parameters.

[0096] The residual of the business intent response is represented as:

[0097] ;

[0098] in, Indicates the actual observation status of the target equipment; Represents the target state variable weight matrix; A function representing the degree of violation of state constraints or operational constraints; Indicates the weight of the constraint term.

[0099] When the control command is valid in terms of protocol format, communication object, and function code, but the target device status does not change accordingly within the response time window according to the intent response constraint unit, the service intent response residual increases, thereby identifying service response anomalies under valid messages.

[0100] Step S7: Anomaly Identification for Dual-Graph Verification

[0101] like Figure 3 As shown, the dual-graph mutual verification of the present invention includes two processes: positive response verification and reverse cause tracing.

[0102] During the positive response verification process, the system uses a device interaction behavior graph. Business Intent Events For indexing, determine the source device. Target equipment Business Intent Tags and response time window And in the business operation status diagram Extract the state variable changes of the target device and its adjacent coupled devices. If the state variable changes do not satisfy the corresponding intent response constraint unit... This results in a positive response verification residual.

[0103] The positive response verification residual is expressed as:

[0104] ;

[0105] in, Represents the target device in the business operation status diagram. and its adjacent coupling devices State graph embedding at any given moment; This represents the set of adjacent nodes of the target device in the state diagram; This represents the expected state diagram response generated by the business intent event and intent response constraint unit.

[0106] During the reverse cause tracing process, the system uses a business operation status diagram. State mutation nodes in For indexing, within a preset backtracking time window Internal retrieval device interaction behavior diagram Does the system contain a business intent event, control link, status feedback link, or alarm transmission link that matches this state change? If no matching link exists, a reverse cause tracing residual is generated.

[0107] The reverse cause tracing residual is represented as:

[0108] ;

[0109] in, This represents the amount of state change at a node that undergoes a sudden change in state. This represents the set of business intent events within the backtracking time window; This indicates the degree of matching between state mutations and business intent events.

[0110] pair Figure 1 Consistency residuals are expressed as:

[0111] ;

[0112] in, Indicates the positive response verification weight. This indicates the weight for tracing back to the reverse cause.

[0113] When a business intent event exists in the device interaction behavior graph, but no corresponding state response appears in the business operation status graph, the positive response verification residual increases; when a state change occurs in the business operation status graph, but no corresponding business intent event or control link exists in the device interaction behavior graph, the reverse cause tracing residual increases.

[0114] Step S8: Calculate the physical constraint residuals of source-grid-load-storage

[0115] like Figure 4 As shown, the physical constraint residuals are calculated based on the source-grid-load-storage service operation mechanism of the park microgrid. The power balance residual is:

[0116] ;

[0117] in, Indicates photovoltaic power output. This indicates the power input from the main grid. Indicates the energy storage discharge power. Indicates V2G discharge power. Indicates the load power of the park. This indicates the charging power of the charging station. Indicates the energy storage charging power. This indicates the power being sent to the main grid. Indicates network loss. Indicates the reference power. This indicates a positive number that prevents the denominator from being zero.

[0118] The residual value for exceeding the SOC limit for energy storage is:

[0119] ;

[0120] in, This indicates the current state of charge of the energy storage. and These represent the upper and lower limits allowed by the SOC, respectively;

[0121] The mutual exclusion residuals of energy storage charging and discharging are:

[0122] ;

[0123] in, and These represent the charging and discharging power of the energy storage, respectively. Indicates the rated power of energy storage;

[0124] The residual error for consistency of electrical parameters of charging piles is:

[0125] ;

[0126] in, This indicates the actual power of the charging station. and They represent voltage and current, respectively. Indicates the power factor. Indicates the rated power of the charging pile;

[0127] The consistency residual across measurement anchors is expressed as:

[0128] ;

[0129] in, Indicates the measured power at the grid connection point. This indicates the aggregated power on the smart meter side. This represents the equivalent power calculated from photovoltaic, energy storage, charging piles, V2G, and load conditions. Indicates the rated power of the park's microgrid. This indicates a positive number that prevents the denominator from being zero.

[0130] The combined physical constraint residuals are:

[0131] ;

[0132] in, This indicates the V2G power direction consistency residual. to These are the physical constraint weights.

[0133] To identify status spoofing or abnormal data collection where a single device reports a normal status but its data is inconsistent with independent metering data, this invention further introduces cross-metering anchor point consistency residuals. These cross-metering anchor points include grid-connected metering devices, aggregated smart meter readings, and equivalent power calculated from photovoltaic, energy storage, charging piles, V2G, and load status.

[0134] Step S9: Adaptive Operation Mode and Anomaly Risk Fusion

[0135] Identify the current operating mode of the park's microgrid The operating modes include at least one of the following: high-power photovoltaic generation mode, peak load mode, energy storage charging mode, energy storage discharging mode, demand response mode, grid-connected operation mode, off-grid operation mode, grid-connected / off-grid switching mode, and fault recovery mode. Various residual weights are dynamically adjusted according to the current operating mode.

[0136] ;

[0137] in, Indicates the characteristics of the operating mode. and This represents the parameters used to generate the weights.

[0138] In the current operating mode Below, such as Figure 5 As shown, the system handles protocol state constraint residuals, abnormal interaction behavior residuals, business intent response residuals, and dual... Figure 1 At least three types of residuals—consistency residuals, physical constraint residuals, and operational mode deviation residuals—are fused. The operational mode deviation residuals are used to characterize the degree of deviation between the current business action and the recommended control direction, equipment availability status, or scheduling strategy under the current operational mode.

[0139] The adaptive weighting of the operating mode is represented as follows:

[0140] ;

[0141] The comprehensive abnormal risk value is expressed as:

[0142] ;

[0143] in, This represents the residual of the protocol state constraint. This indicates abnormal residual behavior during interaction. Indicates the residual of business intent response. Indicates double Figure 1 Integrity residuals Represents the physical constraint residual. This indicates that the operating mode deviates from the residual; These represent the adaptive weights of the corresponding residuals' operating modes.

[0144] Different threshold strategies are used under different operating modes:

[0145] ;

[0146] in, Indicates the operating mode The first historical risk value Quantiles This represents the standard deviation of historical risk values. This represents the safety margin factor. When... If the duration exceeds the preset time, an abnormality is determined to have occurred.

[0147] Step S10: Anomaly Classification and Evidence Chain Generation

[0148] like Figure 5 As shown, anomalies are categorized based on trigger residual type, abnormal device role, abnormal business intent, and abnormal path. Anomaly types include illegal device interaction anomalies, abnormal control commands, abnormal business intent response anomalies, status spoofing anomalies, source-storage coordination anomalies, storage-load coordination anomalies, V2G response anomalies, scheduling link anomalies, and unreasonable business behavior anomalies under legitimate messages.

[0149] To improve the ability to interpret anomalies, this invention further calculates the contribution of various residuals to the overall anomaly risk value. The contribution of class residuals is expressed as:

[0150] ;

[0151] in, Indicates the first The contribution of residuals to the overall anomaly risk value. Indicates the first Class of residuals, Indicates the first Adaptive weights for class residuals in the current operating mode. This indicates the number of residual types involved in the fusion.

[0152] Generate an abnormal chain of evidence:

[0153] ;

[0154] Here, path represents the abnormal interaction path. Indicates abnormal business intent. Indicates an abnormal time window. Represents various residual sets, Represents the set of various residual contributions. This represents the set of constraints that are triggered. Indicates the confidence level of the anomaly. This indicates a suggested handling strategy.

[0155] Anomaly confidence can be expressed as:

[0156] ;

[0157] The handling strategies include issuing alarms, restricting control permissions, blocking abnormal interactions, restoring the default operating policy, switching to manual review, triggering edge-side security policies, or uploading to the cloud for analysis.

[0158] Based on the contribution of various residuals, the system identifies the primary cause of the anomaly and supporting evidence. When the contribution of the business intent response residual is the highest, the primary cause of the anomaly is determined to be inconsistency in the business response; when both are true, the primary cause is determined to be inconsistency in the business response. Figure 1 When the contribution of consistency residuals is the highest, the main cause of the anomaly is determined to be inconsistency between interaction and state verification; when the contribution of physical constraint residuals or cross-metric anchor point consistency residuals is the highest, the main cause of the anomaly is determined to be physical state inconsistency or state forgery.

[0159] Step S11: Cloud-edge collaborative model update

[0160] See Figure 6 Edge computing nodes perform real-time protocol parsing, business intent mapping, dual-graph construction, residual calculation, anomaly risk fusion, and alarm generation. The cloud platform receives anomaly feature summaries, statistical residuals, response template parameter increments, and model parameter increments uploaded from the edge side, and updates the response templates, weight parameters, and threshold parameters for different parks, different equipment types, and different operating modes.

[0161] ;

[0162] in, Indicates the first The edge node at the ... The model parameters after training or updating. This indicates the amount of data or sample weights that the edge node participates in updating. This indicates the number of edge nodes. The cloud distributes the updated response template, model parameters, and threshold strategies to the edge computing nodes, thereby enabling real-time edge detection and cross-scenario optimization in the cloud.

[0163] Although the present invention has been described above with reference to embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, as long as there is no structural conflict, the features in the disclosed embodiments can be combined with each other in any manner. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A method for monitoring anomalies in a park microgrid, characterized in that, Includes the following steps: S1. Obtain device attribute information, device interaction behavior data, control log data, and business operation status data of multiple devices in the park micronet; S2. Construct a device service role library and a service intent library based on the device attribute information; S3. Perform protocol parsing and business semantic conversion on the device interaction behavior data and control log data to obtain a unified business intent event sequence; S4. Construct a device interaction behavior diagram based on the unified business intent event sequence, and construct a business operation status diagram based on the business operation status data and the source-grid-load-storage coupling relationship; S5. For each business intent event, generate an intent response constraint unit, and compare the actual state change of the target device with the intent response constraint unit to obtain the business intent response residual. S6. Perform dual-graph mutual verification based on the device interaction behavior graph and the service operation status graph, and calculate the dual-graph consistency residual; S7. Calculate physical constraint residuals based on the operational constraints of the microgrid source-grid-load-storage system in the park. S8. Based on the current operating mode, adaptively fuse at least three types of residuals among protocol state constraint residuals, interaction behavior abnormal residuals, business intent response residuals, dual-graph consistency residuals, and physical constraint residuals, and output abnormal risk values, abnormal types, and abnormal evidence chains; among them, when the device communication message is legal at the protocol level but unreasonable at the business level, it is judged as an abnormal unreasonable business behavior under a legal message.

2. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The device attribute information includes device number, device type, IP address, port number, communication protocol, microgrid area, rated capacity, rated power, set of operating status variables, set of control commands, control permission level, and set of allowed interactive objects; The business intent event includes the source device, occurrence time, protocol type, business action, action parameters, business intent tag, and intent confidence level.

3. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The semantic conversion of services includes parsing function codes, register addresses, topics, service names, data payloads, or control parameters in Modbus, IEC 61850, MQTT, OPC UA, CAN, RS485, HTTP, or HTTPS protocols, and converting them into unified service intent events according to preset mapping rules. The business intent tags include at least one of the following: photovoltaic power transmission, photovoltaic power limiting control, energy storage charging setting, energy storage discharging setting, charging pile start-up, charging pile stop-up, V2G discharge request, flexible load reduction, grid connection point power control, and equipment alarm transmission.

4. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The device interaction behavior graph is a dynamic graph. Nodes represent microgrid devices in the park, and edges represent data transmission, control commands, status feedback or alarm notification relationships between devices. Edge weights are determined by at least two of the following: interaction frequency, control command sensitivity, business importance and historical interaction stability. The business operation status diagram is a dynamic diagram. Nodes represent microgrid equipment or business units in the park, and edges represent source-storage coupling, source-load coupling, storage-load coupling, V2G bidirectional power coupling, grid connection point coupling, or topological adjacency relationships. Node characteristics include at least one of the following: photovoltaic power, voltage, current, energy storage SOC, energy storage charging and discharging power, charging pile charging status, charging current, charging voltage, V2G reverse power, grid connection point power, load power, and power quality parameters.

5. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The intent response constraint unit includes a set of target state variables, desired change direction, response amplitude range, response time window, and constraint triggering conditions. The response time window is adaptively determined based on at least two of the following: business intent type, target device type, device action lag time, communication delay, state sampling period, and current operating mode. When the business intent event is an energy storage charging setting event, an energy storage discharging setting event, a charging pile start event, or a charging pile stop event, the intent response constraint unit constrains the corresponding power change, SOC change trend, and state switching logic, respectively.

6. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The dual-graph mutual verification includes: Positive response verification: Using the business intent event in the device interaction behavior graph as an index, the corresponding target state response is retrieved in the business operation state graph. If the intent response constraint unit is not satisfied, a positive response verification residual is formed. Reverse cause tracing: Using the state change node in the business operation status diagram as an index, backtrack the matching business intent event or control link in the device interaction behavior diagram. If no matching link exists, a reverse cause tracing residual is formed. The dual-graph consistency residual is calculated based on the positive response verification residual and the reverse cause tracing residual.

7. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The physical constraint residuals include at least one of the following: power balance residuals, energy storage SOC over-limit residuals, energy storage charge-discharge mutual exclusion residuals, charging pile electrical parameter consistency residuals, V2G power direction consistency residuals, and cross-metering anchor point consistency residuals; wherein, the cross-metering anchor point consistency residuals are used to characterize the consistency deviation between the grid-connected point measured power, the smart meter aggregated power, and the equivalent power calculated from photovoltaic, energy storage, charging piles, V2G, and load conditions.

8. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The current operating mode includes at least one of the following: photovoltaic power generation mode, peak load mode, energy storage charging mode, energy storage discharging mode, demand response mode, grid-connected operation mode, off-grid operation mode, grid-connected / off-grid switching mode, and fault recovery mode; Under different operating modes, different weights and different anomaly thresholds are configured for various residuals according to the characteristics of the operating mode, so as to form an adaptive anomaly risk value for the operating mode; The anomaly types include at least one of the following: illegal device interaction anomaly, abnormal control command, abnormal service intent response anomaly, status forgery anomaly, source-storage coordination anomaly, storage-load coordination anomaly, V2G response anomaly, scheduling link anomaly, and unreasonable service behavior anomaly under legitimate messages.

9. The method for monitoring anomalies in a park microgrid according to claim 1, characterized in that, The abnormal evidence chain includes abnormal devices, abnormal interaction paths, abnormal business intentions, abnormal time windows, abnormal state variables, triggered operational constraints, various residual values, the contribution of various residuals to the abnormal risk value, abnormal risk value, abnormal confidence level, and handling suggestions. The proposed microgrid anomaly monitoring method is deployed on edge computing nodes. The edge computing nodes perform relevant calculations in real time and upload anomaly feature summaries to the cloud. The cloud updates the response templates, operating mode weights, anomaly thresholds, and model parameters for different parks and distributes them to the edge computing nodes.

10. A microgrid anomaly monitoring system for industrial parks, characterized in that, The method for monitoring anomalies in a microgrid within a campus, as described in any one of claims 1-9, includes a device business role management module, a multi-source data acquisition module, a business semantic protocol parsing module, a device interaction behavior graph construction module, a business operation status graph construction module, a business intent response constraint module, a dual-graph mutual verification anomaly identification module, a physical constraint residual calculation module, an anomaly risk fusion module, and an anomaly evidence chain generation module.

Images