A power automation system communication message analysis system and method based on size model fusion

Abstract

The application relates to a power automation system communication message analysis system and method based on size model fusion, and belongs to the technical field of power system communication. The system comprises the following: a message data acquisition module, which is used for receiving communication message data and transmitting the communication message data to a message analysis module; the message analysis module, which is used for analyzing the communication message data based on a small model, converting the communication message data into structured protocol field data, and transmitting the structured protocol field data to a fault intelligent discrimination module; the fault intelligent discrimination module, which is used for modeling a communication connection life cycle according to a message analysis result, converting continuous messages into a message communication event sequence, searching for all possible fault discrimination rules or historical fault cases in a knowledge base, and using a fault diagnosis large model to analyze the message communication event sequence in combination with the fault discrimination rules or the historical fault cases in the knowledge base to identify faults in message communication. The application improves the intelligent level of power automation system communication operation and maintenance.

Description

Technical Field

[0001] This invention relates to a communication message analysis system and method for power automation systems based on large-scale model fusion, belonging to the field of power system communication technology. Background Technology

[0002] With the continuous advancement of the construction of new power systems and digital grids, power grid dispatch automation and substation automation are rapidly evolving towards digitalization and intelligence. A complex communication network has been formed between the dispatch master station, substation equipment, and various secondary systems, widely adopting multiple industrial communication protocols such as IEC 60870-5-101 / 103 / 104, IEC 61850, and MQTT (Message Queuing Telemetry Transport) to achieve telemetry, remote signaling, remote control, status monitoring, and business data exchange.

[0003] In the aforementioned environment, the large number of communication links, diverse protocol types, and dynamically changing service loads lead to frequent issues such as communication connection interruptions and service function anomalies. If these anomalies cannot be identified promptly and accurately, they will directly impact the real-time performance and reliability of scheduling data, posing a risk to the stable operation of the power grid. Therefore, efficient parsing and anomaly diagnosis of communication messages in power automation systems are a crucial technological foundation for intelligent operation and maintenance.

[0004] Currently, commonly used parsing software in engineering sites primarily analyzes packet capture data. This type of software typically uses fixed protocol templates to perform layered field parsing of specific message types, followed by manual filtering and comparison. However, existing packet parsing software is limited to single messages and lacks the ability to model the temporal relationships and connection lifecycles of multiple messages, making it difficult to depict the complete communication behavior process. Anomaly detection relies heavily on human experience, failing to automatically identify and analyze complex anomalies such as connection interruptions and service anomalies, resulting in low diagnostic efficiency and poor result stability. For example, Chinese invention patent application CN105656729A discloses a method for detecting errors in the underlying message layer of the IEC 104 protocol. This method parses the original communication message, compares the calculated parameters with those of the master station system, and sends relevant alarm information based on the comparison results. However, it only performs IEC 104 message validity detection based on the comparison of message fields and parameters, mainly detecting format or configuration errors, and is unable to identify communication behavior-level anomalies. Furthermore, current message analysis tools are mostly single-protocol parsing tools, which are difficult to adapt to multi-protocol mixed operating environments. In mixed protocol scenarios such as IEC 60870-5-101 / 103 / 104, IEC61850, and MQTT, there is a lack of unified structured modeling and anomaly analysis capabilities. For example, Chinese invention patent application CN119449349A discloses a method and related device for detecting anomalies in power system industrial control communication protocol messages. It proposes an LSTM-based method and device for detecting anomalies in power system industrial control communication protocol messages, but it only implements anomaly "detection" for the IEC 60870-5-104 protocol, lacking the ability to attribute anomalies to causes and business semantics. Moreover, when the operating environment or communication strategy changes, the model needs to reconstruct anomaly samples and retrain. With the intelligent transformation and development of power grid operation and maintenance, traditional message parsing technology that relies solely on rule-driven approaches can no longer meet the requirements of high reliability and high efficiency. Summary of the Invention

[0005] The purpose of this invention is to provide a communication message analysis system and method for power automation systems based on the fusion of large and small models, in order to solve the problems of existing power automation system communication message analysis relying on human experience, scattered parsing, low efficiency in anomaly location, and difficulty in automatically attributing complex communication interruption causes.

[0006] To achieve the above objectives, the power automation system communication message analysis system based on small and large model fusion of the present invention includes a message data acquisition module, a message parsing module, and a fault intelligent discrimination module. The message data acquisition module receives communication message data and transmits it to the message parsing module. The message parsing module parses the received communication message data based on the small model, converts the communication message data into structured protocol field data, and transmits it to the fault intelligent discrimination module. The fault intelligent discrimination module includes a modeling and conversion unit, a retrieval unit, a fault diagnosis big model, and a knowledge base. The modeling and conversion unit models the communication connection lifecycle based on the message parsing results, converting continuous messages into a message communication event sequence. The retrieval unit retrieves all possible fault discrimination rules or historical fault cases from the knowledge base and finally transmits the retrieval results to the fault diagnosis big model. The fault diagnosis big model analyzes the message communication event sequence in conjunction with the fault discrimination rules or historical fault cases in the knowledge base to identify faults in the message communication.

[0007] In one possible implementation, after receiving the communication message data, the message data acquisition module preprocesses the communication message data and transmits the preprocessed communication message data to the message parsing module.

[0008] In one possible implementation, the preprocessing includes file format conversion and message filtering.

[0009] In one possible implementation, the message parsing module is mainly based on a lightweight model constructed according to protocol rules. It performs message parsing on a message-by-message basis to determine the data type of the message and convert the original message into structured protocol field data.

[0010] In one possible implementation, modeling the communication connection lifecycle based on message parsing results and converting continuous messages into a message communication event sequence involves: extracting quadruple data based on message parsing results; generating a unique identifier for the communication connection based on the quadruple data; maintaining the connection state machine based on this unique identifier and recording each state change; serializing the recorded state changes into a structured event sequence, thereby achieving modeling of the communication connection lifecycle; and performing correlation analysis on continuous messages in chronological order to convert the original message sequence into a communication event sequence.

[0011] In one possible implementation, the process by which the retrieval unit searches the knowledge base for all possible fault discrimination rules or historical fault cases is as follows: the message fault discrimination rules and historical fault case information in the knowledge base are parsed and segmented to establish a unified vector library. For the current communication behavior, possible fault types are initially matched based on the vector library to obtain candidate fault information corresponding to the current communication behavior.

[0012] In one possible implementation, the fault diagnosis big model is constructed through the following methods: based on a general big model base, multiple message protocol rule documents are collected, filtered, and cleaned to construct a protocol rule training dataset; message data from multiple message protocols is collected and analyzed to construct a communication event sequence training dataset; based on the protocol rule training dataset and the communication event sequence training dataset, incremental training, instruction fine-tuning, and prompt word engineering are performed on the general big model base to inject new knowledge into the big model, and finally, the fault diagnosis big model is trained.

[0013] In one possible implementation, the system also includes an intelligent question-answering module, which includes an intelligent question-answering big model. This module receives fault identification results from the fault diagnosis big model and receives message content or protocol field query requests or fault analysis questions input by the user. By calling the message parsing results and fault analysis conclusions, it automatically generates field description tables, key communication behavior summaries, and diagnostic reports in natural language form, thereby achieving interpretable interactive analysis of communication behavior.

[0014] In one possible implementation, the intelligent question-answering module also includes an intelligent question-answering window that supports intelligent question-answering functions for various protocols and related communication protocol knowledge.

[0015] To achieve the above objectives, the power automation system communication message analysis method based on big-small model fusion of the present invention includes the following steps: Step 1: Obtain communication message data; Step 2: Based on the small model, parse the received communication message data and convert the original communication message into structured protocol field data; Step 3: Based on the message parsing results of Step 2, model the communication connection lifecycle, convert continuous messages into a communication event sequence, and retrieve all possible fault discrimination rules or historical fault cases from the knowledge base; Step 4: Based on the fault diagnosis model, analyze the communication event sequence by combining the fault discrimination rules in the knowledge base or historical fault cases to identify faults in message communication.

[0016] The beneficial effects of this invention are as follows: Compared with existing message analysis systems, this invention integrates the protocol parsing capabilities of small models with the intelligent reasoning capabilities of large models, achieving collaborative protocol-level accurate parsing and semantic-level intelligent reasoning, thereby improving the accuracy of communication anomaly identification. Through connection relationship modeling and time-series event analysis, it achieves automatic attribution of complex communication interruption causes, thus improving the intelligent level of communication operation and maintenance in power automation systems. This solves the problems of existing power automation systems' communication message analysis relying on manual experience, scattered parsing, low anomaly location efficiency, and difficulty in automatically attributing complex communication interruption causes. Attached Figure Description

[0017] Figure 1 This is a framework diagram of a power automation system communication message analysis system based on size model fusion according to an embodiment of the present invention; Figure 2 This is a flowchart of the communication message analysis method for power automation systems based on the fusion of large and small models according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0019] The basic idea of ​​this invention is that large-model technology possesses intelligent learning and evolution capabilities. Compared to existing systems that are mainly based on rules and static templates, the message analysis agent based on large models can learn new anomaly patterns from historical communication data and fault samples, better supporting the development of power grid operation and maintenance towards intelligence and proactive diagnosis. Therefore, this invention proposes a power automation system communication message analysis system based on the fusion of large and small models. By integrating protocol parsing capabilities with the intelligent reasoning capabilities of large models, and through the collaboration of large and small models, it achieves unified modeling of multi-protocol communication behavior and automatic identification and root cause analysis of complex anomalies, thereby improving the intelligence level of power automation system communication operation and maintenance.

[0020] Implementation of a power automation system communication message analysis system based on size model fusion: like Figure 1 As shown, the power automation system communication message analysis system based on the fusion of small and large models includes a message data acquisition module, a message parsing module, and a fault intelligent discrimination module. The message data acquisition module receives communication message data; the message parsing module parses the received message data based on the small model, converting it into structured protocol field data, and transmits it to the fault intelligent discrimination module; the fault intelligent discrimination module includes a modeling and conversion unit, a retrieval unit, a fault diagnosis big model, and a knowledge base. The modeling and conversion unit models the communication connection lifecycle (connection establishment, data interaction, connection closure) based on the message parsing results, converting continuous messages (based on the order of messages in the packet capture file, which are temporally continuous) into a message communication event sequence; the retrieval unit searches the knowledge base for discrimination rules or historical fault cases for all possible faults (suspected faults), and finally transmits the retrieval results to the fault diagnosis big model; the fault diagnosis big model analyzes the message communication event sequence in conjunction with the fault discrimination rules or historical fault cases in the knowledge base to identify faults in the message communication.

[0021] This invention addresses the problems of existing power automation systems, such as reliance on manual experience in communication message analysis, fragmented parsing, low efficiency in anomaly location, and difficulty in automatically attributing complex communication interruption causes. It achieves a closed-loop intelligent analysis process from raw messages to message fault diagnosis conclusions through an integrated workflow of "message acquisition - protocol parsing - behavior modeling - intelligent judgment".

[0022] In a preferred embodiment, the system of the present invention further includes an intelligent question-answering module, which comprises an intelligent question-answering window and an intelligent question-answering big model. The intelligent question-answering window is used to enable users to input message content or protocol field query requests or fault analysis questions, and allows users to query message parsing results, fault analysis conclusions, diagnostic reports, etc. The intelligent question-answering big model is used to receive fault judgment results from the fault diagnosis big model and to receive message content or protocol field query requests or fault analysis questions input by users. By calling the message parsing results and fault analysis conclusions, it automatically generates field description tables, key communication behavior summaries, and diagnostic reports in natural language form, realizing interpretable interactive analysis of communication behavior.

[0023] As one embodiment of the intelligent question-answering module, a unified vector library is established by parsing and segmenting various message protocols and related communication protocol knowledge documents. Based on this vector library, the intelligent question-answering module supports intelligent question-answering functions for various protocols and related communication protocol knowledge, providing users with protocol rule explanation queries, communication process descriptions and processing suggestions, thereby improving the efficiency of communication operation and maintenance personnel in understanding complex communication problems.

[0024] As one embodiment of the message data acquisition module, the message data acquisition module is used to receive communication message data and preprocess the received communication message data.

[0025] As one embodiment of message data preprocessing, the preprocessing operations for the collected message data include file format conversion and message filtering. File format conversion refers to converting the received message data format into a structured text format, such as converting a captured pcap file into a txt file. Message filtering settings filter messages according to user-defined filtering rules. The filtering rules must support at least the following combinations: source IP, destination IP, destination port, and protocol type. For example, filtering out TCP protocol messages with a source IP of xx.xx.xx.xx, a destination IP of xx.xx.xx.xx, and a destination port of xx.

[0026] As one embodiment of communication message data, communication message data includes: messages directly reported by the field engineering system, packet capture files generated by network packet capture tools (such as Wireshark and tcpdump), or communication message data submitted by users through the input channel, etc.

[0027] As one embodiment of the message parsing module, the message parsing module is mainly based on a lightweight model constructed according to protocol rules (the rule mapping relationship of each field in the message, and the program written in Python to parse the meaning of each field). It processes the message data output by the message data acquisition module one by one, determines the message data type, and converts the original message into structured protocol field data, such as converting the original hexadecimal message into JSON structured protocol field data.

[0028] Taking IEC 60870-5-104 protocol messages as an example, this paper illustrates the message parsing module's process for parsing message data. The parsing process includes: parsing link layer messages to obtain the source MAC address, destination MAC address, and frame type; parsing network layer messages to obtain the source IP address, destination IP address, header length, and protocol type, etc.; parsing transport layer messages to obtain the source port number, destination port number, sequence number, acknowledgment number, window size, TCP flags, and connection status, etc.; parsing application layer payloads to extract the original IEC 60870-5-104 protocol data and output it as an independent field; the parsing results are output in a standardized JSON structure and transmitted to the fault intelligent identification module in real time; for systems including an intelligent question-and-answer module, users can query the parsing results of a single message or multiple messages through the intelligent question-and-answer window, realizing a visual view and tabular display of communication fields.

[0029] As one embodiment of the intelligent fault diagnosis module, the module models the communication connection lifecycle and converts continuous messages into a communication event sequence through the following process: Based on the message parsing results, four-tuple data (client IP, client port, server IP, server port) is extracted; based on the four-tuple data, a unique identifier for the communication connection is generated; based on this unique identifier, the communication status is tracked and each status change is recorded; the recorded status changes are serialized into a structured event sequence, thereby achieving the modeling of the communication connection lifecycle. The intelligent fault diagnosis module performs correlation analysis on continuous messages in chronological order, converting the original message sequence into a communication event sequence. These communication events include at least connection establishment events, normal data exchange events, acknowledgment events, and connection closure events. The following is an example of modeling the communication event sequence of IEC 60870-5-104 protocol messages: { "time_order": 1, "event_category": "TCP_104 protocol test frames", "time":"2025-12-17 13:54:01.225511", "packet_no": 539, "server_port":2404, "client_port":41288, "direction": "C2S", "tcp_flags": ["ACK"], "state": "ESTABLISHED", "description": "The client sends a 104 test frame when the link is idle." }, { "time_order": 2, "event_category": "TCP_PACKET", "time":"2025-12-17 13:54:21.225511", "packet_no": 839, "server_port":2404, "client_port":41288, "direction": "C2S", "tcp_flags": ["FIN", "ACK"], "state": "FIN_WAIT", "description": "The client actively closed the connection corresponding to port 41288". } In the above program, time_order is the order in the communication event sequence, event_category is the event class type, time is the packet time, packet_no is the order of the packets in the packet capture file, server_port is the server port number, client_port is the client port number, direction is the packet sending discovery, tcp_flags is the packet TCP status flag, state is the connection status, and description is the event description.

[0030] In a preferred embodiment, the fault intelligent discrimination module retrieves the built-in knowledge base through the following process: parsing and segmenting the message fault discrimination rules and historical fault case information in the knowledge base (for example, writing the message fault discrimination rules into an Excel file and converting documents such as historical fault case information into Markdown format, uploading and parsing them using ragflow, segmenting them, and building the knowledge base); establishing a unified vector library; initially matching possible fault types for the current communication behavior; and transmitting the communication event sequence and candidate fault information to the fault diagnosis model. For example, if the current communication behavior is establishing a connection, the fault types that may occur during the connection establishment event can be matched in the established vector library, and then the connection establishment event and the retrieved candidate fault information can be transmitted to the fault diagnosis model.

[0031] As an example of a large-scale fault diagnosis model, the large-scale fault diagnosis model is constructed through the following methods: Based on a general large-scale model foundation, it gathers various message protocol rule documents (such as rule descriptions, standard documents, manuals, etc. corresponding to power / industrial communication protocols such as IEC 60870-5-101 / 103 / 104, IEC-61850, Modbus, MQTT, etc.), and performs data collection, filtering, and cleaning to construct a protocol rule training dataset; it gathers message data from various message protocols, analyzes and models the message data, and constructs a communication event sequence training dataset; it performs incremental training, instruction fine-tuning, and prompt word engineering on the general large-scale model foundation, thereby injecting new knowledge into the large-scale model, and finally trains an industry-specific large-scale model for message analysis (an industry-specific large-scale model is a model that is specifically optimized and strengthened for a particular industry based on a general large-scale model (such as qwen), here referring to a large-scale model with professional message analysis capabilities and message fault diagnosis applicable to the message analysis industry). Incremental training refers to continuing to train the model with new data on the basis of the existing general large-scale model, allowing the model to learn new knowledge or adapt to new fields. Instruction fine-tuning refers to training the model using "question + answer" data to make its responses more consistent with expectations. Cue word engineering refers to guiding the model to output better results simply by designing inputs (cue words) without changing the model parameters.

[0032] Implementation method of communication message analysis method for power automation system based on size model fusion: like Figure 2 As shown, the power automation system communication message analysis method based on size model fusion of the present invention includes the following steps: Step 1: Obtain communication message data.

[0033] Step 2: Based on the small model, parse the received communication message data and convert the original communication message data into structured protocol field data; Step 3: Based on the message parsing results of Step 2, model the lifecycle of the communication connection, convert continuous messages into a sequence of communication events, and retrieve all possible fault discrimination rules or historical fault cases from the knowledge base.

[0034] Step 4: Based on the fault diagnosis model, analyze the communication event sequence by combining the fault discrimination rules in the knowledge base or historical fault cases to identify faults in message communication.

[0035] As a preferred implementation, the power automation system communication message analysis method based on big-small model fusion also includes the following step 5: receiving message content, protocol field query requests, or fault analysis questions input by the user, and automatically generating field description tables, key communication behavior summaries, and diagnostic reports in natural language form by calling message parsing results and fault diagnosis conclusions.

[0036] As a preferred implementation, the power automation system communication message analysis method based on the fusion of large and small models also includes the following functions: by parsing and segmenting various message protocols and related communication protocol knowledge documents, a unified vector library is established, supporting intelligent question-and-answer functions for various protocols and related communication protocol knowledge, providing users with protocol rule explanation queries, communication process descriptions and processing suggestions, thereby improving the efficiency of communication operation and maintenance personnel in understanding complex communication problems.

[0037] As one embodiment of step 1, after obtaining the communication message data, the communication message data is preprocessed.

[0038] As one embodiment of message data preprocessing, the preprocessing operations for communication message data include file format conversion and message filtering. File format conversion refers to converting the received message data format into the required standard format, while message filtering filters messages according to user requirements.

[0039] As one embodiment of communication message data, communication message data includes: packet capture files obtained through field engineering systems, network packet capture tools (such as Wireshark, tcpdump packet capture), or communication message data from user input channels, etc.

[0040] As an embodiment of step 2, the small model is a lightweight small model constructed according to the protocol rules. By parsing the communication message data obtained in step 1 one by one, the data type of the message is determined, and the original message is converted into structured protocol field data.

[0041] As an embodiment of the large-scale message fault diagnosis model, the large-scale message fault diagnosis model is constructed through the following methods: Based on a general large-scale model base, it gathers various message protocol rule documents (such as rule descriptions, standard documents, manuals, etc. corresponding to power / industrial communication protocols such as IEC 60870-5-101 / 103 / 104, IEC-61850, Modbus, MQTT, etc.), and performs data collection, filtering, and cleaning to construct a protocol rule training dataset; it gathers message data from various message protocols, analyzes and models the message data, and constructs a communication event sequence training dataset; it performs incremental training, instruction fine-tuning, and prompt word engineering on the general large-scale model base to inject new knowledge into the large-scale model, and finally trains a large-scale model for message analysis industry verticals.

[0042] As an example of modeling the communication connection lifecycle based on the message parsing results of step 2 and converting continuous messages into a sequence of communication events, based on the message parsing results, a quadruple (client IP, client port, server IP, server port) is used as the unique identifier of the communication connection. The connection state machine is maintained based on this unique identifier and each state change is recorded. The recorded state changes are serialized into a structured event sequence, thereby realizing the modeling of the communication connection lifecycle. The continuous messages are correlated and analyzed in chronological order, and the original message sequence is converted into a sequence of communication events. The communication events include at least connection establishment events, normal data interaction events, response events, and connection closure events.

[0043] The process involves retrieving all possible fault identification rules or historical fault cases from the knowledge base, achieved through the following steps: Parsing and segmenting the message fault identification rules and historical fault case information in the knowledge base to establish a unified vector library; for the current communication behavior, preliminary matching of possible fault types based on the vector library to obtain candidate fault information corresponding to the current communication behavior; and transmitting the communication event sequence and candidate fault information together to the fault diagnosis model. For example, if the current communication behavior is establishing a connection, the established vector library can be used to match the possible fault types that may occur during the connection establishment event, and then the connection establishment event and the retrieved candidate fault information are transmitted to the fault diagnosis model.

[0044] Compared to existing message analysis systems, the system and method of this invention have the following characteristics: 1) By fusing large and small models, we can achieve the synergy between protocol-level accurate parsing and semantic-level intelligent reasoning, thereby improving the accuracy of communication anomaly identification. Through connection relationship modeling and time-series event analysis, we can achieve automatic attribution of complex communication interruption causes.

[0045] 2) This invention can continuously learn new anomaly patterns through historical samples, thereby improving the system's adaptability to complex power grid communication scenarios.

[0046] 3) This invention enables interpretable output of communication message analysis results through intelligent question-and-answer interaction, effectively supporting the evolution of power grid operation and maintenance towards intelligence, and has broad application prospects in the field of power grid message communication operation and maintenance.

Claims

1. A communication message analysis system for power automation systems based on large-scale model fusion, characterized in that, The system includes a message data acquisition module, a message parsing module, and a fault intelligent identification module; The message data acquisition module is used to receive communication message data and transmit it to the message parsing module; the message parsing module is used to parse the received communication message data based on the small model, convert the communication message data into structured protocol field data, and transmit it to the fault intelligent identification module. The intelligent fault identification module includes a modeling and conversion unit, a retrieval unit, a fault diagnosis big model, and a knowledge base. The modeling and conversion unit is used to model the communication connection lifecycle based on the message parsing results, converting continuous messages into a message communication event sequence. The retrieval unit is used to retrieve all possible fault identification rules or historical fault cases from the knowledge base, and finally transmit the retrieval results to the fault diagnosis big model. The fault diagnosis big model is used to analyze the message communication event sequence in combination with the fault identification rules or historical fault cases in the knowledge base to identify faults in message communication.

2. The power automation system communication message analysis system based on big-small model fusion according to claim 1, characterized in that, After receiving the communication message data, the message data acquisition module preprocesses the communication message data and transmits the preprocessed communication message data to the message parsing module.

3. The power automation system communication message analysis system based on big-small model fusion according to claim 2, characterized in that, The preprocessing includes file format conversion and message filtering.

4. The power automation system communication message analysis system based on big-small model fusion according to claim 1, characterized in that, The message parsing module is mainly based on a lightweight model constructed according to protocol rules. It performs message parsing on a message-by-message basis, determines the data type of the message, and converts the original message into structured protocol field data.

5. The power automation system communication message analysis system based on big-small model fusion according to claim 1, characterized in that, The method for modeling the lifecycle of a communication connection based on the message parsing results and converting continuous messages into a sequence of message communication events is as follows: extract four-tuple data based on the message parsing results, generate a unique identifier for the communication connection based on the four-tuple data, and maintain the connection state machine based on the unique identifier and record each state change. The recorded state changes are serialized into a structured event sequence, thereby enabling the modeling of the communication connection lifecycle; Correlation analysis is performed on consecutive messages in chronological order to convert the original message sequence into a communication event sequence.

6. The power automation system communication message analysis system based on big-small model fusion according to claim 1, characterized in that, The process by which the retrieval unit searches the knowledge base for all possible fault discrimination rules or historical fault cases is as follows: the message fault discrimination rules and historical fault case information in the knowledge base are parsed and segmented to establish a unified vector library. For the current communication behavior, possible fault types are initially matched based on the vector library to obtain candidate fault information corresponding to the current communication behavior.

7. The power automation system communication message analysis system based on big-small model fusion according to claim 1, characterized in that, The fault diagnosis big model is constructed using the following methods: based on a general big model foundation, it integrates various message protocol rule documents, and performs data collection, filtering, and cleaning to construct a protocol rule training dataset; By aggregating message data from multiple message protocols, analyzing the message data, and constructing a training dataset for communication event sequences; Based on the protocol rule training dataset and the communication event sequence training dataset, incremental training, instruction fine-tuning, and prompt word engineering are performed on the general large model base to inject new knowledge into the large model, and finally a fault diagnosis large model is trained.

8. The power automation system communication message analysis system based on big-small model fusion according to claim 1, characterized in that, The system also includes an intelligent question-answering module, which includes an intelligent question-answering big model. This module receives fault identification results from the fault diagnosis big model and receives message content, protocol field query requests, or fault analysis questions input by the user. By calling the message parsing results and fault analysis conclusions, it automatically generates field description tables, key communication behavior summaries, and diagnostic reports in natural language, enabling interpretable interactive analysis of communication behavior.

9. The power automation system communication message analysis system based on big-small model fusion according to claim 8, characterized in that, The intelligent question-and-answer module also includes an intelligent question-and-answer window, which supports intelligent question-and-answer functions for various protocols and related communication protocol knowledge.

10. A method for analyzing communication messages in a power automation system based on a fusion of large and small models, characterized in that, The method includes the following steps: Step 1: Obtain communication message data; Step 2: Based on the small model, parse the received communication message data and convert the original communication message into structured protocol field data; Step 3: Based on the message parsing results of Step 2, model the communication connection lifecycle, convert continuous messages into a communication event sequence, and retrieve all possible fault discrimination rules or historical fault cases from the knowledge base; Step 4: Based on the fault diagnosis model, analyze the communication event sequence by combining the fault discrimination rules in the knowledge base or historical fault cases to identify faults in message communication.

Images