Hydropower plant equipment health degree evaluation method and system fusing network security situation

Abstract

The embodiment of the application provides a kind of fusion network security situation's hydropower plant equipment health degree evaluation method and system, it is first to physical sensor data time series reconstruction, calculate reconstruction error.Subsequently, multidimensional sensor sequence and sequence based on control instruction prediction are mapped into the motion trajectory in high-dimensional state space, the curvature of respective trajectory is extracted as the geometric signature of dynamic characteristic by differential geometry tool, and the distribution difference of two curvature time series is measured using KL divergence, to obtain a control-physical consistency score that can reflect the multivariate physical coupling relationship of system deeply.Finally, the quantified network security threat factor, physical health score and control-physical consistency score are dynamically fused.When the consistency score is too low or the network threat level rises, even if the data shows that the physical state is good, the final health score will be significantly revised, to accurately assess the true health level of equipment in a complex network threat environment.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology for hydropower plants, specifically to a method and system for assessing the health of hydropower plant equipment by integrating network security situation. Background Technology

[0002] With the deep integration of informatization and industrialization, hydropower plants, as key infrastructure in the national energy sector, have become highly dependent on automated control systems and industrial communication networks for operation and management. While this digital transformation has significantly improved production and maintenance efficiency, it has also inevitably exposed the core physical equipment of hydropower plants to increasingly complex cybersecurity risks. Traditional equipment health assessment methods are primarily based on the monitoring and analysis of physical quantities, i.e., continuously collecting sensor data sequences such as vibration, temperature, pressure, and flow rate, and using statistical analysis or machine learning models to determine the equipment's operating status. However, the effectiveness of this approach rests on a fundamental premise: that the collected sensor data can accurately and completely reflect the actual physical condition of the equipment. In the current technological context of deep cyber-physical integration, the reliability of this premise is facing severe challenges.

[0003] In recent years, cyberattacks targeting industrial control systems have evolved, exhibiting greater concealment and targeting. Among these, spoofed data injection attacks have become a typical method threatening the safe operation of equipment. Attackers can penetrate the communication links of data acquisition and monitoring systems, maliciously altering measurement data uploaded by sensors, and thus constructing a false appearance of normal equipment operation on the upper-level monitoring platform. Taking a hydroelectric generator set as an example, if the unit has experienced abnormal vibration, an attacker can replace the real vibration data with a spoofed value within the normal range, making the monitoring system unable to detect the anomaly. In this situation, traditional health assessment models, whose assessment logic relies entirely on potentially contaminated sensor data, will inevitably arrive at the erroneous conclusion that the equipment is operating well. The reason for this is that existing assessment systems lack an inherent verification capability that can cross the information and physical domains, failing to verify whether the data feedback at the physical layer and the operational commands issued at the control layer maintain logical consistency. Furthermore, in existing industrial system architectures, physical condition monitoring systems and network security situational awareness systems often operate independently, forming information silos. Intrusion alarms or abnormal traffic events detected by the network security system cannot be effectively adopted and utilized by the physical health assessment model. This disconnect causes health assessments to lose their ability to self-correct when subjected to cyberattacks, potentially leading to the continued concealment of real physical risks and ultimately resulting in equipment damage or even safety accidents.

[0004] Therefore, an optimized health assessment scheme for hydropower plant equipment is desired. Summary of the Invention

[0005] The present invention aims to at least solve one of the technical problems existing in the prior art, and provides a method and system for assessing the health of hydropower plant equipment that integrates network security situation.

[0006] In a first aspect, embodiments of the present invention provide a method for assessing the health of hydropower plant equipment by integrating network security posture, comprising: Acquire physical sensor data sequences, actual control command sequences, and sets of cybersecurity events; A preliminary physical health assessment is conducted based on physical sensor data sequences to obtain a preliminary physical health score. Control-physical timing consistency modeling and evaluation are performed based on actual control command sequences and physical sensor data sequences to obtain control-physical consistency scores. The network security threat factors are quantified from a set of network security events to obtain network threat factors. The preliminary physical health score, control-physical consistency score, and network threat factor are integrated for evaluation and dynamic health correction to obtain the final integrated health score.

[0007] Secondly, embodiments of the present invention provide a hydropower plant equipment health assessment system that integrates network security posture, comprising: The data acquisition module is used to acquire physical sensor data sequences, actual control command sequences, and network security event sets. The physical health preliminary assessment module is used to perform a preliminary physical health assessment based on physical sensor data sequences to obtain a preliminary physical health score. The timing consistency modeling and evaluation module is used to perform control-physical timing consistency modeling and evaluation based on the actual control command sequence and physical sensor data sequence to obtain a control-physical consistency score. The network security threat factor quantification module is used to quantify network security threat factors in a set of network security events to obtain network threat factors. The integrated evaluation and dynamic health correction module is used to perform integrated evaluation and dynamic health correction on the preliminary physical health score, control-physical consistency score and network threat factor to obtain the final integrated health score.

[0008] Compared with existing technologies, this invention provides a method and system for assessing the health of hydropower plant equipment by integrating network security posture. First, it utilizes a deep learning model to perform time-series reconstruction processing on physical sensor data, and provides a preliminary quantitative evaluation of the equipment's physical health status based on the reconstruction error. Addressing the challenge of potential malicious tampering of sensor data leading to distorted physical-level assessment results, this solution constructs a cross-domain consistency verification mechanism. This mechanism embeds multi-dimensional sensor observation sequences and prediction sequences generated based on control commands into a high-dimensional state space to form their respective motion trajectories. Differential geometry methods are used to extract the trajectory curvature as a geometric representation of the system's dynamic behavior. Then, the statistical distribution difference between the two curvature time series is measured using KL divergence, thereby obtaining a control-physical consistency score that fully characterizes the multivariate physical coupling relationships within the system. In the final evaluation stage, the quantified network security threat factor, the preliminary physical health score, and the control-physical consistency score are incorporated into a unified dynamic fusion framework. When the consistency score is significantly low or the network threat level rises significantly, even if the sensor data indicates a good physical condition, the final health score of the system will still be significantly revised downward. This can effectively penetrate the disguise at the data level and accurately reveal the true health status of the device under complex network threat conditions. Attached Figure Description

[0009] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0010] Figure 1 A flowchart illustrating the hydropower plant equipment health assessment method incorporating cybersecurity posture according to an embodiment of the present invention; Figure 2 This is a data flow diagram illustrating the hydropower plant equipment health assessment method that integrates network security posture according to an embodiment of the present invention. Figure 3 A flowchart illustrating a preliminary physical health score obtained from a hydropower plant equipment health assessment method based on physical sensor data sequences, according to an embodiment of the present invention, which integrates network security situational awareness. Figure 4 A flowchart illustrating the control-physical consistency score obtained by modeling and evaluating control-physical timing consistency based on actual control command sequences and physical sensor data sequences in a hydropower plant equipment health assessment method that integrates network security situation according to an embodiment of the present invention. Figure 5A flowchart illustrating the consistency deviation between the physical data sequence and the physical sensor data sequence in the hydropower plant equipment health assessment method that integrates network security situational awareness according to an embodiment of the present invention. Figure 6 This is a block diagram of a hydropower plant equipment health assessment system that integrates network security posture according to an embodiment of the present invention. Detailed Implementation

[0011] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0012] Unless otherwise specifically stated, the technical or scientific terms used in the embodiments of this invention should be understood in their ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains. The terms "comprising" or "including," as used in the embodiments of this invention, do not limit the shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof mentioned, nor do they exclude the appearance or addition of one or more other different shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof, or the inclusion of these.

[0013] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale, and techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail; however, where appropriate, the illustrated techniques, methods, and apparatus should be considered part of the specification. In all the examples shown and discussed herein, any other specific example may have different values. It should be noted that similar symbols and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0014] In the description of the embodiments of the present invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In the embodiments of the present invention, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in the embodiments of the present invention, as well as the features of different embodiments or examples.

[0015] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0016] Current methods for assessing the health status of equipment in critical infrastructure such as hydropower plants primarily revolve around the analysis of physical sensor data. A fundamental shortcoming of these methods is that they implicitly assume the acquired input data to be true and reliable. Such methods lack effective defense against sensor data tampering through cyberattacks and are highly susceptible to erroneous judgments of normal equipment operation due to the injection of false data, thus obscuring potential physical security risks.

[0017] In view of this, the technical solution of this invention proposes a method for integrating network security situation information into the device health assessment process. In this method, a pre-trained model based on a long short-term memory network autoencoder architecture is first used to process the physical sensor data sequence, and a preliminary physical health score is obtained by calculating its reconstruction error. Furthermore, to address the technical challenge of potentially maliciously tampered sensor data, this solution includes a control-physical timing consistency assessment stage. In this stage, the actual control command sequence issued to the device is fed into a response prediction model, thereby generating a predicted physical data sequence that the device should present under normal conditions. This solution breaks through the limitations of traditional point-by-point comparison, instead constructing the multidimensional predicted sequence and the actual observed sequence as parameterized motion trajectories in a high-dimensional state space. Differential geometry methods are used to extract and compare the curvature feature signatures of the two trajectories, and finally, the deviation degree of their inherent dynamic characteristics is quantified using KL divergence, thus obtaining a consistency score that is highly sensitive to the physical coupling relationship of the system. In parallel, this method also quantifies the threat level of a set of network security events, forming a network threat factor. Finally, within the dynamically revised assessment framework, the initial physical health score, control-physical consistency score, and cyber threat factor are organically integrated to output the final device health score. Based on this mechanism, if a significant discrepancy or correlation between the physical-level response and the control-level instructions is detected as a cybersecurity threat, even if the sensor data itself exhibits healthy characteristics, the final comprehensive assessment score will be significantly lowered, effectively revealing false health conditions.

[0018] Figure 1 This is a flowchart of a hydropower plant equipment health assessment method that integrates network security posture according to an embodiment of the present invention. Figure 2 This is a data flow diagram illustrating the hydropower plant equipment health assessment method incorporating network security posture according to an embodiment of the present invention. Figure 1 and Figure 2 As shown, the hydropower plant equipment health assessment method based on the integrated network security situation according to an embodiment of the present invention includes the following steps: S100, acquiring physical sensor data sequences, actual control command sequences, and a set of network security events; S200, performing a preliminary physical health assessment based on the physical sensor data sequences to obtain a preliminary physical health score; S300, performing control-physical timing consistency modeling and assessment based on the actual control command sequences and physical sensor data sequences to obtain a control-physical consistency score; S400, quantifying network security threat factors on the set of network security events to obtain network threat factors; S500, performing a fusion evaluation and dynamic health correction on the preliminary physical health score, control-physical consistency score, and network threat factors to obtain a final fusion health score.

[0019] Specifically, in step S100, physical sensor data sequences, actual control command sequences, and a set of cybersecurity events are acquired. It should be understood that since physical sensor data alone cannot reveal the control intent of a device's operation, nor reflect its cybersecurity environment, relying solely on this data for health assessment will lead to erroneous conclusions when the sensor data itself is maliciously tampered with. Therefore, in the technical solution of this invention, physical sensor data sequences, actual control command sequences, and a set of cybersecurity events are acquired to provide the necessary multi-dimensional data input for subsequent health assessments, consistency verification, and cyber threat quantification. This establishes a data foundation for revealing potential inconsistencies between physical behavior, control intent, and cyber events, which is a prerequisite for identifying false health states.

[0020] More specifically, in a concrete example of the present invention, the first step in the data acquisition process is to construct a standardized data acquisition channel for the governor of the No. 1 hydroelectric generator unit in the hydropower plant. Regarding the physical sensor data sequence, the system periodically polls the programmable logic controller (PLC) of the governor (its IP address is 192.168.1.100), reads the register addresses storing core physical quantities such as the actual guide vane opening and the unit's active power according to a preset sampling frequency, and adds precise timestamp information to each sampled data point, thereby forming the physical sensor data sequence. Regarding the actual control command sequence, a data acquisition agent program is configured in the operation log or historical database of the central monitoring SCADA system. This agent program monitors and captures all control commands issued to the target governor PLC in real time, records the issuance time, command type, and target parameter value of each command (e.g., adjusting the guide vane opening to 70%), and organizes them into an actual control command sequence in a unified format. In terms of network security event sets, all security alarm records with target IP addresses pointing to 192.168.1.100 are aggregated from the log server of the Intrusion Detection System (IDS) deployed in the industrial control network. These records cover elements such as alarm trigger time, event type (e.g., abnormal Modbus write operation), threat level, source IP address, and target IP address, which together constitute the network security event set.

[0021] Specifically, in step S200, a preliminary physical health assessment is performed based on the physical sensor data sequence to obtain a preliminary physical health score. It should be understood that since the physical operating state of the equipment is the direct object of health assessment, its multi-dimensional sensor data sequence contains complex dynamic patterns reflecting normal and abnormal operating conditions. Therefore, in the technical solution of this invention, a preliminary physical health assessment is further performed based on the physical sensor data sequence to obtain a preliminary physical health score, thereby quantifying the degree of deviation between the current equipment operating state and the historical normal state through a deep learning model. This generates a preliminary quantitative index characterizing the apparent health level of the equipment, providing an evaluation benchmark for subsequent dynamic correction of fusion control-physical consistency and network security posture.

[0022] Figure 3 This is a flowchart illustrating a preliminary physical health assessment of hydropower plant equipment based on physical sensor data sequences to obtain a preliminary physical health score, according to an embodiment of the present invention, which integrates network security posture assessment. Figure 3 As shown, step S200 includes: S210, inputting the physical sensor data sequence into a pre-trained LSTM autoencoder model to obtain a reconstructed physical sensor data sequence; S220, calculating the reconstruction error between the physical sensor data sequence and the reconstructed physical sensor data sequence; S230, mapping the reconstruction error to a health score to obtain a preliminary physical health score.

[0023] In step S210, the physical sensor data sequence is input into a pre-trained LSTM autoencoder model to obtain a reconstructed physical sensor data sequence. It should be understood that, due to the complex temporal dependencies and coupling characteristics between multiple variables within the physical sensor data sequence, simple thresholding or conventional statistical methods are insufficient to effectively capture its deep dynamic patterns. Therefore, in the technical solution of this invention, the physical sensor data sequence is further fed into a pre-trained LSTM autoencoder model to obtain a reconstructed physical sensor data sequence, fully leveraging the model's advantages in temporal feature learning and sequence reconstruction to generate an idealized data sequence based on the device's historical normal operating behavior patterns. This provides a high-fidelity reference benchmark for subsequent reconstruction error calculation, and the difference between this benchmark and the original sequence can sensitively reflect subtle deviations in the device's state.

[0024] More specifically, in a concrete example of this invention, the acquired time-series data of the actual opening of the governor guide vanes and the active power of the unit are first preprocessed. This preprocessing includes normalizing the data, scaling physical values ​​of different dimensions to the range of zero to one, to meet the input requirements of the pre-trained LSTM autoencoder model. Subsequently, the normalized multidimensional physical sensor data sequence is input into the model as a whole. This model has been trained on a large amount of historical data covering the normal operating conditions of hydropower plants. Its internal encoder compresses the input time-series data into a low-dimensional vector containing core dynamic features, and the decoder attempts to reconstruct the original input sequence based on this vector. After the model is processed, it outputs a time series with the same dimensions and length as the input sequence. This is the reconstructed physical sensor data sequence, which represents the most standard physical response pattern understood by the model under the current operating conditions.

[0025] In step S220, the reconstruction error between the physical sensor data sequence and the reconstructed physical sensor data sequence is calculated. It should be understood that since the reconstructed physical sensor data sequence is only a reference to an ideal state, the degree of difference between it and the actual observation sequence requires a precise quantitative indicator to characterize it. Therefore, in the technical solution of this invention, the reconstruction error between the physical sensor data sequence and the reconstructed physical sensor data sequence is further calculated to condense the deviation between the two multidimensional time series into a single scalar value that reflects the degree of anomaly. This provides a direct and sensitive numerical basis for subsequently mapping this deviation to a health score, and the magnitude of the error value is positively correlated with the degree to which the equipment state deviates from normal.

[0026] More specifically, in a concrete example of this invention, a root mean square error (RMSE) calculation is performed on the normalized actual physical sensor data sequence and the reconstructed physical sensor data sequence output by the LSTM autoencoder. This calculation first calculates the difference between corresponding data points in the two sequences one by one according to time points and sensor channels, forming a difference sequence. Then, a squaring operation is applied to each element in the difference sequence to eliminate the influence of the sign of the difference and enhance the characterization of the deviation. Finally, all squared differences are summed and averaged to obtain a unique reconstruction error scalar. This scalar comprehensively reflects the overall deviation of the actual evolution trajectories of the two physical quantities—the actual guide vane opening and the unit's active power—from the ideal trajectory reconstructed by the model within the current analysis time window.

[0027] In step S230, a health score is mapped onto the reconstruction error to obtain a preliminary physical health score. It should be understood that since the reconstruction error is an unbounded scalar value, its physical meaning is not intuitive and difficult to directly use for subsequent fusion evaluation and decision-making. Therefore, in the technical solution of this invention, a health score mapping is further performed on the reconstruction error to obtain a preliminary physical health score, thereby converting the original error value into a standardized health index between zero and one. This allows the evaluation result to have a clear business meaning; the closer the score is to one, the healthier the equipment; the closer the score is to zero, the more abnormal the equipment condition, thus providing a unified dimension for the fusion of indicators from different dimensions.

[0028] More specifically, in a concrete example of this invention, a negative exponential function is used to map the calculated reconstruction error value. It is worth noting that when the reconstruction error value is extremely small, approaching zero, it indicates that the actual operating state of the speed governor closely matches the historical normal mode. In this case, the result calculated by the formula will approach one, indicating a high level of physical health for the equipment. Conversely, if the reconstruction error value is large, it indicates a significant deviation in equipment operation, and the health score calculated by the formula will rapidly decay and approach zero. The output of this calculation is the preliminary physical health score, a normalized value that intuitively reflects the current physical health status of the speed governor.

[0029] Specifically, in step S300, control-physical timing consistency modeling and evaluation are performed based on the actual control command sequence and physical sensor data sequence to obtain a control-physical consistency score. It should be understood that since the preliminary health score obtained solely based on the physical sensor data sequence cannot verify the authenticity of the data itself, the score will lose its reliability if the data is maliciously tampered with during transmission. Therefore, in the technical solution of this invention, control-physical timing consistency modeling and evaluation are further performed based on the actual control command sequence and physical sensor data sequence to obtain a control-physical consistency score. This establishes a verification closed loop spanning the control domain and the physical domain. By quantifying the degree of conformity between the device's physical response and the control logic it should follow, the credibility of the physical data is determined. In this way, a quantitative index highly sensitive to mismatches between control commands and physical feedback can be generated, providing a decisive basis for identifying false health states caused by data tampering.

[0030] Figure 4 This is a flowchart illustrating the control-physical timing consistency modeling and evaluation based on actual control command sequences and physical sensor data sequences to obtain a control-physical consistency score, according to an embodiment of the present invention's method for assessing the health of hydropower plant equipment by integrating network security posture. Figure 4As shown, step S300 includes: S310, inputting the actual control command sequence into the pre-trained control-physical response prediction model to obtain the predicted physical data sequence; S320, calculating the consistency deviation value between the predicted physical data sequence and the physical sensor data sequence; S330, mapping the consistency deviation value to a consistency score to obtain the control-physical consistency score.

[0031] In step S310, the actual control command sequence is input into a pre-trained control-physical response prediction model to obtain a predicted physical data sequence. It should be understood that since actual physical feedback data alone is insufficient to determine its rationality, a reference benchmark is needed to compare whether it follows the established control logic. Therefore, in the technical solution of this invention, the actual control command sequence is further input into the pre-trained control-physical response prediction model to obtain a predicted physical data sequence, thereby generating a theoretically healthy response output sequence that conforms to physical laws based on the control input of the device. This allows the construction of a gold standard path, providing a clear and high-fidelity comparison object for subsequent quantification of the deviation between the actual physical response and the expected response.

[0032] Specifically, in a concrete example of this invention, the acquired actual control command sequence is first formatted. This process includes extracting specific governor-oriented command content from the SCADA system log, such as the key control parameter information "adjust the guide vane opening to 70%", and performing a normalization transformation on its parameter values ​​to adapt them to the input format specified by the pre-trained control-physical response prediction model. Subsequently, the processed control command sequence is fed into a prediction model constructed using a Seq2Seq architecture. This model, through learning from large-scale historical operating data, has mastered the precise correspondence between specific control commands under various normal operating conditions and subsequent changes in multi-dimensional physical quantities such as the actual guide vane opening and the unit's active power. After receiving the command input, the model's encoder component encodes the command intent into a context vector representation, and the decoder component outputs a normalized prediction physical data time series based on this vector. Finally, the normalized prediction sequence output by the model is subjected to inverse normalization and restoration operation to convert it into a predicted physical data sequence with actual physical dimensions. This sequence describes the dynamic change process of the guide vane opening and unit power that the governor should exhibit under healthy operating conditions after receiving the opening adjustment command.

[0033] In step S320, the consistency deviation between the predicted physical data sequence and the physical sensor data sequence is calculated. It should be understood that the core flaw of existing technologies in evaluating the consistency between control commands and physical feedback stems from the assumption of channel independence in multidimensional sensor data. By calculating the time-series distance for multiple sensor channels separately and then weighting and summing them, it essentially simplifies a high-dimensional dynamic system problem into a comparison of multiple independent one-dimensional time series. This approach completely ignores the crucial special relationships between different physical measurements, namely the inherent physical coupling and causal structure of the system. In complex industrial systems like hydropower plants, key parameters such as guide vane opening, unit speed, and active power do not exist in isolation but follow strict physical laws, are mutually coupled, and are mutually causal. Their collaborative evolution forms trajectories with specific patterns and directions in the multidimensional state space. Traditional methods can only verify whether the shapes of the time-series curves of individual variables are similar, but cannot detect the fallacy of the evolution direction of the state vector composed of multiple variables in space. Therefore, when a covert attack can cleverly manipulate data, making the time series of each variable appear reasonable on its own, but their combination severely violates physical laws (e.g., power increases while opening decreases), existing mechanisms may fail because they cannot detect this deep-seated structural inconsistency. The fundamental reason is that they only verify the similarity of the projections of the state trajectory onto various coordinate axes, failing to effectively verify the correctness of the trajectory's inherent geometric structure and dynamic characteristics. Therefore, in a preferred embodiment of this invention, the consistency deviation value between the predicted physical data sequence and the physical sensor data sequence is further calculated. This abandons the assumption of channel independence, treating the multidimensional time series as a whole as a parameterized curve in a high-dimensional space, and measuring consistency by analyzing and comparing its inherent geometric properties. In this way, a deviation metric that profoundly reflects the physical coupling relationship and dynamic causal structure among the system's multiple variables can be generated. This metric is no longer limited to comparing the independent time series forms of each variable, but delves into the inherent geometric properties of the trajectory in the multidimensional state space, thus being particularly sensitive to covert attacks that violate physical laws but whose single-variable sequences appear reasonable.

[0034] Figure 5 This is a flowchart illustrating the consistency deviation between the predicted physical data sequence and the physical sensor data sequence in a hydropower plant equipment health assessment method that integrates network security posture analysis according to an embodiment of the present invention. Figure 5As shown, step S320 includes: S321, performing state-space trajectory modeling on the predicted physical data sequence and the physical sensor data sequence to obtain the observed state trajectory and the predicted state trajectory; S322, extracting trajectory curvature signatures from the observed state trajectory and the predicted state trajectory to obtain the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory; S333, calculating the KL divergence value between the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory as the consistency deviation value.

[0035] In step S321, state-space trajectory modeling is performed on the predicted physical data sequence and the physical sensor data sequence to obtain the observed state trajectory and the predicted state trajectory. It should be understood that since discrete sensor data points cannot inherently represent the continuity and multivariate dynamic coupling characteristics of the system's state evolution, they must be converted into continuous mathematical objects capable of supporting differential geometric analysis. This conversion constitutes a necessary prerequisite for the subsequent calculation of the trajectory's instantaneous velocity vector and acceleration vector, and these two vectors are the mathematical basis for quantitatively analyzing the trajectory's dynamic bending characteristics. Therefore, in the technical solution of this invention, state-space trajectory modeling is further performed on the predicted physical data sequence and the physical sensor data sequence to obtain the observed state trajectory and the predicted state trajectory. Using smooth fitting techniques, the discrete data sequence representing the actual physical feedback and the discrete data sequence representing the model's predicted feedback are respectively constructed as smooth curves in an M-dimensional state space with time t as a parameter. In this way, the original discrete data point set can be transformed into a continuous geometric entity form, thereby obtaining two differentiable parameterized curves. The first curve depicts the actual operating path of the device driven by the current observation data, while the second curve represents the standard reference path that the device should follow in a healthy state, based on control commands and physical models.

[0036] Specifically, in a specific example of the present invention, the construction of the state-space trajectory first involves defining a two-dimensional state space, where M equals two, and the coordinate axes represent the actual opening of the governor's guide vanes and the active power of the generator unit, respectively. Then, for the actually observed physical sensor data sequence, the two-dimensional data at each sampling time point is plotted as a coordinate point in this state space. Next, cubic spline interpolation is used to fit these discrete coordinate points, generating a continuous and smooth parametric curve, which is the observed state trajectory. For illustration, it is assumed that the observed physical sensor data sequence (guide vane opening, generator active power) at three consecutive time points is (40.1, 150.2), (40.0, 150.1), and (40.1, 150.3). Simultaneously, based on a control command to increase power, the predicted physical data sequence at the corresponding time points is (42.5, 158.0), (55.0, 195.0), and (68.5, 230.0). In this scenario, the observed state trajectory generated by cubic spline interpolation will be a short line segment almost stationary in the state space, while the predicted state trajectory will be a smooth, directional arc. This significant difference in geometric shape intuitively exposes the inconsistency between the actual response of the physical system and the theoretical expectation. Similarly, the predicted physical data sequence representing the ideal response, output by the control-physics response prediction model, is also plotted in this state space, and the predicted state trajectory is obtained by fitting it using cubic spline interpolation. This process ultimately generates two mapping curves from the time domain to this two-dimensional Euclidean space. These curves, in a parameterized form, completely and continuously represent the governor's operating trajectory under the actual observed data and the standard operating trajectory under the theoretical health model, respectively. In this way, the original data is transformed from a discrete set of points into a continuous geometric entity, resulting in two parameterized curves on which differential operations can be performed.

[0037] In step S322, trajectory curvature signature extraction is performed on the observed state trajectory and the predicted state trajectory to obtain the curvature time series of the observed trajectory and the predicted trajectory. It should be understood that point-to-point distance comparison cannot capture the dynamic curvature characteristics of the trajectory, and these curvature characteristics precisely embody the physical laws governing the interaction between variables. Therefore, in the technical solution of this invention, trajectory curvature signature extraction is further performed on the observed state trajectory and the predicted state trajectory to obtain the curvature time series of the observed trajectory and the predicted trajectory, thereby utilizing the tools of differential geometry to extract a core feature quantity from the trajectory that profoundly reflects the inherent physical dynamic characteristics of the system.

[0038] Specifically, in a particular example of the present invention, γ(t) and γ are calculated using tools of differential geometry. The first and second derivatives (velocity vectors) and the second derivative (acceleration vectors) of these two trajectories are then substituted into the curvature calculation formula to obtain the curvatures κ(t) and k of the two trajectories at each time t. (t). Since the observed and predicted state trajectories have been modeled as continuous parametric curves (e.g., cubic spline curves), the first derivative (velocity vector) and second derivative (acceleration vector) at any given time can be accurately calculated through analytical differentiation, providing a solid mathematical foundation for solving curvature. In the operation scenario of a hydropower plant, curvature is a direct manifestation of the acceleration of system state changes and a geometric signature of the system's dynamic coupling strength. For example, during a normal operating condition switch, the curvature change of the state trajectory is smooth and predictable; however, a malicious data injection that violates physical coupling will create unnatural distortions in the state space, resulting in abnormal curvature characteristics. In the final generated curvature time series, this abnormal characteristic may manifest as one or more sharp pulses with amplitudes far exceeding the normal range, or as a significant increase in the overall variance of the sequence, forming a quantifiable and significant contrast with the smooth, low-amplitude curvature sequence under normal operating conditions. Thus, extracting a core feature quantity from the trajectory that profoundly reflects the system's inherent physical dynamic characteristics results in the generation of κ(t) and k. These two one-dimensional time series (t) compress and refine the original multi-dimensional complex dynamic information into geometric feature signatures that are easier to compare.

[0039] In step S323, the KL divergence value between the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory is calculated as the consistency deviation value. It should be understood that since directly comparing the two curvature sequences point-by-point may lead to misjudgments due to noise or micro-delays, a more robust macroscopic comparison from the statistical distribution level is needed. Therefore, in the technical solution of this invention, the KL divergence value between the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory is further calculated as the consistency deviation value, thereby transforming the consistency problem into an information theory problem: how much information loss occurs when the observed system dynamic geometric characteristic distribution P(κ) is described by a healthy, expected dynamic geometric characteristic distribution Q(κ)? In this way, a stable and sensitive scalar index can be obtained to measure the similarity of the geometric characteristics of two trajectories from a global and statistical perspective. This value can profoundly quantify the differences between the observed trajectory and the predicted trajectory at the level of intrinsic dynamic laws. If the physical dynamic characteristics of the two trajectories are highly consistent, their curvature distributions will also be similar, and the KL divergence will approach zero. Conversely, any abnormal behavior that disrupts the physical coupling will lead to a significant deviation in the curvature distribution, thereby producing a large KL divergence value.

[0040] Specifically, in a specific example of the present invention, κ(t) and k are first... (t) The two curvature time series are considered as sample sets drawn from two unknown probability distributions. Then, the kernel density estimation algorithm is used to estimate the probability density functions P(κ) and Q(κ) corresponding to these two sample sets, respectively. It should be understood that kernel density estimation is a non-parametric method. Its advantage lies in its ability to fit the shape of the probability distribution based on the characteristics of the sample data itself, without pre-assuming that the data follows a specific distribution (such as a normal distribution). This is particularly suitable for describing the variable curvature distribution characteristics under complex operating conditions in hydropower plants. Subsequently, the Kullback-Leibler divergence from information theory is used to calculate the divergence value of P(κ) relative to Q(κ), and this is used as the final consistency deviation value. Under healthy operating conditions, the governor responds to commands and adjusts, and its state trajectory produces a smooth and regular curvature. Therefore, its predicted curvature time series k... The values ​​in κ(t) might be concentrated between 0.1 and 0.3, resulting in a probability density function Q(κ) that is a gentle hill with a peak around 0.2. However, due to data manipulation, the observed state trajectory is almost a straight line, and the values ​​in its observed curvature time series κ(t) will be highly concentrated around 0, resulting in a probability density function P(κ) that is a sharp pulse at the 0 point. In this case, using a gentle hill distribution to describe a sharp pulse distribution results in a huge difference in morphology, and the calculated KL divergence value will inevitably be a large positive number, such as 3.5, thus accurately quantifying this deep inconsistency caused by the disruption of physical laws.

[0041] The preferred embodiment described above, by introducing an interdisciplinary perspective of differential geometry and probability theory, achieves a paradigm shift in the evaluation of consistency across multidimensional time series. This generates a consistency deviation metric that profoundly reflects the physical coupling relationships and dynamic causal structure among the system's multiple variables. This metric is no longer limited to a superficial comparison of the independent temporal forms of individual variables, but delves into the intrinsic geometric properties of the trajectories within the multidimensional state space, providing a structured and global evaluation of the overall similarity between two trajectories. This differential-probabilistic metric is particularly sensitive to covert attacks that violate physical laws but whose single-variable sequences appear reasonable, exhibiting higher identification accuracy and robustness.

[0042] In step S330, the consistency deviation value is mapped to a consistency score to obtain the control-physical consistency score. It should be understood that since the calculated consistency deviation value is an unbounded non-negative scalar, the correspondence between its magnitude and the degree of consistency is not intuitive and cannot be directly used for subsequent fusion evaluation. Therefore, in the technical solution of this invention, the consistency deviation value is further mapped to a consistency score to obtain the control-physical consistency score, thereby normalizing the deviation value to a zero-to-one interval with clear physical meaning. This generates a standardized consistency score that can be directly compared with other evaluation indicators; the closer the score is to one, the higher the consistency, and the closer it is to zero, the worse the consistency, providing a clear quantitative input for the final dynamic correction of health.

[0043] Specifically, in step S400, the network security event set is quantified using network security threat factors to obtain network threat factors. It should be understood that since physical health assessment and control-physical consistency assessment primarily focus on the analysis of the physical and control domains, they cannot directly map the threat level of the network environment in which the device is located. However, network attacks are precisely the root cause of data tampering and consistency breaches. Therefore, in the technical solution of this invention, the network security event set is further subjected to network security threat factor quantification to obtain network threat factors, transforming abstract network security alarm information into a standardized risk indicator that can participate in mathematical calculations. In this way, direct quantitative input from the network security dimension can be injected into the final health fusion assessment, enabling the assessment conclusions to respond promptly and sensitively to potential network attack behaviors.

[0044] More specifically, in a concrete example of this invention, the acquired set of network security events is first filtered, retaining only security event records where the target IP address points to the speed controller PLC address 192.168.1.100. Then, based on a pre-established event threat knowledge base, each filtered security event is assigned a corresponding threat score. This knowledge base establishes a mapping relationship between event types (e.g., abnormal Modbus write operations, unauthorized access attempts, protocol format anomalies, etc.) and basic threat scores, and adjusts the basic score accordingly based on the severity level of the event (e.g., high, medium, low). For example, a Modbus write operation event targeting the PLC, judged as high-risk, can be assigned a threat score of 0.9. Finally, the threat scores of all relevant network security events within the current analysis time window are aggregated. In this example, a maximum value aggregation strategy is selected, meaning the highest threat score among all related events is determined as the final network threat factor for the current time window.

[0045] In summary, the hydropower plant equipment health assessment method integrating network security posture according to embodiments of the present invention is explained. It first utilizes a deep learning model to perform time-series reconstruction processing on physical sensor data, and provides a preliminary quantitative evaluation of the equipment's physical health status based on the reconstruction error. Addressing the challenge of potential malicious tampering of sensor data leading to distortion of physical-level assessment results, this solution constructs a cross-domain consistency verification mechanism. This mechanism embeds multi-dimensional sensor observation sequences and prediction sequences generated based on control commands into a high-dimensional state space to form their respective motion trajectories. Differential geometry methods are used to extract the trajectory curvature as a geometric representation of the system's dynamic behavior. Then, the statistical distribution difference between the two curvature time series is measured using KL divergence, thereby obtaining a control-physical consistency score that can fully characterize the multivariate physical coupling relationships within the system. In the final evaluation stage, the quantified network security threat factor, the preliminary physical health score, and the control-physical consistency score are incorporated into a unified dynamic fusion framework. When the consistency score is significantly low or the network threat level rises significantly, even if the sensor data indicates a good physical condition, the final health score of the system will still be significantly revised downward. This can effectively penetrate the disguise at the data level and accurately reveal the true health status of the device under complex network threat conditions.

[0046] Furthermore, a hydropower plant equipment health assessment system that integrates cybersecurity posture is also provided.

[0047] Figure 6 This is a block diagram of a hydropower plant equipment health assessment system integrating network security posture according to an embodiment of the present invention. As shown in Figure 6, the hydropower plant equipment health assessment system 100 integrating network security posture according to an embodiment of the present invention includes: a data acquisition module 110, used to acquire physical sensor data sequences, actual control command sequences, and a set of network security events; a physical health preliminary assessment module 120, used to perform a preliminary physical health assessment based on the physical sensor data sequences to obtain a preliminary physical health score; a temporal consistency modeling and assessment module 130, used to perform control-physical temporal consistency modeling and assessment based on the actual control command sequences and physical sensor data sequences to obtain a control-physical consistency score; a network security threat factor quantification module 140, used to quantify network security threat factors on the set of network security events to obtain network threat factors; and a fusion evaluation and dynamic health correction module 150, used to perform a fusion evaluation and dynamic health correction on the preliminary physical health score, the control-physical consistency score, and the network threat factors to obtain a final fusion health score.

[0048] Furthermore, the preliminary physical health assessment module 120 includes: The reconstructed physical sensor data sequence acquisition unit is used to input the physical sensor data sequence into a pre-trained LSTM autoencoder model to obtain the reconstructed physical sensor data sequence. The reconstruction error calculation unit is used to calculate the reconstruction error between the physical sensor data sequence and the reconstructed physical sensor data sequence. The health score mapping unit is used to map the reconstruction error to a health score to obtain a preliminary physical health score.

[0049] Furthermore, the time-series consistency modeling and evaluation module 130 includes: The predicted physical data sequence acquisition unit is used to input the actual control command sequence into the pre-trained control-physical response prediction model to obtain the predicted physical data sequence. The consistency deviation calculation unit is used to calculate the consistency deviation between the predicted physical data sequence and the physical sensor data sequence. A consistency score mapping unit is used to map consistency deviation values ​​to obtain the control-physical consistency score.

[0050] Furthermore, the temporal consistency modeling and evaluation module 130 is specifically used for: performing state-space trajectory modeling on the predicted physical data sequence and the physical sensor data sequence to obtain the observed state trajectory and the predicted state trajectory; extracting trajectory curvature signatures from the observed state trajectory and the predicted state trajectory to obtain the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory; and calculating the KL divergence value between the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory as the consistency deviation value.

[0051] As described above, the hydropower plant equipment health assessment system 100 with integrated network security posture according to embodiments of the present invention can be implemented in various computing devices, such as data servers, engineering workstations, or industrial computers deployed in hydropower plant monitoring centers. In one possible implementation, the hydropower plant equipment health assessment system 100 with integrated network security posture according to embodiments of the present invention can be integrated into the computing device as a software module and / or a hardware module. For example, the hydropower plant equipment health assessment system with integrated network security posture can be a software module in the operating system of the computing device, or it can be a dedicated application developed for the computing device; of course, the hydropower plant equipment health assessment system 100 with integrated network security posture can also be one of many hardware modules of the computing device.

[0052] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for assessing the health of hydropower plant equipment by integrating network security situational awareness, characterized in that, include: Acquire physical sensor data sequences, actual control command sequences, and sets of cybersecurity events; A preliminary physical health assessment is conducted based on physical sensor data sequences to obtain a preliminary physical health score. Control-physical timing consistency modeling and evaluation are performed based on actual control command sequences and physical sensor data sequences to obtain control-physical consistency scores. The network security threat factors are quantified from a set of network security events to obtain network threat factors. The preliminary physical health score, control-physical consistency score, and network threat factor are integrated for evaluation and dynamic health correction to obtain the final integrated health score.

2. The method for assessing the health of hydropower plant equipment by integrating network security situational awareness as described in claim 1, characterized in that, A preliminary physical health assessment is performed based on physical sensor data sequences to obtain a preliminary physical health score, including: The physical sensor data sequence is input into a pre-trained LSTM autoencoder model to obtain a reconstructed physical sensor data sequence; Calculate the reconstruction error between the physical sensor data sequence and the reconstructed physical sensor data sequence; The reconstruction error is mapped to a health score to obtain a preliminary physical health score.

3. The method for assessing the health of hydropower plant equipment by integrating network security situational awareness as described in claim 1, characterized in that, Control-physical timing consistency modeling and evaluation are performed based on actual control command sequences and physical sensor data sequences to obtain a control-physical consistency score, including: The actual control command sequence is input into the pre-trained control-physics response prediction model to obtain the predicted physical data sequence; Calculate the consistency deviation between the predicted physical data sequence and the physical sensor data sequence; The consistency deviation values ​​are mapped to a consistency score to obtain the control-physical consistency score.

4. The method for assessing the health of hydropower plant equipment by integrating network security situational awareness as described in claim 3, characterized in that, Calculate the consistency deviation between the predicted physical data sequence and the physical sensor data sequence, including: State-space trajectory modeling is performed on the predicted physical data sequence and the physical sensor data sequence to obtain the observed state trajectory and the predicted state trajectory; Trajectory curvature signatures are extracted from the observed and predicted state trajectories to obtain the curvature time series of the observed and predicted trajectories. The KL divergence value between the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory is calculated as the consistency deviation value.

5. A hydropower plant equipment health assessment system integrating network security situational awareness, characterized in that, include: The data acquisition module is used to acquire physical sensor data sequences, actual control command sequences, and network security event sets. The physical health preliminary assessment module is used to perform a preliminary physical health assessment based on physical sensor data sequences to obtain a preliminary physical health score. The timing consistency modeling and evaluation module is used to perform control-physical timing consistency modeling and evaluation based on the actual control command sequence and physical sensor data sequence to obtain a control-physical consistency score. The network security threat factor quantification module is used to quantify network security threat factors in a set of network security events to obtain network threat factors. The integrated evaluation and dynamic health correction module is used to perform integrated evaluation and dynamic health correction on the preliminary physical health score, control-physical consistency score and network threat factor to obtain the final integrated health score.

6. The hydropower plant equipment health assessment system integrating network security situational awareness as described in claim 5, characterized in that, The preliminary physical health assessment module includes: The reconstructed physical sensor data sequence acquisition unit is used to input the physical sensor data sequence into a pre-trained LSTM autoencoder model to obtain the reconstructed physical sensor data sequence. The reconstruction error calculation unit is used to calculate the reconstruction error between the physical sensor data sequence and the reconstructed physical sensor data sequence. The health score mapping unit is used to map the reconstruction error to a health score to obtain a preliminary physical health score.

7. The hydropower plant equipment health assessment system integrating network security situational awareness as described in claim 5, characterized in that, The time-series consistency modeling and evaluation module includes: The predicted physical data sequence acquisition unit is used to input the actual control command sequence into the pre-trained control-physical response prediction model to obtain the predicted physical data sequence. The consistency deviation calculation unit is used to calculate the consistency deviation between the predicted physical data sequence and the physical sensor data sequence. A consistency score mapping unit is used to map consistency deviation values ​​to obtain the control-physical consistency score.

8. The hydropower plant equipment health assessment system integrating network security situational awareness as described in claim 7, characterized in that, The temporal consistency modeling and evaluation module is specifically used for: performing state-space trajectory modeling on the predicted physical data sequence and physical sensor data sequence to obtain the observed state trajectory and the predicted state trajectory; and extracting trajectory curvature signatures from the observed state trajectory and the predicted state trajectory to obtain the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory. The KL divergence value between the curvature time series of the observed trajectory and the curvature time series of the predicted trajectory is calculated as the consistency deviation value.

Images