A risk early warning method and device based on a new network-involved subject access

Abstract

The application discloses a risk early warning method and device based on a new type of network-related main body access, which comprises the following steps: collecting main body information of the new type of network-related main body and user information of each user in a power distribution network; analyzing the operation condition of the new type of network-related main body, identifying the main body, and giving main body identification data; constructing a corresponding basic user portrait according to the user information; combining the main body identification data to trigger the disturbance update of the basic user portrait and determine the disturbed user portrait; fusing the main body identification data and the disturbed user portrait, analyzing the influence intensity of the new type of network-related main body on each user, and giving a comprehensive risk value; combining a preset risk threshold to judge the comprehensive risk value and giving risk early warning information. The new type of network-related main body connected to the power grid is identified, the correlation analysis between the user characteristics and the network-related main body disturbance is established, accurate hidden danger early warning is provided for the user, and the demand of the safe and stable operation of the power grid is met.

Description

Technical Field

[0001] This invention belongs to the technical field of hidden danger monitoring, specifically relating to a risk early warning method and device based on a new type of network-connected entity access. Background Technology

[0002] In the field of power system safety monitoring, power grid operation status monitoring and potential hazard early warning are core links in ensuring power supply reliability. Traditional power monitoring systems provide basic data support for operation and maintenance work by collecting key power grid operating parameters. With the large-scale development of new grid-connected entities such as distributed energy (such as solar photovoltaic and wind power), energy storage systems, and electric vehicle charging facilities, the scope and scale of their grid connection continue to expand, driving the power grid structure to evolve towards complexity and heterogeneity.

[0003] The rapid integration of new grid-connected entities has significantly altered the characteristics of power grid operation, rendering traditional early warning methods inadequate for accurately predicting grid operational status. Traditional methods suffer from incomplete data coverage, failing to integrate structured and unstructured data from multiple channels such as dispatch automation systems, distribution IoT terminals, and meteorological service platforms, resulting in insufficient data completeness and correlation. Furthermore, traditional methods struggle to accurately identify the type, location, operating conditions, and legitimacy of new grid-connected entities (e.g., unauthorized covert access), and lack a correlation analysis mechanism between user characteristics and disturbances from grid-connected entities. Consequently, they cannot provide users with accurate early warnings of potential hazards, failing to meet the new demands for safe and stable power grid operation.

[0004] Patent application CN121395720A discloses a method and system for early warning of potential hazards in secondary equipment of a new type of power system. The method includes: real-time collection of electrical quantity data, non-electrical quantity data, and equipment environmental data from secondary equipment, followed by time alignment and data quality verification to obtain operational data; extraction and calculation of core assessment factors for quantifying the health status of the equipment based on the operational data; fusion of the core assessment factors to construct a dynamic operational profile of the secondary equipment; inputting the dynamic operational profile into a hazard early warning model to obtain hazard assessment results; and determination of the early warning level and execution of the early warning based on the hazard assessment results and the importance information of the secondary equipment, thereby making the supervision and early warning of secondary equipment more intelligent.

[0005] The aforementioned existing technologies, including those mentioned above, do not identify new grid-connected entities or adjust early warnings based on these entities, potentially leading to power supply risks. The current challenge is to identify these new grid-connected entities and establish a correlation analysis between user characteristics and disturbances caused by these entities, providing users with accurate early warnings to meet the evolving demands for safe and stable grid operation. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a risk warning method and apparatus based on the access of novel grid-connected entities. The method includes: collecting entity information of the novel grid-connected entities and user information of each user in the distribution network; analyzing the operating conditions of the novel grid-connected entities based on their entity information, identifying them, and providing entity identification data; constructing corresponding basic user profiles based on user information; triggering disturbance updates to the basic user profiles based on the entity identification data, and determining the disturbed user profiles; fusing the entity identification data and disturbed user profiles to analyze the impact intensity of the novel grid-connected entities on each user, and providing a comprehensive risk value; and judging the comprehensive risk value based on a preset risk threshold, and providing risk warning information. By identifying novel grid-connected entities accessing the power grid and establishing a correlation analysis between user characteristics and disturbances of grid-connected entities, accurate potential hazard warnings are provided to users to meet the needs of safe and stable power grid operation.

[0007] In a first aspect, the present invention provides a risk warning method based on a novel network-related entity access method, specifically including the following steps: Collect the main information of new types of grid-connected entities and the user information of each user in the distribution network; Based on the subject information of new types of internet-related entities, the operational status of these entities is analyzed, subject identification is performed, and subject identification data is provided. Based on user information, construct corresponding basic user profiles; By combining the subject identification data, a perturbation update of the basic user profile is triggered to determine the perturbation user profile; By integrating entity identification data and disturbing user profiles, the impact of new internet-related entities on various users is analyzed, and a comprehensive risk value is given. Based on preset risk thresholds, the comprehensive risk value is assessed, and risk warning information is provided.

[0008] Furthermore, the main information includes electrical quantity data, access location, registration information, and real-time communication signaling vectors; Based on the entity information of new types of internet-related entities, the operational status of these entities is analyzed, entity identification is performed, and entity identification data is provided, specifically including: By analyzing the electrical quantity data of new types of network-connected entities, real-time disturbance vectors are obtained; Based on the baseline disturbance vector corresponding to the new type of network-related subject, the real-time disturbance vector is matched and calculated to give the first subject identification result; By combining the baseline signaling vector and the standard registration field, feature matching is performed on the registration information and the real-time communication signaling vector respectively, and the second subject identification result is given. The first subject identification result and the second subject identification result are combined to determine the subject identification data.

[0009] Furthermore, by analyzing the electrical quantity data of new types of network-connected entities, real-time disturbance vectors are obtained, specifically including: By combining the rated parameters corresponding to the electrical quantity data, the electrical parameter values ​​of the electrical quantity data are calculated to form the characteristics of electricity consumption behavior; Based on the access location of the new network-connected entity, the electrical distance between the new network-connected entity and each user is obtained, and the disturbance mapping coefficient is given in combination with the attenuation coefficient. By using disturbance mapping coefficients, electricity consumption behavior characteristics are corrected, and by combining dynamic disturbance weights, the real-time disturbance vector of new grid-connected entities is determined.

[0010] Furthermore, the real-time perturbation vector is specifically represented as follows:

[0011] Among them, D (t) Let be the real-time perturbation vector at time t. Let m be the disturbance intensity of the i-th type of disturbance, m be the total number of disturbance types, k be the total number of electrical parameter values, and a be the disturbance intensity of the ith type of disturbance. ij This represents the dynamic disturbance weight corresponding to the j-th electrical parameter value under the i-th type of disturbance. Let φ be the value of the j-th electrical parameter at time t. ij (Location) is the disturbance mapping coefficient corresponding to the j-th electrical parameter value under the i-th type of disturbance for the new network-connected entity with access location, μ is the attenuation coefficient, and dist(Location,Node) is the electrical distance between the new network-connected entity with access location and the user Node.

[0012] Furthermore, based on user information, a corresponding basic user profile is constructed, specifically including: A static profile layer is formed based on the user's basic static information. Based on the changes in various electricity consumption behavior characteristics in user information, construct a behavior profile layer; By setting corresponding disturbance thresholds based on the user's sensitivity to various disturbances and fusing them together, a sensitive response layer is obtained; By integrating the static profile layer, the behavioral profile layer, and the sensitive response layer, a basic user profile is constructed.

[0013] Furthermore, it also includes the dynamic updating of the behavioral profile layer, specifically including: Based on a dynamic update cycle, electricity consumption behavior characteristics are collected in real time. Based on the time decay coefficient, the electricity consumption behavior characteristics at each moment are integrated to determine the current behavior profile layer; By combining a preset forgetting factor, real-time electricity consumption behavior characteristics are integrated with the current behavior profile layer to achieve dynamic updates of the behavior profile layer.

[0014] Furthermore, by incorporating a pre-defined forgetting factor, the electricity consumption behavior characteristics are fused with the current behavioral profile layer to achieve dynamic updates of the behavioral profile layer, specifically as follows:

[0015] Where α is the forgetting factor, B (t+1) For the updated behavior profile layer, B (t) For the current behavioral profiling layer, X (t) Let be the electricity consumption behavior characteristics at time t, and λ be the time decay coefficient. The characteristics of electricity consumption behavior at time t0.

[0016] Furthermore, by combining the subject identification data, a perturbation update of the basic user profile is triggered to determine the perturbation user profile, specifically including: Based on the subject identification data, extract various disturbance intensities from the real-time disturbance vector; Based on the intensity of various disturbances, trigger the update of the sensitive response layer in the basic user profile; By combining the sensitive update coefficient, various disturbance intensities are integrated into the sensitive response layer of the basic user profile to determine the disturbed user profile.

[0017] Furthermore, the perturbation update of the basic user profile is specifically represented as follows:

[0018] in, Let be the perturbation threshold for the i-th type of perturbation at time t+1. Let be the perturbation threshold for the i-th type of perturbation at time t. Let γ be the perturbation intensity of the i-th type of perturbation, and γ be the sensitive update coefficient.

[0019] Furthermore, by integrating entity identification data and user profiles of disruptive entities, the impact strength of new internet-related entities on various users is analyzed, and a comprehensive risk value is given, specifically including: Determine the user sensitivity coefficient based on the static profile layer in the disturbed user profile; Based on the user sensitivity coefficient, the basic sensitivity is given by integrating the real-time perturbation vector in the subject recognition data; By perturbing the current electricity consumption behavior characteristics of the behavioral profile layer in the user profile, and combining them with the historical average electricity consumption behavior, the behavioral sensitivity is determined. Based on the perturbation thresholds of various perturbations in the sensitive response layer of the perturbation user profile, the impact of real-time perturbation vectors on users is analyzed to obtain perturbation sensitivity; By combining the preset risk fusion coefficient, the basic sensitivity, behavioral sensitivity, and disturbance sensitivity are integrated to give a comprehensive risk value.

[0020] Furthermore, the comprehensive risk value is specifically expressed as follows:

[0021] Among them, Risk (t) Let α be the overall risk value at time t. s Risk fusion coefficient corresponding to basic sensitivity, α b α represents the risk fusion coefficient corresponding to behavioral sensitivity. r f is the risk fusion coefficient corresponding to the perturbation sensitivity. s Based on basic sensitivity, f b For behavioral sensitivity, f r For perturbation sensitivity.

[0022] Furthermore, behavioral sensitivity is determined through the following steps: Obtain the user's historical and current electricity consumption behavior characteristics at various times; The average of the user's historical electricity consumption behavior characteristics at each time point is calculated to obtain the average of the user's historical electricity consumption behavior; Analyze the deviation between the current electricity consumption behavior characteristics of each user and the historical average electricity consumption behavior, and provide behavioral sensitivity.

[0023] Furthermore, the perturbation sensitivity is determined through the following steps: Obtain the user's disturbance threshold for various disturbances; By combining the disturbance intensity of various disturbances generated by new network-related entities, the disturbance difference between the disturbance intensity of each disturbance and the corresponding disturbance threshold is calculated; Based on the standard disturbance value, the disturbance difference of various disturbances is judged and the disturbance result is given; By integrating the disturbance results of various disturbances caused by users to new types of internet-related entities, the disturbance sensitivity is determined.

[0024] Furthermore, the disturbance sensitivity is specifically expressed as:

[0025] Among them, f r For perturbation sensitivity, θ i Let be the perturbation threshold for the i-th type of perturbation. Let represent the perturbation intensity of the i-th type of perturbation, max() be the maximum value function, and m be the total number of perturbation types.

[0026] Secondly, the present invention also provides a risk warning device based on the access of a novel network-related entity, employing a risk warning method based on the access of a novel network-related entity as described above, comprising: The data acquisition module is used to collect the main information of new grid-connected entities and the user information of each user in the distribution network; The subject identification module is used to analyze the operating conditions of new types of internet-related subjects based on their subject information, identify the subjects, and provide subject identification data. The user profile building module is used to build corresponding basic user profiles based on user information. The profile update module is used to combine the subject recognition data to trigger a perturbation update of the basic user profile and determine the perturbation user profile. The risk fusion module is used to merge entity identification data and disturbing user profiles to analyze the impact of new internet-related entities on each user and provide a comprehensive risk value. The early warning output module is used to judge the comprehensive risk value by combining preset risk thresholds and provide risk warning information.

[0027] The present invention provides a risk warning method and device based on a novel network-related entity access method, which has at least the following beneficial effects: (1) By constructing a basic user profile, the user can be accurately characterized and the multi-dimensional characteristics of the user can be perceived in real time. By analyzing and judging the main information of new network-related entities, the network-related entities can be accurately identified and the ability to perceive risk sources can be improved. By updating the basic user profile with the main identification data, the disturbed user profile can be obtained. The correlation analysis between user characteristics and network-related entity disturbances can be established to provide users with accurate early warning of hidden dangers so as to meet the needs of safe and stable operation of the power grid.

[0028] (2) In the process of identifying new types of network-related entities, the system integrates electrical quantity change feature detection, communication signaling pattern matching and equipment registration information verification. This not only enables accurate identification of the basic information of new types of network-related entities, but also effectively identifies unauthorized covert access behavior, improves the system's ability to discover unknown risk sources, and achieves effective prevention and control of unknown risk sources.

[0029] (3) Integrate basic user profiles with disturbance information of new network-related entities, and calculate the disturbance threshold of various disturbances by combining sensitive update coefficients to achieve differentiated and targeted early warning of potential hazards, so as to improve the accuracy of early warning of disturbances for each user.

[0030] (4) By calculating the disturbance difference, harmless normal power grid fluctuations are filtered out, and only the excessive disturbances that will harm users are retained; the results of various disturbances are superimposed to obtain the comprehensive disturbance sensitivity, quantify the overall disturbance risk of users, directly reflect the severity of the current disturbance of users by new types of network entities, and provide core quantitative basis for user sensitivity level, hidden danger warning, and reverse reinforcement identification. Attached Figure Description

[0031] Figure 1 A flowchart illustrating a risk warning method based on a novel network-related entity access provided in this embodiment of the invention; Figure 2 This is a flowchart illustrating the process architecture for providing risk warning information, as provided in this embodiment of the invention. Figure 3 This is a structural block diagram of a risk warning device based on a novel network-related entity access provided in an embodiment of the present invention.

[0032] Among them, 201 is the data acquisition module; 202 is the subject identification module; 203 is the profile construction module; 204 is the profile update module; 205 is the risk fusion module; and 206 is the early warning output module. Detailed Implementation

[0033] To better understand the above technical solutions, a detailed description of the solutions will be provided below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0034] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0035] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0036] With the advancement of new power system construction, the proportion of new energy sources in the power grid continues to increase, and a large number of power electronic devices are being connected, making the system's operating characteristics increasingly complex. Traditional threshold alarms are only triggered when equipment parameters exceed limits, which is a reactive alarm and cannot achieve early warning of potential hazards. Furthermore, existing methods fail to fully consider the functional differences of equipment in the power grid, and the early warning strategies lack specificity. Finally, conventional methods rely on the experience and judgment of operation and maintenance personnel and lack data-driven intelligent analysis tools, making it difficult to meet the higher requirements of new power systems for safety early warning.

[0037] Existing power grid hazard early warning technologies are mostly designed for traditional power grid architectures, relying on a single data source (such as relying solely on dispatch automation systems or electricity consumption information collection systems) for monitoring and analysis. They identify hazards by judging thresholds of single-dimensional data and have not formed a complete process of multi-source data fusion and analysis.

[0038] Based on this, the present invention provides a risk warning method based on the access of novel network-connected entities, including collecting entity information of novel network-connected entities and user information of each user in the distribution network; analyzing the operating conditions of novel network-connected entities based on their entity information, identifying them, and providing entity identification data; constructing corresponding basic user profiles based on user information; triggering disturbance updates to the basic user profiles by combining the entity identification data, and determining the disturbed user profiles; integrating the entity identification data and the disturbed user profiles to analyze the impact intensity of the novel network-connected entities on each user and providing a comprehensive risk value; and judging the comprehensive risk value by combining a preset risk threshold and providing risk warning information.

[0039] By constructing a basic user profile, and based on a precise characterization of users, real-time perception of multi-dimensional user characteristics is achieved. By analyzing and judging the main information of new internet-related entities, accurate identification of these entities is achieved, enhancing the ability to perceive risk sources. By perturbing and updating the basic user profile using entity identification data, a perturbed user profile is obtained, resolving the technical challenge of assessing the hierarchical sensitivity of user profiles and internet-related entity information, and enabling differentiated risk warnings.

[0040] like Figure 1 As shown in the figure, this embodiment of the invention provides a risk warning method based on a novel network-related entity access method, the specific steps of which are as follows: S101: Collect the main information of new grid-connected entities and the user information of each user in the distribution network.

[0041] New types of grid-connected entities can include distributed photovoltaic, wind power, energy storage power stations, charging piles, microgrids, industrial and commercial self-provided power sources, and unauthorized concealed access devices. By batch accessing structured and unstructured data from multiple channels such as dispatch automation systems and distribution IoT terminals, the system sequentially performs operations such as anomaly sampling point removal, duplicate record deduplication, and missing segment completion due to communication packet loss. This completes data cleaning, timeline alignment, and semantic fusion, outputting high-quality multi-dimensional data with a unified dimension. This process completes the collection of entity information for new grid-connected entities and user information for each user in the distribution network.

[0042] By collecting structured and unstructured data from multiple channels, we break through the limitations of traditional single data sources, integrate structured and unstructured data from multiple channels, and solve the problem of insufficient data support in traditional technologies through standardized cleaning, alignment and semantic fusion algorithms, thus providing a comprehensive and high-quality data foundation for accurate early warning.

[0043] The main information includes electrical quantity data, access location, registration information, and real-time communication signaling vectors. Electrical quantity data refers to the measurement data of physical quantities that directly characterize the magnitude, state, and changes of electricity within the power system for new grid-connected entities. This data includes voltage, current, active power, reactive power, and harmonic indices. Access location refers to the location where the new grid-connected entity connects to the power system, such as the access area, access cabinet number, physical installation address, latitude and longitude, etc. Registration information includes the static parameters of the new grid-connected entity's equipment identity, such as unique equipment identifier, identity information, rated parameters, and ownership information. Real-time communication signaling vectors are control commands transmitted instantly for establishing real-time connections. These vectors include data such as message type, source address, destination address, timestamp, status code, link quality, and network status.

[0044] Users in the power distribution network include high-voltage sensitive industrial users, general industrial and commercial users, residential users, and dedicated line users. User information includes basic static information and electricity consumption behavior characteristic information. Basic static information includes user type, contracted capacity, etc., while electricity consumption behavior characteristic information includes changes in various electricity consumption characteristics, such as voltage, current, active power, reactive power, and harmonic indicators. For example, a user type is a high-voltage sensitive user in an industrial park, with a contracted capacity of 10,000 kVA.

[0045] S102: Based on the subject information of new types of internet-related entities, analyze the operating conditions of these entities, identify them, and provide subject identification data.

[0046] Specifically, the main information includes electrical quantity data, access location, registration information, and real-time communication signaling vectors; Based on the entity information of new types of internet-related entities, the operational status of these entities is analyzed, entity identification is performed, and entity identification data is provided, specifically including: By analyzing the electrical quantity data of new types of network-connected entities, real-time disturbance vectors are obtained; Based on the baseline disturbance vector corresponding to the new type of network-related subject, the real-time disturbance vector is matched and calculated to give the first subject identification result; By combining the baseline signaling vector and the standard registration field, feature matching is performed on the registration information and the real-time communication signaling vector respectively, and the second subject identification result is given. The first subject identification result and the second subject identification result are combined to determine the subject identification data.

[0047] Furthermore, by analyzing the electrical quantity data of new types of network-connected entities, real-time disturbance vectors are obtained, specifically including: By combining the rated parameters corresponding to the electrical quantity data, the electrical parameter values ​​of the electrical quantity data are calculated to form the characteristics of electricity consumption behavior; Based on the access location of the new network-connected entity, the electrical distance between the new network-connected entity and each user is obtained, and the disturbance mapping coefficient is given in combination with the attenuation coefficient. By using disturbance mapping coefficients, electricity consumption behavior characteristics are corrected, and by combining dynamic disturbance weights, the real-time disturbance vector of new grid-connected entities is determined.

[0048] Specifically, the real-time perturbation vector is represented as follows:

[0049] Among them, D (t) Let be the real-time perturbation vector at time t. Let m be the disturbance intensity of the i-th type of disturbance, m be the total number of disturbance types, k be the total number of electrical parameter values, and a be the disturbance intensity of the ith type of disturbance. ij This represents the dynamic disturbance weight corresponding to the j-th electrical parameter value under the i-th type of disturbance. Let φ be the value of the j-th electrical parameter at time t. ij (Location) is the disturbance mapping coefficient corresponding to the j-th electrical parameter value under the i-th type of disturbance for the new network-connected entity with access location, μ is the attenuation coefficient, and dist(Location,Node) is the electrical distance between the new network-connected entity with access location and the user Node.

[0050] Electricity consumption behavior characteristics are specifically represented as follows:

[0051] Among them, X (t) The electricity consumption behavior characteristics formed by the electrical parameter values ​​of new grid-connected entities at time t. The voltage parameter value of the new type of network-connected entity at time t. P represents the current parameter value of the new type of network-connected entity at time t. (t) Q represents the active power of the new network-connected entity at time t. (t) H represents the reactive power of the new type of network-connected entity at time t. (t) V represents the harmonic index of a new type of network-related entity at time t. (t) V represents the voltage at time t of the new type of network-connected entity. (t-1) V represents the voltage of the new type of network-connected entity at time t-1. N I is the system rated voltage. (t) For the current of the new type of network-connected entity at time t, I (t-1) For the current of the new type of network-connected entity at time t-1, I N This is the rated current of the line.

[0052] Furthermore, based on the baseline perturbation vector corresponding to the new network-related subject, the real-time perturbation vector is matched and calculated to give the first subject identification result, specifically including: Calculate the vector dot product of the reference disturbance vector and the real-time disturbance vector to obtain the disturbance dot product; By fusing the second norm of the reference perturbation vector and the second norm of the real-time perturbation vector, the perturbation length product is obtained; Based on the ratio of the perturbation dot product to the perturbation length product, the perturbation vector matching degree is determined, and the first subject identification result is given.

[0053] The perturbation vector matching degree is specifically expressed as:

[0054] in, Let D be the perturbation vector matching degree at time t, i.e., the first subject identification result. (t) Let be the real-time perturbation vector at time t. Let be the reference perturbation vector at time t, and ||·|| be the second norm.

[0055] It is important to understand that the baseline disturbance vector is the historical baseline disturbance vector of the new network-connected entity under the corresponding operating conditions, and the first entity identification result is the disturbance vector matching degree. If the first entity identification result is greater than or equal to the electrical quantity matching threshold, it indicates that the first layer of identification of the new network-connected entity has been initially passed; if the first entity identification result is less than the electrical quantity matching threshold, it indicates that the new network-connected entity is suspected of unauthorized access.

[0056] The second entity identification result includes registration information matching degree and communication signaling matching degree. The registration information matching degree is determined through the following steps: Match the registration information with the standard registration fields and give the number of fields in the registration information that match the standard registration fields; The matching degree of the registration information is determined based on the number of fields in the registration information that match the standard registration fields, combined with the total number of fields in the standard registration fields.

[0057] The matching degree of registration information is specifically expressed as follows:

[0058] in, Let R be the matching degree of the registration information at time t. MTCH R is the number of fields in the registration information that match the standard registration fields. total This represents the total number of fields in the standard registration fields, which include device ID, MAC address, IP address, device model, etc.

[0059] The communication signaling match degree is determined through the following steps: Calculate the vector dot product of the base signaling vector and the real-time communication signaling vector to obtain the signaling dot product; By fusing the second norm of the baseline signaling vector and the second norm of the real-time communication signaling vector, the signaling length product is obtained; The communication signaling matching degree is determined based on the ratio of the signaling dot product to the signaling length product.

[0060] Communication signaling matching degree, specifically represented as:

[0061] in, Let be the communication signaling matching degree at time t. S represents the first subject identification result at time t. (t) Let be the real-time communication signaling vector at time t. Let ||·|| be the baseline signaling vector, and ||·|| be the second norm.

[0062] In this example, the real-time communication signaling vector includes the communication cycle, data transmission volume, and signaling format. In other examples, it is constructed according to the actual situation, and there are no restrictions here.

[0063] By fusing the results of the first and second subject identifications, subject identification data is determined, specifically including: Based on the preset perturbation matching coefficient, the perturbation vector matching degree is fused to obtain the perturbation identification sub-item; Based on the registration matching coefficient and the matching degree of registration information, determine the registration identification sub-item; By adjusting the signaling matching degree using the signaling matching coefficient, a signaling identification sub-item is provided; By integrating the disturbance identification sub-item, the registration identification sub-item, and the signaling identification sub-item, the subject identification data is obtained.

[0064] Subject identification data, specifically represented as:

[0065] in, The subject identification data at time t, Let be the perturbation vector matching degree at time t. Let be the matching degree of the registration information at time t. Let w be the communication signaling matching degree at time t. E w is the perturbation matching coefficient. R For the registration matching coefficient, w S This represents the signaling matching coefficient.

[0066] When the entity identification data is greater than or equal to the preset first entity identification threshold, the new internet-connected entity is considered a "legitimate internet-connected entity," and the system operates normally, updating the basic user profile. If the entity identification data is less than the first entity identification threshold but greater than or equal to the preset second entity identification threshold, the new internet-connected entity is considered a "suspected unauthorized access" entity, marked as a key monitoring target, and the identification cycle is shortened. If the entity identification data is less than the second entity identification threshold, the new internet-connected entity is considered to have "unauthorized access," triggering an immediate warning and executing actions such as disconnecting the connection and restricting permissions.

[0067] In the process of identifying new types of network-related entities, the system integrates electrical quantity change feature detection, communication signaling pattern matching, and equipment registration information verification. This not only enables accurate identification of the basic information of new network-related entities but also effectively identifies unauthorized covert access behavior, enhances the system's ability to detect unknown risk sources, improves the identification rate of unauthorized covert access, and increases the accuracy of identifying network-related entity types and access locations, thereby achieving effective prevention and control of unknown risk sources.

[0068] S103: Construct the corresponding basic user profile based on user information.

[0069] Specifically, based on user information, a corresponding basic user profile is constructed, including: A static profile layer is formed based on the user's basic static information. Based on the changes in various electricity consumption behavior characteristics in user information, construct a behavior profile layer; By setting corresponding disturbance thresholds based on the user's sensitivity to various disturbances and fusing them together, a sensitive response layer is obtained; By integrating the static profile layer, the behavioral profile layer, and the sensitive response layer, a basic user profile is constructed.

[0070] The basic user profile is specifically represented as follows:

[0071] Among them, U (t) Let S be the basic user profile at time t, and S be the static profile layer. p For the p-th basic static information, such as user type and contract capacity; B (t) The behavior profile layer at time t. Let q be the q-th electricity consumption behavior characteristic, which includes voltage, current, active power, reactive power, and harmonic indices; R is the sensitive response layer, and θ is the q-th characteristic. i is the perturbation threshold for the i-th type of perturbation, and m is the total number of perturbation types.

[0072] Furthermore, it also includes the dynamic updating of the behavioral profile layer, specifically including: Based on a dynamic update cycle, electricity consumption behavior characteristics are collected in real time. Based on the time decay coefficient, the electricity consumption behavior characteristics at each moment are integrated to determine the current behavior profile layer; By combining a preset forgetting factor, electricity consumption behavior characteristics are fused with the current behavioral profile layer to achieve dynamic updates of the behavioral profile layer, specifically as follows:

[0073] Where α is the forgetting factor, B (t+1) For the updated behavior profile layer, B (t) For the current behavioral profiling layer, X (t) Let be the electricity consumption behavior characteristics at time t, and λ be the time decay coefficient. The characteristics of electricity consumption behavior at time t0.

[0074] By using a preset dynamic update cycle, electricity consumption behavior characteristics are collected in real time. Combined with a forgetting factor, the behavioral profile layer in the basic user profile is smoothly iterated and updated in each dynamic update cycle. This retains historical electricity consumption habits while quickly capturing the latest changes in electricity consumption to characterize short-term dynamic behavior. Through a time decay coefficient, outdated electricity consumption behavior characteristics are weakened, focusing only on retaining recent electricity consumption patterns to characterize users' long-term and stable electricity consumption habits, ensuring the accuracy of the basic user profile.

[0075] S104: Combine the subject identification data to trigger a perturbation update of the basic user profile and determine the perturbation user profile.

[0076] Specifically, by combining the subject identification data, a perturbation update of the basic user profile is triggered to determine the perturbation user profile, which includes: Based on the subject identification data, extract various disturbance intensities from the real-time disturbance vector; Based on the intensity of various disturbances, trigger the update of the sensitive response layer in the basic user profile; By combining the sensitive update coefficient, various disturbance intensities are integrated into the sensitive response layer of the basic user profile to determine the disturbed user profile.

[0077] The perturbation update of the basic user profile is specifically represented as follows:

[0078] in, Let be the perturbation threshold for the i-th type of perturbation at time t+1, which is the sensitive response layer in the perturbation user profile. Let be the perturbation threshold of the i-th type of perturbation at time t, which is the sensitive response layer in the basic user profile. Let γ be the perturbation intensity of the i-th type of perturbation, and γ be the sensitive update coefficient.

[0079] By integrating basic user profiles with disturbance information from new internet-related entities, and combining sensitive update coefficients to calculate the disturbance thresholds for various disturbances, differentiated and targeted early warnings of potential risks are achieved, solving the problem of insufficient targeting in traditional early warning systems.

[0080] When a new type of internet-related entity is identified as a legitimate internet-related entity based on entity identification data, the basic user profile is updated. Due to the access of this new entity, the disturbance thresholds for various disturbances for each user are adjusted in a timely manner to improve the accuracy of disturbance warnings for each user.

[0081] A basic user profile is constructed based on multi-dimensional core user characteristics. An innovative two-way feedback triggering mechanism is established with the subject identification data to achieve real-time incremental updates of the basic user profile to obtain a disturbed user profile, ensuring accurate and dynamic perception of the state of high-pressure users. By triggering the disturbance update of the basic user profile through the subject identification data of new internet-related subjects, the disturbance impact of new internet-related subjects on users is determined based on the disturbed user profile, forming a two-way feedback triggering mechanism.

[0082] S105: Integrate subject identification data and disturbed user profiles to analyze the impact intensity of new internet-related subjects on each user and provide a comprehensive risk value.

[0083] Specifically, by integrating entity identification data and user profiles of disruptive entities, the impact of new internet-related entities on various users is analyzed, and a comprehensive risk value is provided, including: Determine the user sensitivity coefficient based on the static profile layer in the disturbed user profile; Based on the user sensitivity coefficient, the basic sensitivity is given by integrating the real-time perturbation vector in the subject recognition data; By perturbing the current electricity consumption behavior characteristics of the behavioral profile layer in the user profile, and combining them with the historical average electricity consumption behavior, the behavioral sensitivity is determined. Based on the perturbation thresholds of various perturbations in the sensitive response layer of the perturbation user profile, the impact of real-time perturbation vectors on users is analyzed to obtain perturbation sensitivity; By combining the preset risk fusion coefficient, the basic sensitivity, behavioral sensitivity, and disturbance sensitivity are integrated to give a comprehensive risk value.

[0084] The comprehensive risk value is specifically expressed as follows:

[0085] Among them, Risk (t) Let α be the overall risk value at time t. s Risk fusion coefficient corresponding to basic sensitivity, α b α represents the risk fusion coefficient corresponding to behavioral sensitivity. r f is the risk fusion coefficient corresponding to the perturbation sensitivity. s Based on basic sensitivity, fb For behavioral sensitivity, f r For perturbation sensitivity.

[0086] Basic sensitivity, specifically expressed as:

[0087] Among them, f s Basic sensitivity, D represents the user sensitivity coefficient corresponding to the static profile layer S. (t) Let be the real-time perturbation vector at time t, and ||·|| be the second norm.

[0088] The user sensitivity coefficient is mapped based on the basic static information in the basic profile layer S. The user sensitivity coefficient represents the ability to amplify or reduce various disturbance risks based on the user's innate attributes.

[0089] Behavioral sensitivity is determined through the following steps: Obtain the user's historical and current electricity consumption behavior characteristics at various times; The average of the user's historical electricity consumption behavior characteristics at each time point is calculated to obtain the average of the user's historical electricity consumption behavior; Analyze the deviation between the current electricity consumption behavior characteristics of each user and the historical average electricity consumption behavior, and provide behavioral sensitivity.

[0090] Behavioral sensitivity, specifically expressed as:

[0091] Among them, f b For behavioral sensitivity, B (t) The behavior profile layer at time t. Let be the historical average electricity consumption, and ||·|| be the second norm.

[0092] Behavioral sensitivity is calculated to characterize the degree to which a user's current electricity consumption behavior deviates from its historical steady-state. Higher sensitivity indicates greater and more abnormal fluctuations in the user's electricity consumption behavior, making them more sensitive to grid disturbances; lower sensitivity indicates stable electricity consumption with no abnormal fluctuations. By calculating the average of the user's historical electricity consumption behavior, a steady-state benchmark for long-term normal electricity consumption is determined. Behavioral sensitivity, based on the user's historical electricity consumption, quantifies the degree of abnormal fluctuations in current electricity consumption behavior, characterizing sensitivity from the user's own operational perspective, and is a core calculation item for comprehensive risk assessment and hazard warning.

[0093] By constructing a user-specific normal electricity consumption benchmark profile (i.e., the average of historical electricity consumption behavior), the steady-state electricity consumption patterns of users can be extracted, avoiding the use of a uniform standard to evaluate users in different industries and with different load characteristics, thus achieving personalized benchmarks.

[0094] Disturbance sensitivity is determined through the following steps: Obtain the user's disturbance threshold for various disturbances; By combining the disturbance intensity of various disturbances generated by new network-related entities, the disturbance difference between the disturbance intensity of each disturbance and the corresponding disturbance threshold is calculated; Based on the standard disturbance value, the disturbance difference of various disturbances is judged and the disturbance result is given; By integrating the disturbance results of various disturbances caused by users to new types of internet-related entities, the disturbance sensitivity is determined.

[0095] Disturbance sensitivity, specifically expressed as:

[0096] Among them, f r For perturbation sensitivity, θ i Let be the perturbation threshold for the i-th type of perturbation. Let be the disturbance intensity of the i-th type of disturbance, max() be the maximum value function, and m be the total number of disturbance types. The disturbance difference is . The perturbation result is In this example, the standard disturbance value is 0. If the disturbance result is greater than zero, it means that the new type of network entity has caused this type of disturbance to the user. Conversely, if the disturbance result is zero, it means that the new type of network entity has not caused this type of disturbance to the user.

[0097] By calculating the disturbance difference, harmless normal power grid fluctuations are filtered out, retaining only excessive disturbances that could harm users. The results of various disturbances are superimposed to obtain a comprehensive disturbance sensitivity, quantifying the overall disturbance risk to users and directly reflecting the severity of the impact of disturbances from new types of grid-related entities. This provides core quantitative basis for user sensitivity levels, hazard warnings, and reverse reinforcement identification.

[0098] S106: Based on the preset risk threshold, the comprehensive risk value is judged and risk warning information is given.

[0099] Risk thresholds include a first risk threshold and a second risk threshold, which provide risk warning information and are determined through the following steps: If the overall risk value is greater than the first risk threshold, the risk warning information is determined to be high risk; If the overall risk value is less than or equal to the first risk threshold and greater than the second risk threshold, then the risk warning information is determined to be of medium risk. If the overall risk value is less than or equal to the second risk threshold, the risk warning information is determined to be low risk.

[0100] Specifically, the risk level of risk warning information is expressed as follows:

[0101] Among them, Risk (t) Let T1 be the comprehensive risk value at time t, T2 be the first risk threshold, T2 be the second risk threshold, and Level be the risk level of the risk warning information.

[0102] After receiving risk warning information, the system can graphically display sensitivity distribution heatmaps, network access status maps, potential hazard area marking maps, and risk warning information lists. Operations personnel can interactively determine the validity of the risk warning information and input specific handling measures (isolate network-related entities / adjust operating modes, etc.). Based on feedback from operations personnel, the system optimizes the basic user profile, forming a closed-loop operation process of "data processing - analysis and evaluation - interactive feedback - model optimization," improving the system's operability and adaptive optimization capabilities, while balancing ease of engineering deployment with depth of intelligent analysis.

[0103] Reference Figure 2 This invention provides a risk warning method based on novel network-connected entities. It constructs a basic user profile by collecting user information, enabling real-time perception of users' multi-dimensional characteristics based on precise user profiling. By analyzing and fusing disturbance vectors, registration information, and communication signaling of the novel network-connected entities, it achieves accurate identification of these entities, enhancing the ability to perceive risk sources. The method updates the basic user profile with disturbance data to obtain a disturbed user profile, establishing a correlation analysis between user characteristics and disturbances from network-connected entities. Finally, it integrates the entity identification data and the disturbed user profile to analyze the impact intensity of the novel network-connected entities on each user, providing a comprehensive risk value and risk warning information. This provides users with accurate hazard warnings to meet the needs of safe and stable power grid operation.

[0104] Reference Figure 3 This invention provides a risk warning device based on a novel network-related entity access method, comprising: The data acquisition module 201 is used to collect the main information of new network-connected entities and the user information of each user in the distribution network; The subject identification module 202 is used to analyze the operating conditions of new types of internet-related subjects based on their subject information, identify the new types of internet-related subjects, and provide subject identification data. The profile building module 203 is used to build a corresponding basic user profile based on user information; The profile update module 204 is used to combine the subject recognition data to trigger a perturbation update of the basic user profile and determine the perturbation user profile. Risk fusion module 205 is used to fuse subject identification data and disturbing user profiles, analyze the impact intensity of new internet-related subjects on each user, and give a comprehensive risk value. The early warning output module 206 is used to judge the comprehensive risk value by combining the preset risk threshold and give risk warning information.

[0105] The data acquisition module is connected to the profile building module via a one-way communication link, transmitting the collected user information. The subject identification module and the profile building module have a two-way feedback mechanism, triggering profile perturbation updates. The profile update module / subject identification module and the risk fusion module transmit data unidirectionally, providing subject identification data and perturbed user profiles. The risk fusion module and the early warning output module output data unidirectionally, transmitting comprehensive risk values. All modules achieve low-latency collaborative operation through an internal high-speed communication bus.

[0106] The data acquisition module provides core data support for the entire device and is the foundation for subsequent analysis; the subject identification module is responsible for identifying risk sources and is key to dynamic adjustment; the profile construction module and profile update module output accurate disturbed user profiles, which are the core inputs for risk fusion; the risk fusion module completes quantitative assessment based on subject identification data and disturbed user profile inputs, which is the core of early warning decision-making; the early warning output module realizes information display and human-computer interaction, which is an important link in closed-loop optimization.

[0107] After the system starts, the data acquisition module enters a continuous data acquisition and processing state, providing initial data for the profile building module. After completing the user profile construction, the profile building module is in a real-time standby state, connected to the profile update module, and responding to the update trigger of the subject identification module. The subject identification module continuously monitors the status of the power grid access point, and immediately completes the identification once a new type of grid-connected subject is detected. The risk fusion module receives the updated disturbance user profile and subject identification data in real time, and dynamically outputs the comprehensive risk value. The early warning output module synchronously displays relevant information, receives operation feedback from operation and maintenance personnel, and feeds back to each core module to complete parameter optimization, forming a continuously adaptive operation mechanism.

[0108] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0109] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A risk warning method based on novel internet-related entity access, characterized in that, include: Collect the main information of new types of grid-connected entities and the user information of each user in the distribution network; Based on the subject information of new types of internet-related entities, the operational status of these entities is analyzed, subject identification is performed, and subject identification data is provided. Based on user information, construct corresponding basic user profiles; By combining the subject identification data, a perturbation update of the basic user profile is triggered to determine the perturbation user profile; By integrating entity identification data and disturbing user profiles, the impact of new internet-related entities on various users is analyzed, and a comprehensive risk value is given. Based on preset risk thresholds, the comprehensive risk value is assessed, and risk warning information is provided.

2. The risk warning method based on novel network-related entity access as described in claim 1, characterized in that, The main information includes electrical quantity data, access location, registration information, and real-time communication signaling vectors; Based on the entity information of new types of internet-related entities, the operational status of these entities is analyzed, entity identification is performed, and entity identification data is provided, specifically including: By analyzing the electrical quantity data of new types of network-connected entities, real-time disturbance vectors are obtained; Based on the baseline disturbance vector corresponding to the new type of network-related subject, the real-time disturbance vector is matched and calculated to give the first subject identification result; By combining the baseline signaling vector and the standard registration field, feature matching is performed on the registration information and the real-time communication signaling vector respectively, and the second subject identification result is given. The first subject identification result and the second subject identification result are combined to determine the subject identification data.

3. The risk warning method based on novel network-related entity access as described in claim 2, characterized in that, By analyzing the electrical quantity data of new types of grid-connected entities, real-time disturbance vectors are obtained, specifically including: By combining the rated parameters corresponding to the electrical quantity data, the electrical parameter values ​​of the electrical quantity data are calculated to form the characteristics of electricity consumption behavior; Based on the access location of the new network-connected entity, the electrical distance between the new network-connected entity and each user is obtained, and the disturbance mapping coefficient is given in combination with the attenuation coefficient. By using disturbance mapping coefficients, electricity consumption behavior characteristics are corrected, and by combining dynamic disturbance weights, the real-time disturbance vector of new grid-connected entities is determined.

4. The risk warning method based on novel network-related entity access as described in claim 1, characterized in that, Based on user information, a basic user profile is constructed, specifically including: A static profile layer is formed based on the user's basic static information. Based on the changes in various electricity consumption behavior characteristics in user information, construct a behavior profile layer; By setting corresponding disturbance thresholds based on the user's sensitivity to various disturbances and fusing them together, a sensitive response layer is obtained; By integrating the static profile layer, the behavioral profile layer, and the sensitive response layer, a basic user profile is constructed.

5. The risk warning method based on novel network-related entity access as described in claim 4, characterized in that, It also includes dynamic updates to the behavioral profile layer, specifically including: Based on a dynamic update cycle, electricity consumption behavior characteristics are collected in real time. Based on the time decay coefficient, the electricity consumption behavior characteristics at each moment are integrated to determine the current behavior profile layer; By combining a preset forgetting factor, real-time electricity consumption behavior characteristics are integrated with the current behavior profile layer to achieve dynamic updates of the behavior profile layer.

6. The risk warning method based on novel network-related entity access as described in claim 5, characterized in that, By combining the subject identification data, a perturbation update of the basic user profile is triggered to determine the perturbation user profile, specifically including: Based on the subject identification data, extract various disturbance intensities from the real-time disturbance vector; Based on the intensity of various disturbances, trigger the update of the sensitive response layer in the basic user profile; By combining the sensitive update coefficient, various disturbance intensities are integrated into the sensitive response layer of the basic user profile to determine the disturbed user profile.

7. The risk warning method based on novel network-related entity access as described in claim 1, characterized in that, By integrating entity identification data and user profiles of disruptive entities, the impact of new internet-related entities on various users is analyzed, and a comprehensive risk value is provided, including: Determine the user sensitivity coefficient based on the static profile layer in the disturbed user profile; Based on the user sensitivity coefficient, the basic sensitivity is given by integrating the real-time perturbation vector in the subject recognition data; By perturbing the current electricity consumption behavior characteristics of the behavioral profile layer in the user profile, and combining them with the historical average electricity consumption behavior, the behavioral sensitivity is determined. Based on the perturbation thresholds of various perturbations in the sensitive response layer of the perturbation user profile, the impact of real-time perturbation vectors on users is analyzed to obtain perturbation sensitivity; By combining the preset risk fusion coefficient, the basic sensitivity, behavioral sensitivity, and disturbance sensitivity are integrated to give a comprehensive risk value.

8. The risk warning method based on novel network-related entity access as described in claim 7, characterized in that, Behavioral sensitivity is determined through the following steps: Obtain the user's historical and current electricity consumption behavior characteristics at various times; The average of the user's historical electricity consumption behavior characteristics at each time point is calculated to obtain the average of the user's historical electricity consumption behavior; Analyze the deviation between the current electricity consumption behavior characteristics of each user and the historical average electricity consumption behavior, and provide behavioral sensitivity.

9. The risk warning method based on novel network-related entity access as described in claim 7, characterized in that, Disturbance sensitivity is determined through the following steps: Obtain the user's disturbance threshold for various disturbances; By combining the disturbance intensity of various disturbances generated by new network-related entities, the disturbance difference between the disturbance intensity of each disturbance and the corresponding disturbance threshold is calculated; Based on the standard disturbance value, the disturbance difference of various disturbances is judged and the disturbance result is given; By integrating the disturbance results of various disturbances caused by users to new types of internet-related entities, the disturbance sensitivity is determined.

10. A risk warning device based on the access of a novel network-related entity, characterized in that, The risk warning method based on novel network-related entity access as described in any one of claims 1-9 includes: The data acquisition module is used to collect the main information of new grid-connected entities and the user information of each user in the distribution network; The subject identification module is used to analyze the operating conditions of new types of internet-related subjects based on their subject information, identify the subjects, and provide subject identification data. The user profile building module is used to build corresponding basic user profiles based on user information. The profile update module is used to combine the subject recognition data to trigger a perturbation update of the basic user profile and determine the perturbation user profile. The risk fusion module is used to merge entity identification data and disturbing user profiles to analyze the impact of new internet-related entities on each user and provide a comprehensive risk value. The early warning output module is used to judge the comprehensive risk value by combining preset risk thresholds and provide risk warning information.

Images