A power system data bloodline tracking method and device

Abstract

The application discloses a kind of electric power system data blood relationship tracking method and device, belong to electric power system network security field, this method includes: respectively deploying flow replication equipment in front and back of each security zone's forward isolation device to carry out bypass flow acquisition;Collection agent is based on similar path historical delay sample in security zone and calculates adaptive time window;Cross-security partition flow correlation is realized by multistage cascade matching strategy;Local query is given priority to using edge cache architecture;Through double-isolation device group architecture, it is realized that pure one-way data synchronization in line with electric power safety regulations, unsynchronized data is retained to receive confirmation mark or trigger capacity alarm, ensure that blood relationship is not lost.The application adopts bypass deployment mode, avoids the influence of series connection access on electric power real-time business, realizes the automatic blood identification and tracking of electric power monitoring system data flow, and can effectively deal with APT attack, data tampering and cross-zone illegal access risk.

Description

Technical Field

[0001] This invention belongs to the field of power system network security, and more specifically, relates to a method and apparatus for power system data lineage tracing. Background Technology

[0002] Data lineage tracing is a core requirement for cybersecurity monitoring in power systems. In power systems, data encompasses all stages of power generation, transmission, transformation, distribution, and consumption, including real-time operational data from SCADA (Supervisory Control and Data Acquisition) systems, relay protection settings, smart meter user information, and dispatch control commands. The security of this data transmission directly impacts the stable operation of the power grid.

[0003] However, existing data lineage tracing methods suffer from drawbacks such as insufficient time window adaptability, high latency in centralized queries, compliance risks in cross-regional deployment, and insufficient reliability of data synchronization.

[0004] Therefore, how to achieve lineage tracing that is adaptive to network environments, hierarchical edge computing, meets security and compliance requirements, and has synchronous fault tolerance capabilities is an urgent problem to be solved. Summary of the Invention

[0005] The existing data lineage tracing methods suffer from insufficient time window adaptability, primarily manifested in the fact that fixed time windows cannot adapt to latency jitter caused by scenarios such as deep detection of isolation devices and processing by encrypted gateways. Existing adaptive solutions attempt to calculate "measured latency" through cross-region matching, but the unidirectional isolation device blocks the return channel, and this calculation includes queue waiting and processing latency, which is not the real network RTT (Round-Trip Time), leading to window convergence errors. The high latency of existing data lineage tracing methods is mainly reflected in the fact that each traffic queries the central database, the network round-trip latency is uncontrollable, and performance bottlenecks are formed under high concurrency. The existing data lineage tracing methods have compliance risks in cross-regional deployment, which are mainly reflected in: the production control area's data collection agent directly connects to the management information area's database, which may violate physical isolation requirements; cross-regional information transmission should not violate the mandatory provision of Article 6.2.4 of GB / T36572-2018 "Guidelines for Network Security Protection of Power Monitoring Systems", which states that "only one-way data transmission is allowed." The main problem with existing data lineage tracing methods is the lack of data synchronization reliability. Existing solutions use a fixed-time elimination strategy. If the isolation device fails and the synchronization delay exceeds the retention period, the data will be deleted and can never be replenished, resulting in a permanent break in the lineage relationship.

[0006] To address the above-mentioned deficiencies or improvement needs of existing technologies, this invention provides a method and apparatus for tracing the lineage of power system data. This method and apparatus employ an improved latency measurement mechanism to dynamically adapt to network jitter, use edge caching to reduce query latency, adopt a dual isolation device group architecture to meet security and compliance requirements, use multi-level matching to improve association accuracy, and employ a synchronization state awareness retention strategy to ensure that lineage is not lost when synchronization fails.

[0007] To achieve the above objectives, according to a first aspect of the present invention, a method for tracing the lineage of power system data is provided, applied to a multi-security partition environment of a power monitoring system, characterized in that the method includes: The mirror collects the data stream of the power business and connects it to the collection agent of its security zone. The collection agent of the source security zone of each data stream generates the lineage information of each data stream and synchronizes it to the central lineage database and the lineage database of the source security zone. The lineage information includes lineage characteristics, flow ID, node identifier, and matching status; in the lineage information of the data flow generated by the acquisition agent of the source security zone, the flow ID is randomly generated. When the acquisition agent of the non-source security zone of each data stream detects a cross-regional data stream, it queries the lineage characteristics of the data stream in the forward security zone of the cross-regional data stream stored in the lineage database of the non-source security zone and performs multi-level cascading matching. If the match is successful, the lineage information of the cross-regional data stream is generated. Otherwise, an asynchronous association task is constructed and written to the pending confirmation queue. The lineage characteristics of all data streams in the central lineage database are queried again and the multi-level cascading matching is performed. If the match is successful, its lineage information is generated. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream and its lineage information is generated. In the lineage information of the cross-regional data stream, the stream ID is the stream ID of the matching data stream; after generating the lineage information of the cross-regional data stream, it is also synchronized to the central lineage database and the lineage database of the non-source security zone. The data stream destination security zone acquisition agent queries the lineage database to obtain the lineage information of all data streams with the same flow ID as the target data stream. After sorting the node identifiers in chronological order, they are connected to obtain the device sequence through which the target data stream flows, so as to reconstruct the transmission path of the target data stream.

[0008] Preferably, before performing the multi-level cascading matching by querying the lineage characteristics of all data streams in the lineage database of the non-source security zone, the method further includes: If a first data stream with a matching status of "matched" is found in the local cache of the non-source security zone and has the same socket quadruple information and message payload characteristics as the cross-region data stream to be matched, and a second data stream with the same socket quadruple information and message payload characteristics as the matching object of the first data stream is found, then the match is successful; otherwise, the lineage characteristics of all data streams in the lineage database of the non-source security zone are queried for multi-level cascading matching. The local cache is used to store cross-regional data streams whose matching status is "matched" and their matching objects in the security zone, as well as data stream lineage information of adjacent security zones; the data stream lineage information generated by the acquisition agent of the source security zone has a matching status of "not matched"; and the cross-regional data stream lineage information has a matching status of "matched".

[0009] Preferably, the lineage characteristics include socket quadruple information, hardware timestamp, and message payload characteristics; The multi-level cascaded matching process includes: A1: If a data stream is found that is completely identical to the socket quadruple of the cross-region data stream to be matched and the timestamp difference is within the adaptive time window, then the match is successful; otherwise, proceed to A2. A2: When the socket quadruple changes due to address translation, if a data stream with the same destination address, source address within the preset network segment range, and timestamp difference within the adaptive time window is found, the match is successful; otherwise, proceed to A3. A3 extracts key fields of the power communication protocol from the payload of the cross-regional data stream to be matched. If a data stream with a field similarity of up to a preset similarity threshold is found, the match is successful; otherwise, the match fails.

[0010] Preferably, the adaptive time window is calculated using the formula: A = BC; Where A is the value of the adaptive time window, B=D+E+F, D is the weighted sum of the statistical quantiles and dispersion measures of the delay sample, the delay sample is the historical delay of similar paths within the same security zone, E is the initial cross-zone transmission delay parameter, F is the protocol parsing time compensation, and C is the conservative margin coefficient.

[0011] Preferably, among all the lineage databases in the security zones, only one security zone's lineage database is the central lineage database, while the lineage databases of the other security zones are all peripheral lineage databases; All data in the edge kinship databases are asynchronously synchronized to the central kinship database through the first horizontal isolation device; the central kinship database periodically transmits the list of confirmed data identifiers to the edge kinship databases through the second horizontal isolation device to synchronize the upload status; the edge kinship databases update their data status by comparing their local queue of data to be synchronized with the received list of confirmed data identifiers; data that has not been confirmed to be synchronized is retained until a confirmation identifier is received or a capacity alarm is triggered. The confirmed data identifier list includes multiple confirmed data identifiers, which are generated after the central lineage database successfully receives the synchronization data; the local queue to be synchronized consists of data in the edge lineage database that has not received a confirmed data identifier; and the unconfirmed synchronized data consists of data in the edge lineage database that has been uploaded but has not received a corresponding confirmed data identifier.

[0012] Preferably, if the security level of the central lineage database is lower than the security level of the security zone where the peripheral lineage database is located, then the first lateral isolation device is a forward isolation device and the second lateral isolation device is a reverse isolation device; otherwise, the first lateral isolation device is a reverse isolation device and the second lateral isolation device is a forward isolation device.

[0013] Preferably, the marginal kinship database adopts a hierarchical storage structure: The first-level cache is used to collect traffic records in the proxy's local memory storage, retaining traffic records within the first preset time period; The second-level cache is used for network node storage in this security zone, and retains traffic records within a second preset time period, which is longer than the first preset time period. The third-level cache is used for persistent storage in this security zone and is retained in stages according to the synchronization status: confirmed synchronization data is retained for a preset retention period, and unconfirmed synchronization data is retained until a reverse confirmation flag is received or a capacity alarm is triggered; the data eviction policy of the third-level cache is: the first N high-confidence records of confirmed synchronization are removed first, and unconfirmed synchronization records are removed in chronological order when a capacity alarm is triggered, and a synchronization failure alarm log is generated.

[0014] Preferably, the asynchronous association task is written into the confirmation queue, and the bloodline characteristics of all data streams in the central bloodline database are queried for further multi-level cascading matching, including: Construct a task to be confirmed for association; the task to be confirmed for association includes outbound flow characteristic information of the cross-regional data flow to be matched and lineage characteristic record identifier of the candidate inbound flow; wherein, the candidate inbound flow is the data flow flowing into the forward security zone of the cross-regional data flow to be matched; Write the pending related tasks into the pending confirmation queue and set a timeout management mechanism; Retrieve unconfirmed related tasks and query the central lineage database for multi-level cascading matching; After a successful match, an acknowledgment identifier is transmitted via the reverse isolation device in the next synchronization cycle; When the central lineage database is unavailable, a synchronization health alert is triggered, and the pending related tasks are continuously persisted locally. At the same time, a timeout period is marked, and the task is automatically retried or transferred to the review queue after the timeout. After recovery, the task is retried, and after a successful retry, a confirmation flag is reissued through the reverse isolation device.

[0015] According to a second aspect of the present invention, a power system data lineage tracing device is provided, applied in a multi-security zone environment of a power monitoring system, the device comprising: The mirror acquisition module is deployed on both sides of the boundary isolation device of the data link in each security zone. It is used to mirror the acquisition of power business data streams and connect them to the acquisition agent of the security zone in which they are located. The acquisition agent of the source security zone of each data stream generates the lineage information of each data stream and synchronizes it to the central lineage database and the lineage database of the source security zone. The processing module, deployed as a collection agent in the source security zone of each data stream, is used to generate lineage information for each data stream and synchronize it to the central lineage database and the lineage database of the source security zone. The lineage information includes lineage characteristics, flow ID, node identifier, and matching status; in the lineage information of the data flow generated by the acquisition agent of the source security zone, the flow ID is randomly generated. The matching and association module, deployed in the non-source security zone of each data stream, is used to query the lineage characteristics of the data stream in the forward security zone of the cross-regional data stream stored in the lineage database of the non-source security zone when a cross-regional data stream is detected. It performs multi-level cascading matching. If the matching is successful, the lineage information of the cross-regional data stream is generated. Otherwise, an asynchronous association task is constructed and written to the confirmation queue. The lineage characteristics of all data streams in the central lineage database are queried again to perform the multi-level cascading matching. If the matching is successful, its lineage information is generated. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream and its lineage information is generated. In the lineage information of the cross-regional data stream, the stream ID is the stream ID of the matching data stream; after generating the lineage information of the cross-regional data stream, it is also synchronized to the central lineage database and the lineage database of the non-source security zone. The tracking module, deployed as a collection agent in the security zone of the data stream destination, is used to query the central lineage database to obtain the lineage information of all data streams with the same flow ID as the target data stream. After sorting the node identifiers in chronological order, the module is connected to obtain the device sequence through which the target data stream flows, so as to reconstruct the transmission path of the target data stream.

[0016] Preferably, before the matching and association module queries the lineage characteristics of all data streams in the lineage database of the non-source security zone to perform multi-level cascading matching, it further includes: If a first data stream with a matching status of "matched" is found in the local cache of the non-source security zone and has the same socket quadruple information and message payload characteristics as the cross-region data stream to be matched, and a second data stream with the same socket quadruple information and message payload characteristics as the matching object of the first data stream is found, then the match is successful; otherwise, the lineage characteristics of all data streams in the lineage database of the non-source security zone are queried for multi-level cascading matching. The local cache is used to store cross-regional data streams whose matching status is "matched" and their matching objects in the security zone, as well as data stream lineage information of adjacent security zones; the data stream lineage information generated by the acquisition agent of the source security zone has a matching status of "not matched"; and the cross-regional data stream lineage information has a matching status of "matched".

[0017] The lineage characteristics include socket quadruple information, hardware timestamp, and message payload characteristics; The multi-level cascaded matching process includes: A1: If a data stream is found that is completely identical to the socket quadruple of the cross-region data stream to be matched and the timestamp difference is within the adaptive time window, then the match is successful; otherwise, proceed to A2. A2: When the socket quadruple changes due to address translation, if a data stream with the same destination address, source address within the preset network segment range, and timestamp difference within the adaptive time window is found, the match is successful; otherwise, proceed to A3. A3 extracts key fields of the power communication protocol from the payload of the cross-regional data stream to be matched. If a data stream with a field similarity of up to a preset similarity threshold is found, the match is successful; otherwise, the match fails.

[0018] Preferably, the adaptive time window is calculated using the formula: A = BC; Where A is the value of the adaptive time window, B=D+E+F, D is the weighted sum of the statistical quantiles and dispersion measures of the delay sample, the delay sample is the historical delay of similar paths within the same security zone, E is the initial cross-zone transmission delay parameter, F is the protocol parsing time compensation, and C is the conservative margin coefficient.

[0019] Preferably, among all the lineage databases in the security zones, only one security zone's lineage database is the central lineage database, while the lineage databases of the other security zones are all peripheral lineage databases; All data in the edge kinship databases are asynchronously synchronized to the central kinship database through the first horizontal isolation device; the central kinship database periodically transmits the list of confirmed data identifiers to the edge kinship databases through the second horizontal isolation device to synchronize the upload status; the edge kinship databases update their data status by comparing their local queue of data to be synchronized with the received list of confirmed data identifiers; data that has not been confirmed to be synchronized is retained until a confirmation identifier is received or a capacity alarm is triggered. The confirmed data identifier list includes multiple confirmed data identifiers, which are generated after the central lineage database successfully receives the synchronization data; the local queue to be synchronized consists of data in the edge lineage database that has not received a confirmed data identifier; and the unconfirmed synchronized data consists of data in the edge lineage database that has been uploaded but has not received a corresponding confirmed data identifier.

[0020] Preferably, if the security level of the central lineage database is lower than the security level of the security zone where the peripheral lineage database is located, then the first lateral isolation device is a forward isolation device and the second lateral isolation device is a reverse isolation device; otherwise, the first lateral isolation device is a reverse isolation device and the second lateral isolation device is a forward isolation device.

[0021] Preferably, the marginal kinship database adopts a hierarchical storage structure: The first-level cache is used to collect traffic records in the proxy's local memory storage, retaining traffic records within the first preset time period; The second-level cache is used for network node storage in this security zone, and retains traffic records within a second preset time period, which is longer than the first preset time period. The third-level cache is used for persistent storage in this security zone and is retained in stages according to the synchronization status: confirmed synchronization data is retained for a preset retention period, and unconfirmed synchronization data is retained until a reverse confirmation flag is received or a capacity alarm is triggered; the data eviction policy of the third-level cache is: the first N high-confidence records of confirmed synchronization are removed first, and unconfirmed synchronization records are removed in chronological order when a capacity alarm is triggered, and a synchronization failure alarm log is generated.

[0022] Preferably, the matching and association module constructs an asynchronous association task and writes it into the pending confirmation queue, queries the bloodline characteristics of all data streams in the central bloodline database, and performs the multi-level cascaded matching again, including: Construct a task to be confirmed for association; the task to be confirmed for association includes outbound flow characteristic information of the cross-regional data flow to be matched and lineage characteristic record identifier of the candidate inbound flow; wherein, the candidate inbound flow is the data flow flowing into the forward security zone of the cross-regional data flow to be matched; Write the pending related tasks into the pending confirmation queue and set a timeout management mechanism; Retrieve unconfirmed related tasks and query the central lineage database for multi-level cascading matching; After a successful match, an acknowledgment identifier is transmitted via the reverse isolation device in the next synchronization cycle; When the central lineage database is unavailable, a synchronization health alert is triggered, and the pending related tasks are continuously persisted locally. At the same time, a timeout period is marked, and the task is automatically retried or transferred to the review queue after the timeout. After recovery, the task is retried, and after a successful retry, a confirmation flag is reissued through the reverse isolation device.

[0023] According to a third aspect of the present invention, an electronic device is provided, comprising: a computer-readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is configured to read executable instructions stored in the computer-readable storage medium and execute the method as described in the first aspect.

[0024] According to a fourth aspect of the invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to perform the method as described in the first aspect.

[0025] According to a fifth aspect of the invention, a computer program product is provided, comprising a computer program or instructions that, when executed by a processor, implement the method as described in the first aspect.

[0026] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: The method provided by this invention strictly adheres to the mandatory requirements of GB / T 36572-2018 "Guidelines for Network Security Protection of Power Monitoring Systems" and "Regulations for Security Protection of Power Monitoring Systems" regarding security zoning, physical isolation, and unidirectional transmission, and has the following advantages: 1. Completely non-intrusive: Power business traffic is collected by bypass mirroring based on traffic replication equipment without modifying the business system code or interfering with the transmission link.

[0027] 2. Strong adaptability: The dynamic window is calculated based on reliable delay samples in the same area and isolation device parameters, avoiding cross-area measurement paradox and significantly improving matching accuracy; and a conservative margin coefficient is introduced to cover clock drift and processing delay.

[0028] 3. Superior real-time performance: The edge caching architecture prioritizes local queries, and the latency of association is greatly reduced when the edge cache is hit, which improves the response speed compared to centralized queries.

[0029] 4. Excellent compliance: The dual isolation device architecture strictly follows the mandatory requirements of GB / T 36572-2018 regarding physical isolation and unidirectional transmission. The forward and reverse data streams are physically independent, with no bidirectional communication channel.

[0030] 5. Enhanced reliability: The synchronous state awareness retention strategy ensures that data is not lost when the isolation device fails, meeting the integrity requirements for audit traceability of critical infrastructure.

[0031] 6. Full traceability: Synchronization failure alarm logs supplement the lineage record of the fault period.

[0032] In summary, this invention adopts a bypass deployment mode to avoid the impact of serial access on real-time power services, realizes automated lineage identification and tracing of power monitoring system data streams, effectively addresses the risks of APT attacks, data tampering and unauthorized cross-regional access, and improves the accuracy of network security monitoring and fault tracing capabilities. Attached Figure Description

[0033] Figure 1 This is a schematic flowchart of a power system data lineage tracing method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the adaptive dynamic window calculation process provided in an embodiment of the present invention; Figure 3 This is a flowchart of a multi-level cascaded matching process provided in an embodiment of the present invention; Figure 4 This is a diagram illustrating the three-level storage and data state management of edge caching provided in an embodiment of the present invention. Figure 5 This is a schematic diagram of a multi-security zone environment for a power monitoring system provided in an embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0035] This invention provides a power system data lineage tracing method, applied to a multi-security zone environment of a power monitoring system. The multi-security zone can include multiple large zones, such as a production control zone, a management information zone, and an internet zone, or it can include multiple security zones within a single large zone, such as Security Zone I and Security Zone II within the production control zone. Figure 1 As shown, the method includes: S1, mirror the data stream of the power business and connect it to the acquisition agent of the security zone where it is located. The acquisition agent of the source security zone of each data stream generates the lineage information of each data stream and synchronizes it to the central lineage database and the lineage database of the source security zone. The lineage information includes lineage characteristics, flow ID, node identifier, and matching status; in the data flow lineage information generated by the acquisition agent of the source security zone, the flow ID is randomly generated; the node identifier is used to characterize the source and destination node devices of the network connection.

[0036] Specifically, traffic replication devices are deployed on both sides of the boundary isolation device of the data link in each security zone to bypass mirror collection of power business traffic. The collected mirror traffic is connected to the collection agent of its respective security zone, thereby bypassing and mirroring the business traffic to the collection agent. Then, the collection agent of each security zone extracts the lineage characteristics of the mirror traffic in its own area and saves them to the lineage database of its respective security zone, while sending them to the central lineage database for storage.

[0037] Traffic replication devices can be passive optical splitters or switch port mirroring.

[0038] Traffic replication devices do not intervene in the business link to avoid delays affecting real-time power services.

[0039] The data acquisition agent should have a high-precision timestamp: The data acquisition agent records the arrival time of messages through a hardware time synchronization protocol and converts it to milliseconds for storage in the database.

[0040] It can be understood that, for each data stream, the security zone where its starting point is located is the source security zone.

[0041] S2, when the acquisition agent of the non-source security zone of each data stream detects a cross-regional data stream, it queries the lineage characteristics of the data stream in the forward security zone of the cross-regional data stream stored in the lineage database of the non-source security zone and performs multi-level cascading matching. If the match is successful, the lineage information of the cross-regional data stream is generated. Otherwise, an asynchronous association task is constructed and written to the pending confirmation queue. The lineage characteristics of all data streams in the central lineage database are queried again and the multi-level cascading matching is performed. If the match is successful, its lineage information is generated. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream and its lineage information is generated. In the lineage information of the cross-regional data stream, the stream ID is the stream ID of the matching data stream; after generating the lineage information of the cross-regional data stream, it is also synchronized to the central lineage database and the lineage database of the non-source security zone. Specifically, in step S2, when the acquisition agent of the non-source security zone of each data stream detects a cross-regional data stream, it queries the lineage characteristics of all data streams in the local lineage database to perform multi-level cascading matching. If the matching is successful, the lineage information of the cross-regional data stream is generated and synchronized to the central lineage database and the lineage database of the non-source security zone. Otherwise, an asynchronous association task is constructed and written to the pending confirmation queue, and the lineage characteristics of all data streams in the central lineage database are queried again to perform multi-level cascading matching. If the matching is successful, the lineage information of the cross-regional data stream is generated and synchronized to the central lineage database and the lineage database of the non-source security zone. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream, the lineage information of the cross-regional data stream is generated, and the lineage information of the non-source security zone is synchronized to the central lineage database and the lineage database of the non-source security zone.

[0042] Each non-source security zone's lineage database stores the lineage information of data flows from the forward security zone. The acquisition agent of each non-source security zone queries the lineage characteristics of the data flows from the forward security zone to perform multi-level cascading matching of cross-region traffic in that non-source security zone. At the same time, the central lineage database stores the lineage information of data flows from all security zones, which is used to provide a query for re-multi-level cascading matching when the query for the lineage database of a non-source security zone fails.

[0043] It is worth noting that for a data stream that flows sequentially through adjacent security zones A and B, A is its forward security zone. Whenever a new lineage feature of an outgoing data stream is added to the lineage database of A, it is synchronized to the lineage database of B.

[0044] Furthermore, to improve query efficiency, the lineage database of each non-source security zone can store only the lineage information of the data stream of the forward security zone within a preset time threshold.

[0045] It is understandable that the "non-data stream source security zone" in step S2 refers to the security zone outside the data stream source, such as... Figure 5 As shown, if the multiple security zones of the power monitoring system include the production control zone and the management information zone, then both the "non-data flow source security zone" and the "data flow destination security zone" refer to the management information zone.

[0046] Furthermore, for a successfully matched data stream, its matching status can also include the confidence level of the match.

[0047] Preferably, in step S2, the multi-level cascaded matching includes: precise matching based on address and time sequence information (based on identical quadruples and timestamp differences within an adaptive time window for equivalent queries), fuzzy matching based on address features and time sequence (when a quadruple change due to address conversion is detected, queries are performed based on consistent destination address, source address conforming to a preset network segment range, and timestamp differences within an adaptive time window range), and semantic parsing matching based on load similarity and time sequence features (extracting key fields from IEC 60870-5-104 or IEC 61850 protocols and calculating semantic similarity based on a power business sensitive word library). That is, as... Figure 3 As shown, the multi-level cascaded matching process includes: A1, precise matching based on address and timing information: query the data stream whose socket quadruple is completely consistent with the cross-region data stream to be matched and whose timestamp difference is within the adaptive window. If the query is successful, the match is successful; otherwise, proceed to A2. A2, Fuzzy matching based on address features and time sequence: When the quadruple changes due to address translation, query the data stream whose destination address is consistent with the cross-regional data stream to be matched, whose source address conforms to the preset network segment range, and whose timestamp difference is within the adaptive time window. If the query finds a match, the match is successful; otherwise, proceed to A3. A3, semantic parsing and matching based on load similarity and temporal features: extract key fields of power communication protocol from the load of the cross-regional data stream to be matched. If a data stream with a field similarity of up to a preset similarity threshold is found, the two are determined to be from the same source and the match is successful; otherwise, the match fails.

[0048] In other words, the cascading termination condition is that any layer matches successfully or all layers fail to match. The final association result records the confidence level according to the matching level, and supports hierarchical auditing based on confidence level.

[0049] The method provided by this invention designs a three-layer progressive matching strategy, which can reconcile the contradiction between matching accuracy and the resulting performance loss.

[0050] Furthermore, the formula for calculating the adaptive time window is: A=BC, where A is the value of the adaptive time window, B=D+E+F, where D is the weighted sum of the statistical quantiles and dispersion measures of the delay samples, the delay samples are the historical delays of similar paths within the same security zone, E is the initial cross-zone transmission delay parameter, F is the protocol parsing time compensation, and C is the conservative margin coefficient.

[0051] Specifically, the acquisition agents in each security zone calculate the adaptive time window for each data link based on historical delay samples of similar paths within their respective regions and typical transmission delay parameters provided by the isolation device manufacturers, and introduce a conservative margin coefficient to cover clock drift and processing delay.

[0052] To address the technical limitation that cross-regional delay cannot be accurately measured, this invention uses similar paths within the same security zone as the measurement benchmark: Establish a similar path-level delay statistics table within this security zone to record the end-to-end delay samples of historical traffic within this security zone. This sample is authentic and reliable because there are no unidirectional isolation devices blocking traffic within the same security zone, allowing for accurate measurement.

[0053] Here, "similar paths" refer to paths where the same source-destination node pair within the same security zone is used as the key. A hash operation is performed on the sequence of intermediate network devices traversed along these paths. If the keys are identical and the Hamming distance is less than a distance threshold, the paths are considered similar and are included in the same statistical entry. The historical end-to-end delay samples of these similar paths are recorded.

[0054] Specifically, when establishing a similar path-level delay statistics table within this security zone, the source node identifier and destination node identifier are used as keys to record end-to-end delay samples of historical traffic within this security zone, and these are used as values ​​to form key-value pairs.

[0055] The adaptive time window is dynamically calculated based on historical delays of similar paths within the same safety zone, typical parameters of the isolation device, and conservative margin coefficients. like Figure 2 As shown, the adaptive time window value A is calculated according to the formula A=BC; B=D+E+F, where D is the weighted sum of the statistical quantiles (P50, P90, P99) and dispersion measure of the delay sample, E is the typical cross-area transmission delay parameter provided by the manufacturer of the boundary isolation device of the original data link in this security zone, F is the protocol parsing time compensation; C is the conservative margin coefficient, with a value range of 1.5-3.0. By introducing the conservative margin coefficient (1.5-3.0), uncontrollable factors such as clock synchronization drift, isolation device processing delay, and queue waiting delay are covered; and A does not exceed the preset upper limit value.

[0056] Each successful match involves writing the measured delay within the safe zone back to the statistics table to update the adaptive time window value, ensuring the reliability of the statistical basis.

[0057] Understandably, for newly established paths or paths with fewer delayed samples than the corresponding threshold, a default window value is used.

[0058] The method provided by this invention calculates a dynamic window based on reliable delay samples in the same region and isolation device parameters, which can avoid cross-region measurement paradox and significantly improve matching accuracy; and introduces a conservative margin coefficient to cover clock drift and processing delay, which can ensure the reliability of matching.

[0059] Preferably, in step S2, before performing the multi-level cascading matching by querying the lineage characteristics of all data streams in the lineage database of the non-source security zone, the method further includes: If a first data stream with a matching status of "matched" is found in the local cache of the non-source security zone and has the same socket quadruple information and message payload characteristics as the cross-region data stream to be matched, and a second data stream with the same socket quadruple information and message payload characteristics as the matching object of the first data stream is found, then the match is successful; otherwise, the lineage characteristics of all data streams in the lineage database of the non-source security zone are queried for multi-level cascading matching. The local cache is used to store cross-regional data streams whose matching status is "matched" in their respective security zones and their matching objects, as well as data stream lineage information of adjacent security zones.

[0060] Specifically, each security zone maintains a local cache, which stores previously successfully matched information, i.e., matching information for cross-region traffic. Before performing multi-level cascading matching on cross-region traffic, a successful match is first checked in the local cache. Only if no match is found does the multi-level cascading matching process proceed to query the local lineage database.

[0061] For example, suppose connections A and B are matching data streams spanning two security zones, where A represents traffic from the preceding security zone and B represents traffic from the following security zone. When the acquisition agent in the following security zone detects cross-zone traffic C from the preceding security zone, if the socket tuple information and packet payload characteristics of C are found in the local cache to be consistent with those of B, and if there is traffic D in the preceding security zone that has the same socket tuple information and packet payload characteristics as A, then C and D are considered to be matching cross-zone traffic. This matching method is faster than the multi-level cascading matching method that queries the lineage characteristics of all data streams in the local lineage database.

[0062] In addition, after a successful match, the local cache of the non-source security zone can be updated. Updating the local cache can be achieved in various ways, such as retaining only recently successfully matched information or only retaining information where the number of matches exceeds a threshold.

[0063] The method provided by this invention enables priority matching of cross-region traffic through local caches maintained by each security zone, which can speed up the matching process and improve system performance.

[0064] Preferably, in step S2, constructing an asynchronous associated task and writing it into the pending confirmation queue, querying the bloodline characteristics of all data streams in the central bloodline database, and performing the multi-level cascaded matching again includes: Construct a task to be confirmed for association; the task to be confirmed for association includes outbound flow characteristic information of cross-regional data flow to be matched and lineage characteristic record identifier of candidate inbound flow; the candidate inbound flow is the data flow flowing into the forward safe zone of the cross-regional data flow to be matched; it can be understood that the lineage characteristic record identifier of the candidate inbound flow is used for the central lineage database to query the lineage characteristics of the candidate inbound flow. Write the pending related tasks into the pending confirmation queue and set a timeout management mechanism; The background thread retrieves batches of tasks awaiting confirmation and queries the central lineage database for multi-level cascading matching. After a successful match, without relying on real-time receipts, an acknowledgment identifier is transmitted through the reverse isolation device in the next synchronization cycle; When the central lineage database is unavailable, a synchronization health alert is triggered, and the pending related tasks are continuously persisted locally. At the same time, a timeout period is marked, and the task is automatically retried or transferred to the review queue after the timeout. After recovery, the task is retried, and after a successful retry, a confirmation flag is reissued through the reverse isolation device.

[0065] In addition, after a successful match, the local cache of the non-source security zone can be updated. Updating the local cache can be achieved in various ways, such as retaining only recently successfully matched information or only retaining information where the number of matches exceeds a threshold.

[0066] S3, the data acquisition agent in the security zone of the data stream destination obtains the lineage information of all data streams with the same flow ID as the target data stream by querying the lineage database of the center. After sorting the node identifiers in the lineage according to the time sequence, the agent connects them to obtain the device sequence through which the target data stream flows, thereby reconstructing the transmission path of the target data stream, generating a structured audit log that conforms to the power industry standard, and completing the lineage tracing of the target data stream.

[0067] It is understandable that the target data stream is the data stream to be traced for lineage, such as a leaked data stream.

[0068] For example, suppose the target data stream originates from A1. After a network connection from device A to B is established in A1, the stream flows through security zone A2, where network connections from device C to D and from D to E are established. It then reaches security zone A3, where a network connection from device F to G is established. Here, B and C are nodes on opposite sides of the isolation device between A1 and A2, and E and F are nodes on opposite sides of the isolation device between A2 and A3. A1, as its source security zone, generates source lineage information and synchronizes it to the central lineage database, including node identifiers A and B. A2, as its non-source security zone, is matched to generate non-source lineage information and synchronized to the central lineage database. This includes node identifiers C, D, and E, and the flow ID is the same as the flow ID in the source lineage information. Notably, the non-source lineage information generated by A2 includes lineage information from C→D and D→E. A3, as its non-source security zone, is matched to generate non-source lineage information and synchronized to the central lineage database. This includes node identifiers F and G, and the flow ID is the same as the flow ID in the source lineage information. A3, as its destination security zone, has its acquisition agent querying the central lineage database for the lineage information of all data flows with the same flow ID as the source lineage information. The node identifiers are then sorted chronologically and concatenated to obtain the device sequence through which the target data flow passes, i.e., A→B→C→D→E→F→G. Furthermore, when the matching status of a successfully matched data stream also includes the confidence level of the match, the transmission path of the target data stream also includes the matching confidence levels between A→B and B→C, C→D and D→E, and D→E and F→G.

[0069] Preferably, among all the lineage databases in the security zones, only one security zone's lineage database is the central lineage database, while the lineage databases of the other security zones are all peripheral lineage databases; All data in the edge kinship databases are asynchronously synchronized to the central kinship database through the first horizontal isolation device; the central kinship database periodically transmits the list of confirmed data identifiers to the edge kinship databases through the second horizontal isolation device to synchronize the upload status; the edge kinship databases update their data status autonomously by comparing their local queue to be synchronized with the received list of confirmed data identifiers; data that has not been confirmed to be synchronized is retained until a confirmation identifier is received or a capacity alarm is triggered. The confirmed data identifier list includes multiple confirmed data identifiers, which are generated after the central lineage database successfully receives the synchronization data; the local queue to be synchronized consists of data in the edge lineage database that has not received a confirmed data identifier; and the unconfirmed synchronized data consists of data in the edge lineage database that has been uploaded but has not received a corresponding confirmed data identifier.

[0070] Understandably, for each security zone, whether its lineage database is a peripheral lineage database or a central lineage database can be set according to actual needs.

[0071] Specifically, the edge lineage database is used to store original traffic records and provisional associations, as well as the lineage information of each data stream of the mirror traffic in its security zone; all data in the edge lineage database is asynchronously synchronized to the central lineage database through the first lateral isolation device.

[0072] The central lineage database is used to receive synchronization data through the second lateral isolation device and store the lineage information of all mirrored traffic extracted by the acquisition agents. The central lineage database periodically transmits a list of confirmed data identifiers to the edge lineage database through the second lateral isolation device to synchronize the upload status.

[0073] To comply with the mandatory requirement of GB / T 36572-2018, Clause 6.2.4, which states that "only unidirectional data transmission is allowed," this invention adopts a dual isolation device architecture, including a forward isolation device and a reverse isolation device: The forward isolation device only allows data to be transmitted from a high-security area to a low-security area, physically blocking the reverse data flow; The reverse isolation device only allows data transmission from areas with low security levels to areas with high security levels. The two devices are physically independent and prohibit the transmission of real-time confirmation receipts through VPNs, dedicated management channels, or other logical channels.

[0074] Based on the security level relationship between the security zones where the central lineage database and the peripheral lineage database are located, the transmission directions of the first and second lateral isolation devices are determined: If the security level of the central lineage database is lower than the security level of the edge lineage database, then the first lateral isolation device is a forward isolation device and the second lateral isolation device is a reverse isolation device; otherwise, the first lateral isolation device is a reverse isolation device and the second lateral isolation device is a forward isolation device.

[0075] Taking the first lateral isolation device as the forward isolation device and the second lateral isolation device as the reverse isolation device as an example, the data synchronization process between the edge lineage database and the central lineage database includes: Forward data transmission: After format checking, the data in the peripheral kinship database is transmitted to the central kinship database through a forward isolation device (one-way optical shutter / network gate); Reverse confirmation transmission: The central lineage database generates a list of confirmed data identifiers (containing only the flow ID and confirmation timestamp) according to a preset cycle. After format checking and digital signature, the data is transmitted to the edge lineage database through an independent reverse isolation device.

[0076] Synchronization status awareness retention: After receiving an acknowledgment flag, the edge lineage database marks the corresponding data as acknowledged and allows it to be evicted according to the policy when a capacity alarm is triggered; data that has not received an acknowledgment flag is continuously retained without a fixed time limit, until an acknowledgment is received or a capacity alarm is triggered. Synchronous health monitoring: Real-time monitoring of the connection status between the two isolation devices. In case of failure, an alarm is immediately generated and data is paused and discarded. After recovery, the backlog of data is automatically retried.

[0077] To address the performance loss caused by centralized query center lineage databases, this invention preferably constructs a three-level storage system for edge lineage databases; that is, preferably, as follows: Figure 4 As shown, the marginal kinship database adopts a hierarchical storage structure: The first-level cache is used for local memory storage of the data collection proxy, retaining traffic records within a first preset time period; for example, retaining traffic records for the most recent 10 seconds, with microsecond-level query response. The second-level cache is used for storage of network nodes in this region, retaining traffic records within a second preset time period, which is longer than the first preset time period; for example, retaining traffic records for the most recent 60 seconds, with millisecond-level query response. The third-level cache is used for persistent storage in this area and is retained in stages according to synchronization status: Synchronized data has been confirmed to retain a preset retention period and can be discarded based on time. Unconfirmed synchronization data retains the reverse confirmation flag sent by the central lineage database or the triggered capacity alarm, ensuring that data is not lost in the event of synchronization failure.

[0078] The data eviction policy for the third-level cache prioritizes removing the top N high-confidence records that have been confirmed to be synchronized (i.e., data that has been successfully matched and synchronized to the central lineage database). Unconfirmed synchronization records are only removed in chronological order when a capacity alarm is triggered, and a synchronization failure alarm log is generated.

[0079] The method provided by this invention, by maintaining a multi-level cache structure, enables local priority querying and asynchronous write-back, and manages data retention strategies hierarchically according to synchronization status, which can reduce the performance loss caused by centralized querying of the lineage database.

[0080] The method provided by this invention will be further illustrated below with two specific examples.

[0081] Example 1: Tracking Control Commands from Provincial Dispatch Centers 1. System Deployment like Figure 5As shown, the power monitoring system has multiple security zones, including a production control zone and a management information zone. Physically independent forward and reverse isolation devices are deployed at the boundary between the production control zone and the management information zone. Optical splitters (splitting ratio 70:30) are deployed before and after the forward isolation device in the production control zone. Mirrored traffic access is handled by a data acquisition agent. The front-end data acquisition agent belongs to the production control zone, and the back-end belongs to the management information zone.

[0082] 2. Adaptive window calculation Taking the path from the production control area dispatch master station to the horizontal isolation node as an example: Establish a similar path-level delay statistics table within the same security zone to record historical delay samples of "dispatch master station → front node of horizontal isolation device"; Obtain typical cross-regional transmission delay parameters of the isolation device (e.g., 2ms); The sample P99 is 15ms, the standard deviation is 3ms, and a conservative residual coefficient of 2.0 is taken. The adaptive time window value = min((15 + 3×3 + 2) × 2.0, 500ms) = 52ms.

[0083] 3. Multi-level cascading matching examples Scenario: The dispatcher issues a line protection setting instruction, and the source address changes after NAT.

[0084] First-level exact match: Quadruple change, failure; Second-level fuzzy matching: Destination address matches, source address matches 10.0.0.0 / 8 network segment, timestamp difference is within 52ms, hit, confidence level 0.8; The cascading process terminates, the record is temporarily associated, and an asynchronous query is performed to confirm in the central database.

[0085] 4. Synchronous verification of dual isolation device group Forward synchronization: Incremental data is exported from the edge library of the production control area every 5 seconds and transmitted unidirectionally to the management information area through the forward isolation device; Reverse confirmation: The central warehouse generates a list of confirmed data identifiers every 5 minutes, which is then transmitted to the production control area via a reverse isolation device; Status-aware retention: Data that has not received an acknowledgment is marked as "pending" and retained indefinitely, without the 7-day limit; when the capacity reaches the threshold, confirmed data is prioritized for deletion, while "pending" data continues to be retained and an alarm is triggered.

[0086] Example 2: Fault-Tolerant Scenario for Isolation Devices Fault scenario: Hardware failure of the forward isolation device causes a 15-day downtime.

[0087] Synchronous health monitoring immediately detects and alerts; New traffic continues to establish provisional associations and is marked as "pending"; Time-based elimination is paused; unconfirmed data will be retained. After the fault is recovered, the backlogged data is retried in batches, retransmitted to the management information area, and a confirmation flag is reissued. The bloodline relationship is complete, there is no data loss, and it meets the audit requirements.

[0088] The following describes the non-intrusive power system data lineage tracing device that combines timing information and load similarity provided by the present invention. The non-intrusive power system data lineage tracing device that combines timing information and load similarity described below and the non-intrusive power system data lineage tracing method that combines timing information and load similarity described above can be referred to in correspondence with each other.

[0089] This invention provides a power system data lineage tracing device, applied to a multi-security zone environment of a power monitoring system. The device includes: The mirror acquisition module is deployed on both sides of the boundary isolation device of the data link in each security zone. It is used to mirror the acquisition of power business data streams and connect them to the acquisition agent of the security zone in which they are located. The acquisition agent of the source security zone of each data stream generates the lineage information of each data stream and synchronizes it to the central lineage database and the lineage database of the source security zone. The processing module, deployed as a collection agent in the source security zone of each data stream, is used to generate lineage information for each data stream and synchronize it to the central lineage database and the lineage database of the source security zone. The lineage information includes lineage characteristics, flow ID, node identifier, and matching status; in the lineage information of the data flow generated by the acquisition agent of the source security zone, the flow ID is randomly generated. The matching and association module, deployed in the non-source security zone of each data stream, is used to query the lineage characteristics of the data stream in the forward security zone of the cross-regional data stream stored in the lineage database of the non-source security zone when a cross-regional data stream is detected. It performs multi-level cascading matching. If the matching is successful, the lineage information of the cross-regional data stream is generated. Otherwise, an asynchronous association task is constructed and written to the confirmation queue. The lineage characteristics of all data streams in the central lineage database are queried again to perform the multi-level cascading matching. If the matching is successful, its lineage information is generated. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream and its lineage information is generated. In the lineage information of the cross-regional data stream, the stream ID is the stream ID of the matching data stream; after generating the lineage information of the cross-regional data stream, it is also synchronized to the central lineage database and the lineage database of the non-source security zone. The tracking module, deployed as a collection agent in the security zone of the data stream destination, is used to query the central lineage database to obtain the lineage information of all data streams with the same flow ID as the target data stream. After sorting the node identifiers in chronological order, the module is connected to obtain the device sequence through which the target data stream flows, so as to reconstruct the transmission path of the target data stream.

[0090] Preferably, before the matching and association module queries the lineage characteristics of all data streams in the lineage database of the non-source security zone to perform the multi-level cascading matching, it further includes: If a first data stream with a matching status of "matched" is found in the local cache of the non-source security zone and has the same socket quadruple information and message payload characteristics as the cross-region data stream to be matched, and a second data stream with the same socket quadruple information and message payload characteristics as the matching object of the first data stream is found, then the match is successful; otherwise, the lineage characteristics of all data streams in the lineage database of the non-source security zone are queried for multi-level cascading matching. The local cache is used to store cross-regional data streams whose matching status is "matched" in their respective security zones and their matching objects, as well as data stream lineage information of adjacent security zones.

[0091] The lineage characteristics include socket quadruple information, hardware timestamp, and message payload characteristics; The multi-level cascaded matching process includes: A1: If a data stream is found that is completely identical to the socket quadruple of the cross-region data stream to be matched and the timestamp difference is within the adaptive time window, then the match is successful; otherwise, proceed to A2. A2: When the socket quadruple changes due to address translation, if a data stream with the same destination address, source address within the preset network segment range, and timestamp difference within the adaptive time window is found, the match is successful; otherwise, proceed to A3. A3 extracts key fields of the power communication protocol from the payload of the cross-regional data stream to be matched. If a data stream with a field similarity of up to a preset similarity threshold is found, the match is successful; otherwise, the match fails.

[0092] Preferably, the adaptive time window is calculated using the formula: A = BC; Where A is the value of the adaptive time window, B=D+E+F, D is the weighted sum of the statistical quantiles and dispersion measures of the delay sample, the delay sample is the historical delay of similar paths within the same security zone, E is the initial cross-zone transmission delay parameter, F is the protocol parsing time compensation, and C is the conservative margin coefficient.

[0093] Preferably, among all the lineage databases in the security zones, only one security zone's lineage database is the central lineage database, while the lineage databases of the other security zones are all peripheral lineage databases; All data in the edge kinship databases are asynchronously synchronized to the central kinship database through the first horizontal isolation device; the central kinship database periodically transmits the list of confirmed data identifiers to the edge kinship databases through the second horizontal isolation device to synchronize the upload status; the edge kinship databases update their data status by comparing their local queue of data to be synchronized with the received list of confirmed data identifiers; data that has not been confirmed to be synchronized is retained until a confirmation identifier is received or a capacity alarm is triggered. The confirmed data identifier list includes multiple confirmed data identifiers, which are generated after the central lineage database successfully receives the synchronization data; the local queue to be synchronized consists of data in the edge lineage database that has not received a confirmed data identifier; and the unconfirmed synchronized data consists of data in the edge lineage database that has been uploaded but has not received a corresponding confirmed data identifier.

[0094] Preferably, if the security level of the central lineage database is lower than the security level of the security zone where the peripheral lineage database is located, then the first lateral isolation device is a forward isolation device and the second lateral isolation device is a reverse isolation device; otherwise, the first lateral isolation device is a reverse isolation device and the second lateral isolation device is a forward isolation device.

[0095] Preferably, the marginal kinship database adopts a hierarchical storage structure: The first-level cache is used to collect traffic records in the proxy's local memory storage, retaining traffic records within the first preset time period; The second-level cache is used for network node storage in this security zone, and retains traffic records within a second preset time period, which is longer than the first preset time period. The third-level cache is used for persistent storage in this security zone and is retained in stages according to the synchronization status: confirmed synchronization data is retained for a preset retention period, and unconfirmed synchronization data is retained until a reverse confirmation flag is received or a capacity alarm is triggered; the data eviction policy of the third-level cache is: the first N high-confidence records of confirmed synchronization are removed first, and unconfirmed synchronization records are removed in chronological order when a capacity alarm is triggered, and a synchronization failure alarm log is generated.

[0096] Preferably, the matching and association module constructs an asynchronous association task and writes it into the pending confirmation queue, queries the bloodline characteristics of all data streams in the central bloodline database, and performs the multi-level cascaded matching again, including: Construct a task to be confirmed for association; the task to be confirmed for association includes outbound flow characteristic information of the cross-regional data flow to be matched and lineage characteristic record identifier of the candidate inbound flow; wherein, the candidate inbound flow is the data flow flowing into the forward security zone of the cross-regional data flow to be matched; Write the pending related tasks into the pending confirmation queue and set a timeout management mechanism; Retrieve unconfirmed related tasks and query the central lineage database for multi-level cascading matching; After a successful match, an acknowledgment identifier is transmitted via the reverse isolation device in the next synchronization cycle; When the central lineage database is unavailable, a synchronization health alert is triggered, and the pending related tasks are continuously persisted locally. At the same time, a timeout period is marked, and the task is automatically retried or transferred to the review queue after the timeout. After recovery, the task is retried, and after a successful retry, a confirmation flag is reissued through the reverse isolation device.

[0097] This invention provides an electronic device, including: a computer-readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is configured to read executable instructions stored in the computer-readable storage medium and execute the method as described in any of the above embodiments.

[0098] This invention provides a computer-readable storage medium storing computer instructions that cause a processor to perform the method described in any of the above embodiments.

[0099] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0100] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0103] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0104] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0105] This invention provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the method described in any of the above embodiments.

[0106] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for tracing the lineage of power system data, applied to a multi-security zone environment of a power monitoring system, characterized in that, The method includes: The mirror collects the data stream of the power business and connects it to the collection agent of its security zone. The collection agent of the source security zone of each data stream generates the lineage information of each data stream and synchronizes it to the central lineage database and the lineage database of the source security zone. The lineage information includes lineage characteristics, flow ID, node identifier, and matching status; in the lineage information of the data stream generated by the acquisition agent of the source security zone, the flow ID is randomly generated. When the acquisition agent of the non-source security zone of each data stream detects a cross-regional data stream, it queries the lineage characteristics of the data stream in the forward security zone of the cross-regional data stream stored in the lineage database of the non-source security zone and performs multi-level cascading matching. If the match is successful, the lineage information of the cross-regional data stream is generated. Otherwise, an asynchronous association task is constructed and written to the pending confirmation queue. The lineage characteristics of all data streams in the central lineage database are queried again and the multi-level cascading matching is performed. If the match is successful, its lineage information is generated. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream and its lineage information is generated. In the lineage information of the cross-regional data stream, the stream ID is the stream ID of the matching data stream; after generating the lineage information of the cross-regional data stream, it is also synchronized to the central lineage database and the lineage database of the non-source security zone. The data stream destination security zone acquisition agent queries the lineage database to obtain the lineage information of all data streams with the same flow ID as the target data stream. The node identifiers are sorted in chronological order and then connected to obtain the device sequence through which the target data stream flows, so as to reconstruct the transmission path of the target data stream.

2. The method as described in claim 1, characterized in that, Before performing the multi-level cascading matching by querying the lineage characteristics of all data streams in the lineage database of the non-source security zone, the process also includes: If a first data stream with a matching status of "matched" is found in the local cache of the non-source security zone and has the same socket quadruple information and message payload characteristics as the cross-region data stream to be matched, and a second data stream with the same socket quadruple information and message payload characteristics as the matching object of the first data stream is found, then the match is successful; otherwise, the lineage characteristics of all data streams in the lineage database of the non-source security zone are queried for multi-level cascading matching. The local cache is used to store cross-regional data streams whose matching status is "matched" in their respective security zones and their matching objects, as well as data stream lineage information of adjacent security zones; the data stream lineage information generated by the acquisition agent of the source security zone has a matching status of "not matched"; the data stream lineage information of the cross-regional data stream has a matching status of "matched".

3. The method as described in claim 1, characterized in that, The lineage characteristics include socket quadruple information, hardware timestamp, and message payload characteristics; The multi-level cascaded matching process includes: A1: If a data stream is found that is completely identical to the socket quadruple of the cross-region data stream to be matched and the timestamp difference is within the adaptive time window, then the match is successful; otherwise, proceed to A2. A2: When the socket quadruple changes due to address translation, if a data stream with the same destination address, source address within the preset network segment range, and timestamp difference within the adaptive time window is found, the match is successful; otherwise, proceed to A3. A3 extracts key fields of the power communication protocol from the payload of the cross-regional data stream to be matched. If a data stream with a field similarity of up to a preset similarity threshold is found, the match is successful; otherwise, the match fails.

4. The method as described in claim 3, characterized in that, The formula for calculating the adaptive time window is: A = BC; Where A is the value of the adaptive time window, B=D+E+F, D is the weighted sum of the statistical quantiles and dispersion measures of the delay sample, the delay sample is the historical delay of similar paths within the same security zone, E is the initial cross-zone transmission delay parameter, F is the protocol parsing time compensation, and C is the conservative margin coefficient.

5. The method as described in claim 1, characterized in that, Among all the lineage databases in all security zones, only one security zone's lineage database is the central lineage database, while the lineage databases of the other security zones are all peripheral lineage databases; All data in the edge kinship databases are asynchronously synchronized to the central kinship database through the first horizontal isolation device; the central kinship database periodically transmits the list of confirmed data identifiers to the edge kinship databases through the second horizontal isolation device to synchronize the upload status; the edge kinship databases update their data status by comparing their local queue of data to be synchronized with the received list of confirmed data identifiers; data that has not been confirmed to be synchronized is retained until a confirmation identifier is received or a capacity alarm is triggered. The confirmed data identifier list includes multiple confirmed data identifiers, which are generated after the central lineage database successfully receives the synchronization data; the local queue to be synchronized consists of data in the edge lineage database that has not received a confirmed data identifier; and the unconfirmed synchronized data consists of data in the edge lineage database that has been uploaded but has not received a corresponding confirmed data identifier.

6. The method as described in claim 5, characterized in that, If the security level of the central lineage database is lower than the security level of the edge lineage database, then the first lateral isolation device is a forward isolation device and the second lateral isolation device is a reverse isolation device; otherwise, the first lateral isolation device is a reverse isolation device and the second lateral isolation device is a forward isolation device.

7. The method as described in claim 5, characterized in that, The marginal kinship database adopts a hierarchical storage structure: The first-level cache is used to collect traffic records in the proxy's local memory storage, retaining traffic records within the first preset time period; The second-level cache is used for network node storage in this security zone, retaining traffic records within a second preset time period, which is longer than the first preset time period. The third-level cache is used for persistent storage in this security zone and is retained in stages according to the synchronization status: confirmed synchronization data is retained for a preset retention period, and unconfirmed synchronization data is retained until a reverse confirmation flag is received or a capacity alarm is triggered; the data eviction policy of the third-level cache is: the first N high-confidence records of confirmed synchronization are removed first, and unconfirmed synchronization records are removed in chronological order when a capacity alarm is triggered, and a synchronization failure alarm log is generated.

8. The method as described in claim 1, characterized in that, The asynchronous association task is written into the pending confirmation queue, and the bloodline characteristics of all data streams in the central bloodline database are queried for further multi-level cascade matching, including: Construct a task to be confirmed for association; the task to be confirmed for association includes outbound flow characteristic information of the cross-regional data flow to be matched and lineage characteristic record identifier of the candidate inbound flow; wherein, the candidate inbound flow is the data flow flowing into the forward security zone of the cross-regional data flow to be matched; Write the pending related tasks into the pending confirmation queue and set a timeout management mechanism; Retrieve unconfirmed related tasks and query the central lineage database for multi-level cascading matching; After a successful match, an acknowledgment identifier is transmitted via the reverse isolation device in the next synchronization cycle; When the central lineage database is unavailable, a synchronization health alert is triggered, and the pending related tasks are continuously persisted locally. At the same time, a timeout period is marked, and the task is automatically retried or transferred to the review queue after the timeout. After recovery, the task is retried, and after a successful retry, a confirmation flag is reissued through the reverse isolation device.

9. A power system data lineage tracing device, applied in a multi-security zone environment of a power monitoring system, characterized in that, The device includes: The mirror acquisition module is deployed on both sides of the boundary isolation device of the data link in each security zone. It is used to mirror the acquisition of power business data streams and connect them to the acquisition agent of the security zone in which they are located. The acquisition agent of the source security zone of each data stream generates the lineage information of each data stream and synchronizes it to the central lineage database and the lineage database of the source security zone. The processing module, deployed as a collection agent in the source security zone of each data stream, is used to generate lineage information for each data stream and synchronize it to the central lineage database and the lineage database of the source security zone. The lineage information includes lineage characteristics, flow ID, node identifier, and matching status; in the lineage information of the data stream generated by the acquisition agent of the source security zone, the flow ID is randomly generated. The matching and association module, deployed in the non-source security zone of each data stream, is used to query the lineage characteristics of the data stream in the forward security zone of the cross-regional data stream stored in the lineage database of the non-source security zone when a cross-regional data stream is detected. It performs multi-level cascading matching. If the matching is successful, the lineage information of the cross-regional data stream is generated. Otherwise, an asynchronous association task is constructed and written to the pending confirmation queue. The lineage characteristics of all data streams in the central lineage database are queried again to perform the multi-level cascading matching. If the matching is successful, its lineage information is generated. Otherwise, the non-source security zone is regarded as the source security zone of the cross-regional data stream and its lineage information is generated. In the lineage information of the cross-regional data stream, the stream ID is the stream ID of the matching data stream; after generating the lineage information of the cross-regional data stream, it is also synchronized to the central lineage database and the lineage database of the non-source security zone. The tracking module, deployed as a collection agent in the security zone of the data stream destination, is used to query the central lineage database to obtain the lineage information of all data streams with the same flow ID as the target data stream. After sorting the node identifiers in chronological order, the module is connected to obtain the device sequence through which the target data stream flows, so as to reconstruct the transmission path of the target data stream.

10. An electronic device, characterized in that, include: Computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is configured to read executable instructions stored in the computer-readable storage medium and execute the method as described in any one of claims 1-6.

Images