A mine tramline protection method based on protocol analysis

Abstract

The present application relates to the technical field of Internet of Things security, in particular to a mine line protection method based on protocol analysis, in the present application, the remote control execution and switch object, trip value and outlet object, setting value modification and zone number pairing relationship are judged based on the protocol semantic tree, the authentication response, preset confirmation, execution confirmation, lock return, alarm return and setting value confirmation are arranged according to the session number based on the semantic constraint marker table, the preposition state, migration forbidden item and observation score are compared by using the Viterbi algorithm, the protection action judgment object can be converted from a single frame state field to a session state path, the function code, control object, action type, confirmation result and lock flag are spliced based on the protection state path table by using the AC automatic machine algorithm, and the missing preset execution, lock closing, repeated tripping, cross-zone setting value modification and alarm reclosing combination are compared, so that the abnormal judgment object is converted from a single instruction to a continuous instruction chain.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a method for protecting mining lines based on protocol parsing. Background Technology

[0002] The Internet of Things (IoT) security technology aims to address the interconnection and communication process between line protection devices, edge control nodes, communication gateways, and scheduling platforms in mining systems. This is achieved through device authentication, protocol message parsing, access control, control command verification, and abnormal message blocking, ensuring that line protection devices receive legitimate commands, execute controlled actions, and maintain stable operation.

[0003] The purpose of a protocol parsing-based mining power line protection method is to identify and block abnormal control commands in the mining power line protection communication process through protocol message parsing, command permission verification, and protection status matching, so as to prevent the line protection device from malfunctioning, refusing to operate, or exceeding its authority, and improve the operational safety of mine power supply lines.

[0004] Existing technologies typically revolve around device authentication, protocol message parsing, access control, control command verification, and blocking of abnormal messages. In actual operation, they focus more on whether the source, field format, permission identifier, and command type of a single frame message conform to preset rules. When the message header, device address, function code, and verification fields are all qualified, the message is easily regarded as an object that can continue to be processed. For multi-level interaction scenarios of mining line protection devices, there are continuous events such as authentication response, preset confirmation, execution confirmation, interlocking return, alarm return, and setting confirmation among the scheduling platform, communication gateway, edge control node, and line protection device. Single-frame judgment is difficult to express the dependencies between events. Existing technologies have shortcomings in session-level state constraints, cross-message business semantic constraints, and continuous abnormal command chain identification. This can easily lead to abnormal behaviors such as forged confirmation messages, deletion of preceding confirmation messages, repeated tripping, and interlocking bypass being mixed into the legitimate field message sequence, thereby affecting the action boundary of the line protection device. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and propose a method for protecting mining lines based on protocol analysis.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a method for protecting mining power lines based on protocol analysis, comprising the following steps: S1: Based on the Kuanghong Communication Gateway, receive messages, read the start character, verify the device address and line number, split the function code, control object, set value area number, action value, confirmation field, and verification field, and return the node to its position according to remote control preset, remote control execution, set value modification, and interlocking return to obtain the protocol semantic tree; S2: Based on the protocol semantic tree, read the function code, switch object, output object, setting area, and confirmation field node, determine the pairing of remote control execution with switch object, trip value with output object, and setting modification with area code, and generate a semantic constraint tag table; S3: Based on the semantic constraint tag table, the authentication response, preset confirmation, execution confirmation, lockout return, alarm return, and set value confirmation are arranged by session number. The Viterbi algorithm is used to compare the previous state, migration prohibition, and observation score. The candidate state with the largest cumulative score is selected and written into the current state node. The highest-scoring protection state path is restored through the backtracking node to generate the protection state path table. S4: Based on the protection status path table, the AC automaton algorithm is used to concatenate the function code, control object, action type, confirmation result, and interlocking flag, and compare the missing preset execution, interlocking closing, repeated tripping, cross-zone setting change, and alarm reclosing combination to generate an abnormal instruction chain certificate. S5: Based on the abnormal instruction chain certificate, call the protection status path table, read the inferred status, breakage flag, hit number, and control object, compare the trip, close, reclose, setting zone switching, interlock release and status permission table, and generate control message processing certificate.

[0007] As a further embodiment of the present invention, the protocol semantic tree includes a message root node, address layer node, function layer node, object layer node, parameter layer node, and verification layer node; the semantic constraint tag table includes object constraint items, action constraint items, setpoint area constraint items, and acknowledgment field constraint items; the protection status path table includes session identifier, event sequence, status node, backtracking node, and migration prohibition item; the abnormal instruction chain credential includes chain combination number, hit sequence, risk category, control object identifier, and blocking status identifier; and the control message handling credential includes line identifier, control object identifier, status constraint item, abnormal hit item, and handling item.

[0008] As a further aspect of the present invention, the specific steps for generating the reduced semantic tree are as follows: Based on the message received by the Kuanghong Communication Gateway, the start character position is used as the message boundary. The device address is checked against the line number item by item. The function code, control object, set value area number, action value, confirmation field, and verification field are split and registered according to byte order to generate a protocol field location table. Based on the specification field location table, the function codes are associated with four types of business nodes: remote control preset, remote control execution, set value modification, and lockout return. The control object is attached to the object layer, the action value is attached to the action layer, and the confirmation field is attached to the return layer to obtain the specification semantic tree.

[0009] As a further aspect of the present invention, the specific steps for generating the semantic constraint tag table are as follows: Based on the aforementioned semantic tree, read the function code node, switch object node, exit object node, set value area node, and confirmation field node, write the node hierarchy relationship, node parent-child relationship, and node same-level relationship into the pairing entries, and generate a node pairing list. Based on the node pairing list, the correspondence between remote control execution and switch object, the correspondence between trip value and output object, and the correspondence between setting value modification and area code are compared respectively. Inconsistent entries are written into the constraint flag bit to generate a semantic constraint flag table.

[0010] As a further aspect of the present invention, the specific steps for generating the protection state path table are as follows: Based on the semantic constraint tag table, authentication responses, preset confirmations, execution confirmations, latch returns, alarm returns, and setpoint confirmations under the same session number are written into the event queue according to their arrival time. The line number, device address, event sequence number, confirmation result, latch flag, alarm reset flag, and setpoint area number are registered in the same row to obtain the session event sequence table. Based on the session event sequence table, the Viterbi algorithm is used to assign each event item to the authentication passed state, remote allowed state, remote control preset state, remote control executed state, action confirmed state, protection locked state, alarm not reset state, setting area switching state, setting modification pending confirmation state, and write the observation score according to the event sequence number. The prohibited migration items are written into the state interval column to obtain the state candidate scoring table. Based on the state candidate scoring table, the cumulative score of the previous state, the state transition score, and the event observation score are compared row by row. The protection is locked to closing execution, the lack of preset is locked to remote control execution, the alarm is not reset to reclosing input, the setting is pending confirmation to trip output is marked as prohibited migration, the candidate state with the largest cumulative score is selected and written to the current state node, and the highest-scoring protection state path is restored through the backtracking node to generate the protection state path table.

[0011] As a further aspect of the present invention, the Viterbi algorithm first reads the session number, event number, event item, observation score, state transition score, and prohibited transition item from the state candidate scoring table. It then establishes a time column based on the event number and creates state rows based on the following states: authentication passed, remote control allowed, remote control preset, remote control executed, action confirmed, protection locked, alarm not reset, setting zone switching, setting modification pending confirmation, and reset completed. At the first event number, it writes the event item and the observation score matching the state row. Then, it reads the previous state item by item at the next event number. The cumulative score is used to form a migration pair between the previous state and the current state. When the migration pair hits a prohibited migration item, a prohibition flag is written. When the migration pair does not hit a prohibited migration item, the state migration score is read. The cumulative score of the previous state, the state migration score, and the current event observation score are added together to obtain the candidate path score. The candidate path score with the larger value under the same current state is selected and written into the current state cumulative score. The corresponding previous state is written into the backtracking node. After completing all event numbers column by column, the backtracking nodes are read backward from the state with the larger cumulative score in the last column. The state node sequence is restored in reverse according to the event number to generate the protection state path table.

[0012] As a further aspect of the present invention, the specific steps for generating the abnormal instruction chain certificate are as follows: Based on the protection state path table, the AC automaton algorithm is used to extract the function code, control object, action type, confirmation result, interlocking flag, and state chain break flag corresponding to each session path node. Adjacent path nodes are concatenated into continuous instruction items according to the event sequence number. The line number and device address are written into the index bit to obtain the instruction symbol bit sequence table. Based on the instruction symbol bit sequence table, two instruction items with adjacent event numbers within the same session are defined as adjacent instruction items, and non-adjacent instruction items within the same session that can still form abnormal combinations after crossing one or more intermediate events are defined as interval instruction items. Adjacent instruction items and interval instruction items are combined into a sequence of instruction items to be matched according to event numbers, and the combinations of missing preset execution, interlocking closing, repeated tripping, cross-zone setting value modification, alarm reclosing, remote execution in local state, and tripping value carried by non-exit object are compared. The start point and end point of the hit are recorded to obtain the abnormal combination hit table. Based on the aforementioned abnormal combination hit table, the hit combination number, hit start point, hit end point, risk category, line number, device address, controlled object, action type, and lockout flag are written into the voucher item. The exit action risk is placed before the set value modification risk, and the lockout detour risk is placed before the repeated control risk, thereby generating an abnormal instruction chain voucher.

[0013] As a further aspect of this invention, an AC automaton algorithm is employed to read the session number, event number, function code, controlled object, action type, confirmation result, interlock flag, state chain break flag, line number, and device address from the instruction symbol bit sequence table. Combinations such as missing preset execution, interlock closing, repeated tripping, cross-zone setting modification, alarm reclosing, local state remote execution, and non-exit object carrying tripping value are written into the dictionary tree nodes in instruction symbol order. The function code category, controlled object category, action type category, confirmation result category, and interlock flag category are written into the node label. The combination number and risk category are written into the termination node. The parent node, child node, and same-level node are read according to the node hierarchy queue. A failure pointer is established, pointing to a node at a deeper level of the common suffix. Continuous instruction items are read sequentially according to the session event sequence number. The continuous instruction items are compared with the outgoing edge label of the current node. If the labels match, the child node is entered; if the labels do not match, the node is backtracked along the failure pointer to a matchable node. When a termination node is hit, the hit combination number, hit start point, hit end point, risk category, line number, device address, controlled object, action type, and interlocking flag are recorded. When multiple combinations are hit with the same event sequence number, the exit action risk, setpoint modification risk, status query risk, interlocking detour risk, and duplicate control risk are compared in order of priority. The risk category with the highest priority is written into the voucher item, generating an abnormal instruction chain voucher.

[0014] As a further aspect of the present invention, the specific steps for generating the control message processing certificate are as follows: Based on the abnormal instruction chain certificate, the protection status path table is invoked to extract the inferred status, breakage flag, hit number, line number, and control object. The abnormal chain hit items are aligned with the session status nodes to generate a handling condition index. Based on the aforementioned handling condition index, tripping, closing, reclosing, setting zone switching, and lockout release are compared with the status permission table, and the message destination, line number, controlled object, and hit number are written into the voucher item to generate a control message handling voucher.

[0015] As a further aspect of the present invention, the step of aligning the abnormal chain hit items with the session status nodes involves first reading the session number, line number, device address, controlled object, hit start point, hit end point, hit number, and risk category from the abnormal instruction chain certificate; then reading the session number, line number, device address, controlled object, event sequence number, inferred status, break flag, and path node number from the protection status path table; using the same session number, line number, device address, and controlled object as the attribution condition; and using an event sequence number greater than or equal to the hit start point and less than or equal to the hit end point as the interval condition; and writing the path node number, inferred status, break flag, and hit number that simultaneously meet the attribution condition and interval condition into the same handling condition index row.

[0016] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, the received message is split into start symbol, device address, line number, function code, control object, set value area number, action value, confirmation field, and verification field, and is arranged into a protocol semantic tree according to remote control preset, remote control execution, set value modification, and lockout return. This expands the original method of judging message legality based solely on field position to synchronous constraints on field hierarchy, node affiliation, and business meaning. In this invention, the pairing relationship between remote control execution and switch object, trip value and output object, and setting modification and area code number is determined based on the protocol semantic tree. This enables the three types of participating items—control object, action value, and setting area—to form cross-restrictions, reducing the number of structurally qualified but business-meaning conflicting messages entering the control chain. Based on the semantic constraint tag table, authentication response, preset confirmation, execution confirmation, interlock return, alarm return, and setting confirmation are arranged by session number. The Viterbi algorithm is used to compare the pre-state, migration prohibition, and observation score, which can transform the protection action judgment object from a single frame state field to a session state path. In this invention, based on the protection status path table, the AC automaton algorithm is used to concatenate function codes, control objects, action types, confirmation results, and interlocking flags, and compare the combinations of missing preset execution, interlocking closing, repeated tripping, cross-zone setting change, and alarm reclosing, so that the abnormal judgment object is transformed from a single instruction to a continuous instruction chain. This invention reads the inferred status, break flag, hit number, and controlled object based on the abnormal instruction chain certificate, and compares it with the status permission table to form a continuous closed loop from protocol semantics, status path, abnormal chain hit to control message processing certificate. This enhances the ability to identify abnormal control behaviors such as out-of-order control, lockout bypass, status jump, cross-zone setting change, and forged confirmation in the mining line protection communication scenario. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the main steps of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Example 1 Please see Figure 1 This invention provides a technical solution: a method for protecting mining power lines based on protocol analysis, comprising the following steps: S1: Based on the Kuanghong Communication Gateway, receive messages, read the start character, verify the device address and line number, split the function code, control object, set value area number, action value, confirmation field, and verification field, and return the node to its position according to remote control preset, remote control execution, set value modification, and interlocking return to obtain the protocol semantic tree; S2: Based on the specification semantic tree, read the function code, switch object, output object, setting area, and confirmation field node, determine the pairing of remote control execution with switch object, trip value with output object, and setting modification with area code, and generate a semantic constraint tag table; S3: Based on the semantic constraint tag table, the authentication response, preset confirmation, execution confirmation, lockout return, alarm return, and set value confirmation are arranged by session number. The Viterbi algorithm is used to compare the previous state, migration prohibition, and observation score. The candidate state with the highest cumulative score is selected and written into the current state node. The highest-scoring protection state path is restored through the backtracking node to generate the protection state path table. S4: Based on the protection status path table, the AC automaton algorithm is used to concatenate the function code, control object, action type, confirmation result, and interlocking flag. The missing preset execution, interlocking closing, repeated tripping, cross-zone setting change, and alarm reclosing combinations are compared to generate abnormal instruction chain credentials. S5: Based on the abnormal instruction chain certificate, call the protection status path table, read the inferred status, breakage flag, hit number, and control object, compare the trip, close, reclose, setting zone switching, interlock release and status permission table, and generate control message processing certificate.

[0020] The protocol semantic tree includes a message root node, address layer node, function layer node, object layer node, parameter layer node, and verification layer node. The semantic constraint tag table includes object constraint items, action constraint items, setting area constraint items, and acknowledgment field constraint items. The protection state path table includes session identifier, event sequence, state node, backtracking node, and migration prohibition item. The abnormal instruction chain credential includes chain combination number, hit sequence, risk category, controlled object identifier, and blocking status identifier. The control message handling credential includes line identifier, controlled object identifier, state constraint item, abnormal hit item, and handling item.

[0021] The specific steps for generating the reduction semantic tree are as follows: Based on the message received by the Kuanghong Communication Gateway, a deterministic finite state automaton is used for field boundary positioning. The system sets up idle, start, address, line, function, object, setpoint zone, action, acknowledgment, verification, and end states. The start character value is set to 0x68, the end character value to 0x16, the device address length to 2 bytes, the line number length to 2 bytes, the function code length to 1 byte, the controlled object length to 2 bytes, the setpoint zone number length to 1 byte, the action value length to 1 byte, the acknowledgment field length to 1 byte, and the verification field length to 2 bytes. The system records the start byte, end byte, field length, field value, and verification field position in the state transition order. The device address is checked against the line number item by item, and the field values ​​are written into the positioning row to generate a protocol field positioning table. Based on the specification field location table, the Early grammar parsing algorithm is used to expand the specification grammar. The start item is set as the message root node, the production items are set as remote control preset, remote control execution, set value modification, and latch return, the input symbols are set as function code, control object, set value area number, action value, confirmation field, and check field, the item position index is set as the starting byte of the field, the prediction operation is written to the candidate business node, the scan operation compares the field value with the production item, the completed operation connects the parent node, child node, and same-level node, and attaches the function code to the business layer, the control object to the object layer, the action value to the action layer, and the confirmation field to the return layer to obtain the specification semantic tree.

[0022] The specific steps for generating the semantic constraint tag table are as follows: Based on the semantic tree of the specification, a depth-first traversal algorithm is used to read function code nodes, switch object nodes, exit object nodes, set value area nodes, and confirmation field nodes. The message root node is initially written into the traversal stack, with the root node level value set to 0 and the child node level value set to the parent node level value plus 1. After the top node is popped from the stack, child nodes are pushed in the order of business layer, object layer, parameter layer, action layer, and return layer. The node number, parent node number, level value, same-level sequence number, field start byte, field end byte, and field value are written into the node index row. Candidate pairing entries are established between function code nodes and switch object nodes, exit object nodes, set value area nodes, and confirmation field nodes. The node level relationship, node parent-child relationship, and node same-level relationship are written into the pairing entries to generate a node pairing list. Based on the node pairing list, a three-value constraint matrix matching method is used to compare the correspondence between remote control execution and switch object, trip value and output object, and setting modification and area code number. The constraint matrix is ​​set so that row number 1 corresponds to remote control execution plus switch object, row number 2 corresponds to trip value plus output object, and row number 3 corresponds to setting modification plus setting area code plus setting number. A matrix value of 1 indicates that pairing is allowed, a matrix value of 0 indicates that pairing is prohibited, and a matrix value of 2 indicates that a pairing item is missing. The function code number, object category code, action value code, setting area code, and setting number are read row by row. The read values ​​are compared with the cross values ​​of the constraint matrix row number and column number. Entries with a value of 0 are written to the conflict flag bit, entries with a value of 2 are written to the missing item flag bit, and inconsistent entries are written to the constraint flag bit, generating a semantic constraint flag table.

[0023] The specific steps for generating the protection status path table are as follows: Based on the semantic constraint tag table, a stable merge sorting method is adopted to perform authentication responses, preset confirmations, execution confirmations, latch returns, alarm returns, and setpoint confirmation queues under the same session number. The sorting keys are set to ascending order of session number, ascending order of arrival time, and ascending order of message sequence number. The event type codes are set to authentication response 01, preset confirmation 02, execution confirmation 03, latch return 04, alarm return 05, and setpoint confirmation 06. The arrival timestamp precision is set to 1 millisecond. The line number length is set to 2 bytes, the device address length is set to 2 bytes, the event sequence number is incremented from 1, the confirmation result is 00 for failure and 01 for success, the latch flag is 00 for not latched and 01 for latched, the alarm reset flag is 00 for not reset and 01 for reset, and the setpoint area number is 01 to 08. The line number, device address, event sequence number, confirmation result, latch flag, alarm reset flag, and setpoint area number are registered in the same row to obtain the session event bit sequence table. Based on the session event bit sequence table, the Viterbi algorithm is used to map event items to protection status candidates. Status codes are set as follows: Authentication Passed (S01), Remote Allowed (S02), Remote Preset (S03), Remote Executed (S04), Action Confirmed (S05), Protection Interlocked (S06), Alarm Not Reset (S07), Setpoint Pending Confirmation (S08). Event type code 01 corresponds to S01, event type code 02 corresponds to S03, event type code 03 corresponds to S04, event type code 04 corresponds to S06, and event type code 05 corresponds to... S07, event type code 06 corresponds to S08, the matching observation score is set to 10, the non-matching observation score is set to -10, the missing confirmation observation score is set to -20, the migrationable state score is set to 5. When a prohibited migration item is hit, the corresponding migration pair is excluded from the candidate migration set and the migration pair is not included in the candidate path calculation. The protection is blocked to closing execution, the missing preset is blocked to remote control execution, the alarm is not reset to reclosing input, and the setting is pending confirmation to trip output and written into the status interval column to obtain the status candidate scoring table. Based on the state candidate scoring table, the Viterbi algorithm is used to perform path score recursion and backtracking node registration. The cumulative state score in the first column is equal to the first event observation score. The next column reads the cumulative score of the preceding state, the state transition score, and the event observation score item by item. The three items are added together to obtain the candidate path score. When there are multiple candidate paths for the current state, the path with the larger score is selected. The corresponding preceding state number is written into the backtracking node. The protection is blocked to closing execution, if the preset is missing, it is executed by remote control, if the alarm has not been reset, it is put into reclosing, and if the setting is pending confirmation, it is marked as prohibited migration at the trip output. The last column reads the state node with the larger score, arranges the event sequence number in reverse order according to the backtracking node, and writes the session number, line number, device address, event sequence number, inferred state, break flag, and path node number to generate the protection state path table.

[0024] The Viterbi algorithm first reads the session number, event number, event item, observation score, state transition score, and prohibited transition item from the state candidate scoring table. It then establishes a time column by event number and a state row by authentication passed state, remote control allowed state, remote control preset state, remote control executed state, action confirmed state, protection locked state, alarm not reset state, setpoint area switching state, setpoint modification pending confirmation state, and reset completed state. At the first event number, it writes the event item and its observation score to match the state row. At each subsequent event number, it reads the accumulated score of the preceding state item and sets the previous state's score accordingly. The current state and the previous state form a migration pair. When the migration pair hits a prohibited migration item, a prohibition flag is written. When the migration pair does not hit a prohibited migration item, the state migration score is read. The cumulative score of the previous state, the state migration score, and the current event observation score are added to obtain the candidate path score. The candidate path score with the larger value under the same current state is selected and written to the current state cumulative score. The corresponding previous state is written to the backtracking node. After completing all event numbers column by column, the backtracking node is read backward from the state with the larger cumulative score in the last column. The state node sequence is restored in reverse according to the event number to generate the protection state path table.

[0025] The specific steps for generating an exception instruction chain credential are as follows: Based on the protection state path table, the AC automaton algorithm is used to encode the symbols of the session path nodes. The length of the function code is set to 1 byte, the length of the controlled object is set to 2 bytes, the length of the action type is set to 1 byte, the length of the confirmation result is set to 1 byte, the length of the interlocking flag is set to 1 byte, and the length of the state chain break flag is set to 1 byte. The symbol concatenation order is set to function code, controlled object, action type, confirmation result, interlocking flag, and state chain break flag. Adjacent path nodes are connected in ascending order of event sequence number. The 2 bytes of line number and 2 bytes of device address are written into the index bit. Each consecutive instruction item is written into the bit sequence row to obtain the instruction symbol bit sequence table. Based on the instruction symbol bit sequence table, the AC automaton algorithm is used to construct an abnormal combination dictionary tree. The combinations of missing preset execution, interlocked closing, repeated tripping, cross-zone setting modification, alarm reclosing, local status remote execution, and non-exit object carrying tripping value are inserted into the node one by one. The node labels are set as function code category, control object category, action type category, confirmation result category, and interlock flag category. The root node number is set to 0. The termination node is written with the combination number and risk category. A failure pointer is established, which points to a node with a deeper level of common suffix. Adjacent instruction items and interval instruction items are read according to the event sequence number. The hit start point and hit end point are recorded to obtain the abnormal combination hit table. Based on the abnormal combination hit table, the AC automaton algorithm is used to merge the hit items of the termination node. The hit combination number, hit start point, hit end point, risk category, line number, device address, controlled object, action type, and interlock flag are written into the voucher item. The risk ranking value is set as follows: exit action risk 6, interlock detour risk 5, cross-zone setting change risk 4, alarm reclosing risk 3, repeated control risk 2, and status query risk 1. When multiple risks are hit by the same event number, the risk category with the largest ranking value is selected and written into the voucher item, and the original voucher item corresponding to the event number is overwritten, generating an abnormal instruction chain voucher.

[0026] Using the AC automaton algorithm, the session number, event number, function code, controlled object, action type, confirmation result, interlock flag, state chain break flag, line number, and device address are read from the instruction symbol bit sequence table. Combinations such as missing preset execution, interlocked closing, repeated tripping, cross-zone setting modification, alarm reclosing, local status remote execution, and non-exit object carrying trip value are written into the dictionary tree nodes in instruction symbol order. The function code category, controlled object category, action type category, confirmation result category, and interlock flag category are written into the node label. The combination number and risk category are written into the termination node. The parent node, child node, and same-level node are read according to the node hierarchy queue. Failure to establish the node is investigated. The pointer, with the failure pointer pointing to a deeper node in the common suffix hierarchy, reads consecutive instruction items sequentially according to the session event sequence number. It compares the consecutive instruction items with the outgoing edge label of the current node. If the labels match, it enters the child node; if the labels do not match, it backtracks along the failure pointer to the matching node. When a termination node is hit, it records the hit combination number, hit start point, hit end point, risk category, line number, device address, controlled object, action type, and lockout flag. When multiple combinations are hit with the same event sequence number, it compares the order of exit action risk, setpoint modification risk, status query risk, lockout detour risk, and duplicate control risk. It selects the risk category with the highest order and writes it into the voucher item, generating an abnormal instruction chain voucher.

[0027] The specific steps for generating control message processing credentials are as follows: Based on the abnormal instruction chain credentials, a composite key hash connection method is used to register the abnormal chain hit items with the session status nodes. The composite key is set as session number, line number, device address, and control object. The hash bucket number is generated by adding the last three digits of the session number to the low byte of the line number. When there are multiple records in the same hash bucket, a linked list is used to store conflicting items, and the four composite keys of session number, line number, device address, and control object are compared item by item. If all four composite keys are consistent, it is determined to be a registration item. If any one is inconsistent, the comparison is skipped to the next linked list node. The hit number, hit start point, hit end point, risk category, action type, and lockout flag are read. The protection status path table is called to extract the inferred status, break flag, path node number, event sequence number, session number, line number, device address, and control object. Items with the same composite key are written into the same index group. Items with event sequence numbers greater than or equal to the hit start point and less than or equal to the hit end point are written into the interval group. The inferred status, break flag, hit number, risk category, and path node number in the interval group are registered to the index row to generate the disposal condition index. Based on the handling condition index, a Boolean state matrix matching method is used to compare control commands with the state permission table. The state matrix rows are set as authentication passed, remote permission allowed, remote control preset, remote control executed, action confirmed, protection locked, alarm not reset, setting value pending confirmation, and reset completed. The state matrix columns are set as trip, close, reclose, setting value area switching, and lockout released. Matrix value 1 indicates release, matrix value 0 indicates discard, and matrix value 2 indicates termination of session exit command issuance. The inferred state, break flag, hit number, risk category, line number, and controlled object are read item by item. When the break flag is 1, matrix value 2 is written. When the risk category is lockout detour and the control command is close, matrix value 0 is written. When the risk category is cross-zone setting value change and the control command is setting value area switching, matrix value 0 is written. The message destination, line number, controlled object, and hit number are written into the voucher item to generate a control message handling voucher.

[0028] Align the anomaly chain hit items with the session status nodes. First, read the session number, line number, device address, controlled object, hit start point, hit end point, hit number, and risk category from the anomaly instruction chain certificate. Then, read the session number, line number, device address, controlled object, event sequence number, inferred status, break flag, and path node number from the protection status path table. Use the same session number, line number, device address, and controlled object as the attribution condition. Use the event sequence number being greater than or equal to the hit start point and less than or equal to the hit end point as the interval condition. Write the path node number, inferred status, break flag, and hit number that simultaneously meet the attribution condition and interval condition into the same handling condition index row.

[0029] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for protecting mining transmission lines based on protocol parsing, characterized in that, Includes the following steps: S1: Based on the Kuanghong Communication Gateway, receive messages, read the start character, verify the device address and line number, split the function code, control object, set value area number, action value, confirmation field, and verification field, and return the node to its position according to remote control preset, remote control execution, set value modification, and interlocking return to obtain the protocol semantic tree; S2: Based on the protocol semantic tree, read the function code, switch object, output object, setting area, and confirmation field node, determine the pairing of remote control execution with switch object, trip value with output object, and setting modification with area code, and generate a semantic constraint tag table; S3: Based on the semantic constraint tag table, the authentication response, preset confirmation, execution confirmation, lockout return, alarm return, and set value confirmation are arranged by session number. The Viterbi algorithm is used to compare the previous state, migration prohibition, and observation score. The candidate state with the largest cumulative score is selected and written into the current state node. The highest-scoring protection state path is restored through the backtracking node to generate the protection state path table. S4: Based on the protection status path table, the AC automaton algorithm is used to concatenate the function code, control object, action type, confirmation result, and interlocking flag, and compare the missing preset execution, interlocking closing, repeated tripping, cross-zone setting change, and alarm reclosing combination to generate an abnormal instruction chain certificate. S5: Based on the abnormal instruction chain certificate, call the protection status path table, read the inferred status, breakage flag, hit number, and control object, compare the trip, close, reclose, setting zone switching, interlock release and status permission table, and generate control message processing certificate.

2. The method for mine-connected power line protection based on protocol parsing according to claim 1, characterized in that, The protocol semantic tree includes a message root node, address layer node, function layer node, object layer node, parameter layer node, and verification layer node. The semantic constraint tag table includes object constraint items, action constraint items, setpoint area constraint items, and acknowledgment field constraint items. The protection status path table includes session identifier, event sequence, status node, backtracking node, and migration prohibition item. The abnormal instruction chain credential includes chain combination number, hit sequence, risk category, control object identifier, and blocking status identifier. The control message handling credential includes line identifier, control object identifier, status constraint item, abnormal hit item, and handling item.

3. The method for mine-connected power line protection based on protocol parsing according to claim 1, characterized in that, The specific steps for generating the reduced semantic tree are as follows: Based on the message received by the Kuanghong Communication Gateway, the start character position is used as the message boundary. The device address is checked against the line number item by item. The function code, control object, set value area number, action value, confirmation field, and verification field are split and registered according to byte order to generate a protocol field location table. Based on the specification field location table, the function codes are associated with four types of business nodes: remote control preset, remote control execution, set value modification, and lockout return. The control object is attached to the object layer, the action value is attached to the action layer, and the confirmation field is attached to the return layer to obtain the specification semantic tree.

4. The method for mine-connected power line protection based on protocol parsing according to claim 1, characterized in that, The specific steps for generating the semantic constraint tag table are as follows: Based on the aforementioned semantic tree, read the function code node, switch object node, exit object node, set value area node, and confirmation field node, write the node hierarchy relationship, node parent-child relationship, and node same-level relationship into the pairing entries, and generate a node pairing list. Based on the node pairing list, the correspondence between remote control execution and switch object, the correspondence between trip value and output object, and the correspondence between setting value modification and area code are compared respectively. Inconsistent entries are written into the constraint flag bit to generate a semantic constraint flag table.

5. The method for mine-connected power line protection based on protocol parsing according to claim 1, characterized in that, The specific steps for generating the protection status path table are as follows: Based on the semantic constraint tag table, authentication responses, preset confirmations, execution confirmations, latch returns, alarm returns, and setpoint confirmations under the same session number are written into the event queue according to their arrival time. The line number, device address, event sequence number, confirmation result, latch flag, alarm reset flag, and setpoint area number are registered in the same row to obtain the session event sequence table. Based on the session event sequence table, the Viterbi algorithm is used to assign each event item to the authentication passed state, remote allowed state, remote control preset state, remote control executed state, action confirmed state, protection locked state, alarm not reset state, setting area switching state, setting modification pending confirmation state, and write the observation score according to the event sequence number. The prohibited migration items are written into the state interval column to obtain the state candidate scoring table. Based on the state candidate scoring table, the cumulative score of the previous state, the state transition score, and the event observation score are compared row by row. The protection is locked to closing execution, the lack of preset is locked to remote control execution, the alarm is not reset to reclosing input, the setting is pending confirmation to trip output is marked as prohibited migration, the candidate state with the largest cumulative score is selected and written to the current state node, and the highest-scoring protection state path is restored through the backtracking node to generate the protection state path table.

6. The method for mine-connected power line protection based on protocol parsing according to claim 5, characterized in that, The Viterbi algorithm first reads the session number, event number, event item, observation score, state transition score, and prohibited transition item from the state candidate scoring table. It then establishes a time column by event number and a state row by authentication passed state, remote control allowed state, remote control preset state, remote control executed state, action confirmed state, protection locked state, alarm not reset state, setpoint area switching state, setpoint modification pending confirmation state, and reset completed state. At the first event number, it writes the event item and the observation score matching the state row. At each subsequent event number, it reads the accumulated score of the preceding state item. The previous state and the current state form a migration pair. When the migration pair hits a prohibited migration item, a prohibition flag is written. When the migration pair does not hit a prohibited migration item, the state migration score is read. The cumulative score of the previous state, the state migration score, and the current event observation score are added together to obtain the candidate path score. The candidate path score with the larger value under the same current state is selected and written into the current state cumulative score. The corresponding previous state is written into the backtracking node. After completing all event numbers column by column, the backtracking nodes are read backward starting from the state with the larger cumulative score in the last column. The state node sequence is restored in reverse according to the event number to generate the protection state path table.

7. The method for mine-connected power line protection based on protocol parsing according to claim 1, characterized in that, The specific steps for generating the abnormal instruction chain certificate are as follows: Based on the protection state path table, the AC automaton algorithm is used to extract the function code, control object, action type, confirmation result, interlocking flag, and state chain break flag corresponding to each session path node. Adjacent path nodes are concatenated into continuous instruction items according to the event sequence number. The line number and device address are written into the index bit to obtain the instruction symbol bit sequence table. Based on the instruction symbol bit sequence table, two instruction items with adjacent event numbers within the same session are defined as adjacent instruction items, and non-adjacent instruction items within the same session that can still form abnormal combinations after crossing one or more intermediate events are defined as interval instruction items. Adjacent instruction items and interval instruction items are combined into a sequence of instruction items to be matched according to event numbers, and the combinations of missing preset execution, interlocking closing, repeated tripping, cross-zone setting value modification, alarm reclosing, remote execution in local state, and tripping value carried by non-exit object are compared. The start point and end point of the hit are recorded to obtain the abnormal combination hit table. Based on the abnormal combination hit table, the hit combination number, hit start point, hit end point, risk category, line number, device address, controlled object, action type, and lockout flag are written into the voucher item. The exit action risk is placed before the set value modification risk and the lockout detour risk is placed before the repeated control risk, thereby generating an abnormal instruction chain voucher. The unique priority settings, from highest to lowest, are as follows: exit action risk, blockage detour risk, cross-regional setting change risk, alarm reclosing risk, duplicate control risk, and status query risk.

8. The method for mine-connected power line protection based on protocol parsing according to claim 7, characterized in that, Using the AC automaton algorithm, the session number, event number, function code, controlled object, action type, confirmation result, interlock flag, state chain break flag, line number, and device address are read from the instruction symbol bit sequence table. Combinations such as missing preset execution, interlocked closing, repeated tripping, cross-zone setting modification, alarm reclosing, local status remote execution, and non-exit object carrying trip value are written into the dictionary tree nodes in instruction symbol order. The function code category, controlled object category, action type category, confirmation result category, and interlock flag category are written into the node label. The combination number and risk category are written into the termination node. The parent node, child node, and same-level node are read according to the node hierarchy queue. Failure to establish the node is investigated. The pointer, with the failure pointer pointing to a deeper node in the common suffix hierarchy, reads consecutive instruction items sequentially according to the session event sequence number. It compares the consecutive instruction items with the outgoing edge label of the current node. If the labels match, it enters the child node; if the labels do not match, it backtracks along the failure pointer to the matching node. When a termination node is hit, it records the hit combination number, hit start point, hit end point, risk category, line number, device address, controlled object, action type, and lockout flag. When multiple combinations are hit with the same event sequence number, it compares the order of exit action risk, setpoint modification risk, status query risk, lockout detour risk, and duplicate control risk. It selects the risk category with the highest order and writes it into the voucher item, generating an abnormal instruction chain voucher.

9. The method for mine-connected power line protection based on protocol parsing according to claim 1, characterized in that, The specific steps for generating the control message processing certificate are as follows: Based on the abnormal instruction chain certificate, the protection status path table is invoked to extract the inferred status, breakage flag, hit number, line number, and control object. The abnormal chain hit items are aligned with the session status nodes to generate a handling condition index. Based on the aforementioned handling condition index, tripping, closing, reclosing, setting zone switching, and lockout release are compared with the status permission table, and the message destination, line number, controlled object, and hit number are written into the voucher item to generate a control message handling voucher.

10. The method for mine-connected power line protection based on protocol parsing according to claim 9, characterized in that, To align the anomaly chain hit items with the session status nodes, first read the session number, line number, device address, controlled object, hit start point, hit end point, hit number, and risk category from the anomaly instruction chain certificate. Then, read the session number, line number, device address, controlled object, event sequence number, inferred status, break flag, and path node number from the protection status path table. Use the same session number, line number, device address, and controlled object as the attribution condition. Use the event sequence number being greater than or equal to the hit start point and less than or equal to the hit end point as the interval condition. Write the path node number, inferred status, break flag, and hit number that simultaneously meet the attribution condition and interval condition into the same handling condition index row.

Images