A power distribution network defense agent design method and device

Abstract

The application discloses a power distribution network defense intelligent agent design method and device, and relates to the field of novel power system network security and large model intelligent defense. The design method comprises the following steps: a preprocessing module receives and analyzes original parameters of a Volt / VAR control curve issued by SCADA to form a structured control parameter list; an intelligent agent decision module generates a safety analysis task planning result and a tool calling plan in combination with memory information, and after being audited by a human expert, calls a control curve instruction detection tool and a power distribution network steady-state analysis tool to obtain a detection label, a power flow calculation result and power grid topology information. In a non-attack situation, the parameters are restored and issued to an intelligent inverter; in an attack situation, the issuance is prevented and a defense report is generated by fusing analysis results. After the task is completed, an execution abstract is written into a memory module. The application can improve the automation degree of power distribution network security analysis, the controllability of tool calling and the explainability of tool output results.

Description

Technical Field

[0001] This invention relates to the field of new power system network security and large-scale intelligent defense, and in particular to an AI defense agent design method and device for Volt / VAR control curve attacks on distribution networks. Specifically, it involves technologies such as distribution network security analysis, intelligent inverter control security, tool-enhanced agents, and human-in-the-loop. Background Technology

[0002] With the expansion of distributed energy grid connection and the increasing digitalization of power systems, the number of information systems, communication links, and control terminals in distribution networks is growing, leading to a continuous expansion of the network attack surface. In distributed photovoltaic (PV) integration scenarios, smart inverters typically participate in reactive power and voltage regulation through Volt / VAR control curves. If attackers covertly tamper with the control curve regulation commands through fusion terminals or control links, they may alter the reactive power response boundary, preventing timely suppression of local undervoltage or overvoltage, thus adversely affecting the operational safety of the distribution network. These risks have become a significant issue in the cybersecurity of new power systems.

[0003] Current defense strategies still heavily rely on the human experience of experts with dual backgrounds in power systems and cybersecurity. For tasks such as steady-state analysis, control command detection, tool result interpretation, and handling assistance required to counter these attacks, operators often need to switch between multiple tools, resulting in long analysis chains, insufficient automation, and weak interpretability of tool outputs. Furthermore, distribution network cybersecurity analysis is a risk-sensitive task; without a controllable execution mechanism, improper external operations can easily occur during tool invocation.

[0004] Therefore, there is an urgent need for an AI defense agent design method and device that can be used to address Volt / VAR control curve attack scenarios in power distribution networks. This method integrates control parameter environmental awareness, historical information reuse, tool collaborative invocation, manual review, and result interpretation into a unified link, thereby improving the automation level of security analysis, the controllability of tool execution, and the interpretability of tool output results. Summary of the Invention

[0005] The purpose of this invention is to address the problems of insufficient automation, high labor costs, and weak interpretability of tool output results in the existing Volt / VAR control curve command security analysis of distribution networks. To achieve the above objective, this invention provides the following technical solution: a method and apparatus for designing a distribution network defense intelligent agent. The method and apparatus are as follows:

[0006] 1. Obtain the original parameters of the Volt / VAR control curves issued by the distribution network dispatching system or SCADA system, and parse the parameters through the preprocessing module to form a structured control parameter list.

[0007] S1.1 Obtain the original parameters of the Volt / VAR control curve sent to the smart inverter by the distribution network dispatching system or SCADA system. The original parameters include the voltage information and reactive power information corresponding to the control curve.

[0008] S1.2 The preprocessing module parses the original parameters, extracts the voltage parameters and reactive power parameters corresponding to each control point, establishes the correspondence between the voltage parameters and reactive power parameters, and generates a structured control parameter list containing information on multiple voltage-reactive power control points based on the correspondence, which is used to characterize the current Volt / VAR control curve.

[0009] 2. Based on the structured control parameter list, the agent decision-making module combines the memory information to perform task analysis and reasoning, and generates the corresponding security analysis task planning results.

[0010] The S2.1 intelligent agent decision-making module receives the structured control parameter list, determines the Volt / VAR control curve to be analyzed and its control parameter information, and forms the current task context;

[0011] S2.2 Using the current task context as the search criteria, retrieve historical task planning results, tool call records, and expert feedback information related to the Volt / VAR control curve to be analyzed from the memory module;

[0012] S2.3 The retrieved historical task planning results, tool call records, and expert feedback information are backfilled into the current task context to form a task reasoning context for the intelligent agent decision-making module to perform task analysis and reasoning;

[0013] S2.4 The agent decision-making module performs task analysis and reasoning based on the task reasoning context to determine the security analysis objectives and the analysis tasks to be performed, and generates security analysis task planning results.

[0014] 3. Based on the security analysis task planning results, the intelligent agent decision module generates a tool invocation plan and determines the tools to be invoked and their corresponding execution parameters.

[0015] S3.1 Based on the security analysis task planning results, determine the analysis tasks to be executed and the dependencies between each analysis task to be executed;

[0016] S3.2 Based on the functional descriptions of each security analysis tool in the analysis task to be executed and the tool execution module, determine the tool to be invoked corresponding to each analysis task to be executed;

[0017] S3.3 Determine the calling order of each tool to be called according to the aforementioned dependency relationship, and determine the corresponding execution parameters according to the current task context and the input fields of each tool to be called;

[0018] S3.4 Associate the tools to be called, the calling order, and the corresponding execution parameters to form a tool calling plan.

[0019] 4. The tool invocation plan is reviewed through a human-in-the-loop mechanism, and the execution status and whether the tool invocation is executed are determined based on the expert review results.

[0020] The S4.1 expert review module receives the tool invocation plan, prevents the corresponding tool from starting execution, and displays the tools to be invoked, the invocation order, and the corresponding execution parameters to human experts.

[0021] S4.2 Receive the expert review results of human experts on the tool invocation plan, the expert review results including approval, rejection, or approval after modification of execution parameters;

[0022] S4.3 When the expert review result is that the modified execution parameters are approved, the corresponding execution parameters in the tool call plan are updated according to the parameter modification information submitted by the human expert;

[0023] S4.4 If the expert review result is not received, the tool call plan will be set to terminated, and the control curve parameters that have not been reviewed will be automatically restored and sent out.

[0024] S4.5 Based on the expert review results, tool call plans that have passed the review or have passed after modifying the execution parameters are set to the pending execution status, and tool call plans that have been rejected by the review are set to the terminated status.

[0025] 5. According to the approved tool call plan, the tool execution module calls the security analysis tool to detect and analyze the control parameters and obtain the tool execution results.

[0026] S5.1 The tool execution module reads the approved tool invocation plan, invokes the corresponding security analysis tools according to the invocation order, and passes the corresponding execution parameters to each security analysis tool.

[0027] S5.2 When the security analysis tool includes the Volt / VAR control curve instruction detection tool, the structured control parameter list is used as input to call the externally encapsulated attack detection interface to obtain the detection label and the corresponding confidence information.

[0028] S5.3 When the security analysis tool includes a distribution network steady-state analysis tool, at least one of the distribution network operating status information and topology information is obtained;

[0029] S5.4 Summarize the outputs of each security analysis tool according to the calling order to form the tool execution results corresponding to the current security analysis task.

[0030] 6. Determine the safety status of the control curve parameters based on the execution results of the tool, generate a defense report in the event of an attack, restore the parameters and send them to the smart inverter in the event of no attack, and write a summary of this round of tasks into the memory module.

[0031] S6.1 Based on the detection labels in the execution results of the tool, determine the security status of the Volt / VAR control curve parameters to be analyzed as either an attack state or a non-attack state.

[0032] S6.2 When the security state is an attack state, prevent the control curve parameters from being sent, and fuse the detection results with the obtained distribution network operation status information and / or topology information to generate a defense report and send it to human experts;

[0033] S6.3 When the security state is a non-attack state, the structured control parameter list is restored according to the data organization form of the original parameters and sent to the corresponding smart inverter;

[0034] S6.4 The summary of the current task execution process is backfilled into the memory module for storage.

[0035] 7. A power distribution network defense intelligent agent device, characterized in that it includes a preprocessing module, an intelligent agent decision-making module, a memory module, an expert review module, and a tool execution module, wherein each module is configured to execute the method described in claims 1-6.

[0036] The present invention has the following advantages in the above technical solution:

[0037] 1. Integrate distribution network steady-state analysis, control command attack detection, manual confirmation, and tool result interpretation into a unified closed loop to reduce the complexity of switching between multiple tools and enhance the degree of defense automation;

[0038] 2. The memory backfilling mechanism enhances contextual consistency and information reuse capabilities in continuous security analysis scenarios, alleviating the computational overhead caused by repetitive reasoning in large language models;

[0039] 3. Improve the controllability and security of tool usage through human-in-the-loop verification mechanisms;

[0040] 4. Generate defense reports and defense response recommendations for human experts, enhancing the understandability and engineering applicability of the tool's analysis results. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0042] Figure 1 This is a flowchart of the method of the present invention;

[0043] Figure 2 This is a diagram illustrating the device structure and data flow of the present invention.

[0044] Figure 3 This is an example diagram illustrating the tool invocation sequence of the present invention;

[0045] Figure 4 This is an example diagram illustrating the execution of the expert review rejection tool of the present invention;

[0046] Figure 5 is an example diagram of the security analysis tool of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] This embodiment provides a method and apparatus for designing a power distribution network defense intelligent agent, such as... Figure 1 and Figure 2As shown. The device includes: a preprocessing module, an agent decision-making module, a memory module, an expert review module, and a tool execution module. The design method includes: a preprocessing module receiving the original parameters of the Volt / VAR control curve to be sent to the smart inverter from the distribution network dispatching system or SCADA system, and extracting the voltage and reactive power parameters of each control point in the control curve to form a structured control parameter list; an intelligent agent decision-making module combining the structured control parameter list and memory information to perform task analysis and reasoning, generating a security analysis task planning result and a tool call plan; a memory module storing historical task execution summaries, including but not limited to: task planning results, tool call records, and expert feedback information; an expert review module interrupting the tool call plan before tool execution and submitting it to human experts for review (if no expert review result is received within the set review waiting period, it is handled according to the preset unreviewed handling process); a tool execution module calling the Volt / VAR control curve instruction detection tool and the distribution network steady-state analysis tool according to the review result, summarizing the output results of each tool to form a defense report in the event of an attack, restoring the instruction and sending it to the smart inverter in the event of a non-attack, and finally storing the execution process summary in the memory module. SCADA, the smart inverter, and the human-machine interface serve as external interaction objects of the device.

[0049] In a specific embodiment, the defensive intelligent agent device is deployed on a server or computing device with a processor and memory. Python is used as the development language, and LangChain and LangGraph are used to implement large language model invocation, tool registration, workflow orchestration, state maintenance, and interrupt recovery. OpenDSS is used as the distribution network simulation software to read the distribution network feeder model and perform power flow calculations, node voltage analysis, and topology extraction. The operating status of the defensive intelligent agent device is displayed through a local interactive interface. The implementation environment described is merely an exemplary embodiment and does not constitute a limitation on the operating platform, programming language, intelligent agent framework, or simulation software of this invention.

[0050] The method described in this embodiment includes the following steps:

[0051] S1: Obtain the original parameters of the Volt / VAR control curve issued by the distribution network dispatching system or SCADA system, and parse the parameters through the preprocessing module to form a structured control parameter list;

[0052] S2: Based on the structured control parameter list, the intelligent agent decision-making module combines memory information to perform task analysis and reasoning, and generates corresponding security analysis task planning results;

[0053] S3: Based on the security analysis task planning results, the intelligent agent decision module generates a tool invocation plan and determines the tools to be invoked and their corresponding execution parameters;

[0054] S4: The tool invocation plan is reviewed through a human-in-the-loop mechanism, and the tool invocation is determined based on the expert review results, including whether the tool invocation is executed and the corresponding execution status.

[0055] S5: According to the approved tool call plan, the tool execution module calls the security analysis tool to detect and analyze the control parameters and obtain the tool execution results;

[0056] S6: Determine the safety status of the control curve parameters based on the execution results of the tool, generate a defense report in the event of an attack, restore the parameters and send them to the smart inverter in the event of no attack, and write a summary of the task in this round into the memory module.

[0057] In a specific embodiment, step S1 specifically includes the following steps:

[0058] The S1.1 preprocessing module receives the raw parameters of the Volt / VAR control curve to be sent to the target smart inverter from the distribution network dispatching system or SCADA system. These raw parameters include the voltage and reactive power information corresponding to the control curve, and carry or associate with the device identifier of the target smart inverter.

[0059] S1.2 Based on the correspondence between the voltage information and reactive power information, a structured control parameter list containing multiple voltage-reactive power control point information is generated. The structured control parameter list can be represented as: .in, Indicates the first Voltage parameters corresponding to each control point Indicates the first Reactive power parameters corresponding to each control point This indicates the number of control points in the Volt / VAR control curve.

[0060] The preprocessing module also saves the data organization format of the original parameters, the arrangement relationship of control points, and the device identifier of the target smart inverter, which are used to restore the structured control parameter list and distribute parameters in subsequent non-attack states.

[0061] In a specific embodiment, step S2 specifically includes the following steps:

[0062] The S2.1 memory module maintains a task identifier, target device identifier, and memory profile for each round of security analysis tasks. The task identifier is used to distinguish different security analysis tasks, the target device identifier is used to associate with the corresponding smart inverter, and the memory profile is used to store stability information related to the target device and historical security analyses.

[0063] The intelligent agent decision-making module receives the structured control parameter list, determines the Volt / VAR control curve to be analyzed and its control parameter information, and forms the current task context;

[0064] S2.2 The memory module retrieves historical task planning results, tool call records, and expert feedback information related to the current task context. The historical task planning results characterize historical security analysis tasks and their planning methods; the tool call records characterize the tools used in historical tasks, their order of use, and execution results; and the expert feedback information characterizes parameter modification information or handling opinions generated during historical review processes.

[0065] The S2.3 agent decision-making module fills the retrieved historical task planning results, tool call records, and expert feedback information back into the current task context, forming a task inference context. When the memory module does not contain historical information related to the current Volt / VAR control curve, the agent decision-making module forms an initial task inference context using the structured control parameter list.

[0066] Based on the task reasoning context, the S2.4 intelligent agent decision-making module performs task analysis and reasoning on the Volt / VAR control curve to be analyzed, determines the security analysis objective and the analysis tasks to be executed, and generates security analysis task planning results. The analysis tasks to be executed include at least one of the following: control curve attack detection task, power flow calculation task, and topology information extraction task.

[0067] In a specific embodiment, step S3 specifically includes the following steps:

[0068] S3.1 Based on the security analysis task planning results, determine the analysis tasks to be executed and the dependencies between each analysis task to be executed;

[0069] The S3.2 tool execution module is pre-configured with multiple security analysis tools, along with their function descriptions, input fields, and output fields. These security analysis tools include a Volt / VAR control curve command detection tool and a distribution network steady-state analysis tool. The distribution network steady-state analysis tool is used to perform at least one of power flow calculations and topology information extraction.

[0070] The S3.3 intelligent agent decision-making module determines the tools to be invoked for each analysis task based on the task's requirements and the functional descriptions of each security analysis tool. It then determines the invocation order of these tools based on the dependencies between the analysis tasks. Figure 3 This is an example diagram illustrating how an agent first invokes topology analysis and then power flow calculation. The corresponding execution parameters are determined based on the current task context and the input fields of each tool to be invoked.

[0071] The S3.4 intelligent agent decision-making module associates the tools to be invoked, the invocation order, and the corresponding execution parameters to form a tool invocation plan. The tool invocation plan includes at least the tool identifier, the invocation order, and the execution parameters.

[0072] In a specific embodiment, step S4 specifically includes the following steps:

[0073] The S4.1 human-in-the-loop mechanism will prevent tools from being executed before human experts review them and will show human experts the tools to be invoked, the invocation order, and the corresponding execution parameters.

[0074] S4.2 Human experts provide expert review results for the tool invocation plan, including approval, rejection, or approval after modification of execution parameters;

[0075] S4.3 When the expert review result is that the modified execution parameters are approved, the corresponding execution parameters in the tool invocation plan are updated according to the parameter modification information submitted by the human expert, and the updated tool invocation plan is set to the pending execution state;

[0076] S4.4 When no expert review result is received within the set review waiting period, the expert review module prevents the execution of the corresponding security analysis tool and sets the tool invocation plan to a terminated state. The intelligent agent restores the structured control parameter list according to the data organization form of the original parameters and sends it to the corresponding intelligent inverter along the original control parameter distribution path;

[0077] When the expert review result in S4.5 is "approved," the expert review module sets the original tool invocation plan to a "pending execution" state; when the expert review result is "rejected," the tool invocation plan is set to a "terminated" state, and the corresponding tool is prevented from executing. An example of rejection is shown in the diagram below. Figure 4 As shown.

[0078] In a specific embodiment, step S5 specifically includes the following steps:

[0079] S5.1 The tool execution module reads the approved tool invocation plan, invokes the corresponding security analysis tools according to the invocation order, and passes the corresponding execution parameters to each security analysis tool.

[0080] S5.2 When the security analysis tool includes a Volt / VAR control curve instruction detection tool, the structured control parameter list is used as input to call its externally encapsulated attack detection interface to obtain detection tags and corresponding confidence information. Figure 5(c) is an example diagram, where the detection tags are used to characterize whether the Volt / VAR control curve parameters to be analyzed belong to a non-attack state or an attack state.

[0081] The Volt / VAR control curve command detection tool, as a specialized tool unit within the tool execution module, is used to encapsulate external or pre-defined control curve attack detection interfaces. This invention does not consider the classification model, model training method, or detection algorithm used within the attack detection interface itself as a necessary technical feature; instead, it encapsulates the attack detection capability into a security analysis tool that can be planned by the agent decision module and invoked by the tool execution module.

[0082] S5.3 When the security analysis tool includes a distribution network steady-state analysis tool, the distribution network steady-state analysis tool obtains at least one of distribution network operating status information and topology information.

[0083] During power flow calculation, the distribution network steady-state analysis tool calls the distribution network simulation software interface to solve the operating state of the target feeder model, obtaining the power flow calculation convergence state, node voltage information, and node operating state information. Figure 5(a) is an example diagram. The distribution network operating state information includes at least one of the following: minimum node voltage, maximum node voltage, average node voltage, number of undervoltage nodes, and number of overvoltage nodes.

[0084] When performing topology information extraction, the distribution network steady-state analysis tool analyzes the equipment connection relationship in the target feeder model to obtain the bus connection relationship, branch connection relationship, and connection relationship of smart inverter, photovoltaic access equipment and load equipment, forming topology information. Figure 5(b) is an example diagram of topology information, which includes information such as topology structure and physical access.

[0085] S5.4 Summarize the outputs of each security analysis tool according to the calling order to form the tool execution results corresponding to the current security analysis task.

[0086] In a specific embodiment, step S6 specifically includes the following steps:

[0087] The S6.1 intelligent agent decision module determines the security status of the Volt / VAR control curve parameters to be analyzed as either a non-attack state or an attack state based on the detection tags in the tool execution results.

[0088] S6.2 When the security state is an attack state, prevent the control curve parameters to be analyzed from being sent to the smart inverter, and fuse the detection tag and confidence level with the obtained distribution network operation status information and / or topology information to generate a defense report and send it to human experts;

[0089] The defense report includes at least the safety status of the Volt / VAR control curve to be analyzed, the detection confidence level, the analysis results of the distribution network operation status, and defense handling recommendations. When the tool execution result includes topology information, the defense report also includes the equipment associated with the abnormal control curve and its location information in the distribution network topology;

[0090] S6.3 When the security state is a non-attack state, the intelligent agent restores the structured control parameter list according to the data organization form of the original parameters, restores the arrangement relationship of control points and the corresponding field structure, generates the Volt / VAR control curve parameters to be sent, and then sends them to the corresponding intelligent inverter.

[0091] After the task in S6.4 is completed, the agent decision-making module will generate a summary of the task execution process and store it in the memory module. The summary includes the identification information of the structured control parameter list for this round, the security analysis task planning results, tool call records, expert review results, tool execution results, and the final disposal results, which will be used for memory retrieval and task reasoning for subsequent security analysis tasks.

[0092] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0093] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. Obtain the original parameters of the Volt / VAR control curves issued by the distribution network dispatching system or SCADA system, and parse the parameters through the preprocessing module to form a structured control parameter list. S1.1 Obtain the original parameters of the Volt / VAR control curve sent to the smart inverter by the distribution network dispatching system or SCADA system. The original parameters include the voltage information and reactive power information corresponding to the control curve. S1.2 The preprocessing module parses the original parameters, extracts the voltage parameters and reactive power parameters corresponding to each control point, establishes the correspondence between the voltage parameters and reactive power parameters, and generates a structured control parameter list containing information on multiple voltage-reactive power control points based on the correspondence, which is used to characterize the current Volt / VAR control curve.

2. Based on the structured control parameter list, the agent decision-making module combines the memory information to perform task analysis and reasoning, and generates the corresponding security analysis task planning results. The S2.1 intelligent agent decision-making module receives the structured control parameter list, determines the Volt / VAR control curve to be analyzed and its control parameter information, and forms the current task context; S2.2 Using the current task context as the search criteria, retrieve historical task planning results, tool call records, and expert feedback information related to the Volt / VAR control curve to be analyzed from the memory module; S2.3 The retrieved historical task planning results, tool call records, and expert feedback information are backfilled into the current task context to form a task reasoning context for the intelligent agent decision-making module to perform task analysis and reasoning; S2.4 The agent decision-making module performs task analysis and reasoning based on the task reasoning context to determine the security analysis objectives and the analysis tasks to be performed, and generates security analysis task planning results.

3. Based on the security analysis task planning results, the intelligent agent decision module generates a tool invocation plan and determines the tools to be invoked and their corresponding execution parameters. S3.1 Based on the security analysis task planning results, determine the analysis tasks to be executed and the dependencies between each analysis task to be executed; S3.2 Based on the functional descriptions of each security analysis tool in the analysis task to be executed and the tool execution module, determine the tool to be invoked corresponding to each analysis task to be executed; S3.3 Determine the calling order of each tool to be called according to the aforementioned dependency relationship, and determine the corresponding execution parameters according to the current task context and the input fields of each tool to be called; S3.4 Associate the tools to be called, the calling order, and the corresponding execution parameters to form a tool calling plan.

4. The tool invocation plan is reviewed through a human-in-the-loop mechanism, and the execution status and whether the tool invocation is executed are determined based on the expert review results. The S4.1 expert review module receives the tool invocation plan, prevents the corresponding tool from starting execution, and displays the tools to be invoked, the invocation order, and the corresponding execution parameters to human experts. S4.2 Receive the expert review results of human experts on the tool invocation plan, the expert review results including approval, rejection, or approval after modification of execution parameters; S4.3 When the expert review result is that the modified execution parameters are approved, the corresponding execution parameters in the tool call plan are updated according to the parameter modification information submitted by the human expert; S4.4 If the expert review result is not received, the tool call plan will be set to terminated, and the control curve parameters that have not been reviewed will be automatically restored and sent out. S4.5 Based on the expert review results, tool call plans that have passed the review or have passed after modifying the execution parameters are set to the pending execution status, and tool call plans that have been rejected by the review are set to the terminated status.

5. According to the approved tool call plan, the tool execution module calls the security analysis tool to detect and analyze the control parameters and obtain the tool execution results. S5.1 The tool execution module reads the approved tool invocation plan, invokes the corresponding security analysis tools according to the invocation order, and passes the corresponding execution parameters to each security analysis tool. S5.2 When the security analysis tool includes the Volt / VAR control curve instruction detection tool, the structured control parameter list is used as input to call the externally encapsulated attack detection interface to obtain the detection label and the corresponding confidence information. S5.3 When the security analysis tool includes a distribution network steady-state analysis tool, at least one of the distribution network operating status information and topology information is obtained; S5.4 Summarize the outputs of each security analysis tool according to the calling order to form the tool execution results corresponding to the current security analysis task.

6. Determine the safety status of the control curve parameters based on the execution results of the tool, generate a defense report in the event of an attack, restore the parameters and send them to the smart inverter in the event of no attack, and write a summary of this round of tasks into the memory module. S6.1 Based on the detection labels in the execution results of the tool, determine the security status of the Volt / VAR control curve parameters to be analyzed as either an attack state or a non-attack state. S6.2 When the security state is an attack state, prevent the control curve parameters from being sent, and fuse the detection results with the obtained distribution network operation status information and / or topology information to generate a defense report and send it to human experts; S6.3 When the security state is a non-attack state, the structured control parameter list is restored according to the data organization form of the original parameters and sent to the corresponding smart inverter; S6.4 The summary of the current task execution process is backfilled into the memory module for storage.

7. A power distribution network defense intelligent agent device, characterized in that, It includes a preprocessing module, an agent decision-making module, a memory module, an expert review module, and a tool execution module, each of which is configured to execute the method described in claims 1-6.

Images