Security posture perception and disturbance monitoring method and system for user-side multi-agent

Abstract

The application provides a user-side multi-agent security situation awareness and disturbance monitoring method and system, and relates to the technical field of power system security monitoring and smart grid. The method comprises the following steps: acquiring multi-source heterogeneous data of user-side multi-agents, fusing the multi-source heterogeneous data to obtain a comprehensive feature vector; performing multi-attribute verification on the device attribute information of each agent to obtain a static abnormality coefficient; determining a dynamic abnormality coefficient based on the error between the dynamic characteristics of each agent in the current evaluation period and the corresponding predicted value; performing correlation analysis between user behavior characteristics and device operation characteristics in the current evaluation period; and determining an abnormal event in the current evaluation period based on the static abnormality coefficient, the dynamic abnormality coefficient and the correlation analysis result. The application solves the problem of high false alarm and missed detection risk in new power system security monitoring.

Description

Technical Field

[0001] This invention relates to the field of power system security monitoring and smart grid technology, specifically to a method and system for security situation perception and disturbance monitoring of multiple stakeholders on the user side. Background Technology

[0002] With the accelerated construction of new power systems, user-side power sources and load equipment such as distributed photovoltaics, energy storage systems, and electric vehicle charging piles are being connected on a large scale. User-side multiple entities are various terminal devices and entities that exchange data, process business, and make decisions with the power grid in the new power system. Although the connection of these multiple entities improves the capacity of the distribution network and the reliability of power supply, the random fluctuations in their output or load, without obvious patterns, also bring new challenges to system safety monitoring.

[0003] Currently, safety monitoring for such entities generally adopts a domain-based monitoring model. The power supply-side system focuses on the operating parameters of power generation equipment, while the user-side system focuses on electricity load data. Moreover, anomaly detection often relies on fixed thresholds, triggering alarms when monitored quantities such as voltage, current, or power exceed the limits. This model struggles to identify complex anomalies involving multiple entities, and the fixed thresholds cannot adapt to the dynamic changes of fluctuating power sources and diverse loads, resulting in a high risk of false alarms and missed detections. Summary of the Invention

[0004] To overcome the high risk of false alarms and missed detections in the security monitoring of the aforementioned new power systems, this invention provides a method and system for security situation awareness and disturbance monitoring by multiple stakeholders on the user side.

[0005] On one hand, this invention provides a security situation awareness method for multiple stakeholders on the user side, applied to edge computing nodes deployed in user areas or on the load aggregator side, including: Acquire multi-source heterogeneous data from multiple user entities, and perform fusion processing on the multi-source heterogeneous data to obtain a comprehensive feature vector; the multi-source heterogeneous data includes equipment operation data, user behavior data, and meteorological data; The equipment attribute information of each subject is verified by multiple attributes to obtain the static anomaly coefficient; the equipment operation characteristics and user behavior characteristics in the comprehensive feature vector are extracted as the dynamic characteristics of each subject, and the dynamic anomaly coefficient is determined based on the error between the dynamic characteristics of each subject and the corresponding predicted value in the current evaluation period. Correlation analysis was conducted on user behavior characteristics and device operation characteristics during the current evaluation period, focusing on the relationships between users and devices, as well as among various stakeholders. Based on the static anomaly coefficient, dynamic anomaly coefficient, and correlation analysis results, the abnormal events in the current evaluation period are determined. The predicted values ​​are determined based on the historical operational data of each entity or the historical behavior data of users, as well as the meteorological data for the prediction period.

[0006] Optionally, the multiple entities include various distributed energy sources, energy storage, charging piles, load aggregators, and smart meters.

[0007] Optionally, the device attribute information includes at least one of the following: device identifier, firmware version, communication protocol type, device operating parameters, and security certificate serial number; The multi-attribute verification includes at least one of the following: identifier verification, communication specification verification, parameter verification, and security requirement verification.

[0008] Optionally, dynamic anomaly coefficients are determined based on the error between the dynamic characteristics of each subject and the corresponding predicted values ​​within the current assessment period, including: For each moment in the current evaluation period, the Euclidean distance between each dynamic feature and the corresponding predicted value at that moment is calculated as the prediction error. Based on the prediction error and the historical error statistics of the corresponding dynamic feature, the error level of the dynamic feature at that moment is determined. Based on the statistical analysis of the error levels of each dynamic characteristic at that moment, the dynamic anomaly coefficient at that moment is determined. The predicted value of each dynamic feature at each time point is obtained by inputting the dynamic features of historical periods and the meteorological data of that time point into a long short-term memory autoencoder.

[0009] Optionally, the correlation analysis results include the coupling degree between the various entities; the correlation analysis between the user behavior characteristics and device operation characteristics within the current evaluation period includes: The multiple entities are divided into at least one group according to their physical characteristics. Each group includes a source entity and a response entity. The output of the source entity is dominated by external primary factors, and the output of the response entity is dominated by internal control strategies or external demands. The coupling degree is the unidirectional coupling degree between the source entity and the response entity. For any group of subjects, the Jacobian matrix of the current dynamic features of the responding subject versus the previous dynamic features of the source subject is estimated using multiple linear regression within a sliding window. The average value of the Frobenius norm of the Jacobian matrix obtained from each window is used as the unidirectional coupling degree of the main body.

[0010] Optionally, before calculating the unidirectional coupling degree, the method further includes: For each subject group, using the meteorological data as a conditional variable, we examine whether the current dynamic characteristics of the response subject and the previous dynamic characteristics of the source subject satisfy the conditional independence under the given meteorological data. If the condition of independence is met, the unidirectional coupling degree of the main body group is determined to be zero.

[0011] Optionally, the correlation analysis results include the correlation between each pair of user behavior characteristics and device operation characteristics; based on the static anomaly coefficient and dynamic anomaly coefficient and the correlation analysis results, the abnormal events in the current evaluation period are determined, including: The static anomaly coefficient and the dynamic anomaly coefficient are weighted and fused to obtain a comprehensive anomaly score; When the comprehensive anomaly score is greater than or equal to the first threshold, there is at least one pair of user behavior features and device operation features with a correlation greater than or equal to the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined to be a device-user composite anomaly event. When the comprehensive anomaly score is greater than or equal to the first threshold, and there is at least one group of subjects whose unidirectional coupling degree is greater than or equal to the third threshold, the current evaluation period is determined to be a multi-subject cascaded anomaly event. When the comprehensive anomaly score is greater than or equal to the first threshold, the correlation between each pair of user behavior features and device operation features is less than the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined to be a single subject anomaly event. Optionally, the third threshold is determined based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions.

[0012] Optionally, after identifying the abnormal events in the current evaluation period, the following steps are also included: Execute a local tiered security response for the aforementioned abnormal event.

[0013] Optionally, before performing a local tiered security response, the following may also be included: Receive global security policies issued by the cloud platform; Update the local security response policy based on the differences between the local security response policy and the global security policy; The global security policy is determined by the cloud platform based on the abnormal events and abnormal feature data reported by each edge computing node from each monitoring point.

[0014] On the other hand, the present invention also provides a disturbance monitoring method for multiple user-side entities, applied to a cloud platform deployed on the main station side, including: Receive disturbance events and their disturbance characteristic data, as well as abnormal events and their abnormal characteristic data, reported by multiple edge computing nodes; If, within a preset event receiving time window, disturbance events are received from multiple spatially adjacent edge computing nodes, and the arrival times of the disturbances recorded by each disturbance event are close to each other, it is determined that a cross-regional disturbance event has occurred, and based on the disturbance feature data received within the current time window, disturbance source localization and disturbance propagation path tracing are performed. Based on the disturbance feature data and anomaly feature data received within the current time window, the cross-regional disturbance event and each anomaly event are spatiotemporally correlated to determine the correlation between the cross-regional disturbance event and each anomaly event. Based on the disturbance source location results, disturbance propagation path tracing results, and the aforementioned correlation, differentiated global security policies are generated and distributed to each edge computing node.

[0015] Optionally, the disturbance characteristic data includes the arrival time of the disturbance at each monitoring point; the disturbance source location includes: The difference between the spatial distance from the disturbance source to each monitoring point and the disturbance propagation distance at each monitoring point is weighted and fused to construct an evaluation function; Based on the disturbance feature data within the current time window, with the location of the disturbance source as the optimization variable and minimizing the evaluation function as the objective, the matrix particle swarm optimization algorithm is used to optimize and solve the problem, and the optimal particle position is used as the disturbance source localization result. The disturbance propagation distance is determined based on the disturbance arrival time difference between each monitoring point and the reference node, as well as the disturbance propagation speed; the reference node is the monitoring point that detects the disturbance earliest.

[0016] Optionally, the disturbance propagation path tracing includes: Obtain the network topology of the distribution network area monitored by each edge computing node, take the bus or equipment access point in the distribution network area as the node, and the transmission line or transformer branch as the edge; take the power flow direction and disturbance propagation direction as the edge direction, and take the attenuation coefficient of the disturbance propagating from the source node to the target node as the edge weight, and construct a directed graph of the distribution network area. Based on the perturbation feature data of each node received within the current time window, a node feature matrix is ​​constructed. The directed graph and the node feature matrix are then input into a pre-trained graph convolutional network for layer-by-layer convolution and fully connected processing to obtain the perturbation propagation probability matrix. In the disturbance propagation probability matrix, starting from the node corresponding to the disturbance source location result, the next hop node is selected in sequence according to the highest probability to form a path sequence until the propagation probability is lower than the disturbance threshold or the terminal node is reached, thus obtaining the disturbance propagation path and the sequence of disturbed nodes. The attenuation coefficient is determined based on historical disturbance events in the distribution network.

[0017] Optionally, the abnormal feature data includes source nodes and dynamic anomaly coefficients, wherein the dynamic anomaly coefficients are used to characterize the deviation level between the actual dynamic characteristics of each subject and the predicted expected characteristics; spatiotemporal correlation is performed on the cross-regional disturbance events and each abnormal event to determine the correlation relationship between the cross-regional disturbance events and each abnormal event, including: For any abnormal event within the current time window, if the source node of the abnormal event is located in the sequence of disturbed nodes, then based on the time difference between the time of abnormal event perception and the time of arrival of the disturbance of the cross-regional disturbance event, it is determined whether the abnormal event is associated with the disturbance. If the source node of the abnormal event is not in the sequence of disturbed nodes, the abnormal event is marked as an independent abnormal event; The abnormality perception moment is the moment when the dynamic abnormality coefficient corresponding to the abnormal event first exceeds the preset error threshold.

[0018] Optionally, the abnormal feature data includes a comprehensive anomaly score; the disturbance propagation path tracking result includes a sequence of disturbed nodes and a disturbance propagation path; based on the disturbance source location result, the disturbance propagation path tracking result, and the correlation, a differentiated global security policy is generated and distributed to each edge computing node, including: For abnormal events associated with disturbances, generate a response degradation instruction as a global security policy for the corresponding edge computing node and issue it to indicate that the abnormal event is a disturbance-related response. When an independent abnormal event occurs and its overall abnormal score exceeds a preset high threshold, a command to maintain or upgrade the response level is generated and issued as a global security policy for the corresponding edge computing node. For edge computing nodes in the disturbed node sequence that have not reported abnormal events, an early warning notification is generated and sent as a global security policy for the corresponding edge computing node based on the disturbance propagation path, prompting it to check the device status. If the disturbance source location result points to an isolable device or branch, a selective isolation instruction is generated as the global security policy of the edge computing node corresponding to the node where the disturbance source is located and is then issued.

[0019] On the other hand, the present invention also provides an edge computing node, comprising: The data fusion module is used to acquire multi-source heterogeneous data from multiple users, perform fusion processing on the multi-source heterogeneous data, and obtain a comprehensive feature vector; the multi-source heterogeneous data includes equipment operation data, user behavior data, and meteorological data; The anomaly coefficient calculation module is used to perform multi-attribute verification on the equipment attribute information of each subject to obtain the static anomaly coefficient; extract the equipment operation characteristics and user behavior characteristics in the comprehensive feature vector as the dynamic characteristics of each subject, and determine the dynamic anomaly coefficient based on the error between the dynamic characteristics of each subject and the corresponding predicted value in the current evaluation period. The correlation analysis module is used to perform correlation analysis between users and settings, as well as between various entities, on user behavior characteristics and device operation characteristics within the current evaluation period. The anomaly analysis module is used to determine the abnormal events in the current evaluation period based on the static anomaly coefficient, the dynamic anomaly coefficient, and the correlation analysis results. The predicted values ​​are determined based on the historical operational data of each entity or the historical behavior data of users, as well as the meteorological data for the prediction period.

[0020] On the other hand, the present invention also provides a cloud platform, comprising: The receiving module is used to receive disturbance events and their disturbance characteristic data, as well as abnormal events and their abnormal characteristic data, reported by multiple edge computing nodes. The disturbance analysis module is used to determine that a cross-regional disturbance event has occurred if disturbance events reported from multiple spatially adjacent edge computing nodes are received within a preset event receiving time window, and the arrival times of the disturbances recorded by each disturbance event are close to each other. Based on the disturbance feature data received within the current time window, the module performs disturbance source localization and disturbance propagation path tracing. The spatiotemporal correlation module is used to perform spatiotemporal correlation on the cross-regional disturbance event and each abnormal event based on the disturbance feature data and abnormal feature data received within the current time window, and to determine the correlation relationship between the cross-regional disturbance event and each abnormal event. The policy generation module is used to generate and distribute differentiated global security policies to each edge computing node based on the disturbance source location results, disturbance propagation path tracking results, and the aforementioned correlation.

[0021] On the other hand, the present invention also provides a security situation awareness system for multiple entities on the user side, including: edge computing nodes as described in any of the preceding claims deployed on the user station area or load aggregator side and / or cloud platforms as described in any of the preceding claims deployed on the main station side.

[0022] On the other hand, the present invention also provides a readable storage medium having an executable program stored thereon, wherein when the executable program is executed, it implements the method described in any one of the above.

[0023] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a security situation awareness method for multiple user-side entities. It integrates three types of heterogeneous data—equipment operation, user behavior, and meteorological data—to form a comprehensive feature vector. Based on this, anomaly detection is decomposed into two complementary dimensions: a static anomaly coefficient, which detects configuration-level anomalies such as equipment attributes through multi-attribute verification; and a dynamic anomaly coefficient, which is determined by the error between the dynamic characteristics (equipment operation characteristics and user behavior characteristics) of each entity within the current assessment period and the corresponding predicted values, to adapt to the random fluctuations in the output or load of multiple user-side entities. Through the static and dynamic anomaly coefficients, it is possible to distinguish between normal weather-driven fluctuations and genuine anomalies of the equipment itself, thereby reducing false alarms caused by environmental factors.

[0024] This invention analyzes the correlation between users and devices, as well as between various entities, by analyzing user behavior characteristics and device operation characteristics within the current evaluation period. This allows the invention to capture abnormal device-user correlations caused by behaviors such as electricity theft, as well as the strength of mutual influence between various entities. It realizes the correlation between the user side, the power supply side, and various entities, thereby reducing the false alarm and false negative rates of cross-domain and multi-entity safety monitoring. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a user-side multi-subject security situation awareness method according to the present invention. Figure 2 This is a flowchart illustrating a disturbance monitoring method for multiple user-side entities according to the present invention. Figure 3 This is a schematic diagram of a user-side multi-subject security situation perception and disturbance monitoring system according to the present invention. Detailed Implementation

[0026] From end-point management in traditional power grids to peripheral governance in new power systems, the upgrade in user-side safety management reflects the underlying logic of energy transition. However, current user-side multi-stakeholder safety monitoring faces the following prominent technical bottlenecks: (i) Data silos lead to serious missed detections of cross-entity anomalies. Traditional monitoring systems generally adopt a domain-based monitoring model: the power supply side monitoring system focuses on the equipment's own operating parameters, while the user side monitoring system focuses on electricity load data. The two systems are independent in terms of data storage, processing tools, and alarm mechanisms, lacking cross-domain interface design. For example, a decrease in the efficiency of a photovoltaic inverter may be related to an abnormal surge in user load, but because the two systems do not interact, it is difficult to identify combined anomalies of equipment failure and abnormal user electricity consumption, leading to long-term missed detections of anomalies such as electricity theft and equipment malfunctions.

[0027] (ii) Difficulty in coordinating among multiple stakeholders and weak ability to grasp the overall security situation. The user-side entities are diverse—distributed photovoltaic systems are intermittent and fluctuating, electric vehicle charging loads are random and impulsive, energy storage systems have variable operating conditions, and load aggregators exhibit even more complex behavior patterns after aggregating a large number of dispersed users. Existing systems lack a unified monitoring framework to integrate multi-source heterogeneous data, making it difficult to effectively perceive the coupling relationships and interactive influences between these entities. Furthermore, traditional security mechanisms—one-time authentication, one-time authorization, and long-term effectiveness—do not adequately consider anomalies that may occur at terminals during long-term operation.

[0028] (iii) Passive threshold alarms are difficult to cope with dynamic disturbance scenarios. Existing technologies mostly rely on fixed thresholds to trigger alarms. By setting upper and lower limits for parameters such as voltage, current, and power, an alarm is triggered when real-time data exceeds these limits. This method has obvious limitations: on the one hand, the thresholds cannot dynamically adapt to the fluctuations of distributed power sources and the impact of weather; on the other hand, it lacks sensitivity to latent anomalies, such as gradual equipment degradation and irregular abnormal user behavior, often only able to respond after the fact, making it difficult to achieve early warning.

[0029] (iv) Single data source detection is significantly affected by environmental interference. Current mainstream anomaly detection methods are mostly based on analysis of a single data source, lacking cross-validation with multi-dimensional data. For example, if a photovoltaic power station experiences a temporary drop in power generation due to cloud cover, relying solely on power source data may misjudge it as equipment failure; similarly, if a user experiences a sudden increase in load due to the temporary use of high-power appliances, the user-side system may falsely report it as electricity theft.

[0030] (v) The disturbance source has low localization accuracy and the propagation path is difficult to trace. Existing disturbance localization methods are insufficient in identifying unknown disturbances, have low accuracy in locating disturbance sources and tracking propagation paths, and exhibit system response lag. In distribution networks containing distributed generation sources, the dynamic changes in power flow direction often prevent existing disturbance source localization algorithms from accurately locating the disturbance.

[0031] The purpose of this invention is to provide a user-side multi-entity security situation perception and disturbance monitoring method and system. By using multi-source data fusion, cloud-edge collaborative computing, adaptive anomaly detection and multi-level disturbance localization and other technical means, this invention solves the above-mentioned problems in the prior art and realizes comprehensive perception of the user-side multi-entity security situation, accurate disturbance localization and intelligent early warning.

[0032] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0033] Example 1 This invention provides a user-side multi-subject security situation awareness method, the schematic diagram of which is shown below. Figure 1 As shown, the method includes: Step S110: Obtain multi-source heterogeneous data from multiple subjects on the user side, and perform fusion processing on the multi-source heterogeneous data to obtain a comprehensive feature vector; the multi-source heterogeneous data includes equipment operation data, user behavior data, and meteorological data; Step S120: Perform multi-attribute verification on the obtained equipment attribute information of each subject to obtain static anomaly coefficients; extract the equipment operation features and user behavior features from the comprehensive feature vector as the dynamic features of each subject, and determine the dynamic anomaly coefficients based on the error between the dynamic features of each subject and the corresponding predicted values ​​in the current evaluation period. Step S130: Perform correlation analysis between users and devices and between various entities on the user behavior characteristics and device operation characteristics within the current evaluation period; Step S140: Based on the static anomaly coefficient, the dynamic anomaly coefficient, and the correlation analysis results, determine the abnormal events in the current evaluation period; The predicted values ​​are determined based on the historical operational data of each entity or the historical behavior data of users, as well as the meteorological data for the prediction period.

[0034] In this example implementation, the execution entity is an edge computing node deployed at the user distribution area or load aggregator side. Monitoring equipment can be configured at various entities on the user side to acquire multi-source heterogeneous data. These various entities refer to various terminal devices and aggregation entities in the new power system that exchange data and perform business interactions with the power grid, including but not limited to distributed photovoltaic inverters, energy storage systems, electric vehicle charging piles, smart meters, and load aggregators. The multi-source heterogeneous data covers three different types of information: the first type is equipment operation data, such as photovoltaic power generation, inverter efficiency, inverter temperature, energy storage terminal voltage, and energy storage current; the second type is user behavior data, such as user load power, power factor, and cumulative electricity consumption; and the third type is meteorological data, such as light intensity, wind speed, and ambient temperature. Because these data differ in sampling frequency, physical units, and data format, preprocessing (such as data cleaning and time alignment) and feature splicing are required to form a unified comprehensive feature vector, laying a cross-domain data foundation for subsequent analysis. After data fusion is completed, the two-dimensional anomaly assessment stage begins. In the static dimension, multi-attribute verification is performed on the device attribute information of each entity, and a static anomaly coefficient is calculated to detect configuration-level security risks such as device identifier tampering, firmware version anomalies, communication protocol violations, parameter configuration errors, or security certificate expiration. In the dynamic dimension, device operation characteristics and user behavior characteristics are extracted from the comprehensive feature vector as dynamic characteristics of each entity, and the dynamic anomaly coefficient is determined based on the error between the dynamic characteristics of each entity and the corresponding predicted value within the current evaluation period. The predicted value is obtained by inputting historical operation data of each entity or historical user behavior data, combined with meteorological data for the prediction period, into a long short-term memory autoencoder model. The introduction of meteorological data enables the prediction model to perceive changes in environmental factors such as light and temperature, thereby incorporating normal power fluctuations driven by weather into the prediction benchmark, so that the prediction error used for anomaly determination can effectively distinguish between normal fluctuations caused by environmental factors and true anomalies of the device or behavior itself. After obtaining the two types of anomaly coefficients, a multi-subject interaction correlation analysis is further performed: First, the correlation degree (e.g., correlation) between user behavior characteristics and equipment operation characteristics in the current assessment period is calculated. This correlation degree can be quantified using the Pearson correlation coefficient to capture abnormal coupling between equipment output and user electricity consumption that deviates from the normal decoupling relationship in scenarios such as electricity theft. Second, for the possible mutual influence between different subjects such as distributed photovoltaic, energy storage, charging piles, and load aggregators (e.g., photovoltaic power fluctuations triggering energy storage charging and discharging responses), the correlation of dynamic characteristics between each subject is calculated. For example, the Frobenius norm of the Jacobi matrix is ​​used to quantify the influence intensity of one subject's output fluctuation on another subject, providing a calculable metric for identifying cascading security risks among multiple subjects.Finally, based on the static and dynamic anomaly coefficients, and combined with the above correlation analysis results, a composite judgment is made to determine the type of abnormal event in the current assessment period. Through the closed-loop mechanism of multi-source data fusion, joint scoring of static and dynamic features, and quantification of inter-subject interactions, the traditional data silos between the power supply side and the user side are broken, the limitation of fixed thresholds being unable to adapt to dynamic scenarios is overcome, the security risks of both the static configuration layer and the dynamic operation layer are taken into account, and the correlation between multiple subjects is incorporated into the anomaly judgment logic. This enables the effective detection of composite and cascading anomalies caused by multi-subject interactions, significantly reducing the risk of false alarms and missed detections, and improving the localized and accurate perception capability of the security status of multiple subjects on the user side.

[0035] In some implementations, the multiple entities include various distributed energy sources, energy storage, charging piles, load aggregators, and smart meters.

[0036] In this example implementation, the multiple entities include various distributed energy sources, energy storage, charging piles, load aggregators, and smart meters. Distributed energy sources refer to devices that generate electricity using renewable energy sources (such as distributed photovoltaics and wind power) connected to the end of the distribution network; energy storage refers to devices that can store electrical energy during off-peak hours and release it during peak hours or when the grid needs it, operating in multiple modes such as charging, discharging, and standby; charging piles refer to facilities that provide charging services for electric vehicles, whose charging load is random and impulsive, significantly affected by user travel behavior; load aggregators refer to intermediary service entities that aggregate a large number of dispersed user-side adjustable loads through communication and control technologies, participating in grid dispatch and market transactions as a unified entity; smart meters refer to metering terminals with two-way communication, remote meter reading, and electricity consumption information collection functions. These entities share common characteristics: they are dispersedly connected to the end of the distribution network, their ownership or management boundary is located at the user end, their behavioral characteristics differ significantly, and they are electrically coupled with each other; therefore, they are collectively referred to as user-side multiple entities.

[0037] In some implementations, the fusion process may include at least one of data cleaning, time alignment, and standardization, and may also include feature concatenation. Since the data generated by the aforementioned entities may differ in sampling frequency, time alignment is needed to unify the data at different frequencies to the same time granularity. Common methods include interpolation, resampling, or taking the nearest neighbor value. Data cleaning removes outliers and null values ​​caused by sensor failures, communication packet loss, etc. Standardization eliminates the influence of different physical units on subsequent analysis models, ensuring that each feature is within a similar numerical range. Feature concatenation merges the aligned and standardized source data vectors along the feature dimension to form a comprehensive feature vector. Through this processing flow, the originally heterogeneous multi-source data, which varied significantly in time scale, physical units, and data quality, is transformed into a comprehensive feature representation with a unified structure and controllable quality.

[0038] For example, to address the issue that device operation data, user behavior data, and meteorological data generated by multiple user entities are inconsistent in terms of time scale, physical units, and data format, making direct joint analysis difficult, the following multi-source heterogeneous data vector representation and fusion formula is constructed: Define three original data vectors:

[0039]

[0040]

[0041] in: , , These are the original feature vectors for equipment operation data, user behavior data, and meteorological data, respectively. Sampling time; Photovoltaic power generation (kW); Photovoltaic inverter efficiency (%) Inverter temperature (°C); , For the terminal voltage (V) and current (A) of the energy storage system; User load power (kW); Power factor; Cumulative electricity consumption (kWh); Light intensity (W / m²); Wind speed (m / s); The ambient temperature is (°C).

[0042] To address the issue that multi-source data is difficult to directly input into a unified analysis model, the following feature fusion formula is constructed:

[0043] in, This is the comprehensive feature vector after data fusion. This indicates fusion processing, which includes data cleaning, time alignment, standardization, and concatenation operations.

[0044] In some implementations, the device attribute information includes at least one of the following: device identifier, firmware version, communication protocol type, device operating parameters, and security certificate serial number; The multi-attribute verification includes at least one of the following: identifier verification, communication specification verification, parameter verification, and security requirement verification.

[0045] In this example implementation, the device attribute information refers to static information inherent to each entity upon network access or during operation, related to its identity and configuration, including at least one of the following: device identifier, which is the device's unique serial number or number used to distinguish different devices of the same type; firmware version, which is the version number of the embedded software inside the device, and different versions may have functional differences or security vulnerabilities; communication protocol type, which is the communication protocol followed by the device when exchanging data with the outside world, such as Modbus, IEC 61850, etc.; device operating parameters, which are the factory settings or operating limits of the device, such as rated power, rated voltage, rated current, and power factor range; and security certificate serial number, which is the unique identifier of the digital certificate used by the device for identity authentication and data encryption. Although this static information changes infrequently during the device's lifecycle, malicious tampering or configuration errors can lead to security risks such as device identity forgery, communication data leakage, or exceeding operating parameter limits. The multi-attribute verification includes at least one of the following verification operations: Identifier verification, which compares the currently collected device identifier with legitimate identifiers in the whitelist or device registration database to detect the presence of counterfeit devices; Communication specification verification, which checks whether the communication protocol version and message format used by the device comply with security policy requirements and detects any unauthorized communication behavior; Parameter verification, which determines whether the device's rated parameters are within a reasonable range and whether the operating parameters are consistent with the registration information, and detects whether parameters have been maliciously modified; Security requirement verification, which verifies whether the security certificate is valid and whether the encryption strength meets security policy requirements, and detects the risk of certificate expiration or revocation. Through these multi-dimensional verifications, the simple rule check that previously only provided a binary judgment of legality / illegality is upgraded to a quantifiable multi-attribute scoring mechanism. This provides a continuous metric for static security risks, reflecting the compliance level of the device in terms of identity, communication, parameters, and security configuration. It also provides standardized input for subsequent weighted fusion with dynamic anomaly coefficients, enabling progressive perception of configuration drift and identity anomalies that occur during long-term terminal operation.

[0046] For example, to address the issue that terminal-specific information (device serial number, firmware version, communication protocol, etc.) may be tampered with or misconfigured, but a single verification rule is insufficient to quantify the degree of anomaly, the following static feature vector representation and weighted verification scoring formula are constructed: Define static eigenvectors for:

[0047] Static anomaly coefficient Calculated using four check functions:

[0048] in: These include device identifier, firmware version, communication protocol type, device operating parameters, and security certificate serial number. The function is identified by the check function (1 indicates a perfect match, 0 indicates an invalid match). This is a parameter validation function (checking whether the rated values ​​and certificates are within the valid range). A security requirement validation function (checks whether it complies with the security policy); A function for verifying communication specifications (checking protocol version and message format); This is a weighting coefficient, which can be adjusted according to the equipment type.

[0049] In some implementations, dynamic anomaly coefficients are determined based on the error between the dynamic characteristics of each subject and the corresponding predicted value within the current evaluation period, including: For each moment in the current evaluation period, the Euclidean distance between each dynamic feature and the corresponding predicted value at that moment is calculated as the prediction error. Based on the prediction error and the historical error statistics of the corresponding dynamic feature, the error level of the dynamic feature at that moment is determined. Based on the statistical analysis of the error levels of each dynamic characteristic at that moment, the dynamic anomaly coefficient at that moment is determined. The predicted value of each dynamic feature at each time point is obtained by inputting the dynamic features of historical periods and the meteorological data of that time point into a long short-term memory autoencoder.

[0050] In this example implementation, the dynamic anomaly coefficient detects anomalies by comparing the deviation between actual observed values ​​and model predicted values. For each moment within the current evaluation period, the predicted value of each dynamic feature at that moment needs to be obtained first. Dynamic features include equipment operation features (such as photovoltaic output, energy storage terminal voltage, etc.) and user behavior features (user electricity consumption, user load power, etc.). The generation of the predicted values ​​relies on a pre-trained long short-term memory autoencoder model, which consists of an encoder and a decoder. The encoder receives the dynamic feature sequence from historical periods and the meteorological data at that moment as input, compressing and mapping the high-dimensional dynamic feature time series into a low-dimensional hidden state vector. This hidden state vector captures the inherent laws of the evolution of dynamic features over time and their response patterns to meteorological conditions. The decoder then uses this hidden state vector as a starting point to reconstruct and generate the predicted value of the dynamic feature for the next moment or the current moment. Then, for each moment within the current evaluation period, the deviation between the actual value and the corresponding predicted value of each dynamic feature is calculated, i.e., the prediction error. Next, the prediction error at this moment is standardized using historical error statistics of this dynamic feature under normal operating conditions (such as the mean and standard deviation of historical prediction errors). This yields the error level of the dynamic feature at that moment, i.e., the degree to which the current error deviates from normal error fluctuations. Finally, statistical analysis is performed on the error levels of all dynamic features at this moment, typically using aggregation methods such as taking the mean or the maximum value. The aggregation result is then mapped using the sigmoid function to obtain the dynamic anomaly coefficient at that moment. Through the above process, the dynamic anomaly coefficient can capture early signs of hidden anomalies such as gradual equipment degradation and irregular abnormal user behavior. Furthermore, because meteorological data is incorporated into the prediction model, it can effectively distinguish between normal power fluctuations caused by weather changes and actual equipment failures or abnormal user behavior, reducing the false alarm rate caused by environmental factors and achieving dynamic and adaptive detection of time-series data anomalies.

[0051] For example, considering the strong time dependence of user-side runtime sequence data, where fixed threshold methods cannot capture gradual degradation and irregular anomalies, the following prediction error model based on LSTM-Autoencoder is constructed: Dynamic feature time series , For the m-th dynamic feature, the superscript T denotes matrix transpose. Using the LSTM-Autoencoder model, the encoder-decoder mapping is as follows:

[0052] in: The length of the historical time window; express arrive Dynamic feature time series within a time window; The hidden state vector; They are the encoder and decoder, respectively. These are the model parameters for the encoder and decoder, respectively; This is the predicted value of the dynamic features at the next time step output by the model.

[0053] To map the prediction error to a comparable dynamic anomaly score, the following error normalization and sigmoid mapping formula is constructed, where the prediction error is:

[0054] in, The prediction error at time t+1; The original dynamic features at time t+1.

[0055] Dynamic anomaly coefficient Defined as:

[0056] In the formula: These are the mean and standard deviation of historical prediction errors (obtained statistically under normal operating conditions); The activation function is used to map the error to... Interval.

[0057] In some implementations, the correlation analysis results include the coupling degree between the various entities; performing correlation analysis between the user behavior characteristics and device operation characteristics within the current evaluation period includes: The multiple entities are divided into at least one group according to their physical characteristics. Each group includes a source entity and a response entity. The output of the source entity is dominated by external primary factors, and the output of the response entity is dominated by internal control strategies or external demands. The coupling degree is the unidirectional coupling degree between the source entity and the response entity. For any group of subjects, the Jacobian matrix of the current dynamic features of the responding subject versus the previous dynamic features of the source subject is estimated using multiple linear regression within a sliding window. The average value of the Frobenius norm of the Jacobian matrix obtained from each window is used as the unidirectional coupling degree of the main body.

[0058] In this example implementation, considering the potential mutual influences between different entities such as distributed photovoltaic (PV), energy storage, charging piles, and load aggregators (e.g., PV power fluctuations triggering energy storage charging and discharging responses), the coupling degree quantifies the intensity of the mutual influence of the dynamic behaviors between different entities. First, the multiple entities are divided into at least one group based on their physical characteristics. Each group includes source-end entities and response-end entities. Source-end entities are those whose output or state is primarily driven by external primary factors. For example, the output of distributed PV mainly depends on sunlight intensity, and wind-driven power generation equipment depends on wind speed. The behavior of these entities is more determined by external environmental forces than by internal control logic. Response-end entities are those whose output or state is primarily driven by internal control strategies or external demands. For example, the charging and discharging of energy storage systems is decided by the battery management system based on electricity prices, state of charge, and grid demand; the charging power of electric vehicle charging piles is determined by user charging demands and vehicle battery status; and the actions of load aggregators are driven by their optimized scheduling strategies. Under this division, the coupling degree is defined as the unidirectional coupling degree between the source-end entity and the response-end entity in each group. For any group of subjects, the specific process for calculating their unidirectional coupling degree is as follows: Within a sliding time window of a certain length, using the dynamic characteristics of the source subject at the previous moment as the independent variable and the dynamic characteristics of the response subject at the current moment as the dependent variable, a multiple linear regression analysis is performed. The coefficient matrix obtained from this regression is the estimated value of the Jacobian matrix, which quantitatively describes how much change in each characteristic component of the source subject will cause to each characteristic component of the response subject, reflecting the local sensitivity relationship between the two. Then, the Frobenius norm of this Jacobian matrix is ​​calculated. This norm is the square root of the sum of the squares of all elements in the matrix, which can comprehensively reflect the overall amplification or attenuation gain of the matrix. The average value of the Frobenius norms obtained by traversing the entire evaluation period through the sliding window is the unidirectional coupling degree of the group of subjects. Through the above method, the mutual influence between subjects is quantified, providing an objective basis for subsequent judgment of multi-subject cascading anomalies, enabling the system to identify systemic security risks caused by the drastic fluctuations of a single source subject triggering a chain reaction of multiple response subjects.

[0059] In some implementations, before calculating the unidirectional coupling degree, the method further includes: For each subject group, using the meteorological data as a conditional variable, we examine whether the current dynamic characteristics of the response subject and the previous dynamic characteristics of the source subject satisfy the conditional independence under the given meteorological data. If the condition of independence is met, the unidirectional coupling degree of the main body group is determined to be zero.

[0060] In this example implementation, in actual operation, the dynamic characteristics of both the source and response entities may change synchronously due to simultaneous influence from common environmental factors. For instance, in sunny weather, as photovoltaic output increases, rising temperatures lead to increased air conditioning load. While there may be a statistical correlation between photovoltaic output and air conditioning load, this correlation is not caused by electrical coupling or control interaction between the two, but rather by a spurious association resulting from shared weather-related forces. To eliminate such problems, a conditional independence test is introduced before calculating the unidirectional coupling degree. This test uses meteorological data as a conditional variable. Specifically, given meteorological data (such as light intensity and ambient temperature), it examines whether the current dynamic characteristics of the response entity and the previous dynamic characteristics of the source entity satisfy a conditional independence relationship. If the two are conditionally independent under given meteorological conditions, it indicates that the correlation between them can be fully explained by common meteorological factors. In this case, the unidirectional coupling degree of this group of entities is directly set to zero. This pre-verification eliminates the interference of common environmental variables such as illumination, temperature, and wind speed on the coupling degree calculation, enabling the final coupling degree value to more realistically reflect the substantial coupling relationship between subjects caused by electrical connections, control responses, and physical interactions, thereby improving the accuracy and reliability of multi-subject correlation analysis.

[0061] In some implementations, based on the static anomaly coefficient, the dynamic anomaly coefficient, and the correlation analysis results, the abnormal events of the current evaluation period are determined, including: The static anomaly coefficient and the dynamic anomaly coefficient are weighted and fused to obtain a comprehensive anomaly score; When the comprehensive anomaly score is greater than or equal to the first threshold, there is at least one pair of user behavior features and device operation features with a correlation greater than or equal to the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined to be a device-user composite anomaly event. When the comprehensive anomaly score is greater than or equal to the first threshold, and there is at least one group of subjects whose unidirectional coupling degree is greater than or equal to the third threshold, the current evaluation period is determined to be a multi-subject cascaded anomaly event. When the comprehensive anomaly score is greater than or equal to the first threshold but does not meet any of the above conditions, the current evaluation period is determined to be a single-subject anomaly event. The third threshold is determined based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions.

[0062] In this example implementation, the abnormal events include device-user composite abnormal events, multi-subject cascaded abnormal events, and single-subject abnormal events, i.e., abnormal events are classified into three categories. The correlation analysis results include the correlation between each pair of user behavior characteristics and device operation characteristics. A comprehensive abnormality score is obtained by weighted fusion of static and dynamic abnormality coefficients. In this weighted fusion, the weight coefficients can be adjusted according to the device type and application scenario; typically, the dynamic abnormality coefficient has a slightly higher weight to reflect the greater contribution of runtime sequence abnormalities to the overall security posture. For example, considering the different contributions of static and dynamic abnormalities to the overall security posture, the following weighted fusion formula is constructed:

[0063] in, For comprehensive anomaly scoring, To integrate weights, satisfy Typical values .

[0064] After obtaining the comprehensive anomaly score, the process proceeds to determine the type of anomaly. In the first scenario, if three conditions are met simultaneously: the comprehensive anomaly score is greater than or equal to the first threshold (e.g., 0.5); there exists at least one pair of user behavior characteristics and equipment operation characteristics with a correlation greater than or equal to the second threshold (e.g., 0.7); and the unidirectional coupling degree of all groups of subjects with unidirectional coupling is less than the third threshold, then a combined device-user anomaly event has occurred in the current assessment period. This type of anomaly corresponds to scenarios such as electricity theft and meter tampering. Its typical characteristic is that anomalies in the operating status of equipment on one side are highly correlated with anomalies in user electricity consumption behavior on the other side, but the anomalies have not spread to more subjects to form a cascade. In the second scenario, if the comprehensive anomaly score is greater than or equal to the first threshold, and there exists at least one group of subjects with a unidirectional coupling degree greater than or equal to the third threshold, regardless of the correlation, then a multi-subject cascade anomaly event has occurred in the current assessment period. This is because a high coupling degree itself indicates that fluctuations in one subject have been transmitted to another, signifying that the anomaly has broken through the boundary of a single subject to form a chain or network propagation, which is more severe than a combined anomaly, and therefore given priority in the determination. In the third scenario, when the comprehensive anomaly score reaches the first threshold, the correlation between each pair of user behavior characteristics and device operation characteristics is less than the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, all three conditions are simultaneously met. That is, when neither highly correlated pairs nor highly coupled groups appear, it is determined to be a single-subject anomaly event. This indicates that the anomaly is limited to a specific device or user and has not caused cross-subject impact. Through this hierarchical judgment mechanism, not only can the presence or absence of anomalies be detected, but the nature and severity of the anomalies can also be distinguished, providing a refined qualitative basis for subsequent graded responses.

[0065] For example, the third threshold is determined based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions. The determination of the third threshold is based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions. For example, the 95th percentile of the historical coupling degree distribution can be taken, so that the threshold can automatically adapt to the inherent coupling characteristics differences of different subject pairs.

[0066] In some implementations, after identifying the anomalous event in the current evaluation period, the method further includes: Execute a local tiered security response for the aforementioned abnormal event.

[0067] In this example implementation, when an abnormal event is detected, a local tiered security response is executed. Local tiered security response refers to the edge computing node taking different levels of action based on the range of the comprehensive anomaly score, such as logging, pushing alerts, or triggering real-time alarms and performing proactive isolation. For example, a higher-level response (such as real-time alarms or proactive device isolation) is performed when the comprehensive anomaly score is high, while a lower-level response (such as simply logging) is performed when the comprehensive anomaly score is low.

[0068] In some implementations, the following is also included before performing a local tiered security response: Receive global security policies issued by the cloud platform; Update the local security response policy based on the differences between the local security response policy and the global security policy; The global security policy is determined by the cloud platform based on the abnormal events and abnormal feature data reported by each edge computing node from each monitoring point.

[0069] In this example implementation, edge computing nodes can receive global security policies issued by the cloud platform. These global security policies are optimized strategies generated by the cloud platform based on anomaly events and anomaly characteristic data reported by each edge computing node, after cross-regional and cross-entity global situational awareness fusion analysis. The policy may include adjusted comprehensive anomaly scoring thresholds, response level mapping relationships, and a set of preventative adjustment instructions for specific disturbances. After receiving the cloud policy, the edge computing node compares it with its local security response policy and calculates the difference norm (e.g., Euclidean distance) between the two. If the difference norm is greater than or equal to a preset update threshold, it indicates that the cloud policy has been substantially updated relative to the local policy, and the edge computing node updates its local security response policy to the cloud-issued policy; if the difference norm is less than the update threshold, the local policy remains unchanged to avoid frequent policy switching that could cause system instability. This enables edge computing nodes to achieve autonomous and rapid responses at the millisecond to second level based on local real-time data, while also periodically obtaining policy parameters from the cloud after global optimization and disturbance tracing to correct local judgment thresholds and response rules. This achieves a balance between local autonomy and global collaboration, enabling cloud-edge collaboration and ensuring the timeliness and accuracy of security responses.

[0070] Example 2 Based on the same inventive concept, this invention also provides a disturbance monitoring method for multiple user-side entities, the flowchart of which is shown below. Figure 2 As shown, it includes the following steps: Step S210: Receive disturbance events and their disturbance characteristic data, and abnormal events and their abnormal characteristic data reported by multiple edge computing nodes; Step S220: If disturbance events reported by multiple spatially adjacent edge computing nodes are received within the preset event receiving time window, and the arrival times of the disturbances recorded by each disturbance event are close to each other, it is determined that a cross-regional disturbance event has occurred, and based on the disturbance feature data received within the current time window, disturbance source localization and disturbance propagation path tracing are performed. Step S230: Based on the disturbance feature data and abnormal feature data received within the current time window, perform spatiotemporal correlation on the cross-regional disturbance event and each abnormal event to determine the correlation relationship between the cross-regional disturbance event and each abnormal event. Step S240: Based on the disturbance source location results, disturbance propagation path tracking results, and the aforementioned correlation, generate and distribute differentiated global security policies to each edge computing node.

[0071] In this example implementation, the execution entity is a cloud platform deployed on the main station side. The cloud platform receives two independent types of event data: the first type is disturbance events and their disturbance characteristic data, which are independently triggered and reported by the high sampling rate disturbance recording modules of each edge computing node when they detect sudden changes in voltage or current waveforms at each monitoring point in the system. The disturbance characteristic data includes at least the arrival time of the disturbance at each monitoring point, as well as transient electrical quantities such as voltage sag depth, frequency deviation, and harmonic distortion rate. The second type is abnormal events and their abnormal characteristic data, which are reported by the steady-state abnormality analysis modules of each edge computing node, including comprehensive abnormality scores, abnormality types, comprehensive feature vectors, and multi-entity correlation analysis results (correlation and coupling). After receiving the data, the cloud platform maintains a sliding time window for event reception, within which it continuously receives events reported by each node. If, within the window, there are disturbance events reported from multiple spatially adjacent edge computing nodes and the arrival times of the disturbance events are adjacent to each other, then it is determined that a cross-regional disturbance event has occurred. Spatial proximity here refers to the electrical distance between relevant edge computing nodes on the distribution network topology being less than a preset radius. Temporal proximity refers to the maximum difference between the arrival times of disturbances recorded by each node being less than a preset proximity threshold. Both conditions must be met simultaneously to determine that the disturbance has a common physical source. After determining a cross-regional disturbance event, the cloud platform performs two key analysis tasks based on the disturbance characteristic data received within the current time window: disturbance source localization and disturbance propagation path tracing. Disturbance source localization determines the precise coordinates of the physical fault point or transient event that caused the disturbance; disturbance propagation path tracing reconstructs the complete path sequence of the disturbance propagating from the source node along the distribution network topology to each affected node. Subsequently, the cloud platform performs spatiotemporal correlation analysis based on the disturbance characteristic data and anomaly characteristic data aggregated within the same time window to determine the causal or co-occurring correlation between this cross-regional disturbance event and each anomaly event within the window. Finally, by integrating the disturbance source localization results, propagation path tracing results, and the aforementioned correlations, a differentiated global security strategy is generated and distributed to each relevant edge computing node. Through the aforementioned cloud-based aggregation, tracing, and policy generation process, the independent local perception of each edge node is elevated to the global level, enabling accurate tracing of disturbance events and causal explanation of abnormal events.

[0072] In some example implementations, the disturbance characteristic data includes the arrival time of the disturbance at each monitoring point; the disturbance source location includes: The difference between the spatial distance from the disturbance source to each monitoring point and the disturbance propagation distance at each monitoring point is weighted and fused to construct an evaluation function; Based on the disturbance feature data within the current time window, with the location of the disturbance source as the optimization variable and minimizing the evaluation function as the objective, the matrix particle swarm optimization algorithm is used to optimize and solve the problem, and the optimal particle position is used as the disturbance source localization result. The disturbance propagation distance is determined based on the disturbance arrival time difference between each monitoring point and the reference node, as well as the disturbance propagation speed; the reference node is the monitoring point that detects the disturbance earliest.

[0073] In this example implementation, the disturbance characteristic data may include the disturbance arrival time, which refers to the precise timestamp calibrated by the high-precision clock synchronization module of each monitoring point when the transient signal of the same disturbance event propagates to each monitoring point. The monitoring points achieve microsecond-level time synchronization through the Global Positioning System (GPS) or the BeiDou satellite system. In addition to the arrival time, the disturbance characteristic data may also include at least one of the following recorded by each monitoring point: voltage sag depth, frequency deviation, and harmonic distortion rate. These physical quantities characterize the strength and characteristics of the disturbance signal. The disturbance source localization first constructs an evaluation function based on the following idea: for a candidate disturbance source location, the spatial distance from that location to each monitoring point should be consistent with the actual propagation distance of the disturbance signal from the disturbance source to each monitoring point. The disturbance propagation distance is calculated as follows: taking the disturbance arrival time of each monitoring point, using the monitoring point that detected the disturbance earliest as the reference node, calculating the disturbance arrival time difference of each other monitoring point relative to the reference node, and then multiplying this time difference by the disturbance propagation speed to obtain the disturbance propagation distance of each monitoring point. The disturbance propagation speed can be determined based on the disturbance propagation medium in the power distribution network (such as overhead lines, cables, etc.). The propagation speed in overhead lines is approximately the speed of light, while the propagation speed in cables is approximately 50% to 80% of the speed of light. The specific form of the evaluation function is as follows: calculate the difference between the spatial distance and the propagation distance for each monitoring point, square this difference, multiply it by the confidence weight of that monitoring point, and then sum the weighted squares of all monitoring points. The confidence weight of a monitoring point is determined based on its signal-to-noise ratio (SNR). A higher SNR results in a larger weight, indicating that the time-scale measurement of that monitoring point is more reliable and should contribute more significantly to the location results.

[0074] For example, to address the issue that traditional disturbance localization methods can only locate disturbances at the feeder segment or substation level, lacking sufficient accuracy to support precise isolation at the equipment level, and are significantly affected by measurement errors and uncertain propagation speeds, the following evaluation function based on weighted least squares of the time difference of arrival of multiple monitoring points is constructed: Let the coordinate vector of the disturbance source to be located be... , Let the coordinates of the disturbance source be denoted. Define the evaluation function. :

[0075] in: The number of monitoring points that received the disturbance signal; For the first The coordinates of each monitoring point; For the disturbance to reach the first The time difference between each monitoring point and the baseline point; The propagation speed of the disturbance in the power grid (which can be determined a priori or estimated in real time). For the first The confidence weight of each monitoring point (determined by the signal-to-noise ratio).

[0076] After constructing the evaluation function, the location coordinates of the perturbation source are used as the optimization variable, and the matrix particle swarm optimization algorithm is used iteratively to minimize the evaluation function. This algorithm disperses multiple candidate particles in the solution space, each representing a possible perturbation source location. Through information sharing and iterative updates among the particles, it gradually converges to the optimal location, and the particle location with the smallest evaluation function value is taken as the perturbation source localization result. For example, for the optimization problem where the evaluation function is non-convex and has multiple peak values, the following matrix particle swarm iterative update formula is constructed:

[0077]

[0078] In the formula: , The first The particle in the first Second-rate, The speed of each iteration; For the first The particle in the first The position of the next iteration. For the first The particle in the first The position of the next iteration; Inertial weights; For learning factors; for A random number that is uniformly distributed on the upper surface; For the first The optimal position of each particle; This represents the globally optimal location. The final disturbance source localization result is the solution to the following minimization problem:

[0079] In the formula, This is the optimal solution. This represents the value space or solution threshold for the location of the disturbance source.

[0080] The matrix particle swarm optimization algorithm can effectively avoid the problem of getting trapped in local optima due to the multi-peak and non-convex characteristics of the evaluation function, and is suitable for disturbance pulse source localization scenarios under complex distribution network topologies.

[0081] Some example implementations of the disturbance propagation path tracing include: Obtain the network topology of the distribution network area monitored by each edge computing node, take the bus or equipment access point in the distribution network area as the node, and the transmission line or transformer branch as the edge; take the power flow direction and disturbance propagation direction as the edge direction, and take the attenuation coefficient of the disturbance from the source node to the target node as the edge weight, and construct a directed graph of the distribution network area. Based on the perturbation feature data of each node received within the current time window, a node feature matrix is ​​constructed. The directed graph and the node feature matrix are then input into a pre-trained graph convolutional network for layer-by-layer convolution and fully connected processing to obtain the perturbation propagation probability matrix. In the disturbance propagation probability matrix, starting from the node corresponding to the disturbance source location result, the next hop node is selected in sequence according to the highest probability to form a path sequence until the propagation probability is lower than the disturbance threshold or the terminal node is reached, thus obtaining the disturbance propagation path and the sequence of disturbed nodes. The attenuation coefficient is determined based on historical disturbance events in the distribution network.

[0082] In this example implementation, the cloud platform acquires the network topology of the distribution network area monitored by each edge computing node. Addressing the challenges of complex disturbance propagation paths and dynamically changing power flow directions in the distribution network, which traditional topology analysis methods struggle to track complete paths in real time, a directed graph model of the distribution network area is constructed. Nodes in the directed graph are defined as bus nodes or access points for various devices within the distribution network area, and edges are defined as physical transmission lines or transformer branches connecting these nodes. The direction of the edges follows two principles: first, the power flow direction during normal operation, i.e., from the substation bus, through feeders, to the distribution transformer, and then to the user access point; second, the measured disturbance propagation direction. When historical disturbance event data shows a discrepancy between the disturbance propagation direction and the power flow direction, a reverse edge can be added. The edge weight is defined as the attenuation coefficient of the disturbance propagating from the source node to the target node. This attenuation coefficient is determined based on statistical analysis of historical disturbance event data of the distribution network, reflecting the degree of attenuation of disturbance energy after transmission through the line, and is related to factors such as line length, impedance, and type. Then, based on the disturbance characteristic data of each node received within the current time window, a node feature matrix is ​​constructed. The disturbance characteristic data may include electrical quantities recorded by each monitoring point during the disturbance event that characterize the disturbed state of the nodes, including at least voltage sag depth, frequency deviation, and harmonic distortion rate. These characteristics form a node characteristic matrix. N is the total number of nodes. For each node, there are characteristic dimensions (such as voltage sag depth, frequency deviation, and harmonic distortion rate). The node feature matrix and the adjacency weight matrix of the aforementioned directed graph are input into a pre-trained graph convolutional network. The graph convolutional network aggregates neighbor information layer by layer: in each convolutional layer, the feature vector of each node updates its own representation by weighting and aggregating the features of its neighboring nodes, with the weights determined by the normalized decay coefficient of the adjacency matrix. This layer-by-layer propagation mechanism is highly consistent with the physical process of disturbance signals spreading step by step along the line in a power distribution network. Shallow convolution corresponds to the propagation of disturbance from the source node to a one-hop neighbor, while deep convolution corresponds to the propagation of disturbance to nodes with more hops. After multi-layer graph convolution processing, the final embedding vector of each node incorporates the disturbance state information of its hop neighbors. For example, each graph convolutional layer... , To determine the number of convolutional layers, perform the following procedure: Adding a self-loop introduces the influence of the node's own state:

[0083] in, To add a self-loop adjacency matrix, This is the adjacency weight matrix. for An identity matrix of order 1.

[0084] Calculate the symmetric normalized adjacency matrix :

[0085] in, Let be a degree matrix, and be a diagonal matrix, whose diagonal elements are... , for The element in the i-th row and j-th column is used to prevent differences in degree values ​​from affecting the propagation intensity.

[0086] Feature transformation and aggregation: , in, , The first , The output of each convolutional layer For the first Each convolutional layer can learn weight matrices for feature space mapping; It is a non-linear activation function (such as ReLU).

[0087] The output of the last convolutional layer is then decoded using a decoding function (such as a fully connected layer + softmax) to output a probability matrix. In this probability matrix, each element represents the probability of a disturbance propagating from the source node to the target node. Finally, starting from the node corresponding to the disturbance source location result in the probability matrix, a greedy search strategy is used to select the next-hop node with the highest probability at each step, linking hops to form a path sequence until the propagation probability decays below a preset disturbance threshold or reaches the end node of the distribution network. The resulting path sequence is the disturbance propagation path, and all nodes along the path constitute the disturbed node sequence. Through this method combining directed graph modeling and graph convolutional inference, propagation path tracing is not only performed under topological constraints but also incorporates the measured disturbance characteristics of each node, thus enabling adaptive adaptation to the dynamic changes in the power flow direction of the distribution network and achieving accurate reconstruction of the entire disturbance propagation process.

[0088] Some example implementations involve spatiotemporally correlating the cross-regional disturbance event and various anomalous events to determine the correlation between the cross-regional disturbance event and each anomalous event, including: For any abnormal event within the current time window, if the source node of the abnormal event is located in the sequence of disturbed nodes, then based on the time difference between the time of abnormal event perception and the time of arrival of the disturbance of the cross-regional disturbance event, it is determined whether the abnormal event is associated with the disturbance. If the source node of the abnormal event is not in the sequence of disturbed nodes, the abnormal event is marked as an independent abnormal event; The abnormality perception moment is the moment when the dynamic abnormality coefficient corresponding to the abnormal event first exceeds the preset error threshold.

[0089] In this example implementation, the spatiotemporal correlation analysis aims to determine whether there is a causal relationship between a cross-regional disturbance event determined by the cloud and abnormal events reported by edge computing nodes within the same time window. The abnormal feature data here includes at least the source node and dynamic anomaly coefficient for each abnormal event. The dynamic anomaly coefficient is used to characterize the deviation level between the actual dynamic characteristics and the predicted expected characteristics of each subject. The moment when the dynamic anomaly coefficient corresponding to the abnormal event first exceeds a preset error threshold is taken as the moment when the anomaly is first perceived. The spatiotemporal correlation analysis is as follows: For each abnormal event received within the current preset time window, it is first determined whether the source node of the abnormal event is located in the disturbed node sequence. If the source node is not in the disturbed node sequence, it indicates that the node has not been affected by the disturbance, and its anomaly should be caused by local reasons such as equipment failure, electricity theft, or aging and deterioration, which is unrelated to this disturbance event. Therefore, this abnormal event is marked as an independent abnormal event. If the source node is located in the disturbed node sequence, a further temporal correlation judgment is performed: the moment when the dynamic anomaly coefficient of the abnormal event first exceeds the preset error threshold is extracted, and the time difference between this moment and the arrival time of the cross-regional disturbance event at that node is calculated. This time difference reflects the delay between the physical impact of the disturbance and the moment the anomaly is first perceived. Based on the comparison between this time difference and the preset disturbance attribution time tolerance, it is determined whether the anomalous event is related to the disturbance. Through the path matching in the spatial dimension and the sequence verification in the temporal dimension, the causal relationship between cross-regional disturbance events and anomalous events at each node is accurately identified, avoiding the erroneous attribution of temporally coincidental but spatially unrelated anomalies to disturbance events, thus improving the accuracy of event attribution analysis.

[0090] Some example implementations, based on the disturbance source location results, disturbance propagation path tracing results, and the aforementioned correlation, generate and distribute differentiated global security policies to each edge computing node, including: For abnormal events associated with disturbances, generate a response degradation instruction as a global security policy for the corresponding edge computing node and issue it to indicate that the abnormal event is a disturbance-related response. When an independent abnormal event occurs and its overall abnormal score exceeds a preset high threshold, a command to maintain or upgrade the response level is generated and issued as a global security policy for the corresponding edge computing node. For edge computing nodes in the disturbed node sequence that have not reported abnormal events, an early warning notification is generated as a global security policy for the corresponding edge computing node and sent out to prompt it to check the device status.

[0091] In this example implementation, the abnormal feature data includes a comprehensive abnormal score. This score is obtained by weighted fusion of static and dynamic abnormal coefficients from the edge computing nodes, comprehensively reflecting the severity of the abnormal event. The disturbance propagation path tracking results include the sequence of disturbed nodes and the disturbance propagation path. For abnormal events determined to be associated with disturbances through spatiotemporal correlation analysis, it indicates that the abnormality is not caused by equipment malfunction or malicious user behavior, but rather by the equipment's normal protection response or operating condition switching under external disturbance impact. For such events, the cloud platform generates a response degradation instruction as a global security policy and distributes it to the corresponding edge computing nodes. The purpose of this degradation instruction is to prompt the edge nodes that their previously reported abnormal events have been identified as disturbance-related responses, and the locally triggered alarm level should be downgraded from a fault alarm to a disturbance response record to avoid mistakenly issuing equipment fault work orders due to uncontrollable external factors and reduce the ineffective occupation of maintenance resources. For events determined to be independent abnormal events through spatiotemporal correlation analysis, and whose comprehensive abnormal score simultaneously exceeds a preset high threshold, it indicates that the node does indeed have a fundamental security threat, and its severity is high. For such events, instructions to maintain or escalate the response level are generated and issued as a global security policy, requiring edge nodes to maintain or increase their current alarm levels to ensure timely handling of serious security threats. Simultaneously, maintenance work orders can be pushed to the corresponding edge nodes to guide maintenance personnel in conducting targeted investigations. For edge computing nodes in the affected node sequence that have not yet reported any abnormal events, it indicates that although the disturbance energy has propagated through the node, the devices connected to it may be in a state of latent damage or near-failure without triggering the detection threshold. The cloud platform proactively generates an early warning notification containing the disturbance propagation path, as a global security policy, and issues it to such edge computing nodes, prompting them to check the status of their connected devices to prevent delayed failures or cumulative damage that may be caused by the disturbance. If the disturbance source location results point to an isolable device or branch, a selective isolation instruction for the disturbance source is generated and issued as a global security policy for the edge computing node corresponding to the node containing the disturbance source, to isolate the disturbance source in a timely manner. Through the aforementioned differentiated strategy generation and distribution mechanism, the cloud platform transforms the results of disturbance tracing into precise guidance for different nodes and situations, realizing a multi-layered collaborative defense system across the entire region, combining accuracy and prevention.

[0092] Example 3 Based on the same inventive concept, the present invention also provides an edge computing node, comprising: The data fusion module is used to acquire multi-source heterogeneous data from multiple users, perform fusion processing on the multi-source heterogeneous data, and obtain a comprehensive feature vector; the multi-source heterogeneous data includes equipment operation data, user behavior data, and meteorological data; The anomaly coefficient calculation module is used to perform multi-attribute verification on the equipment attribute information of each subject to obtain the static anomaly coefficient; extract the equipment operation characteristics and user behavior characteristics in the comprehensive feature vector as the dynamic characteristics of each subject, and determine the dynamic anomaly coefficient based on the error between the dynamic characteristics of each subject and the corresponding predicted value in the current evaluation period. The correlation analysis module is used to perform correlation analysis between users and devices, as well as between various entities, on user behavior characteristics and device operation characteristics within the current evaluation period. The anomaly analysis module is used to determine the abnormal events in the current evaluation period based on the static anomaly coefficient, the dynamic anomaly coefficient, and the correlation analysis results. The predicted values ​​are determined based on the historical operational data of each entity or the historical behavior data of users, as well as the meteorological data for the prediction period.

[0093] In one possible implementation, the multi-entity includes various distributed energy sources, energy storage, charging piles, load aggregators, and smart meters.

[0094] In one possible implementation, the device attribute information includes at least one of the following: device identifier, firmware version, communication protocol type, device operating parameters, and security certificate serial number; The multi-attribute verification includes at least one of the following: identifier verification, communication specification verification, parameter verification, and security requirement verification.

[0095] In one possible implementation, the anomaly coefficient calculation module includes a dynamic coefficient calculation submodule, which is used for: For each moment in the current evaluation period, the Euclidean distance between each dynamic feature and the corresponding predicted value at that moment is calculated as the prediction error. Based on the prediction error and the historical error statistics of the corresponding dynamic feature, the error level of the dynamic feature at that moment is determined. Based on the statistical analysis of the error levels of each dynamic characteristic at that moment, the dynamic anomaly coefficient at that moment is determined. The predicted value of each dynamic feature at each time point is obtained by inputting the dynamic features of historical periods and the meteorological data of that time point into a long short-term memory autoencoder.

[0096] In one possible implementation, the correlation analysis results include the coupling degree between the entities; the correlation analysis module includes a coupling degree calculation submodule, which is used for: The multiple entities are divided into at least one group according to their physical characteristics. Each group includes a source entity and a response entity. The output of the source entity is dominated by external primary factors, and the output of the response entity is dominated by internal control strategies or external demands. The coupling degree is the unidirectional coupling degree between the source entity and the response entity. For any group of subjects, the Jacobian matrix of the current dynamic features of the responding subject versus the previous dynamic features of the source subject is estimated using multiple linear regression within a sliding window. The average value of the Frobenius norm of the Jacobian matrix obtained from each window is used as the unidirectional coupling degree of the main body.

[0097] In one possible implementation, the coupling calculation submodule is further configured to: For each subject group, using the meteorological data as a conditional variable, we examine whether the current dynamic characteristics of the response subject and the previous dynamic characteristics of the source subject satisfy the conditional independence under the given meteorological data. If the condition of independence is met, the unidirectional coupling degree of the main body group is determined to be zero.

[0098] In one possible implementation, the correlation analysis results include the correlation between each pair of user behavior features and device operation features; the anomaly analysis module includes: The scoring calculation submodule is used to weight and fuse the static anomaly coefficient and the dynamic anomaly coefficient to obtain a comprehensive anomaly score; The anomaly determination submodule is used to determine the current evaluation period as a device-user composite anomaly event when all three conditions are met: the comprehensive anomaly score is greater than or equal to a first threshold, there is at least one pair of user behavior features with a correlation greater than or equal to a second threshold, and the unidirectional coupling degree of each group of subjects is less than a third threshold; when the comprehensive anomaly score is greater than or equal to the first threshold and there is at least one group of subjects with a unidirectional coupling degree greater than or equal to the third threshold, the current evaluation period is determined as a multi-subject cascaded anomaly event; when all three conditions are met simultaneously: the comprehensive anomaly score is greater than or equal to the first threshold, the correlation degree of each pair of user behavior features with a correlation greater than or equal to the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined as a single-subject anomaly event. In one possible implementation, the third threshold is determined based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions.

[0099] In one possible implementation, it also includes: An anomaly response module is used to perform a local hierarchical security response to the anomaly event.

[0100] In one possible implementation, it also includes: The policy update module is used to receive global security policies issued by the cloud platform; and update the local security response policy based on the differences between the local security response policy and the global security policy. The global security policy is determined by the cloud platform based on the abnormal events and abnormal feature data reported by each edge computing node from each monitoring point.

[0101] Example 4 Based on the same inventive concept, the present invention also provides a cloud platform, comprising: The receiving module is used to receive disturbance events and their disturbance characteristic data, as well as abnormal events and their abnormal characteristic data, reported by multiple edge computing nodes. The disturbance analysis module is used to determine that a cross-regional disturbance event has occurred if, within a preset event receiving time window, disturbance events reported by multiple spatially adjacent edge computing nodes are received and the arrival times of the disturbances recorded by each disturbance event are close to each other, and to perform disturbance source localization and disturbance propagation path tracing based on the disturbance feature data received within the current time window. The spatiotemporal correlation module is used to perform spatiotemporal correlation on the cross-regional disturbance event and each abnormal event based on the disturbance feature data and abnormal feature data received within the current time window, and to determine the correlation relationship between the cross-regional disturbance event and each abnormal event. The policy generation module is used to generate and distribute differentiated global security policies to each edge computing node based on the disturbance source location results, disturbance propagation path tracking results, and the aforementioned correlation.

[0102] In one possible implementation, the disturbance characteristic data includes the arrival time of the disturbance at each monitoring point; the disturbance analysis module includes a disturbance source location submodule, which includes: The evaluation function construction sub-unit is used to weight and fuse the difference between the spatial distance from the disturbance source to each monitoring point and the disturbance propagation distance at each monitoring point in order to construct the evaluation function; The solution sub-unit is used to optimize the perturbation feature data within the current time window, with the location of the perturbation source as the optimization variable and minimizing the evaluation function as the objective. The matrix particle swarm optimization algorithm is used to solve the problem and obtain the optimal particle position as the perturbation source localization result. The disturbance propagation distance is determined based on the disturbance arrival time difference between each monitoring point and the reference node, as well as the disturbance propagation speed; the reference node is the monitoring point that detects the disturbance earliest.

[0103] In one possible implementation, the disturbance analysis module includes a path tracing submodule, which includes: A directed graph construction subunit is used to obtain the network topology of the distribution network area monitored by each edge computing node. The bus or equipment access point in the distribution network area is used as the node, and the transmission line or transformer branch is used as the edge. The power flow direction and the disturbance propagation direction are used as the direction of the edge, and the attenuation coefficient of the disturbance propagating from the source node to the target node of the edge is used as the weight of the edge to construct a directed graph of the distribution network area. The graph convolutional subunit is used to construct a node feature matrix based on the perturbation feature data of each node received within the current time window. The directed graph and the node feature matrix are then input into a pre-trained graph convolutional network for layer-by-layer convolution and fully connected processing to obtain the perturbation propagation probability matrix. The tracking subunit is used to start from the node corresponding to the disturbance source location result in the disturbance propagation probability matrix, select the next hop node in sequence according to the highest probability to form a path sequence, until the propagation probability is lower than the disturbance threshold or the terminal node is reached, so as to obtain the disturbance propagation path and the sequence of disturbed nodes. The attenuation coefficient is determined based on historical disturbance events in the distribution network.

[0104] In one possible implementation, the abnormal feature data includes source nodes and dynamic anomaly coefficients, wherein the dynamic anomaly coefficients are used to characterize the deviation level between the actual dynamic features of each subject and the predicted expected features; the spatiotemporal correlation module is specifically used for: For any abnormal event within the current time window, if the source node of the abnormal event is located in the sequence of disturbed nodes, then based on the time difference between the time of abnormal event perception and the time of arrival of the disturbance of the cross-regional disturbance event, it is determined whether the abnormal event is associated with the disturbance. If the source node of the abnormal event is not in the sequence of disturbed nodes, the abnormal event is marked as an independent abnormal event; The abnormality perception moment is the moment when the dynamic abnormality coefficient corresponding to the abnormal event first exceeds the preset error threshold.

[0105] In one possible implementation, the anomaly feature data includes a comprehensive anomaly score; the disturbance propagation path tracking result includes a sequence of disturbed nodes and a disturbance propagation path; the policy generation module is specifically used for: For abnormal events associated with disturbances, generate a response degradation instruction as a global security policy for the corresponding edge computing node and issue it to indicate that the abnormal event is a disturbance-related response. When an independent abnormal event occurs and its overall abnormal score exceeds a preset high threshold, a command to maintain or upgrade the response level is generated and issued as a global security policy for the corresponding edge computing node. For edge computing nodes in the disturbed node sequence that have not reported abnormal events, an early warning notification is generated and sent as a global security policy for the corresponding edge computing node based on the disturbance propagation path, prompting it to check the device status. If the disturbance source location result points to an isolable device or branch, a selective isolation instruction is generated as the global security policy of the edge computing node corresponding to the node where the disturbance source is located and is then issued.

[0106] Example 5 Based on the same inventive concept, the present invention also provides a security situation awareness and disturbance monitoring system for multiple user-side entities, including edge computing nodes as described in any one of Embodiment 3 deployed on the user station area or load aggregator side and / or cloud platforms as described in any one of Embodiment 4 deployed on the main station side.

[0107] For example, such as Figure 3 As shown, the user-side multi-subject security situation awareness and disturbance monitoring system proposed in this invention adopts a three-layer collaborative architecture of end-edge-cloud, including: Terminal Sensing Layer: This layer comprises various intelligent sensing terminals deployed on the user side across multiple stakeholders. These terminals collect real-time data on device operation, user behavior, and environmental auxiliary data. Intelligent sensing terminals include, but are not limited to: photovoltaic inverter monitoring terminals, energy storage system monitoring terminals, electric vehicle charging pile monitoring terminals, smart meters, and load aggregator edge gateways. Each terminal collects real-time operational data such as voltage, current, power, frequency, temperature, power generation, and charging / discharging status, as well as static characteristic information such as device identification, firmware version, and communication protocol parameters.

[0108] Edge computing layer: Edge computing nodes deployed in user areas or on the load aggregator side are responsible for preprocessing, feature extraction, local anomaly detection, and preliminary situational analysis of multi-source data uploaded from the terminal perception layer. Edge nodes incorporate lightweight anomaly detection models and multi-agent correlation analysis engines to achieve rapid local data response.

[0109] Cloud Platform: A cloud-based situational awareness and collaboration platform built on the main station side. It receives analysis results and anomalies reported by edge nodes, combines them with power grid topology and historical data to perform cross-regional and cross-entity global situational awareness fusion analysis, precise disturbance source location, propagation path tracing, and intelligent early warning decision-making, and supports situational awareness visualization. For example, the cloud-based collaboration platform is used to solve for precise disturbance source location based on matrix particle swarm optimization; output disturbance propagation probability matrices and trace propagation paths based on graph neural networks; and generate and issue alarm and defense strategies. It can also graphically display asset maps, risk maps, disturbance propagation situational maps, and alarm trend maps through a situational awareness visualization module.

[0110] Example 6 Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). An electronic device readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both built-in storage media within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of a user-side multi-subject security situation awareness and / or disturbance monitoring method in the above embodiments.

[0111] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0114] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A method for security situation awareness among multiple user-side entities, characterized in that, Applications include edge computing nodes deployed in user areas or on the load aggregator side, including: Acquire multi-source heterogeneous data from multiple user entities, and perform fusion processing on the multi-source heterogeneous data to obtain a comprehensive feature vector; the multi-source heterogeneous data includes equipment operation data, user behavior data, and meteorological data; The obtained equipment attribute information of each subject is subjected to multi-attribute verification to obtain static anomaly coefficients; the equipment operation characteristics and user behavior characteristics in the comprehensive feature vector are extracted as dynamic characteristics of each subject, and the dynamic anomaly coefficients are determined based on the error between the dynamic characteristics of each subject and the corresponding predicted values ​​in the current evaluation period. Correlation analysis was conducted on user behavior characteristics and device operation characteristics during the current evaluation period, focusing on the relationships between users and devices, as well as among various stakeholders. Based on the static anomaly coefficient, dynamic anomaly coefficient, and correlation analysis results, the abnormal events in the current evaluation period are determined. The predicted values ​​are determined based on the historical operational data of each entity or the historical behavior data of users, as well as the meteorological data for the prediction period.

2. The method according to claim 1, characterized in that, The diverse entities include various distributed energy sources, energy storage, charging piles, load aggregators, and smart meters.

3. The method according to claim 1, characterized in that, The device attribute information includes at least one of the following: device identifier, firmware version, communication protocol type, device operating parameters, and security certificate serial number; The multi-attribute verification includes at least one of the following: identifier verification, communication specification verification, parameter verification, and security requirement verification.

4. The method according to claim 1, characterized in that, The dynamic anomaly coefficient is determined based on the error between the dynamic characteristics of each subject and the corresponding predicted value within the current assessment period, including: For each moment in the current evaluation period, the Euclidean distance between each dynamic feature and the corresponding predicted value at that moment is calculated as the prediction error. Based on the prediction error and the historical error statistics of the corresponding dynamic feature, the error level of the dynamic feature at that moment is determined. Based on the statistical analysis of the error levels of each dynamic characteristic at that moment, the dynamic anomaly coefficient at that moment is determined. The predicted value of each dynamic feature at each time point is obtained by inputting the dynamic features of historical periods and the meteorological data of that time point into a long short-term memory autoencoder.

5. The method according to claim 1, characterized in that, The correlation analysis results include the coupling degree between the various entities; correlation analysis is performed between the user behavior characteristics and device operation characteristics within the current evaluation period, including: The multiple entities are divided into at least one group according to their physical characteristics. Each group includes a source entity and a response entity. The output of the source entity is dominated by external primary factors, and the output of the response entity is dominated by internal control strategies or external demands. The coupling degree is the unidirectional coupling degree between the source entity and the response entity. For any group of subjects, the Jacobian matrix of the current dynamic features of the responding subject versus the previous dynamic features of the source subject is estimated using multiple linear regression within a sliding window. The average value of the Frobenius norm of the Jacobian matrix obtained from each window is used as the unidirectional coupling degree of the main body.

6. The method according to claim 5, characterized in that, Before calculating the unidirectional coupling degree, the following is also included: For each subject group, using the meteorological data as a conditional variable, we examine whether the current dynamic characteristics of the response subject and the previous dynamic characteristics of the source subject satisfy the conditional independence under the given meteorological data. If the condition of independence is met, the unidirectional coupling degree of the main body group is determined to be zero.

7. The method according to claim 5, characterized in that, The correlation analysis results include the correlation between each pair of user behavior characteristics and device operation characteristics; based on the static anomaly coefficient, dynamic anomaly coefficient, and correlation analysis results, the abnormal events in the current evaluation period are determined, including: The static anomaly coefficient and the dynamic anomaly coefficient are weighted and fused to obtain a comprehensive anomaly score; When the comprehensive anomaly score is greater than or equal to the first threshold, there is at least one pair of user behavior features and device operation features with a correlation greater than or equal to the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined to be a device-user composite anomaly event. When the comprehensive anomaly score is greater than or equal to the first threshold, and there is at least one group of subjects whose unidirectional coupling degree is greater than or equal to the third threshold, the current evaluation period is determined to be a multi-subject cascaded anomaly event. When the comprehensive anomaly score is greater than or equal to the first threshold, the correlation between each pair of user behavior features and device operation features is less than the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined to be a single-subject anomaly event.

8. The method according to claim 7, characterized in that, The third threshold is determined based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions.

9. The method according to claim 1, characterized in that, After identifying the anomalies in the current assessment period, the following is also included: Execute a local tiered security response for the aforementioned abnormal event.

10. The method according to claim 9, characterized in that, Before executing a local tiered security response, the following is also included: Receive global security policies issued by the cloud platform; Update the local security response policy based on the differences between the local security response policy and the global security policy; The global security policy is determined by the cloud platform based on the abnormal events and abnormal feature data reported by each edge computing node from each monitoring point.

11. A disturbance monitoring method for multiple user-side entities, characterized in that, Applied to cloud platforms deployed on the main site side, including: Receive disturbance events and their disturbance characteristic data, as well as abnormal events and their abnormal characteristic data, reported by multiple edge computing nodes; If, within a preset event receiving time window, disturbance events are received from multiple spatially adjacent edge computing nodes, and the arrival times of the disturbances recorded by each disturbance event are close to each other, it is determined that a cross-regional disturbance event has occurred, and based on the disturbance feature data received within the current time window, disturbance source localization and disturbance propagation path tracing are performed. Based on the disturbance feature data and anomaly feature data received within the current time window, the cross-regional disturbance event and each anomaly event are spatiotemporally correlated to determine the correlation between the cross-regional disturbance event and each anomaly event. Based on the disturbance source location results, disturbance propagation path tracing results, and the aforementioned correlation, differentiated global security policies are generated and distributed to each edge computing node.

12. The method according to claim 11, characterized in that, The disturbance characteristic data includes the arrival time of the disturbance at each monitoring point; the disturbance source location includes: The difference between the spatial distance from the disturbance source to each monitoring point and the disturbance propagation distance at each monitoring point is weighted and fused to construct an evaluation function; Based on the disturbance feature data within the current time window, with the location of the disturbance source as the optimization variable and minimizing the evaluation function as the objective, the matrix particle swarm optimization algorithm is used to optimize and solve the problem, and the optimal particle position is used as the disturbance source localization result. The disturbance propagation distance is determined based on the disturbance arrival time difference between each monitoring point and the reference node, as well as the disturbance propagation speed; the reference node is the monitoring point that detects the disturbance earliest.

13. The method according to claim 11, characterized in that, The disturbance propagation path tracing includes: Obtain the network topology of the distribution network area monitored by each edge computing node, take the bus or equipment access point in the distribution network area as the node, and the transmission line or transformer branch as the edge; take the power flow direction and disturbance propagation direction as the edge direction, and take the attenuation coefficient of the disturbance propagating from the source node to the target node as the edge weight, and construct a directed graph of the distribution network area. Based on the perturbation feature data of each node received within the current time window, a node feature matrix is ​​constructed. The directed graph and the node feature matrix are then input into a pre-trained graph convolutional network for layer-by-layer convolution and fully connected processing to obtain the perturbation propagation probability matrix. In the disturbance propagation probability matrix, starting from the node corresponding to the disturbance source location result, the next hop node is selected in sequence according to the highest probability to form a path sequence until the propagation probability is lower than the disturbance threshold or the terminal node is reached, thus obtaining the disturbance propagation path and the sequence of disturbed nodes. The attenuation coefficient is determined based on historical disturbance events in the distribution network.

14. The method according to claim 13, characterized in that, The abnormal feature data includes source nodes and dynamic anomaly coefficients, whereby the dynamic anomaly coefficients characterize the deviation level between the actual dynamic characteristics of each subject and the predicted expected characteristics. Spatiotemporal correlation is performed on the cross-regional disturbance events and each abnormal event to determine the correlation between the cross-regional disturbance events and each abnormal event, including: For any abnormal event within the current time window, if the source node of the abnormal event is located in the sequence of disturbed nodes, then based on the time difference between the time of abnormal event perception and the time of arrival of the disturbance of the cross-regional disturbance event, it is determined whether the abnormal event is associated with the disturbance. If the source node of the abnormal event is not in the sequence of disturbed nodes, the abnormal event is marked as an independent abnormal event; The abnormality perception moment is the moment when the dynamic abnormality coefficient corresponding to the abnormal event first exceeds the preset error threshold.

15. The method according to claim 14, characterized in that, The abnormal feature data includes a comprehensive anomaly score; the disturbance propagation path tracking results include the sequence of disturbed nodes and the disturbance propagation path; based on the disturbance source location results, the disturbance propagation path tracking results, and the aforementioned correlation, differentiated global security policies are generated and distributed to each edge computing node, including: For abnormal events associated with disturbances, generate a response degradation instruction as a global security policy for the corresponding edge computing node and issue it to indicate that the abnormal event is a disturbance-related response. When an independent abnormal event occurs and its overall abnormal score exceeds a preset high threshold, a command to maintain or upgrade the response level is generated as a global security policy for the corresponding edge computing node and issued. For edge computing nodes in the disturbed node sequence that have not reported abnormal events, an early warning notification is generated and sent as a global security policy for the corresponding edge computing node based on the disturbance propagation path, prompting it to check the device status. If the disturbance source location result points to an isolable device or branch, a selective isolation instruction is generated as the global security policy of the edge computing node corresponding to the node where the disturbance source is located and is then issued.

16. An edge computing node, characterized in that, include: The data fusion module is used to acquire multi-source heterogeneous data from multiple users, perform fusion processing on the multi-source heterogeneous data, and obtain a comprehensive feature vector; the multi-source heterogeneous data includes equipment operation data, user behavior data, and meteorological data; The anomaly coefficient calculation module is used to perform multi-attribute verification on the equipment attribute information of each subject to obtain the static anomaly coefficient; extract the equipment operation characteristics and user behavior characteristics in the comprehensive feature vector as the dynamic characteristics of each subject, and determine the dynamic anomaly coefficient based on the error between the dynamic characteristics of each subject and the corresponding predicted value in the current evaluation period. The correlation analysis module is used to perform correlation analysis between users and devices, as well as between various entities, on user behavior characteristics and device operation characteristics within the current evaluation period. The anomaly analysis module is used to determine the abnormal events in the current evaluation period based on the static anomaly coefficient, the dynamic anomaly coefficient, and the correlation analysis results. The predicted values ​​are determined based on the historical operational data of each entity or the historical behavior data of users, as well as the meteorological data for the prediction period.

17. The edge computing node according to claim 16, characterized in that, The diverse entities include various distributed energy sources, energy storage, charging piles, load aggregators, and smart meters.

18. The edge computing node according to claim 16, characterized in that, The device attribute information includes at least one of the following: device identifier, firmware version, communication protocol type, device operating parameters, and security certificate serial number; The multi-attribute verification includes at least one of the following: identifier verification, communication specification verification, parameter verification, and security requirement verification.

19. The edge computing node according to claim 16, characterized in that, The anomaly coefficient calculation module includes a dynamic coefficient calculation submodule, which is used for: For each moment in the current evaluation period, the Euclidean distance between each dynamic feature and the corresponding predicted value at that moment is calculated as the prediction error. Based on the prediction error and the historical error statistics of the corresponding dynamic feature, the error level of the dynamic feature at that moment is determined. Based on the statistical analysis of the error levels of each dynamic characteristic at that moment, the dynamic anomaly coefficient at that moment is determined. The predicted value of each dynamic feature at each time point is obtained by inputting the dynamic features of historical periods and the meteorological data of that time point into a long short-term memory autoencoder.

20. The edge computing node according to claim 16, characterized in that, The correlation analysis results include the coupling degree between the entities; the correlation analysis module includes a coupling degree calculation submodule, which is used for: The multiple entities are divided into at least one group according to their physical characteristics. Each group includes a source entity and a response entity. The output of the source entity is dominated by external primary factors, and the output of the response entity is dominated by internal control strategies or external demands. The coupling degree is the unidirectional coupling degree between the source entity and the response entity. For any group of subjects, the Jacobian matrix of the current dynamic features of the responding subject versus the previous dynamic features of the source subject is estimated using multiple linear regression within a sliding window. The average value of the Frobenius norm of the Jacobian matrix obtained from each window is used as the unidirectional coupling degree of the main body.

21. The edge computing node according to claim 20, characterized in that, The coupling degree calculation submodule is also used for: For each subject group, using the meteorological data as a conditional variable, we examine whether the current dynamic characteristics of the response subject and the previous dynamic characteristics of the source subject satisfy the conditional independence under the given meteorological data. If the condition of independence is met, the unidirectional coupling degree of the main body group is determined to be zero.

22. The edge computing node according to claim 20, characterized in that, The correlation analysis results include the correlation between each pair of user behavior characteristics and device operation characteristics; The anomaly analysis module includes: The scoring calculation submodule is used to weight and fuse the static anomaly coefficient and the dynamic anomaly coefficient to obtain a comprehensive anomaly score; The anomaly determination submodule is used to determine the current evaluation period as a device-user composite anomaly event when all three conditions are met: the comprehensive anomaly score is greater than or equal to a first threshold, there is at least one pair of user behavior features with device operation features that have a correlation greater than or equal to a second threshold, and the unidirectional coupling degree of each group of subjects is less than a third threshold; when the comprehensive anomaly score is greater than or equal to the first threshold and there is at least one group of subjects that have a unidirectional coupling degree greater than or equal to the third threshold, the current evaluation period is determined as a multi-subject cascaded anomaly event; when all three conditions are met simultaneously: the comprehensive anomaly score is greater than or equal to the first threshold, the correlation between each pair of user behavior features and device operation features is less than the second threshold, and the unidirectional coupling degree of each group of subjects is less than the third threshold, the current evaluation period is determined as a single-subject anomaly event.

23. The edge computing node according to claim 22, characterized in that, The third threshold is determined based on the statistical distribution of the historical coupling degree of each group of subjects under normal operating conditions.

24. The edge computing node according to claim 16, characterized in that, Also includes: An anomaly response module is used to perform a local hierarchical security response to the anomaly event.

25. The edge computing node according to claim 24, characterized in that, Also includes: The policy update module is used to receive global security policies issued by the cloud platform; Update the local security response policy based on the differences between the local security response policy and the global security policy; The global security policy is determined by the cloud platform based on the abnormal events and abnormal feature data reported by each edge computing node from each monitoring point.

26. A cloud platform, characterized in that, include: The receiving module is used to receive disturbance events and their disturbance characteristic data, as well as abnormal events and their abnormal characteristic data, reported by multiple edge computing nodes. The disturbance analysis module is used to determine that a cross-regional disturbance event has occurred if, within a preset event receiving time window, disturbance events reported by multiple spatially adjacent edge computing nodes are received and the arrival times of the disturbances recorded by each disturbance event are close to each other, and to perform disturbance source localization and disturbance propagation path tracing based on the disturbance feature data received within the current time window. The spatiotemporal correlation module is used to perform spatiotemporal correlation on the cross-regional disturbance event and each abnormal event based on the disturbance feature data and abnormal feature data received within the current time window, and to determine the correlation relationship between the cross-regional disturbance event and each abnormal event. The policy generation module is used to generate and distribute differentiated global security policies to each edge computing node based on the disturbance source location results, disturbance propagation path tracking results, and the aforementioned correlation.

27. The cloud platform according to claim 26, characterized in that, The disturbance characteristic data includes the arrival time of the disturbance at each monitoring point; the disturbance analysis module includes a disturbance source location submodule, which includes: The evaluation function construction sub-unit is used to weight and fuse the difference between the spatial distance from the disturbance source to each monitoring point and the disturbance propagation distance at each monitoring point in order to construct the evaluation function; The solution sub-unit is used to optimize the perturbation feature data within the current time window, with the location of the perturbation source as the optimization variable and minimizing the evaluation function as the objective. The matrix particle swarm optimization algorithm is used to solve the problem and obtain the optimal particle position as the perturbation source localization result. The disturbance propagation distance is determined based on the disturbance arrival time difference between each monitoring point and the reference node, as well as the disturbance propagation speed; the reference node is the monitoring point that detects the disturbance earliest.

28. The cloud platform according to claim 26, characterized in that, The disturbance analysis module includes a path tracing submodule, which includes: A directed graph construction subunit is used to obtain the network topology of the distribution network area monitored by each edge computing node. The bus or equipment access point in the distribution network area is used as the node, and the transmission line or transformer branch is used as the edge. The power flow direction and the disturbance propagation direction are used as the direction of the edge, and the attenuation coefficient of the disturbance propagating from the source node to the target node of the edge is used as the weight of the edge to construct the directed graph of the distribution network area. The graph convolutional subunit is used to construct a node feature matrix based on the perturbation feature data of each node received within the current time window. The directed graph and the node feature matrix are then input into a pre-trained graph convolutional network for layer-by-layer convolution and fully connected processing to obtain the perturbation propagation probability matrix. The tracking subunit is used to start from the node corresponding to the disturbance source location result in the disturbance propagation probability matrix, select the next hop node in sequence according to the highest probability to form a path sequence, until the propagation probability is lower than the disturbance threshold or the terminal node is reached, so as to obtain the disturbance propagation path and the sequence of disturbed nodes. The attenuation coefficient is determined based on historical disturbance events in the distribution network.

29. The cloud platform according to claim 28, characterized in that, The abnormal feature data includes source nodes and dynamic anomaly coefficients, whereby the dynamic anomaly coefficients characterize the deviation level between the actual dynamic features of each subject and the predicted expected features; the spatiotemporal correlation module is specifically used for: For any abnormal event within the current time window, if the source node of the abnormal event is located in the sequence of disturbed nodes, then based on the time difference between the time of abnormal event perception and the time of arrival of the disturbance of the cross-regional disturbance event, it is determined whether the abnormal event is associated with the disturbance. If the source node of the abnormal event is not in the sequence of disturbed nodes, the abnormal event is marked as an independent abnormal event; The abnormality perception moment is the moment when the dynamic abnormality coefficient corresponding to the abnormal event first exceeds the preset error threshold.

30. The cloud platform according to claim 29, characterized in that, The abnormal feature data includes a comprehensive abnormal score; the disturbance propagation path tracking results include the disturbed node sequence and the disturbance propagation path; the strategy generation module is specifically used for: For abnormal events associated with disturbances, generate a response degradation instruction as a global security policy for the corresponding edge computing node and issue it to indicate that the abnormal event is a disturbance-related response. When an independent abnormal event occurs and its overall abnormal score exceeds a preset high threshold, a command to maintain or upgrade the response level is generated as a global security policy for the corresponding edge computing node and issued. For edge computing nodes in the disturbed node sequence that have not reported abnormal events, an early warning notification is generated and sent as a global security policy for the corresponding edge computing node based on the disturbance propagation path, prompting it to check the device status. If the disturbance source location result points to an isolable device or branch, a selective isolation instruction is generated as the global security policy of the edge computing node corresponding to the node where the disturbance source is located and is then issued.

31. A user-side multi-subject security situation awareness and disturbance monitoring system, characterized in that, This includes edge computing nodes as described in any one of claims 16-25 deployed on the user station area or load aggregator side and / or cloud platforms as described in any one of claims 26-30 deployed on the main station side.

32. A readable storage medium, characterized in that, It contains an executable program, which, when executed, implements the method as described in any one of claims 1 to 15.

Images