A power network port protection method and system

Abstract

The application relates to the technical field of electric power safety protection, in particular to an electric power network port protection method and system, which comprises the following steps: deploying a double-lock physical protection structure on a network port of a target electric power network device, collecting network port data packets and power supply voltage data of the target electric power network device; extracting an Internet protocol address and a media access control address from the network port data packets to construct a current composite identity identifier of the target electric power network device; obtaining a current power supply state transition probability of the target electric power network device based on the transition relationship between power supply state intervals of the power supply voltage data; obtaining a real-time probability deviation measurement result according to the current power supply state transition probability; performing legality verification based on the real-time probability deviation measurement result and the current composite identity identifier, and performing double-lock linkage unlocking when the legality verification is passed. The application realizes double protection of a physical layer and a logic layer of an electric power network port by deploying a double-lock physical protection structure.

Description

Technical Field

[0001] This invention relates to the field of power safety protection technology, and in particular to a method and system for protecting power network ports. Background Technology

[0002] In the daily operation and maintenance of power systems, the security protection of physical ports of equipment has long faced multiple challenges. At the level of physical port protection for terminal equipment, the protection measures for Universal Serial Bus (USB) ports and network ports are isolated from each other and lack an effective linkage unlocking mechanism. Existing smart network port locks can only achieve physical protection for network ports, while the protection of USB ports still relies on software control or simple physical blocking. This level of protection is difficult to effectively resist attacks. Moreover, when it is necessary to debug or upgrade equipment through the USB interface, the physical lock will directly hinder normal operation. Existing technology lacks a convenient unlocking mechanism linked with network authorization, resulting in a serious conflict between the physical blocking of USB ports and normal maintenance needs.

[0003] Secondly, regarding power supply stability, existing smart universal serial bus locks rely on the device's USB port for power supply. In the event of abnormal power supply conditions such as slow voltage drops, voltage fluctuations, or malicious disconnection, the system cannot identify abnormal trends in advance, nor can it accurately distinguish between normal shutdown and abnormal damage events. In addition, the existing offline unlocking mode of electronic keys has multiple defects. The management system terminal requires physical proximity to complete authorization, which is extremely inconvenient for remote operation. Moreover, the unlocking process and records cannot be synchronized to the management system in real time, making it difficult to achieve closed-loop management of on-site application, immediate authorization, and rapid unlocking. Furthermore, existing port protection technologies generally adopt a single-dimensional verification strategy, which relies solely on network layer identity authentication or solely on physical layer lock control. It fails to jointly determine the communication identity characteristics of the network port with the power supply environment status of the port. This allows attackers to carry out physical layer intrusion by forging legitimate identities during power supply anomalies, or to penetrate the logic layer by taking advantage of protection blind spots during normal power supply periods, resulting in a systemic risk of power network ports being bypassed. Summary of the Invention

[0004] To address the above technical problems, this invention provides a method and system for protecting power network ports.

[0005] In a first aspect, the present invention provides a power network port protection method, the method comprising the following steps: A dual-lock physical protection structure is deployed at the network port of the target power network device, and the network port data packets and power supply voltage data of the target power network device are collected through the dual-lock physical protection structure. In response to an external unlocking request, the Internet Protocol address and Media Access Control address are extracted from the network port data packets, and a current composite identity of the target power network device is constructed based on the Internet Protocol address and the Media Access Control address. The power supply voltage data is discretized to obtain several power supply state intervals, and the current power supply state transition probability of the target power network equipment is obtained based on the transition relationship between each power supply state interval. Based on the current power supply state transition probability and the pre-acquired baseline state transition probability, a real-time probability deviation measurement result is obtained; The legitimacy is verified based on the real-time probability deviation measurement result and the current composite identity, and a dual-lock linkage unlock is performed when the legitimacy verification is successful.

[0006] In a further embodiment, the dual-lock physical protection structure includes a first smart lock and a second smart lock; The lock head of the first smart lock is physically inserted into the universal serial bus port of the target power network device, so that the lock head of the first smart lock blocks the insertion channel of the universal serial bus port in the locked state; The first smart lock is used to collect power supply voltage data from the universal serial bus port of the target power network equipment; The second smart lock is connected in series between the network port of the target power network device and the external network cable in a transparent bridging manner. The second smart lock is used to collect data packets from the network port of the target power network device.

[0007] In a further embodiment, the step of extracting the Internet Protocol address and Media Access Control address from the network port data packet includes: The source Internet Protocol address and source Media Access Control address are parsed from the network port data packets to form a set of raw address pairs. The frequency of pairings of all source Internet Protocol addresses and source Media Access Control addresses within a preset time period is calculated based on the original address pair set. The address pairs with the highest frequency of occurrence are selected from the original set of address pairs and used as the actual Internet Protocol address and Media Access Control address of the target power network device's network port.

[0008] In a further implementation, the step of constructing the current composite identity of the target power network device based on the Internet Protocol address and the Media Access Control address includes: The Internet Protocol address and the Media Access Control address are converted to hexadecimal encoding to obtain a static network identity feature vector. The voltage and current waveform data of the network port of the target power network equipment are collected in real time, and the voltage and current waveform data are filtered and denoised to obtain the random fluctuation residual signal of the target power network equipment. Calculate the approximate entropy value of the random fluctuation residual signal to obtain the operating entropy of the residual signal, and calculate the rate of change of the operating entropy based on the difference value of the operating entropy of the residual signal within a continuous time window; Correlation analysis of the residual signal entropy of adjacent network ports is performed based on the topological relationship of the target power network equipment to obtain the behavioral correlation coefficient between network ports; Cross-modal attention fusion is performed based on the static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports to generate a multidimensional composite feature tensor. The multidimensional composite feature tensor is compressed to obtain a composite feature vector, and a hash operation is performed on the composite feature vector to obtain the current composite identity of the target power network device.

[0009] In a further implementation, the step of performing cross-modal attention fusion based on the static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports to generate a multidimensional composite feature tensor includes: The static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports are aligned in the time dimension to obtain the time-aligned static identity feature representation, time dynamic feature representation, and spatial correlation feature representation. Attention weights are assigned to the interrelation strength among the time-aligned static identity feature representation, time-dynamic feature representation, and spatial association feature representation to obtain the corresponding modal attention weight matrix; The modal attention weight matrix is ​​used to perform cross-modal attention fusion on static identity feature representation, temporal dynamic feature representation and spatial association feature representation to generate a multidimensional composite feature tensor.

[0010] In a further implementation, the step of discretizing the power supply voltage data to obtain several power supply state intervals, and obtaining the current power supply state transition probability of the target power network device based on the transition relationship between each power supply state interval, includes: The power supply voltage data is discretized into several power supply state intervals to obtain a real-time power supply state discrete sequence; The real-time state transition frequency matrix is ​​obtained by statistically analyzing the number of transitions from each power supply state interval to other power supply state intervals within the observation time window based on the real-time power supply state discrete sequence. The current power supply state transition probability of the target power network device is obtained by normalizing all transition frequencies in each power supply state interval based on the real-time state transition frequency matrix.

[0011] In a further implementation, the step of obtaining the real-time probability deviation metric result based on the current power supply state transition probability and the pre-acquired baseline state transition probability includes: The baseline state transition probability is obtained in advance based on the historical power supply state transition probabilities collected from the target power network equipment under normal operation. The real-time probability deviation metric is obtained based on the Euclidean distance between the current power supply state transition probability and the reference state transition probability.

[0012] In a further implementation, the step of performing legality verification based on the real-time probability deviation measurement result and the current composite identity, and performing dual-lock linkage unlocking when the legality verification passes, includes: When the real-time probability deviation measurement result is a flag indicating that the generation environment conditions are met, the current composite identity is matched with the legitimate device behavior pattern in the feature space to obtain the matching confidence, and a legitimacy verification result is generated based on the matching confidence. If the legality verification result is successful, an unlocking command is generated, and the dual-lock linkage unlocking is executed through the unlocking command.

[0013] Secondly, the present invention provides a power network port protection system, the system comprising: The data acquisition module is used to deploy a double-lock body physical protection structure at the network port of the target power network equipment, and to acquire network port data packets and power supply voltage data of the target power network equipment through the double-lock body physical protection structure; An identifier construction module is used to extract the Internet Protocol address and Media Access Control address from the network port data packet in response to an external unlocking request, and construct the current composite identity identifier of the target power network device based on the Internet Protocol address and the Media Access Control address; The state analysis module is used to discretize the power supply voltage data to obtain several power supply state intervals, and based on the transition relationship between each power supply state interval, to obtain the current power supply state transition probability of the target power network equipment. The deviation analysis module is used to obtain real-time probability deviation measurement results based on the current power supply state transition probability and the pre-acquired baseline state transition probability. The linkage unlocking module is used to perform legality verification based on the real-time probability deviation measurement result and the current composite identity identifier, and to perform dual-lock linkage unlocking when the legality verification is successful.

[0014] In a further embodiment, the dual-lock physical protection structure includes a first smart lock and a second smart lock; The lock head of the first smart lock is physically inserted into the universal serial bus port of the target power network device, so that the lock head of the first smart lock blocks the insertion channel of the universal serial bus port in the locked state; The first smart lock is used to collect power supply voltage data from the universal serial bus port of the target power network equipment; The second smart lock is connected in series between the network port of the target power network device and the external network cable in a transparent bridging manner. The second smart lock is used to collect data packets from the network port of the target power network device.

[0015] This invention provides a power network port protection method and system. The method deploys a dual-lock physical protection structure at the network port of a target power network device, and collects network port data packets and power supply voltage data of the target power network device through the dual-lock physical protection structure. In response to an external unlocking request, the method extracts the Internet Protocol address and Media Access Control address from the network port data packets, and constructs a current composite identity of the target power network device based on the Internet Protocol address and the Media Access Control address. The method discretizes the power supply voltage data to obtain several power supply state intervals, and obtains the current power supply state transition probability of the target power network device based on the transition relationship between each power supply state interval. The method obtains a real-time probability deviation measurement result based on the current power supply state transition probability and a pre-acquired baseline state transition probability. The method performs a legality verification based on the real-time probability deviation measurement result and the current composite identity, and performs dual-lock linkage unlocking when the legality verification is successful. Compared with existing technologies, this method deploys a dual-lock physical protection structure on the target power network equipment and collaboratively collects network port data packets and power supply voltage data to build a collaborative verification mechanism that integrates network identity features and power supply environment status. This achieves high-reliability security protection for power network ports and provides a guarantee for the safe operation of power network equipment. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the power network port protection method provided in an embodiment of the present invention; Figure 2 This is a block diagram of a power network port protection system provided in an embodiment of the present invention.

[0017] Explanation of reference numerals in the attached diagram: 101, Data acquisition module; 102, Identifier construction module; 103, Status analysis module; 104, Deviation analysis module; 105, Linkage unlocking module. Detailed Implementation

[0018] The embodiments of the present invention are described in detail below with reference to the accompanying drawings. The embodiments are given for illustrative purposes only and should not be construed as limiting the present invention. The accompanying drawings are for reference and illustration only and do not constitute a limitation on the scope of patent protection of the present invention, because many changes can be made to the present invention without departing from the spirit and scope of the present invention.

[0019] Figure 1 This is a schematic flowchart of a power network port protection method provided in an embodiment of the present invention. The present invention provides a power network port protection method, such as... Figure 1 As shown, the method includes the following steps: S1. Deploy a dual-lock physical protection structure at the network port of the target power network device, and collect network port data packets and power supply voltage data of the target power network device through the dual-lock physical protection structure.

[0020] In some embodiments, the dual-lock physical protection structure includes a first smart lock and a second smart lock; The lock head of the first smart lock is physically inserted into the universal serial bus port of the target power network device, so that the lock head of the first smart lock blocks the insertion channel of the universal serial bus port in the locked state; The first smart lock is used to collect power supply voltage data from the universal serial bus port of the target power network equipment; The second smart lock is connected in series between the network port of the target power network device and the external network cable in a transparent bridging manner. The second smart lock is used to collect data packets from the network port of the target power network device.

[0021] In the actual operating environment of power network equipment, attackers not only illegally access data through standard network ports (Ethernet ports), but also exploit the often-overlooked Universal Serial Bus (USB) ports on power network equipment for bypass attacks. For example, they can establish covert communication links through USB network cards, USB wireless network cards, or malicious charging devices to bypass network port access control. Simply relying on authentication or firewall rules cannot prevent illegal plugging and unplugging or port abuse at the physical layer. Furthermore, existing port protection for power network equipment is mostly limited to logical access control or single physical locks, lacking the ability to coordinate physical blocking of both USB and network ports. This allows attackers to bypass logical protection by directly plugging and unplugging network cables or inserting USB storage devices, enabling them to inject illegal data, implant malicious code, or launch man-in-the-middle attacks. Therefore, this embodiment addresses the dual protection problem of simultaneously blocking unauthorized physical access channels (especially USB ports) and capturing network port traffic in real time. A dual-lock physical protection structure is deployed at the network port. This structure synchronously collects data packets from the network port of the target power network device and power supply voltage data from the Universal Serial Bus (USB) port. This transforms port access behavior from an uncontrollable open state to a controlled locked state, achieving synchronous physical control over the USB and network ports. In this embodiment, the dual-lock physical protection structure includes a first smart lock and a second smart lock. The first smart lock collects the physical locking and power supply voltage data of the USB port of the target power network device, while the second smart lock collects the transparent bridging and network data packets of the network port. In actual deployment, the lock head of the first smart lock is physically inserted into the USB port of the target power network device along the insertion direction. Simultaneously, the second smart lock is connected in series between the network port of the target power network device and the external network cable, thus forming a complete physical layer protection at the external port of the target power network device.

[0022] The Universal Serial Bus (USB) ports of power network equipment are often exposed and unprotected, making them highly vulnerable to physical contact attacks. For example, attackers can insert a USB storage device pre-infected with malware or use malicious USB device attack methods to tamper with the device firmware. Therefore, in this embodiment, the physical locking of the first smart lock completely blocks the illegal access channel of the USB port during deployment, effectively preventing malicious device injection attacks and unauthorized data copying based on the USB interface. Simultaneously, without damaging the original power supply lines of the target power network equipment or affecting the normal operation of the equipment, the power supply voltage data of the USB port is obtained in a non-intrusive manner. Specifically, this embodiment can use the locking head of the first smart lock along... The plug-in direction of the Universal Serial Bus (USB) port is physically inserted into the USB port of the target power network device. The conductive probe at the front end of the lock head forms a stable electrical contact with the power contact inside the USB port, so that the lock head of the first smart lock firmly blocks the insertion channel of the USB port in the locked state, thereby preventing external USB devices from being physically inserted into the port. In this embodiment, the first smart lock senses the potential difference of the power contact of the USB port in real time through the conductive probe to obtain an analog voltage signal, and performs low-pass filtering and noise suppression on the analog voltage signal to obtain a filtered analog voltage signal. Then, the filtered analog voltage signal is converted into a digital voltage signal through an analog-to-digital converter to obtain the power supply voltage data of the USB port.

[0023] In this embodiment, the second smart lock adopts a transparent bridging architecture. Transparent bridging means that the second smart lock itself does not assign an Internet Protocol (IP) address, nor does it modify the source or destination addresses of the data packets it passes through. It operates at the Media Access Control (MAC) layer, and its existence is invisible to the communication devices at both ends. In the specific deployment process, this embodiment connects the first physical network interface of the second smart lock to the network port of the target power network device via a standard network cable, and connects the second physical network interface of the second smart lock to an external network cable. Thus, the second smart lock is connected in series between the network port of the target power network device and the external network cable, becoming an intermediate node in the network communication link. In this embodiment, the network switching chip inside the second smart lock operates in a transparent bridging mode, performing Media Access Control (MAC) address learning and Layer 2 forwarding on data frames entering and leaving the network port, without modifying the source MAC address, destination MAC address, or Internet Protocol (IP) address of the data frames. Network layer header information such as Protocol (IP) addresses ensures transparent connectivity between the target power network device and the external network, preventing changes in network topology or communication link interruptions caused by the deployment of a dual-lock physical protection structure. In this embodiment, the second smart lock completely copies the data packets flowing through the network port to the local capture buffer and parses the copied network port data packets layer by layer according to preset address filtering rules, extracting the source Internet Protocol address, destination Internet Protocol address, source Media Access Control address, destination Media Access Control address, and transport layer protocol type fields to form the network port data packets of the target power network device. This embodiment achieves lossless capture and line-speed forwarding of network port data packets through a transparent bridging architecture, ensuring that normal communication between the power network device and the external network is not affected by the deployment of the dual-lock physical protection structure, and also enabling control of the on / off state of the network port through an electrically controlled locking actuator at the physical layer.

[0024] After the physical deployment of the dual-lock body physical protection structure is completed, the first and second smart locks establish a high-speed communication connection through an internal bus to achieve coordinated acquisition and timing alignment of power supply voltage data and network port data packets. Specifically, after each power supply voltage sampling, the first smart lock adds a timestamp generated by a real-time clock (RTC) to the power supply voltage sampling data and transmits the timestamped power supply voltage sampling data to the second smart lock through the internal bus. While capturing network port data packets, the second smart lock adds corresponding timestamp information to each network port data packet using its built-in real-time clock. The power supply voltage data and network port data packets within the same time window are associated and bound according to the timestamp information. Thus, the power supply voltage sampling data of the universal serial bus port is associated with the network port data packets through the timestamp alignment mechanism, avoiding missed detections and false detections caused by asynchronous data acquisition or single dimension, thereby improving the reliability and accuracy of power network port protection.

[0025] S2. In response to an external unlocking request, extract the Internet Protocol address and Media Access Control address from the network port data packet, and construct the current composite identity of the target power network device based on the Internet Protocol address and the Media Access Control address.

[0026] In some implementations, the step of extracting the Internet Protocol address and Media Access Control address from the network port data packet includes: The source Internet Protocol address and source Media Access Control address are parsed from the network port data packets to form a set of raw address pairs. The frequency of pairings of all source Internet Protocol addresses and source Media Access Control addresses within a preset time period is calculated based on the original address pair set. The address pairs with the highest frequency of occurrence are selected from the original set of address pairs and used as the actual Internet Protocol address and Media Access Control address of the target power network device's network port.

[0027] In the actual operating environment of power network equipment, the network port data packets collected by the second smart lock in this embodiment may contain not only data packets sent by the target power network equipment itself, but also broadcast traffic generated by other power network equipment in the same broadcast domain. For example, Address Resolution Protocol (ARP) broadcasts, deceptive data packets forged by attackers, or redundant data caused by network loops. Deceptive data packets forged by attackers may include data such as forged source Internet Protocol (IP) addresses or source Media Access Control (MAC) addresses. If the captured address pairs are directly used as device identifiers, it is very easy to misjudge the forged addresses or broadcast addresses in the network as legitimate identifiers, leading to the failure of subsequent authentication. When the second smart lock receives an external unlocking request sent by maintenance personnel through an authentication terminal, it retrieves network port data packets from the local capture buffer within a preset time window before and after the unlocking request. It then peels off the data frame header information of the network port data packets layer by layer according to the network protocol, extracts the source media access control address field from the data frame header, and extracts the source internet protocol address field from the network layer header. Each pair of source internet protocol addresses and source media access control addresses is combined to form a raw address pair. All raw address pairs extracted within the preset time window are then integrated to form a set of raw address pairs, thus avoiding the risk of misidentification due to the randomness of data packet selection.

[0028] After forming the original address pair set, relying solely on address information from a single or small number of data packets for identity verification makes it highly susceptible to being deceived by spoofed addresses. Legitimate devices continuously send large amounts of real communication data during normal operation. Therefore, the second smart lock iterates through all original address pairs in the original address pair set, sequentially reading each pair. Using the source Internet Protocol (IP) address and source Media Access Control (MAC) address in each pair as indexes, a hash mapping table is established. Whenever an address pair already existing in the hash mapping table is read, the corresponding counter value is incremented by one. Whenever a new address pair not existing in the hash mapping table is read, a new record is created for that address pair in the hash mapping table, and the counter value is initialized to one. This process is repeated until all address pairs in the original address pair set have been statistically analyzed. Finally, the frequency of each source IP address and source MAC address pairing within a preset time period is obtained. After completing the frequency analysis, the second smart lock retrieves the address pair record with the highest counter value from the hash mapping table. Specifically, it initializes the highest frequency record variable and... The candidate address pair variable is used, and each record in the hash map is traversed sequentially. The counter value of the current record is compared with the value stored in the highest frequency record variable. If the counter value of the current record is greater than the value in the highest frequency record variable, the highest frequency record variable is updated to the counter value of the current record, and the candidate address pair variable is updated to the source Internet Protocol address and source Media Access Control address corresponding to the current record. If the counter value of the current record is less than or equal to the value in the highest frequency record variable, the highest frequency record variable and the candidate address pair variable remain unchanged. The comparison is repeated until all records in the hash map table are traversed. Finally, the address pair stored in the candidate address pair variable is the address pair with the highest frequency of occurrence. This address pair with the highest frequency of occurrence is used as the real Internet Protocol address and Media Access Control address of the target power network equipment network port. In this embodiment, the most active and stable address pairs with the highest frequency of communication behavior are selected from the massive and mixed address information as real identity identifiers. This makes identity verification based on the real network identity benchmark that has been statistically verified, thus enhancing the accuracy and robustness of identity recognition.

[0029] In some implementations, the step of constructing a current composite identity for the target power network device based on the Internet Protocol address and the Media Access Control address includes: The Internet Protocol address and the Media Access Control address are converted to hexadecimal encoding to obtain a static network identity feature vector. The voltage and current waveform data of the network port of the target power network equipment are collected in real time, and the voltage and current waveform data are filtered and denoised to obtain the random fluctuation residual signal of the target power network equipment. Calculate the approximate entropy value of the random fluctuation residual signal to obtain the operating entropy of the residual signal, and calculate the rate of change of the operating entropy based on the difference value of the operating entropy of the residual signal within a continuous time window; Correlation analysis of the residual signal entropy of adjacent network ports is performed based on the topological relationship of the target power network equipment to obtain the behavioral correlation coefficient between network ports; Cross-modal attention fusion is performed based on the static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports to generate a multidimensional composite feature tensor. The multidimensional composite feature tensor is compressed to obtain a composite feature vector, and a hash operation is performed on the composite feature vector to obtain the current composite identity of the target power network device.

[0030] The step of performing cross-modal attention fusion based on the static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports to generate a multidimensional composite feature tensor includes: The static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports are aligned in the time dimension to obtain the time-aligned static identity feature representation, time dynamic feature representation, and spatial correlation feature representation. Attention weights are assigned to the interrelation strength among the time-aligned static identity feature representation, time-dynamic feature representation, and spatial association feature representation to obtain the corresponding modal attention weight matrix; The modal attention weight matrix is ​​used to perform cross-modal attention fusion on static identity feature representation, temporal dynamic feature representation and spatial association feature representation to generate a multidimensional composite feature tensor.

[0031] In a specific embodiment, the Internet Protocol (IP) address and Media Access Control (MAC) address extracted from network data packets are in different string formats, such as binary or dotted decimal. Therefore, this embodiment maps these two heterogeneous addresses, IP and MAC, to a fixed dimension. Specifically, the selected real IP address is segmented and parsed according to the dotted decimal format to obtain four decimal number segments. Each decimal number segment is converted into a two-digit hexadecimal number. If the conversion result is less than two digits, zeros are padded at the high bits, thus obtaining the hexadecimal encoding sequence of the IP address. Simultaneously, the selected real MAC address... The address is segmented and parsed according to the colon-separated hexadecimal format to obtain six hexadecimal byte segments. Each byte segment is directly preserved in its two-digit hexadecimal representation. The hexadecimal encoded sequence of the Internet Protocol address and the hexadecimal byte sequence of the Media Access Control address are concatenated end to end in a preset fixed order to form a continuous hexadecimal number string. Finally, this hexadecimal number string is divided into two adjacent hexadecimal characters as a byte unit, and each byte unit is mapped to its corresponding decimal value. All the mapped decimal values ​​are arranged in the original order to form a one-dimensional sequence, resulting in a static network identity feature vector.

[0032] Simultaneously, this embodiment synchronously samples the instantaneous voltage and current values ​​on the network port transmission line at a preset fixed sampling frequency. The instantaneous voltage and current values ​​obtained from each sampling are arranged in chronological order to form raw voltage and current waveform data. This raw voltage and current waveform data is input into a digital low-pass filter. This digital low-pass filter allows power frequency and lower frequency components to pass through while attenuating and filtering out high-frequency noise components above twice the power frequency, thus outputting filtered voltage and current waveform data. A fixed-length sliding window moves point-by-point across the filtered voltage and current waveform data, calculating the arithmetic mean of all data points within each window as a local estimate of the window's center point. Subtracting the corresponding local estimate from each data point in the filtered voltage and current waveform data yields the random fluctuation residual signal. Since port attacks on power networks often manifest as deterministic, gradual damage to equipment operation or sudden anomalies, this embodiment uses an approximate entropy value to characterize the complexity of random fluctuations and calculates the rate of change of the entropy value between continuous time windows, forming a time-dynamic feature that reflects the drift direction and severity of equipment operating status. In this embodiment, a data segment of fixed time length is extracted from the starting position of the random fluctuation residual signal. This data segment is then divided into subsequences based on a preset pattern length. All subsequences within the data segment are compared pairwise, and the repetition count of similar patterns is calculated. The logarithm of the ratio of the repetition count to the total number of comparisons is used to obtain the approximate entropy value of the data segment. This approximate entropy value is then used as the running entropy of the residual signal. The data segment is then slid backward along the time axis of the complete random fluctuation residual signal according to a preset translation step size. Each slide extracts a subsequence. A new data segment is generated and its residual signal running entropy is calculated. The above sliding is repeated until the entire time axis is covered, resulting in the residual signal running entropy of multiple consecutive time windows arranged in chronological order. For adjacent time windows, in this embodiment, the residual signal running entropy of the next time window is subtracted from the residual signal running entropy of the previous time window to obtain the entropy difference between adjacent windows. The entropy difference is then divided by the time interval between the center points of two adjacent time windows to obtain the entropy change rate per unit time. In this embodiment, the entropy change rate per unit time is used as the running entropy change rate.

[0033] In power network equipment (such as industrial switches or substation intelligent electronic equipment), adjacent network ports typically carry related service flows. For example, data received by one port may be forwarded to another port via an internal backplane. When an attacker injects abnormal traffic or physically tampers with a port, the residual signal operating entropy of adjacent ports may change synchronously or in reverse. Therefore, this embodiment verifies the consistency of port behavior by analyzing the correlation of residual signal operating entropy among multiple ports. Specifically, this embodiment determines adjacent network ports that have a direct physical connection or logical adjacency with the current network port to be protected based on the physical topology connection relationship and port configuration table of the target power network equipment. Then, using the same sampling frequency, filtering parameters, and window length as the current network port, the residual signal operating entropy of each adjacent network port within the corresponding time window is calculated. The residual signal entropy sequence of each adjacent port is formed, and the Pearson correlation coefficient between the residual signal entropy sequence of the current network port and the residual signal entropy sequence of each adjacent network port is calculated to obtain the behavioral correlation coefficient between the current network port and the adjacent network port. The above calculation is repeated for all adjacent network ports to obtain the behavioral correlation coefficient between the current network port and each adjacent port. In summary, under normal operation, ports that forward data within the same device usually show a positive correlation. When an attacker tampers with or attacks a single port from the outside, the rate of change of the entropy of that port will deviate significantly from that of adjacent ports, thus being detected. This embodiment provides a spatial dimension consistency check for subsequent composite verification by analyzing the behavioral correlation of topology-related ports, making it difficult for the forgery or intrusion of a single port to blend into the normal behavior pattern of the device.

[0034] In this embodiment, the static network identity feature vector is an identity identifier feature generated instantaneously at the address screening time, the operational entropy change rate is a dynamic process feature covering a time window, and the behavior correlation coefficient is a correlation feature for multi-port spatial comparison. The generation time, time granularity, and update frequency of these three are different. Therefore, this embodiment uses the occurrence time of the current external unlocking request as a unified time alignment reference point. Since the static network identity feature vector does not change over time, it is marked as the instantaneous static identity feature representation at this reference point. For the operational entropy change rate, this embodiment searches for the operational entropy change rate corresponding to the most recent complete time window covering the reference point. If the reference point happens to be at the intersection of two adjacent time windows, the operational entropy change rates of the previous and subsequent windows are multiplied by their respective weighting coefficients and then summed. The weighting coefficients are determined based on the distance between the reference point and the center points of the two windows; the closer the distance, the higher the weight. This embodiment uses the weighted sum as the time dynamic feature representation at the reference point. For the behavior correlation coefficient, this embodiment selects the same time window as the operational entropy change rate. Furthermore, the correlation coefficient of adjacent port behavior calculated within the overlapping time range window is used as the spatial correlation feature representation at the reference point time. Thus, three sets of static identity feature representations, temporal dynamic feature representations, and spatial correlation feature representations aligned on the same time reference are obtained. At the same time, this embodiment obtains multi-dimensional physical state data of the USB lock within a continuous time window under normal working conditions. The multi-dimensional physical state data includes real-time battery voltage, contact impedance change at the lock head of the USB lock, and power interruption event flag sequence. The contact impedance change can be indirectly calculated by passing a small, safe AC excitation signal between the lock head and the USB port shell and continuously monitoring the amplitude and phase change of its feedback voltage. Any physical plugging and unplugging action will cause instantaneous change in contact impedance. The system continuously monitors the current waveform of the USB port of the power network device charging the power supply unit, extracts the steady-state mean and ripple coefficient of the charging current, and uses the steady-state mean and ripple coefficient as additional dynamic features, updating them to the multi-dimensional physical state data in real time. The additional dynamic features can reflect the health status changes of the power management circuit or the battery itself. In this embodiment, the multi-dimensional physical state data is mapped into a physical feature vector after time-series normalization.

[0035] Since static identity feature representation, physical feature vector, temporal dynamic feature representation, and spatial association feature representation belong to different modalities, their contribution to the final identity fingerprint dynamically changes with the device operation stage and network environment. For example, static address features have higher reliability during stable device operation, while spatial association feature representation has higher reliability during periods of severe power grid load fluctuations. If a pre-set fixed weight is used for fusion, the influence of low-contribution features may be excessively amplified in certain scenarios, while suppressing the expression of high-contribution features. In this embodiment, the time-aligned static identity feature representation, physical feature vector, temporal dynamic feature representation, and spatial association feature representation are input based on Transform. In the cross-modal encoder of the ER architecture, the attention layer automatically learns the modal attention weights between different vector elements, ultimately outputting a multi-dimensional composite feature tensor. Cross-modal attention fusion ensures that the final multi-dimensional composite feature tensor not only contains information from all modalities but also highlights the most reliable modality in the current environment, suppressing interference from unreliable modalities. Compared to simple concatenation, this fusion method improves the uniqueness and anti-interference capability of the fingerprint generated by subsequent hash operations. It should be noted that in the cross-modal attention learning process, this embodiment can represent the time-aligned static identity feature representation, physical feature vector, temporal dynamic feature representation, and spatial association feature representation as four feature moments, respectively. The matrix consists of four modalities. Each feature matrix has rows corresponding to time points and columns corresponding to feature dimensions. These four modalities are combined to construct modal pairs, such as static and temporal-dynamic, static and spatial, and temporal-dynamic and spatial. In this embodiment, dot product similarity or cosine similarity is used to calculate the similarity matrix between the feature matrices of each modal pair, resulting in four similarity matrices. Dot product similarity is the sum of the products of corresponding positional values, and cosine similarity is the dot product divided by its respective modulus. This embodiment normalizes the similarity matrix using the Softmax normalization function, converting the values ​​in the similarity matrix into a probability distribution form, ensuring that the sum of the weights in each row is 1, thus obtaining the modal attention weight matrix. Each element in this modal attention weight matrix... The element represents the attention intensity of one modality to another at a certain point in time. The attention weight allocation proposed in this embodiment can reduce the association strength between a modality and other modalities when a modality is interfered with or attacked, for example, when a static address is temporarily forged, thereby obtaining a lower weight and avoiding adverse effects on the final identity identification. In practical applications, this embodiment can further calculate the importance weight of each modality to itself. By compressing the above modal attention weight matrix, for example, by averaging the columns of the modal attention weight matrix, the comprehensive attention weight coefficient of each modality is obtained. The larger the comprehensive attention weight coefficient, the higher the importance of the modality in characterizing the device identity at the current moment.

[0036] Because the generated multidimensional composite feature tensor has a high dimensionality, directly using it for identity comparison computation incurs significant computational overhead and may contain redundant information, this embodiment employs a fully connected neural network layer to compress the multidimensional composite feature tensor into a fixed-length low-dimensional vector, obtaining a composite feature vector. This compression process retains the information with the largest variance in the original tensor while discarding noise and redundant dimensions. Then, this embodiment performs a block hash operation on the composite feature vector, dividing it into several data blocks according to a preset equal-length partitioning rule, and performing cyclic redundancy check on all numerical elements within each data block. The system performs a checksum (CRC) operation to obtain a checksum value for each data block. The checksum values ​​of all data blocks are then concatenated in a fixed order to form a complete binary string. This binary string is the current composite identity of the target power network device. This composite identity integrates static address, dynamic characteristics of hardware random fluctuations, and spatial correlation between adjacent ports. The hash operation ensures its unidirectionality and uniqueness. Furthermore, because the rate of change of operating entropy evolves slowly over time, the composite identity will naturally change over a long period but remain stable in the short term. This supports repeated verification and resists long-term replay attacks, providing a reliable device identity for subsequent legitimacy verification.

[0037] S3. Discretize the power supply voltage data to obtain several power supply state intervals, and obtain the current power supply state transition probability of the target power network equipment based on the transition relationship between each power supply state interval.

[0038] In some implementations, the step of discretizing the power supply voltage data to obtain several power supply state intervals, and obtaining the current power supply state transition probability of the target power network device based on the transition relationship between each power supply state interval, includes: The power supply voltage data is discretized into several power supply state intervals to obtain a real-time power supply state discrete sequence; The real-time state transition frequency matrix is ​​obtained by statistically analyzing the number of transitions from each power supply state interval to other power supply state intervals within the observation time window based on the real-time power supply state discrete sequence. The current power supply state transition probability of the target power network device is obtained by normalizing all transition frequencies in each power supply state interval based on the real-time state transition frequency matrix.

[0039] In a specific embodiment, after acquiring power supply voltage data from the power contacts of the Universal Serial Bus (USB) port according to a preset fixed sampling period, abnormal sampling points are removed from the power supply voltage data. Power supply voltage data that is lower than the lower threshold of the USB standard voltage or higher than the upper threshold of the USB standard voltage is determined as invalid outliers and removed from the power supply voltage data. Only valid voltage sampling values ​​within the standard voltage range are retained. Then, within the range of valid voltage sampling values ​​from the lowest to the highest voltage value, this embodiment divides the value range into several equally wide voltage sub-intervals according to the principle of equal intervals, and assigns a unique status category identifier to each voltage sub-interval in ascending order. The effective voltage sample value is numbered, and then each retained effective voltage sample value is assigned to a specific range. Specifically, the effective voltage sample value is compared with the lower and upper boundary values ​​of each voltage sub-range in turn. If the effective voltage sample value is greater than or equal to the lower boundary value of a voltage sub-range and less than or equal to the upper boundary value of the voltage sub-range, it is determined that the effective voltage sample value falls within the voltage sub-range. The effective voltage sample value is then mapped to the state category identifier number corresponding to the voltage sub-range. According to the original sampling time sequence, the state category identifier numbers mapped by each effective voltage sample value are arranged and combined in turn to form a real-time power supply state discrete sequence of the same length as the effective voltage sampling sequence.

[0040] Simultaneously, this embodiment sets a fixed observation time window. The start and end times of this observation time window cover the complete voltage sampling period before and after the current unlock request occurs. Within the observation time window, this embodiment reads each state category identifier number in the real-time power supply state discrete sequence in chronological order. Starting from the beginning position of the real-time power supply state discrete sequence, the state category identifier number of the current reading position is recorded as the pre-transition state, and the state category identifier number of the next position immediately following the current reading position is recorded as the post-transition state. This combination of the pre-transition state and the post-transition state is determined as a complete state transition event. This embodiment constructs a counting table with all initial values ​​of zero, with the pre-transition state category as the row direction and the post-transition state category as the column direction. Whenever a state transition event is determined to occur... When a state transition event occurs from a state before a transition to a state after a transition, the original count value in the counting table is increased by one at the intersection of the row containing the state before the transition and the column containing the state after the transition. The reading position is then moved one sampling point to the right. This transition determination and count increment operation is repeated until all adjacent state pairs in the real-time power supply state discrete sequence, except for the last sampling point, have been traversed. It should be noted that the last sampling point at the end of the real-time power supply state discrete sequence does not participate in the state transition determination because it has no adjacent successor state. After the traversal is completed, the value at the intersection of each row and column in the counting table represents the total number of times the transition from the corresponding state before the transition to the corresponding state after the transition actually occurs within the observation time window. This counting table is the real-time state transition frequency matrix.

[0041] Finally, this embodiment performs row-by-row normalization on the real-time state transition frequency matrix. For each row in the real-time state transition frequency matrix, the transition frequency values ​​at all column positions in that row are summed to obtain the total number of transitions from the pre-transition state to all other power supply state intervals within the observation time window. For each column position in that row, the transition frequency value at that column position is divided by the total number of transitions in that row to obtain the relative occurrence ratio of transitioning from the pre-transition state to the corresponding post-transition state. If the total number of transitions for a pre-transition state is zero, that is, no transition to other intervals occurred in that power supply state interval within the observation time window, then the relative occurrence ratio values ​​at all column positions in that row are set to zero to avoid division by zero errors. This results in a current power supply state transition probability matrix with the same number of rows and columns as the real-time state transition frequency matrix. In this current power supply state transition probability matrix, the sum of all relative occurrence ratio values ​​in each row is equal to the unit value. The value at the intersection of each row and column in the square matrix represents the probability of transitioning from the corresponding pre-transition state to the corresponding post-transition state.

[0042] S4. Based on the current power supply state transition probability and the pre-acquired baseline state transition probability, obtain the real-time probability deviation measurement result.

[0043] In some implementations, the step of obtaining the real-time probability deviation metric result based on the current power supply state transition probability and the pre-acquired reference state transition probability includes: The baseline state transition probability is obtained in advance based on the historical power supply state transition probabilities collected from the target power network equipment under normal operation. The real-time probability deviation metric is obtained based on the Euclidean distance between the current power supply state transition probability and the reference state transition probability.

[0044] In a specific embodiment, before the target power network equipment is officially put into port protection operation, this embodiment continuously collects historical power supply voltage data of the universal serial bus port according to the same fixed sampling period, voltage interval division rules, and observation time window length as the real-time acquisition phase. It also collects typical operating conditions of the target power network equipment, such as the equipment startup phase, light load operation phase, rated load operation phase, and peak load operation phase, to ensure that the reference data comprehensively reflects the overall power supply state transitions of the equipment during normal business cycles. After collection, this embodiment discretizes the collected historical power supply voltage data into several power supply state intervals according to the same discretization process as the real-time processing phase, obtaining a discrete sequence of historical power supply states. Following the same state transition frequency statistics method, it counts the number of transitions from each power supply state interval to other power supply state intervals within each historical observation time window, obtaining the historical state transition frequency matrix for each historical observation window. Each historical state transition frequency matrix is ​​then normalized row by row. The historical power supply state transition probabilities for each historical observation window are obtained. Finally, the arithmetic mean of the historical power supply state transition probabilities of all historical observation windows is calculated to obtain the baseline state transition probability. In this embodiment, each corresponding element of the current power supply state transition probability matrix and the baseline state transition probability matrix is ​​traversed, and the Euclidean distance between the two element values ​​is calculated to obtain the deviation metric. The larger the deviation metric, the more serious the deviation of the current power supply state transition mode from the normal baseline. At the same time, this embodiment presets a safety threshold, which is pre-set according to the maximum historical deviation range of the power supply state transition probability of the target power network equipment during normal operation. It is used to define the boundary between the power supply environment being in a safe state and an abnormal state. In this embodiment, the deviation metric is compared with the safety threshold. If the deviation metric is less than or equal to the safety threshold, it is determined that the current power supply environment is within the normal fluctuation range, and a real-time probability deviation metric result of the environmental condition meeting the criteria is generated. If the deviation metric is greater than the safety threshold, it is determined that the current power supply environment has an abnormal deviation, and a real-time probability deviation metric result of the environmental condition not meeting the criteria is generated.

[0045] S5. Perform legality verification based on the real-time probability deviation measurement result and the current composite identity identifier, and perform double-lock linkage unlocking when the legality verification is successful.

[0046] In some implementations, the step of performing legitimacy verification based on the real-time probability deviation measurement result and the current composite identity, and performing dual-lock linkage unlocking when the legitimacy verification passes, includes: When the real-time probability deviation measurement result is a flag indicating that the generation environment conditions are met, the current composite identity is matched with the legitimate device behavior pattern in the feature space to obtain the matching confidence, and a legitimacy verification result is generated based on the matching confidence. If the legality verification result is successful, an unlocking command is generated, and the dual-lock linkage unlocking is executed through the unlocking command.

[0047] In a specific embodiment, when the real-time probability deviation measurement result indicates that the generation environment conditions are met, this embodiment directly verifies the legitimacy of the current composite identity. When the real-time probability deviation measurement result indicates that the generation environment conditions are not met, this embodiment first pre-triggers alarm preparation and caches the current power supply waveform, and then verifies the legitimacy of the current composite identity. During the legitimacy verification of the current composite identity, the second smart lock internally stores a legitimate device behavior pattern library. This legitimate device behavior pattern library stores composite identity templates of all authorized legitimate terminal devices and their associated devices that have accessed the network ports of the target power network equipment. Each composite identity template is a binary number string obtained during the device registration stage using the same hash operation method as the current composite identity generation process. During the legitimacy verification, this embodiment sequentially reads each pre-stored composite identity template from the legitimate device behavior pattern library and performs feature space matching between the current composite identity and the pre-stored composite identity template. The matching process can use the Hamming distance metric to match the binary number string of the current composite identity with the binary number string of the pre-stored composite identity template. The strings are compared bit by bit according to the same position order. The number of bits that differ in corresponding positions between the two binary strings is counted to obtain the difference number. Then, the difference number is divided by the total length of the current composite identity binary string to obtain the relative difference ratio. Next, in this embodiment, the relative difference ratio is subtracted from the value one to obtain the matching confidence score. The matching confidence score ranges from zero to one. The closer the matching confidence score is to the value one, the more similar the current composite identity is to the pre-stored template. The calculated matching confidence score is then compared with a preset legal threshold, which is based on the power network equipment. The balance between false acceptance rate and false rejection rate is pre-set. If the matching confidence is greater than or equal to the legality threshold, the current composite identity is determined to have passed the legality verification, and a legality verification result indicating successful verification is generated. If the matching confidence is less than the legality threshold, the current composite identity is determined to have failed the legality verification, and a legality verification result indicating failed verification is generated. At the same time, an illegal access alarm record is triggered. In this embodiment, if the legality verification result is a successful verification state, an identity condition satisfaction flag is generated; if the legality verification result is a failed verification state, an identity condition non-satisfaction flag is generated.

[0048] When the identity condition is met, this embodiment generates an unlocking command. The unlocking command is synchronously sent to the first and second smart locks via the internal bus. The first and second smart locks execute the unlocking action sequentially. First, the second smart lock releases the network link connectivity, and then the first smart lock releases the physical channel of the Universal Serial Bus port, completing the full protection release of the target power network device's network port. In this embodiment, after receiving the unlocking command, the first smart lock releases the physical blockage of the Universal Serial Bus port insertion channel; after receiving the unlocking command, the second smart lock releases the physical blockage of the network port data link, restoring the normal signal connectivity between the network switching chip and the external network cable. If the identity condition is met but the status is not met, the generation of the unlocking command is refused, the locked state of the dual-lock physical protection structure is maintained, and the corresponding interception reason information is reported to the operation and maintenance management system.

[0049] This invention provides a power network port protection method. The method deploys a dual-lock physical protection structure at the network port of a target power network device, and collects network port data packets and power supply voltage data of the target power network device through the dual-lock physical protection structure. In response to an external unlocking request, it extracts the Internet Protocol address and Media Access Control address from the network port data packets, and constructs a current composite identity for the target power network device based on the Internet Protocol address and the Media Access Control address. It discretizes the power supply voltage data to obtain several power supply state intervals, and obtains the current power supply state transition probability of the target power network device based on the transition relationship between each power supply state interval. It obtains a real-time probability deviation measurement result based on the current power supply state transition probability and a pre-acquired baseline state transition probability. It performs legality verification based on the real-time probability deviation measurement result and the current composite identity, and performs dual-lock linkage unlocking when the legality verification passes. Compared with existing technologies, this method deploys a dual-lock physical protection structure on the target power network equipment and collaboratively collects network port data packets and power supply voltage data to build a collaborative verification mechanism that integrates network identity features and power supply environment status. This achieves high-reliability security protection for power network ports and provides a guarantee for the safe operation of power network equipment.

[0050] It should be noted that the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0051] In one embodiment, such as Figure 2 As shown, an embodiment of the present invention provides a power network port protection system, the system comprising: Data acquisition module 101 is used to deploy a double-lock body physical protection structure at the network port of the target power network device, and to acquire network port data packets and power supply voltage data of the target power network device through the double-lock body physical protection structure; The identifier construction module 102 is used to extract the Internet Protocol address and Media Access Control address from the network port data packet in response to an external unlocking request, and construct the current composite identity identifier of the target power network device based on the Internet Protocol address and the Media Access Control address; The state analysis module 103 is used to discretize the power supply voltage data to obtain several power supply state intervals, and based on the transition relationship between each power supply state interval, to obtain the current power supply state transition probability of the target power network device. The deviation analysis module 104 is used to obtain a real-time probability deviation measurement result based on the current power supply state transition probability and the pre-acquired baseline state transition probability. The linkage unlocking module 105 is used to perform legality verification based on the real-time probability deviation measurement result and the current composite identity identifier, and to perform dual-lock linkage unlocking when the legality verification is passed.

[0052] In some embodiments, the dual-lock physical protection structure includes a first smart lock and a second smart lock; The lock head of the first smart lock is physically inserted into the universal serial bus port of the target power network device, so that the lock head of the first smart lock blocks the insertion channel of the universal serial bus port in the locked state; The first smart lock is used to collect power supply voltage data from the universal serial bus port of the target power network equipment; The second smart lock is connected in series between the network port of the target power network device and the external network cable in a transparent bridging manner. The second smart lock is used to collect data packets from the network port of the target power network device.

[0053] For specific limitations regarding a power network port protection system, please refer to the above-described limitations regarding a power network port protection method, which will not be repeated here. Those skilled in the art will recognize that the various modules and steps described in conjunction with the embodiments disclosed in this application can be implemented in hardware, software, or a combination of both. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0054] This invention provides a power network port protection system. The system's data acquisition module deploys a dual-lock physical protection structure at the network port of a target power network device, and acquires network port data packets and power supply voltage data through this structure. An identifier construction module, responding to an external unlocking request, extracts the Internet Protocol address (IPA) and Media Access Control (MAC) address from the network port data packets, and constructs a current composite identity for the target power network device based on these addresses. A state analysis module discretizes the power supply voltage data to obtain several power supply state intervals, and obtains the current power supply state transition probability of the target power network device based on the transition relationships between these intervals. A deviation analysis module obtains a real-time probability deviation measurement result based on the current power supply state transition probability and a pre-acquired baseline state transition probability. A linkage unlocking module performs a legality verification based on the real-time probability deviation measurement result and the current composite identity, and executes dual-lock linkage unlocking when the legality verification is successful. Compared with existing technologies, this system deploys a dual-lock physical protection structure on the target power network equipment and collaboratively collects network port data packets and power supply voltage data to build a collaborative verification mechanism that integrates network identity features and power supply environment status. This achieves high-reliability security protection for power network ports and provides a guarantee for the safe operation of power network equipment.

[0055] The embodiments described above are merely preferred embodiments of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the technical principles of this invention, and these improvements and substitutions should also be considered within the scope of protection of this application. Therefore, the scope of protection of this patent application should be determined by the scope of the claims.

Claims

1. A power network port protection method, characterized in that, Includes the following steps: A dual-lock physical protection structure is deployed at the network port of the target power network device, and the network port data packets and power supply voltage data of the target power network device are collected through the dual-lock physical protection structure. In response to an external unlocking request, the Internet Protocol address and Media Access Control address are extracted from the network port data packets, and a current composite identity of the target power network device is constructed based on the Internet Protocol address and the Media Access Control address. The power supply voltage data is discretized to obtain several power supply state intervals, and the current power supply state transition probability of the target power network equipment is obtained based on the transition relationship between each power supply state interval. Based on the current power supply state transition probability and the pre-acquired baseline state transition probability, a real-time probability deviation measurement result is obtained; The legitimacy is verified based on the real-time probability deviation measurement result and the current composite identity, and a dual-lock linkage unlock is performed when the legitimacy verification is successful.

2. The power network port protection method as described in claim 1, characterized in that: The dual-lock physical protection structure includes a first smart lock and a second smart lock; The lock head of the first smart lock is physically inserted into the universal serial bus port of the target power network device, so that the lock head of the first smart lock blocks the insertion channel of the universal serial bus port in the locked state; The first smart lock is used to collect power supply voltage data from the universal serial bus port of the target power network equipment; The second smart lock is connected in series between the network port of the target power network device and the external network cable in a transparent bridging manner. The second smart lock is used to collect data packets from the network port of the target power network device.

3. The power network port protection method as described in claim 1, characterized in that, The step of extracting the Internet Protocol address and Media Access Control address from the network port data packet includes: The source Internet Protocol address and source Media Access Control address are parsed from the network port data packets to form a set of raw address pairs. The frequency of pairings of all source Internet Protocol addresses and source Media Access Control addresses within a preset time period is calculated based on the original address pair set. The address pairs with the highest frequency of occurrence are selected from the original set of address pairs and used as the actual Internet Protocol address and Media Access Control address of the target power network device's network port.

4. A power network port protection method as described in claim 1, characterized in that, The step of constructing the current composite identity of the target power network device based on the Internet Protocol address and the Media Access Control address includes: The Internet Protocol address and the Media Access Control address are encoded and converted to obtain a static network identity feature vector; The voltage and current waveform data of the network port of the target power network equipment are collected in real time, and the voltage and current waveform data are filtered and denoised to obtain the random fluctuation residual signal of the target power network equipment. Calculate the approximate entropy value of the random fluctuation residual signal to obtain the operating entropy of the residual signal, and calculate the rate of change of the operating entropy based on the difference value of the operating entropy of the residual signal within a continuous time window; Correlation analysis of the residual signal entropy of adjacent network ports is performed based on the topological relationship of the target power network equipment to obtain the behavioral correlation coefficient between network ports; Cross-modal attention fusion is performed based on the static network identity feature vector, the rate of change of operational entropy and the behavioral correlation coefficient between network ports to generate a multidimensional composite feature tensor. The multidimensional composite feature tensor is compressed to obtain a composite feature vector, and a hash operation is performed on the composite feature vector to obtain the current composite identity of the target power network device.

5. A power network port protection method as described in claim 4, characterized in that, The step of performing cross-modal attention fusion based on the static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports to generate a multidimensional composite feature tensor includes: The static network identity feature vector, the rate of change of operational entropy, and the behavioral correlation coefficient between network ports are aligned in the time dimension to obtain the time-aligned static identity feature representation, time dynamic feature representation, and spatial correlation feature representation. Attention weights are assigned to the interrelation strength among the time-aligned static identity feature representation, time-dynamic feature representation, and spatial association feature representation to obtain the corresponding modal attention weight matrix; The modal attention weight matrix is ​​used to perform cross-modal attention fusion on static identity feature representation, temporal dynamic feature representation and spatial association feature representation to generate a multidimensional composite feature tensor.

6. A power network port protection method as described in claim 1, characterized in that, The step of discretizing the power supply voltage data to obtain several power supply state intervals, and obtaining the current power supply state transition probability of the target power network equipment based on the transition relationship between each power supply state interval, includes: The power supply voltage data is discretized into several power supply state intervals to obtain a real-time power supply state discrete sequence; The real-time state transition frequency matrix is ​​obtained by statistically analyzing the number of transitions from each power supply state interval to other power supply state intervals within the observation time window based on the real-time power supply state discrete sequence. The current power supply state transition probability of the target power network device is obtained by normalizing all transition frequencies in each power supply state interval based on the real-time state transition frequency matrix.

7. A power network port protection method as described in claim 1, characterized in that: The step of obtaining the real-time probability deviation measurement result based on the current power supply state transition probability and the pre-acquired baseline state transition probability includes: The baseline state transition probability is obtained in advance based on the historical power supply state transition probabilities collected from the target power network equipment under normal operation. The real-time probability deviation metric is obtained based on the Euclidean distance between the current power supply state transition probability and the reference state transition probability.

8. A power network port protection method as described in claim 1, characterized in that, The step of performing legality verification based on the real-time probability deviation measurement result and the current composite identity, and performing dual-lock linkage unlocking when the legality verification is successful, includes: When the real-time probability deviation measurement result is a flag indicating that the generation environment conditions are met, the current composite identity is matched with the legitimate device behavior pattern in the feature space to obtain the matching confidence, and a legitimacy verification result is generated based on the matching confidence. If the legality verification result is successful, an unlocking command is generated, and the dual-lock linkage unlocking is executed through the unlocking command.

9. A power network port protection system, characterized in that, The system includes: The data acquisition module is used to deploy a double-lock body physical protection structure at the network port of the target power network equipment, and to acquire network port data packets and power supply voltage data of the target power network equipment through the double-lock body physical protection structure; An identifier construction module is used to extract the Internet Protocol address and Media Access Control address from the network port data packet in response to an external unlocking request, and construct the current composite identity identifier of the target power network device based on the Internet Protocol address and the Media Access Control address; The state analysis module is used to discretize the power supply voltage data to obtain several power supply state intervals, and based on the transition relationship between each power supply state interval, to obtain the current power supply state transition probability of the target power network equipment. The deviation analysis module is used to obtain real-time probability deviation measurement results based on the current power supply state transition probability and the pre-acquired baseline state transition probability; The linkage unlocking module is used to perform legality verification based on the real-time probability deviation measurement result and the current composite identity identifier, and to perform dual-lock linkage unlocking when the legality verification is successful.

10. A power network port protection system as described in claim 9, characterized in that: The dual-lock physical protection structure includes a first smart lock and a second smart lock; The lock head of the first smart lock is physically inserted into the universal serial bus port of the target power network device, so that the lock head of the first smart lock blocks the insertion channel of the universal serial bus port in the locked state; The first smart lock is used to collect power supply voltage data from the universal serial bus port of the target power network equipment; The second smart lock is connected in series between the network port of the target power network device and the external network cable in a transparent bridging manner. The second smart lock is used to collect data packets from the network port of the target power network device.

Images