A power communication network operation risk situation awareness method and system

Abstract

The application discloses a power communication network operation risk situation awareness method and system, relates to the technical field of power communication, and comprises the following steps: for the power communication network, relying on a three-layer mapping relationship, minimum protocol unit decomposition and dynamic recombination, deploying an operation and maintenance detector, continuously sampling and analyzing performance data to locate an abnormal communication path by the operation and maintenance detector; for the abnormal communication path, calling multi-source heterogeneous data, completing high-dimensional and low-dimensional processing, projecting and mapping layers to deduce a risk propagation path, combining protocol abnormal behavior baseline analysis to output an operation risk situation, and completing risk control management of the power communication network according to the operation risk situation. The application solves the technical problems that the existing power communication monitoring means cannot realize multi-level network element correlation research and judgment, cannot identify implicit transmission abnormalities, and cannot trace the propagation path of one-sided risk data, achieves the technical effects of cross-level fault cause and effect tracking and accurate positioning, and improves the accuracy and timeliness of operation risk situation awareness.

Description

Technical Field

[0001] This invention relates to the field of power communication technology, and in particular to a method and system for assessing operational risks in power communication networks. Background Technology

[0002] Power communication networks rely on SDN (Software-Defined Networking) to carry core services such as relay protection and dispatching. The operational risks of the entire network directly determine the stability of the power grid, making accurate situational awareness a core requirement for operation and maintenance. Existing SDN power communication monitoring solutions mostly collect optical path performance data or resolve protocols separately, and are only effective in closed, layered, and isolated networks. However, power communication is characterized by deep coupling between the optical cable physical layer, transmission network layer, and power service layer, as well as frequent intra-domain / cross-domain protocol interactions. Traditional monitoring methods lack a unified three-layer mapping system, lack standardized protocol anomaly baselines, and cannot conduct cross-layer causal inference. Existing solutions only collect indicators at single points, making it difficult to capture hidden risks such as protocol fragmentation and reassembly, and cross-domain buffer overflows. The collected data has a single dimension, the risk propagation path cannot be traced, and the acquired operational data is one-sided and distorted, failing to accurately quantify risks across the entire network and failing to support the hierarchical risk control and proactive operation and maintenance management needs of power communication networks. Summary of the Invention

[0003] This application provides a method and system for assessing the operational risks of power communication networks, which solves the technical problems of existing power communication monitoring methods being unable to achieve multi-level network element correlation analysis, difficult to identify hidden transmission anomalies, and having one-sided risk data that cannot trace the propagation path.

[0004] The first aspect of this application provides a method for assessing operational risk status in a power communication network. The method includes: deploying an operation and maintenance detector for the power communication network based on the mapping relationship between the optical cable physical layer, communication network layer, and service layer, and based on the decomposition and dynamic reassembly of the smallest protocol unit of the network protocol; using the communication network layer within the operation and maintenance detector, performing continuous sampling analysis of performance data at key locations to locate abnormal communication paths; for the abnormal communication paths, retrieving multi-source heterogeneous data and performing high-dimensional and low-dimensional processing, projecting it to the mapping layer to perform inter-layer correlation location and intra-layer causal reasoning, performing baseline analysis of abnormal protocol behavior based on the determined layer propagation path, and outputting an operational risk status; and performing risk control management on the power communication network based on the operational risk status.

[0005] A second aspect of this application provides a power communication network operation risk situation awareness system, the system comprising: an operation and maintenance detector deployment module, used to deploy operation and maintenance detectors for the power communication network based on the mapping relationship between the optical cable physical layer, communication network layer and service layer and based on the decomposition and dynamic reorganization of the smallest protocol unit of the network protocol; an abnormal communication path location module, used to perform continuous sampling analysis of performance data at key location points using the communication network layer within the operation and maintenance detector to locate abnormal communication paths; an operation risk situation acquisition module, used to retrieve multi-source heterogeneous data for the abnormal communication paths and perform high-dimensional and low-dimensional processing, project it to the mapping layer to perform inter-layer correlation location and intra-layer causal reasoning, perform baseline analysis of abnormal protocol behavior based on the determined layer propagation path, and output the operation risk situation; and a risk control management execution module, used to perform risk control management on the power communication network based on the operation risk situation.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0007] This application collects multi-dimensional operational data at key points in the communication network, processes it through time-series smoothing and hierarchical feature extraction to obtain network anomaly-related data, deduces risk propagation paths and hazard levels, and combines the analysis results of hierarchical resource mapping and protocol evaluation standards to make judgments. This allows for the accurate identification of various hidden and explicit operational hazards within the communication network, making the assessment results of the power communication network's operational risk situation more comprehensive and reliable. It achieves the technical effect of cross-level fault causal tracing and precise location, improving the accuracy and timeliness of operational risk situation perception. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a flowchart illustrating a method for assessing operational risks in a power communication network, as provided in an embodiment of this application.

[0010] Figure 2 This is a schematic diagram of the structure of a power communication network operation risk situation awareness system provided in an embodiment of this application.

[0011] Figure labeling: Operation and maintenance detector deployment module 1, abnormal communication path location module 2, operation risk status acquisition module 3, risk control management execution module 4. Detailed Implementation

[0012] This application provides a method and system for assessing the operational risks of power communication networks, which solves the technical problems of existing power communication monitoring methods being unable to achieve multi-level network element correlation analysis, difficult to identify hidden transmission anomalies, and having one-sided risk data that cannot trace the propagation path.

[0013] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0014] It should be noted that the terms "first," "second," etc., in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices.

[0015] Example 1, as Figure 1 As shown, a method for assessing operational risks in a power communication network includes:

[0016] For power communication networks, operation and maintenance detectors are deployed based on the mapping relationship between the optical cable physical layer, communication network layer and service layer, and the decomposition and dynamic reorganization of the smallest protocol unit based on network protocols.

[0017] In this embodiment, the power communication network is an optical fiber transmission network carrying power grid relay protection and dispatching services, consisting of optical cables, transmission equipment, and service terminals. The operation and maintenance detector is a monitoring and acquisition device deployed at network element ports to collect optical path and protocol message data.

[0018] Specifically, the deployment process of the operation and maintenance detector is as follows: first, the power communication network is restructured in a layered and lightweight manner to build a mapping layer; then, the two types of interaction protocols, namely intra-network and cross-domain, are sorted out and two sets of differentiated protocol anomaly baselines are formed; finally, the operation and maintenance detector is deployed based on the mapping layer and the protocol anomaly baselines. The specific implementation process of this step will be described in detail later.

[0019] By employing the communication network layer within the operation and maintenance detector, continuous sampling and analysis of performance data at key locations are performed to pinpoint abnormal communication paths.

[0020] In this embodiment, the abnormal communication path is an optical fiber service transmission link that experiences optical power degradation, message abnormalities, or transmission interruption.

[0021] Optionally, a type of sampling point can be defined based on key location points within the communication network layer. Performance data including optical power, signal-to-noise ratio, and bit error rate can be continuously collected. Then, differentiated sensitivity weights can be assigned according to the service type carried by each network path, and the performance data can be verified. This completes the location operation of abnormal communication paths. The specific implementation process of this step will also be described in detail later.

[0022] For the abnormal communication path, multi-source heterogeneous data is retrieved and high-dimensional and low-dimensional processing is performed. The data is then projected to the mapping layer to perform inter-layer correlation localization and intra-layer causal reasoning. Based on the determined layer propagation path, the abnormal behavior baseline analysis of the protocol is performed, and the operational risk status is output.

[0023] In one embodiment of this application, after the abnormal communication path is located, a complete analysis process of the operational risk status of the power communication network is initiated for the located abnormal communication path. First, the retrieval of multi-source heterogeneous data is triggered, and full-dimensional operational data related to the abnormal communication path are collected. High-dimensional feature dimension processing and low-dimensional semantic dimension processing are performed on the retrieved multi-source heterogeneous data to obtain the feature analysis results of the corresponding dimensions.

[0024] Next, the two types of feature results obtained from the processing are projected into the mapping layer. Based on the three-layer association structure of the mapping layer, inter-layer association positioning and intra-layer causal reasoning are performed to determine the layer propagation path of risk between the optical cable physical layer, communication network layer and service layer. Combined with the established protocol abnormal behavior baseline, matching analysis and anomaly judgment are carried out along the layer propagation path, and finally the operation risk status results of the power communication network in the corresponding region are generated and output.

[0025] The specific constraints and pre-response processes for retrieving multi-source heterogeneous data, the detailed implementation methods for high-dimensional and low-dimensional processing, and the execution process of inter-layer association and causal reasoning in the mapping layer will be described in detail in the corresponding embodiments below.

[0026] Based on the aforementioned operational risk situation, risk control management is implemented for the power communication network.

[0027] Specifically, based on the operational risk situation, risk types are distinguished and graded responses are carried out. For Category I services with higher impact, immediate switching of primary and backup optical paths and protocol downgrading are performed. For Category II services with lower impact, maintenance suggestions are generated and added to the maintenance work order queue. At the same time, routing policies are issued to the network management port to complete route reconfiguration for abnormal paths of protocol conversion. The specific implementation process of this step will be described in detail later.

[0028] Furthermore, the method provided in this application embodiment includes:

[0029] For the power communication network, a lightweight hierarchical reconstruction is performed to obtain the mapping layer; the intra-domain operation protocol and cross-domain interaction protocol of the power communication network are obtained, and the abnormal protocol behavior baseline is mined, wherein the abnormal protocol behavior baseline includes a first abnormal protocol baseline based on the intra-domain operation protocol and a second abnormal protocol behavior baseline based on the cross-domain interaction protocol; based on the mapping layer and the abnormal protocol behavior baseline, operation and maintenance detectors are deployed.

[0030] In this embodiment, the mapping layer is a data storage and processing module that stores the mapping relationships between the three layers of optical cable, optical path, and service. The protocol abnormal behavior baseline is a standard data threshold library formed by protocol units and reassembled messages during normal device operation.

[0031] Specifically, the process begins by extracting the raw data sources for the optical cable physical layer, communication network layer, and service layer from the resource management module and network management acquisition module. These raw data sources include static resource data such as pole and tower ledgers, optical cable segment routing information, splice box location information, optical path configuration data, channel time slot data, transmission system networking information, relay protection service configuration, dispatch automation service links, and transaction settlement service channel information. Next, the raw data for each layer undergoes cleaning, alignment, and normalization. The cleaning process removes duplicate data entries using deduplication rules and invalid data with missing fields using null value filtering rules. The alignment process uses a unified resource code as the primary key to match entries corresponding to the same resource in each layer of data. The normalization process uses a preset field mapping table to convert the field names and data formats output by different network management vendors into a unified standard format.

[0032] Subsequently, logical association rules between elements at each layer are established, clarifying that each relay protection service in the business layer is carried by the corresponding channel in the communication network layer. The corresponding channel is sequentially associated with the corresponding optical path and transmission system, and further mapped to the corresponding tower, cable segment, and splice box in the optical cable physical layer. Without altering the physical topology, a unified mapping layer data structure is constructed based on the above association rules. In this embodiment, the mapping layer is implemented using a three-layer mapping relationship matrix data structure. The specific composition of this matrix, namely the layer element definition and association weight expression rules of the three-dimensional association matrix, is detailed in the specific implementation details below.

[0033] Next, the intra-domain operation protocols and cross-domain interaction protocols of the power communication network are acquired. The transmission protocol types operating within each independent operation and maintenance domain are identified, along with the protocol conversion rules and signaling interaction processes for data interaction between different operation and maintenance domains. Based on the intra-domain operation protocols and cross-domain interaction protocols, corresponding abnormal protocol behavior baselines are mined, forming a complete baseline library containing a first protocol abnormality baseline and a second protocol abnormality baseline. The specific algorithm implementation process for mining the intra-domain two-layer baseline and the cross-domain conversion overflow baseline in this step is described in detail in subsequent embodiments.

[0034] Finally, based on the resource distribution of the mapping layer and the detection requirements for protocol anomaly baselines, maintenance detectors are deployed at key nodes in the power communication network, including core transmission network element nodes, cross-domain protocol conversion gateways, backbone optical cable splicing sites, and core service access rooms. The deployment locations are determined as follows: core transmission network element nodes cover the main transmission aggregation points of the communication network layer; cross-domain protocol conversion gateways cover the conversion boundary points of cross-domain interaction protocols; backbone optical cable splicing sites cover the backbone aggregation points of the optical cable physical layer; and core service access rooms cover the key service entry points of the service layer. These deployment locations together form a complete detection grid covering the three-layer mapping relationship and protocol anomaly detection requirements. During deployment, the maintenance detectors connect to the network management devices of the corresponding nodes via northbound interfaces to obtain performance and configuration data. They also collect protocol message data at the nodes through port mirroring, ensuring that each maintenance detector covers the physical resources, network links, and service channels within its corresponding area, while possessing the capability for message parsing and anomaly detection for the corresponding protocols.

[0035] By extracting and processing data in layers and building associated mappings, sorting out protocols by domain and matching and deploying detection nodes, the precise deployment of operation and maintenance detectors was achieved, providing a stable detection foundation for subsequent network-wide risk perception.

[0036] Furthermore, the method provided in this application embodiment includes:

[0037] The mapping layer is a mapping relationship matrix based on the optical cable physical layer, communication network layer and service layer; wherein, the optical cable physical layer uses towers, optical cable segments and splice boxes as layer elements, the communication network layer uses optical paths, channels and transmission systems as layer elements, and the service layer uses relay protection, dispatch automation and transaction settlement as layer elements.

[0038] In this embodiment, the optical cable physical layer is the underlying physical transmission carrier composed of hardware transmission media such as optical fiber cables, optical distribution boxes, and optical transmission modules. The communication network layer is the optical transmission network scheduling layer that carries various power service optical paths, transmission channels, and protocol conversion gateways. The service layer is the application terminal layer that runs core power grid services such as relay protection, dispatch automation, and power trading settlement.

[0039] Optionally, the mapping layer constructed during the aforementioned lightweight reconstruction process can be defined using a mapping relationship matrix. This mapping relationship matrix is ​​a three-dimensional correlation matrix, with the three dimensions corresponding to the optical cable physical layer, communication network layer, and service layer, respectively. The physical layer elements include towers, optical cable segments, and splice boxes. A unique row index is assigned to each tower, optical cable segment, and splice box in the matrix, and each row stores the location code, specifications, and operating status attributes of the corresponding element. The communication network layer elements include optical paths, channels, and transmission systems. A corresponding column index is assigned to each optical path, channel, and transmission system in the matrix, and each column stores the bandwidth parameters, time slot configuration, and bearer relationship attributes of the corresponding element. The service layer elements include relay protection, dispatch automation, and transaction settlement. A corresponding depth index is assigned to each type of service in the matrix, and each depth dimension stores the priority, latency requirements, and protection level attributes of the corresponding service.

[0040] In the mapping relationship matrix, the cross-layer mapping relationship is expressed numerically using the association weight value. When determining whether there is a bearer association between the physical layer elements of the optical cable and the communication network layer elements, the fiber core resource ledger of the optical cable physical layer and the optical path port configuration information of the communication network layer are matched item by item. When there is a one-to-one physical connection between the corresponding fiber core in a certain optical cable segment or splice box and the transceiver port of a certain optical path, it is determined that there is a bearer association between the two. When a physical layer element and a network layer element have a bearer association, the weight value of the corresponding matrix position is set to 1, and it is set to 0 when there is no association.

[0041] When determining whether there is a bearer association between communication network layer elements and service layer elements, the channel time slot configuration data of the communication network layer is matched and verified with the service link routing information of the service layer. If the time slot resource of a certain channel is exclusively occupied or fixedly multiplexed by the corresponding service, a bearer association is determined. The priority coefficient of the corresponding service is assigned a graded value according to the service's operation and maintenance protection level, ranging from 0 to 1. The larger the value, the higher the service priority. Relay protection services correspond to the highest priority coefficient, dispatch automation services to the second highest priority coefficient, and transaction settlement services to the regular priority coefficient. When a network layer element and a service layer element have a bearer association, the weight value at the corresponding depth position is set to the priority coefficient of the corresponding service; otherwise, it is set to 0. By traversing and calculating the weight values, the physical resources of the entire link corresponding to any service can be quickly located, and all affected services can be traced upwards from any physical fault point.

[0042] Furthermore, this mapping matrix is ​​stored in a relational database, with separate tables for physical layer elements, network layer elements, business layer elements, and association weights. Each table is linked by a foreign key using a unified resource encoding. When performing a cross-layer query, a structured query is used to traverse the association weight tables. Inputting an element identifier from any level allows for step-by-step matching to obtain the associated elements from the other two levels, thus completing the cross-layer mapping and location.

[0043] By clearly defining the relationship and numerical expression rules of the three-layer elements through a three-dimensional matrix structure, a unified mapping of physical, network, and business resources is achieved, providing standardized data support for cross-layer risk transmission analysis.

[0044] Furthermore, the method provided in this application embodiment includes:

[0045] The smallest protocol unit of the protocol running within the domain is determined, and a reassembly identifier is added to each smallest protocol unit. The abnormal behavior baseline of the unit and the abnormal behavior baseline of the protocol packet based on the reassembly state are mined as the first protocol abnormal baseline of the behavior within the domain. Each domain corresponds to at least one running protocol with a domain name encoding. The reassembly identifier includes the fragment sequence number, the total number of fragments, and the packet fitting metacode. The signaling structure differences of the cross-domain interaction protocol are determined, and the abnormal path that probabilistically triggers the buffer overflow vulnerability during the protocol conversion process is identified as the second protocol abnormal baseline of the cross-domain behavior.

[0046] In this embodiment of the application, the smallest protocol unit is a basic data segment that cannot be further divided after the power communication message is split, which contains independent protocol information such as single field parameters, identification codes and status values.

[0047] Specifically, the mining of protocol abnormal behavior baselines is divided into two aspects: mining the first protocol abnormal baseline of intra-domain running protocols and mining the second protocol abnormal baseline of cross-domain interaction protocols.

[0048] First, when acquiring the intra-domain operation protocols and cross-domain interaction protocols of the power communication network, the operation and maintenance detector connects to the network management system of the transmission equipment corresponding to each operation and maintenance domain. It reads the transmission protocol types, message format definitions, and signaling interaction rules used by the services carried within each operation and maintenance domain, assigns a unique domain name code to each domain, and binds it to the corresponding operation protocol, thus forming a complete list of intra-domain operation protocols. Simultaneously, it connects to the protocol conversion gateway in the cross-domain link, reads the protocol conversion configuration information, field mapping rules, and signaling conversion process on both sides of the gateway, and combines this with the actual cross-domain interaction messages collected by port mirroring to obtain the complete structure and interaction logic of the cross-domain interaction protocols, forming a list of cross-domain interaction protocols.

[0049] For the first protocol anomaly baseline mining of protocols running within the domain: First, the message structure of the protocols running within the domain is decomposed to determine the smallest protocol unit. Each smallest protocol unit is an independent group of fields in the protocol message that cannot be further divided. A reassembly identifier is added to each smallest protocol unit obtained from the decomposition. The reassembly identifier includes the fragment sequence number, the total number of fragments, and the packet fitting metacode. The fragment sequence number indicates the order of the current unit in the complete message, the total number of fragments indicates the total number of units split from the complete message, and the packet fitting metacode indicates the message packet to which the unit belongs.

[0050] Next, a large number of protocol message samples under normal operating conditions within the domain were collected. The field value range, frequency of occurrence, and time interval of each smallest protocol unit were statistically analyzed. The characteristic distribution of normal samples was statistically analyzed using a normal distribution fitting method. The 3σ principle was used to determine the normal value range of each feature. Specifically, the arithmetic mean and sample standard deviation of the corresponding features for all normal samples were first calculated. The arithmetic mean minus three times the sample standard deviation was used as the lower limit of the normal range, and the arithmetic mean plus three times the sample standard deviation was used as the upper limit. Feature states within this range were considered normal, and feature states outside this range were considered abnormal. This method was used to obtain the baseline for abnormal unit behavior. Simultaneously, the packet length, checksum, reassembly interval, and fragmentation order under the complete message reassembly state were statistically analyzed. The same statistical fitting method was used to determine the normal feature range, obtaining the protocol packet abnormal behavior baseline based on the reassembly state. The unit abnormal behavior baseline and the protocol packet abnormal behavior baseline together constitute the first protocol abnormality baseline for behavior within the domain. Each operation and maintenance domain corresponds to at least one operating protocol identified by a domain name code. Each domain generates its corresponding first protocol abnormality baseline and stores it in the baseline database.

[0051] For the second protocol anomaly baseline mining of cross-domain interaction protocols: First, the signaling structure differences of protocols running in different domains are compared, and the field mapping relationship and signaling conversion process at the protocol conversion gateway are analyzed. The protocol conversion process under different traffic loads is simulated, with the traffic load gradually increased in a fixed step size. This fixed step size can be set to any value between 50Mbps and 200Mbps based on the data processing capacity of the protocol conversion gateway; those skilled in the art can also choose other applicable step size values ​​based on the actual gateway performance. The occupancy rate of the protocol conversion buffer is recorded in real time. When the occupancy rate reaches the capacity threshold and the duration exceeds a preset threshold (which can be set to any value between 5 seconds and 30 seconds based on the actual operation and maintenance strategy, or dynamically configured based on network latency sensitivity), the corresponding packet combinations and traffic paths are marked as abnormal paths. These abnormal paths are used as the second protocol anomaly baseline for cross-domain behavior. The first and second protocol anomaly baselines are stored together in a baseline library for subsequent use by the operation and maintenance detector during anomaly detection.

[0052] By splitting the smallest protocol unit and adding a recombination identifier to construct a two-layer intra-domain baseline, and identifying protocol conversion overflow paths to construct a cross-domain baseline, a protocol anomaly evaluation standard covering intra-domain and cross-domain scenarios is formed, providing an accurate basis for subsequent protocol anomaly judgment.

[0053] Furthermore, the method provided in this application embodiment includes:

[0054] In the communication network layer, a type of sampling point is determined based on key location points; performance data is continuously collected based on the type of sampling point, wherein the performance data includes optical power, signal-to-noise ratio, and bit error rate; differentiated sensitivity weights are assigned according to the service type carried by each network, the performance data is verified, and abnormal communication paths are identified.

[0055] Specifically, firstly, at the communication network layer, a type of sampling point is determined based on the network topology and service carrying distribution. Specifically, relying on the communication network layer element information recorded in the mapping layer constructed in the previous steps, the number of service carrying points, service importance level, and link topology location of all optical paths and channels are analyzed. Key locations such as service ports of core transmission network elements, the two ends of backbone optical paths, and transfer nodes of cross-domain links are selected as the first type of sampling point. A unique sampling point code is assigned to each first type of sampling point, associated with the corresponding optical path identifier and channel identifier, ensuring that the sampling data can be accurately traced back to its respective communication path.

[0056] Based on a defined set of sampling points, continuous performance data acquisition is performed without interruption. The system connects to the network management interface of the transmission equipment corresponding to each sampling point via an operation and maintenance detector, continuously reading three types of performance data: optical power, signal-to-noise ratio, and bit error rate, according to a fixed sampling period. For example, the sampling period can be set to 1 second. The acquisition process remains continuous throughout, without interruption even if the current data is within the normal range. Each set of acquired performance data is accompanied by a corresponding sampling timestamp and sampling point code, and is stored in a local cache queue in real time for subsequent verification. Under normal operating conditions where no anomalies are detected, only data acquisition and basic verification are continuously performed; deep analysis is not initiated. Only when verification determines the existence of an abnormal communication path will the path identifier, abnormal performance indicator type, abnormal value, and anomaly occurrence timestamp of the abnormal communication path be synchronously transmitted to the subsequent analysis module, triggering detailed analysis operations for that path.

[0057] Next, each sampling point of type I is assigned to a corresponding communication network path, and each communication network path carries one or more service types. Based on the service type carried by each network path, a differentiated sensitivity weight is assigned to the corresponding path. Those skilled in the art need to classify the weight levels according to the importance of the service and set corresponding values. For example, the sensitivity weight of a path carrying relay protection services can be set to 1.5, the sensitivity weight of a path carrying dispatch automation services can be set to 1.2, and the sensitivity weight of a path carrying transaction settlement services can be set to 1.0. The larger the weight value, the higher the importance of the service carried by the path, and the higher the corresponding anomaly identification sensitivity. The anomaly judgment threshold is set based on the technical specifications of the corresponding transmission equipment and daily operation and maintenance experience. The optical power threshold is determined with reference to the nominal values ​​of the receiving sensitivity and transmitting power of the equipment's optical module. The signal-to-noise ratio threshold is set with reference to the minimum acceptable threshold of the corresponding transmission system, and the bit error rate threshold is set with reference to the bit error rate performance requirements of the corresponding service.

[0058] Finally, a weighted threshold verification method is used to verify the collected performance data. The measured values ​​of optical power, signal-to-noise ratio and bit error rate are multiplied by the sensitivity weight of the corresponding path to obtain the weighted verification value. When the weighted verification value of any performance indicator exceeds the corresponding anomaly judgment threshold, the communication path to which the sampling point belongs is determined to be an abnormal communication path.

[0059] By deploying sampling points at key locations to perform continuous performance data collection at fixed intervals and conducting threshold verification by allocating quantitative and differentiated weights based on the type of service being carried, the system achieves accurate location of abnormal communication paths and on-demand triggering of in-depth analysis, thus ensuring the sensitivity of anomaly identification while reasonably controlling the consumption of operating resources.

[0060] Furthermore, the method provided in this application embodiment includes:

[0061] According to the pre-set emergency plan of the operation and maintenance detector, the abnormal communication path is matched and the plan response is performed; for the abnormal communication path, multi-source heterogeneous data collected in a distributed manner is retrieved with spatiotemporal code as a constraint; based on the multi-source heterogeneous data, parallel analysis based on the mapping layer and the protocol abnormal behavior baseline is performed to obtain the operational risk situation.

[0062] Specifically, the operation and maintenance detector has a pre-built hierarchical emergency plan library. This library is divided into three levels of response plans according to the level of business impact, the severity of the anomaly, and the scope of impact. Each level of plan corresponds to a set of preset response actions. The first-level plan is for scenarios where the path carrying relay protection services experiences severe performance degradation, and it executes the highest priority actions of increasing the collection frequency and issuing early warnings. The second-level plan is for scenarios where the path carrying dispatch automation services experiences moderate performance anomalies, and it executes moderate collection frequency increases and anomaly marking actions. The third-level plan is for scenarios where the path carrying transaction settlement services experiences slight performance fluctuations, and it executes normal collection frequency and record marking actions.

[0063] Once the abnormal communication path is located, the path identifier, service type, abnormal performance indicator category, and degree of deviation are extracted. This information is then used as matching criteria to perform a conditional matching search in a pre-set emergency plan database. A combination of exact string matching and threshold range matching is used to filter out the target emergency plan with the highest match to the current abnormal scenario. Immediately after matching, the corresponding plan's response actions are executed, including prioritizing data collection for the corresponding path, marking the path as a key monitoring target, and sending a pre-alarm notification to the operations and maintenance management module. Subsequent data retrieval processes are only initiated after the plan response is completed.

[0064] When retrieving multi-source heterogeneous data for abnormal communication paths, a spatiotemporal code is used as the retrieval constraint. The spatiotemporal code consists of two parts: spatial encoding and temporal encoding. The spatial encoding is generated by concatenating the unique resource codes of the optical fiber physical layer nodes, communication network layer elements, and service layer access points associated with the abnormal communication path, defining the spatial range for data retrieval. The temporal encoding traces back a preset duration based on the timestamp of the anomaly. For example, the preset duration can be selected within the range of 15 minutes to 1 hour, with a typical value set to 30 minutes. This value can also be flexibly configured according to actual operation and maintenance strategies. Then, it extends backward to the current moment, defining the time window for data retrieval. According to the constraints of the spatiotemporal code, data retrieval commands are sent to the operation and maintenance detectors and network management acquisition modules distributed across each node. Each acquisition node verifies whether it falls within the retrieval range based on the spatial encoding, extracts the acquired data within the corresponding time period based on the temporal encoding, and returns multi-source heterogeneous data including performance data, protocol message data, and resource configuration data.

[0065] Finally, the retrieved multi-source heterogeneous data undergoes a summary verification, which includes three aspects: integrity verification, deduplication verification, and format verification. Integrity verification confirms the absence of missing data within the corresponding spatiotemporal range by comparing the sampling period and the number of data entries. Deduplication verification removes duplicate data entries based on the unique identifier and timestamp of the data. Format verification verifies the format and value range of each field according to a unified data standard, eliminating invalid data with abnormal formats. The verified data is then sent to a parallel analysis unit for parallel analysis processing based on the mapping layer and the protocol's abnormal behavior baseline. The specific implementation process of parallel analysis will be detailed in subsequent embodiments.

[0066] By implementing pre-set hierarchical contingency plans for abnormal scenario matching and proactive response, and by using spatiotemporal codes to constrain the scope of distributed data retrieval with a corresponding data verification mechanism, rapid response and accurate and compliant data retrieval after anomalies occur are achieved, providing an efficient and targeted data foundation for subsequent risk situation analysis.

[0067] Furthermore, the method provided in this application embodiment includes:

[0068] The multi-source heterogeneous data is subjected to weighted fusion and Kalman smoothing preprocessing to output a time-aligned unified data view. The unified data view is traversed and mapped to a low-dimensional semantic topic vector according to the topic-term probability distribution. A high-dimensional feature vector is generated by concatenating the low-dimensional semantic topic vector with the structured operation attributes. The low-dimensional semantic topic vector and the high-dimensional feature vector are projected onto the mapping layer of the operation and maintenance detection device to perform a propagation trend analysis based on causal direction to determine the operation risk trend.

[0069] In one embodiment, weighted fusion and Kalman smoothing preprocessing are performed on the retrieved multi-source heterogeneous data. This multi-source heterogeneous data includes performance data, protocol message data, and resource configuration data reported by different acquisition nodes, with differences in sampling periods, timestamp precision, and data formats. First, fusion weights are assigned to different types of data sources, and weight levels are determined based on the reliability of the data acquisition method. For example, the weight of performance data directly acquired from a device port can be set to 0.6, the weight of protocol message data acquired via port mirroring can be set to 0.3, and the weight of resource configuration data reported by the network management system can be set to 0.1. These weight values ​​can be flexibly configured based on the reliability assessment results of the actual acquisition scenario. Using a unified standard time axis as a benchmark, time slices are divided according to a fixed time step of 1 second. Data from different sampling periods are aligned to their corresponding time slices. Within the same time slice, similar data are weighted according to their corresponding weights to calculate the fusion value for that time slice.

[0070] Next, Kalman smoothing is performed on the aligned time series data to construct corresponding state and observation equations. The state equation is expressed as the true state value of the data at the current moment equals the true state value of the data at the previous moment plus process noise, where the true state value is the true value of the performance parameter to be estimated, and the process noise is the random fluctuation interference during the acquisition process. The observation equation is expressed as the observed data value at the current moment equals the true state value of the data at the current moment plus observation noise, where the observed data value is the raw data actually acquired, and the observation noise is the measurement error introduced by the acquisition equipment. Through a two-step iterative operation of calculating the prior state estimate in the prediction phase and correcting the posterior estimate by combining the observation value in the update phase, the data estimate is corrected time-by-time. After repeated iterations until the filtering converges, the noise-filtered estimate is output, filtering out the random fluctuation noise during the acquisition process, preserving the true trend of data change, and finally outputting a unified data view with complete time alignment and consistent data types.

[0071] Subsequently, the unified data view is traversed to extract unstructured text content such as alarm texts, event logs, and anomaly descriptions. The text content is then segmented and stop words without actual semantic meaning are removed. A general latent Dirichlet assignment topic model is used to train the preprocessed text corpus. The topic-term probability distribution of this model satisfies the following generation relationship: Where d is a single text sample, w is a term in the text, z is a semantic topic, and K is the total number of preset topics. Let z be the probability distribution of text d corresponding to topic z. The probability distribution of term w is generated for topic z. During training, Gibbs sampling iteratively solves for each distribution parameter until the parameters converge, resulting in a stable topic-term probability distribution. Each topic corresponds to a set of terms with strong semantic associations, and each term corresponds to a probability value belonging to each topic. To eliminate semantic confusion, a synonym mapping table for the power communication field is pre-constructed, mapping terms with different expressions but consistent semantics to the same standard term. For example, expressions such as "low optical power," "abnormal optical reception," and "degraded optical module reception" are uniformly mapped to the standard term "abnormal optical power." The normalized terms are then substituted into the topic-term probability distribution for calculation, preventing the same semantic meaning from being split into different topics due to differences in expression, thus ensuring the uniqueness of topic semantics. Based on the topic-term probability distribution, each text content is mapped to a low-dimensional semantic topic vector. Each dimension of the vector corresponds to a semantic topic, and the dimension value is the probability value of the text belonging to the corresponding topic. The number of dimensions in the low-dimensional semantic topic vector corresponds to the total number of topics, typically set to 8 to 16 dimensions, which can be flexibly adjusted according to the semantic richness of the text. The generated low-dimensional semantic topic vectors will be synchronously passed to the mapping layer, which will be used to locate layer elements that match the semantic description of the text.

[0072] Next, structured operational attributes are extracted from the unified data view. These attributes include real-time values ​​and unit-time fluctuation amplitudes of optical power, signal-to-noise ratio, and bit error rate, as well as structured parameters such as bandwidth, service level, and continuous operating time of the corresponding link. Linear normalization is then performed on all structured operational attributes using a min-max normalization method. Specifically, the normalized value is equal to the original value of the current parameter minus the historical minimum value of the corresponding parameter, then divided by the difference between the historical maximum and minimum values ​​of the corresponding parameter. This maps all parameter values ​​to a uniform range of 0 to 1, eliminating numerical scale bias caused by differences in the dimensions of different parameters and generating a structured attribute vector with regular dimensions.

[0073] Finally, the low-dimensional semantic topic vector and the structured attribute vector are concatenated sequentially according to their dimensions, with all dimensions of the low-dimensional semantic topic vector arranged first and all dimensions of the structured attribute vector arranged last, forming a high-dimensional feature vector with complete dimensions. In typical scenarios, the total dimension of the high-dimensional feature vector is the sum of the dimensions of the low-dimensional semantic topic vector and the structured attribute vector, usually set to 20 to 30 dimensions, which can be flexibly adjusted according to the number of data types. For example, if the dimension of the low-dimensional semantic topic vector is set to 10 and the dimension of the structured attribute vector is set to 12, then the total dimension of the high-dimensional feature vector is 22. The generated low-dimensional semantic topic vector and high-dimensional feature vector will be synchronously passed to the mapping layer for subsequent inter-layer association localization and causal reasoning analysis. The specific analysis process will be described in detail in subsequent embodiments.

[0074] By using weighted fusion and Kalman smoothing to achieve time alignment and noise filtering of multi-source data, and combining topic-term probability distribution and semantic normalization to generate low-dimensional semantic vectors and concatenating structured attributes to obtain high-dimensional feature vectors, standardized feature extraction of multi-source heterogeneous data is realized, providing a unified and accurate feature data foundation for subsequent risk propagation trend analysis.

[0075] Furthermore, the method provided in this application embodiment includes:

[0076] Based on the low-dimensional semantic topic vector, feature localization is performed in the mapping layer, and inter-layer mapping based on the feature localization result is performed in combination with the mapping relationship matrix to determine the data mapping distribution; based on the data mapping distribution, the high-dimensional feature vector is written, and the layer propagation path is determined by inter-layer correlation localization and intra-layer causal reasoning; based on the layer propagation path, the minimum protocol unit matching and dynamic reorganization anomaly determination are performed in the protocol abnormal behavior baseline to generate the operational risk situation.

[0077] Optionally, after projecting the low-dimensional semantic topic vector and high-dimensional feature vector to the mapping layer in the aforementioned steps, the abnormal element localization is first performed. Combining the path identifier of the located abnormal communication path, the corresponding optical path element is first locked in the communication network layer of the mapping layer. Then, the abnormal propagation direction and initial abnormal element are determined according to the semantic topic with the highest probability in the low-dimensional semantic topic vector. When the semantic topic corresponds to an optical cable interruption type abnormality, the optical cable physical layer of the mapping layer is traced upward from the locked optical path to locate the corresponding optical cable segment element as the initial abnormal element. When the semantic topic corresponds to an optical path degradation type abnormality, the locked optical path element is directly used as the initial abnormal element. Inter-layer mapping is performed in combination with the mapping relationship matrix. Starting from the initial abnormal element, according to the propagation direction from the physical layer to the communication network layer and from the communication network layer to the service layer, the association weight values ​​in the mapping relationship matrix are traversed one by one to match the upper-layer elements with carrying associations. When an optical cable segment is interrupted, all optical paths and channels carried in that optical cable segment are first mapped, and then all relay protection, dispatch automation, and transaction settlement services carried in the corresponding channels are further mapped, finally obtaining a data mapping distribution covering all associated elements in the three layers.

[0078] Next, the dimensional values ​​corresponding to the operational attributes of each element in the high-dimensional feature vector are written into each associated element in the data mapping distribution according to the element correspondence, serving as the risk feature value for each element. Inter-layer correlation localization is performed. Based on the carrying correlation relationships in the mapping matrix, the causal transmission direction between elements at each layer is clarified. That is, anomalies in physical layer elements will lead to anomalies in the corresponding links of the communication network layer, and anomalies in the communication network layer links will further lead to anomalies in the corresponding services of the service layer, thus determining the backbone link for cross-layer transmission. Intra-layer causal reasoning is then performed, deriving the associated effects based on the topological connection relationships and operational logic of elements within the same layer. Within the optical cable physical layer, the state changes of adjacent optical cable segments and splice boxes are deduced based on the splicing relationships of optical cable segments. Within the communication network layer, the switching effects of backup channels within the same system are deduced based on the protection mechanism of the transmission system. Within the service layer, the operational effects of associated services are deduced based on the linkage mechanism of services. The deduction process continues until no new associated elements within the same layer are included in the scope of influence, or the cross-layer transmission level exceeds the exemplary preset 3-level transmission boundary, which can be flexibly configured according to the actual network scale. By combining the main links between layers and the related effects of causal inference within layers, a complete layer propagation path is formed, clarifying all directions and pathways of risk transmission from the initial anomaly point.

[0079] Then, based on the determined layer propagation path, the real-time protocol message data of all nodes on the path is extracted and matched against the protocol abnormal behavior baseline. The specific steps are as follows:

[0080] For intra-domain transmission paths, real-time messages are first broken down into the smallest protocol units and matched one by one with the abnormal behavior baselines of the units in the first protocol abnormal baseline. The field values, frequency of occurrence, and timing intervals of each smallest protocol unit are checked to see if they are within the normal range. After the unit baseline matching is completed, the broken down smallest protocol units are reassembled into complete messages according to their respective reassembly identifiers and matched with the abnormal behavior baselines of the protocol packets in the first protocol abnormal baseline. The length, checksum, reassembly interval, and fragmentation order of the reassembled protocol packets are checked to see if they conform to normal rules. If any part of the unit baseline matching or the reassembled packet baseline matching is abnormal, the node is judged as abnormal at the intra-domain protocol level.

[0081] For cross-domain transmission paths, in addition to the above intra-domain baseline matching, the following additional operations are performed: the pre- and post-conversion messages at the protocol conversion gateway on the cross-domain transmission path are matched with the second protocol abnormal baseline to verify whether the protocol conversion process falls into an abnormal path that probabilistically triggers a buffer overflow.

[0082] Finally, by synthesizing the baseline matching results of all nodes, the severity of the anomaly at each node is determined. For example, by combining the physical resource coverage of the layer propagation path, the number of network links, the highest level of affected services, and the degree of deviation of performance indicators, the operational risk situation is divided into three levels: Level 1 risk corresponds to a complete interruption of core services, Level 2 risk corresponds to a performance degradation of important services, and Level 3 risk corresponds to a slight fluctuation in general services. The above classification criteria can be flexibly adjusted according to the service importance classification strategy of different power communication networks. The final result is a power communication network operational risk situation that includes risk level, scope of impact, list of affected services, and anomaly tracing conclusions.

[0083] Through the above-mentioned sequential steps, the accurate prediction of risk propagation and the precise identification of anomalies are achieved, providing reliable data support for the graded management and control of operational risks in the power communication network.

[0084] Furthermore, the method provided in this application embodiment includes:

[0085] Based on the operational risk situation, a risk type-based response is executed; the graded response includes: triggering immediate switching of primary and backup optical paths and protocol downgrading for Category I affected services; generating maintenance suggestions and including them in the maintenance work order queue for Category II affected services, wherein the impact of Category II affected services is lower than that of Category I affected services; and issuing routing policies to the network management port to perform route reconfiguration for abnormal paths of protocol conversion.

[0086] In one embodiment, after obtaining the operational risk situation results, the affected service list, abnormal path attributes, and risk level information are extracted and classified according to the degree of business impact. The degree of impact is determined by a combination of service priority coefficient and anomaly severity; the higher the priority coefficient and the greater the degree of anomaly deviation, the higher the corresponding impact. Relay protection services with the highest impact are classified as Category I affected services, while dispatch automation and transaction settlement services with the next highest impact are classified as Category II affected services. Cross-domain paths with protocol conversion anomalies are also identified separately. The corresponding rules for graded response are shown in Table 1.

[0087] Table 1: Corresponding Table of Operational Risk Classification, Response Categories, and Actions

[0088] One type of impact on business response The path carrying relay protection services is interrupted or suffers severe performance degradation. Trigger immediate switching of primary and backup optical paths and synchronously execute protocol degradation processing. Category II Impact on Business Response The paths carrying automated scheduling and transaction settlement services are experiencing moderate or mild performance anomalies. Generate targeted maintenance suggestions and add them to the maintenance work order queue according to priority. Protocol conversion exception response A protocol conversion buffer overflow exception occurred in the cross-domain link. Generate an adaptation routing policy and distribute it to the network management port to perform route reconfiguration.

[0089] For a type of service impact, the availability of the backup optical path is first verified. This involves reading the pre-configured real-time optical power, signal-to-noise ratio, and bit error rate (BER) of the backup optical path, verifying that all indicators are within the normal operating threshold range, confirming that the backup optical path is capable of carrying services. Upon successful verification, an immediate switching operation between the primary and backup optical paths is triggered. A protection switching command is issued to the corresponding optical transmission network element through the transmission equipment's network management interface, switching the service-bearing link from the faulty primary optical path to the backup optical path. The switching process employs an automatic switching mechanism, with the switching time controlled within 50 milliseconds to ensure uninterrupted operation of core services. Simultaneously, protocol degradation processing is performed. For example, the protocol interaction frequency is reduced from 10 times per second to 5 times per second, three unnecessary extended fields are removed, and the single-packet data length is reduced to 70% of its original length, reducing link bandwidth usage and ensuring stable transmission of core service data on the backup optical path.

[0090] For services affected by Category II issues, based on the location results of abnormal communication paths and risk causal analysis, corresponding maintenance suggestions are automatically generated. These suggestions include the location of the abnormal node, abnormal performance index values, preliminary fault cause assessment, and recommended maintenance steps. Work order priorities are calculated according to quantitative rules; the priority value equals the priority coefficient of the corresponding service multiplied by the anomaly severity coefficient, with higher values ​​ranking higher. The generated maintenance suggestions are sorted from highest to lowest priority value and pushed to the maintenance work order management system, where they are added to the pending work order queue. Work orders are then assigned to the corresponding maintenance personnel in order of priority, ensuring that anomalies are handled sequentially.

[0091] For cross-domain paths identified as having protocol conversion anomalies in the operational risk profile, an optimal routing adjustment strategy is generated based on the current network topology and real-time load of each link, defining new cross-domain forwarding paths and bandwidth allocation rules. Routing policy instructions are sent to the corresponding protocol conversion gateway device via the network management port. Upon receiving the instructions, the device first establishes a forwarding channel for the new route. After verifying the channel's availability, service traffic is gradually diverted to the new path. Once all traffic has been migrated, the forwarding configuration of the original abnormal path is removed. This smooth switching approach avoids service traffic interruption, completes the route reconfiguration operation, and eliminates the operational risks caused by protocol conversion anomalies.

[0092] By classifying response levels according to the degree of business impact and implementing differentiated handling, along with supporting mechanisms for backup optical path availability verification, work order priority quantification and sorting, and smooth route adjustment, and by carrying out route reconfiguration for abnormal paths due to protocol conversion, we have achieved hierarchical and precise response to operational risks, which has improved the efficiency of operation and maintenance while ensuring the stable operation of core businesses.

[0093] In summary, the power communication network operation risk situation awareness method provided in this application has the following technical effects:

[0094] This application locates abnormal communication paths, retrieves multi-source heterogeneous data for high-dimensional and low-dimensional parallel processing, projects it onto the mapping layer to conduct inter-layer correlation location and intra-layer causal reasoning, combines the protocol abnormal behavior baseline to determine the layer propagation path and generate operational risk status, and executes differentiated responses at different levels, thereby accurately predicting the risk transmission status, making the operational risk perception results of the power communication network more accurate and reliable, achieving cross-level fault causal tracing and accurate location, and improving the technical effect of improving the accuracy and timeliness of operational risk status perception.

[0095] Example 2, as Figure 2 As shown, based on the same inventive concept as the aforementioned Embodiment 1, this application provides a power communication network operation risk situation awareness system, the system comprising:

[0096] The operation and maintenance detector deployment module 1 is used to deploy operation and maintenance detectors for power communication networks based on the mapping relationship between the optical cable physical layer, communication network layer and service layer and the decomposition and dynamic reorganization of the smallest protocol unit based on the network protocol.

[0097] An abnormal communication path location module 2 is used to perform continuous sampling and analysis of performance data at key locations using the communication network layer within the operation and maintenance detector to locate abnormal communication paths.

[0098] The operational risk situation acquisition module 3 is used to retrieve multi-source heterogeneous data for the abnormal communication path and perform high-dimensional and low-dimensional processing, project it to the mapping layer to perform inter-layer correlation positioning and intra-layer causal reasoning, perform protocol abnormal behavior baseline analysis according to the determined layer propagation path, and output the operational risk situation.

[0099] Risk control management execution module 4 is used to perform risk control management on the power communication network based on the operational risk situation.

[0100] Furthermore, the operation and maintenance detector deployment module 1 is used to perform the following steps:

[0101] For the power communication network, a lightweight hierarchical reconstruction is performed to obtain the mapping layer; the intra-domain operation protocol and cross-domain interaction protocol of the power communication network are obtained, and the abnormal protocol behavior baseline is mined, wherein the abnormal protocol behavior baseline includes a first abnormal protocol baseline based on the intra-domain operation protocol and a second abnormal protocol behavior baseline based on the cross-domain interaction protocol; based on the mapping layer and the abnormal protocol behavior baseline, operation and maintenance detectors are deployed.

[0102] Furthermore, the operation and maintenance detector deployment module 1 is used to perform the following steps:

[0103] The smallest protocol unit of the protocol running within the domain is determined, and a reassembly identifier is added to each smallest protocol unit. The abnormal behavior baseline of the unit and the abnormal behavior baseline of the protocol packet based on the reassembly state are mined as the first protocol abnormal baseline of the behavior within the domain. Each domain corresponds to at least one running protocol with a domain name encoding. The reassembly identifier includes the fragment sequence number, the total number of fragments, and the packet fitting metacode. The signaling structure differences of the cross-domain interaction protocol are determined, and the abnormal path that probabilistically triggers the buffer overflow vulnerability during the protocol conversion process is identified as the second protocol abnormal baseline of the cross-domain behavior.

[0104] Furthermore, the operation and maintenance detector deployment module 1 is used to perform the following steps:

[0105] The mapping layer is a mapping relationship matrix based on the optical cable physical layer, communication network layer and service layer; wherein, the optical cable physical layer uses towers, optical cable segments and splice boxes as layer elements, the communication network layer uses optical paths, channels and transmission systems as layer elements, and the service layer uses relay protection, dispatch automation and transaction settlement as layer elements.

[0106] Furthermore, the abnormal communication path location module 2 is used to perform the following steps:

[0107] In the communication network layer, a type of sampling point is determined based on key location points; performance data is continuously collected based on the type of sampling point, wherein the performance data includes optical power, signal-to-noise ratio, and bit error rate; differentiated sensitivity weights are assigned according to the service type carried by each network, the performance data is verified, and abnormal communication paths are identified.

[0108] Furthermore, the operational risk situation acquisition module 3 is used to perform the following steps:

[0109] According to the pre-set emergency plan of the operation and maintenance detector, the abnormal communication path is matched and the plan response is performed; for the abnormal communication path, multi-source heterogeneous data collected in a distributed manner is retrieved with spatiotemporal code as a constraint; based on the multi-source heterogeneous data, parallel analysis based on the mapping layer and the protocol abnormal behavior baseline is performed to obtain the operational risk situation.

[0110] Furthermore, the operational risk situation acquisition module 3 is used to perform the following steps:

[0111] The multi-source heterogeneous data is subjected to weighted fusion and Kalman smoothing preprocessing to output a time-aligned unified data view. The unified data view is traversed and mapped to a low-dimensional semantic topic vector according to the topic-term probability distribution. A high-dimensional feature vector is generated by concatenating the low-dimensional semantic topic vector with the structured operation attributes. The low-dimensional semantic topic vector and the high-dimensional feature vector are projected onto the mapping layer of the operation and maintenance detection device to perform a propagation trend analysis based on causal direction to determine the operation risk trend.

[0112] Furthermore, the operational risk situation acquisition module 3 is used to perform the following steps:

[0113] Based on the low-dimensional semantic topic vector, feature localization is performed in the mapping layer, and inter-layer mapping based on the feature localization result is performed in combination with the mapping relationship matrix to determine the data mapping distribution; based on the data mapping distribution, the high-dimensional feature vector is written, and the layer propagation path is determined by inter-layer correlation localization and intra-layer causal reasoning; based on the layer propagation path, the minimum protocol unit matching and dynamic reorganization anomaly determination are performed in the protocol abnormal behavior baseline to generate the operational risk situation.

[0114] Furthermore, the risk control management execution module 4 is used to perform the following steps:

[0115] Based on the operational risk situation, a risk type-based response is executed; the graded response includes: triggering immediate switching of primary and backup optical paths and protocol downgrading for Category I affected services; generating maintenance suggestions and including them in the maintenance work order queue for Category II affected services, wherein the impact of Category II affected services is lower than that of Category I affected services; and issuing routing policies to the network management port to perform route reconfiguration for abnormal paths of protocol conversion.

[0116] The power communication network operation risk situation awareness system provided in this embodiment of the invention can execute the power communication network operation risk situation awareness method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Although this application makes various references to certain modules in the system according to the embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy distinction between each other and are not used to limit the scope of protection of this invention.

[0118] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application. In some cases, the actions or steps described in this application can be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for assessing operational risks in a power communication network, characterized in that, The method includes: For power communication networks, operation and maintenance detectors are deployed based on the mapping relationship between the optical cable physical layer, communication network layer and service layer, and the decomposition and dynamic reassembly of the smallest protocol unit based on network protocols. By employing the communication network layer within the operation and maintenance detector, continuous sampling and analysis of performance data at key locations are performed to pinpoint abnormal communication paths. For the abnormal communication path, multi-source heterogeneous data is retrieved and high-dimensional and low-dimensional processing is performed. The data is then projected to the mapping layer to perform inter-layer correlation localization and intra-layer causal reasoning. Based on the determined layer propagation path, the abnormal behavior baseline analysis of the protocol is performed, and the operational risk status is output. Based on the aforementioned operational risk situation, risk control management is implemented for the power communication network.

2. The method for assessing operational risks in a power communication network as described in claim 1, characterized in that, Deploy and maintain the detectors, including: For power communication networks, perform lightweight hierarchical reconstruction to obtain the mapping layer; The intra-domain operation protocol and cross-domain interaction protocol of the power communication network are obtained, and the abnormal protocol behavior baseline is identified. The abnormal protocol behavior baseline includes a first abnormal protocol baseline based on the intra-domain operation protocol and a second abnormal protocol behavior baseline based on the cross-domain interaction protocol. Based on the mapping layer and the baseline of abnormal protocol behavior, deploy an operation and maintenance detector.

3. The method for assessing operational risks in a power communication network as described in claim 2, characterized in that, Obtain the intra-domain operation protocols and cross-domain interaction protocols of the power communication network, and identify baselines of abnormal protocol behavior, including: The smallest protocol unit of the protocol running within the domain is determined, a reorganization identifier is added to each smallest protocol unit, and the abnormal behavior baseline of the unit and the abnormal behavior baseline of the protocol packet based on the reorganization state are mined as the first protocol abnormal baseline of the behavior within the domain. Each domain corresponds to at least one running protocol with a domain name encoding. The reorganization identifier includes the fragment sequence number, the total number of fragments and the group fitting metacode. The signaling structure differences of the cross-domain interaction protocol are determined, and abnormal paths that probabilistically trigger buffer overflow vulnerabilities during the protocol conversion process are identified as the second protocol abnormal baseline for cross-domain behavior.

4. The method for assessing operational risks in a power communication network as described in claim 2, characterized in that, The mapping layer is a mapping relationship matrix based on the optical cable physical layer, communication network layer and service layer; The optical cable physical layer uses towers, optical cable segments, and splice boxes as its layer elements; the communication network layer uses optical paths, channels, and transmission systems as its layer elements; and the service layer uses relay protection, dispatch automation, and transaction settlement as its layer elements.

5. The method for assessing operational risks in a power communication network as described in claim 1, characterized in that, Locate the abnormal communication path, including: In the communication network layer, a type of sampling point is determined based on key location points; Based on the aforementioned sampling points, performance data is continuously collected, wherein the performance data includes optical power, signal-to-noise ratio, and bit error rate; Based on the service type carried by each network, differentiated sensitivity weights are assigned to verify the performance data and identify abnormal communication paths.

6. The method for assessing operational risks in a power communication network as described in claim 1, characterized in that, According to the pre-set emergency plan of the operation and maintenance detector, the abnormal communication path is matched and the plan response is performed; For the aforementioned abnormal communication path, spatiotemporal codes are used as constraints to retrieve multi-source heterogeneous data collected in a distributed manner. Based on the multi-source heterogeneous data, perform parallel analysis based on the mapping layer and the protocol abnormal behavior baseline to obtain the operational risk situation.

7. The method for assessing operational risks in a power communication network as described in claim 6, characterized in that, Perform parallel analysis based on the mapping layer and protocol anomaly behavior baseline using the multi-source heterogeneous data, including: Weighted fusion and Kalman smoothing preprocessing are performed on the multi-source heterogeneous data to output a time-aligned unified data view; Traverse the unified data view, map it to a low-dimensional semantic topic vector according to the topic-term probability distribution, and generate a high-dimensional feature vector by concatenating the low-dimensional semantic topic vector with the structured running attributes; The low-dimensional semantic topic vector and the high-dimensional feature vector are projected onto the mapping layer of the operation and maintenance detection device, and a propagation situation analysis based on causal direction is performed to determine the operation risk situation.

8. The method for assessing operational risks in a power communication network as described in claim 7, characterized in that, The low-dimensional semantic topic vector and the high-dimensional feature vector are projected onto the mapping layer of the operation and maintenance detection device to perform propagation situation analysis based on causal direction, including: Based on the low-dimensional semantic topic vector, feature localization is performed in the mapping layer, and inter-layer mapping based on the feature localization results is performed in combination with the mapping relationship matrix to determine the data mapping distribution; Based on the data mapping distribution, the high-dimensional feature vector is written to determine the layer propagation path through inter-layer correlation localization and intra-layer causal reasoning; Based on the layer propagation path, anomaly determination is performed under minimum protocol unit matching and dynamic reorganization in the protocol abnormal behavior baseline to generate the operational risk situation.

9. The method for assessing operational risks in a power communication network as described in claim 1, characterized in that, Based on the described operational risk situation, implement risk type-based response; The graded response includes: For Category I affected services, immediate switching of primary and backup optical paths and protocol degradation are triggered. For Category II affected services, maintenance suggestions are generated and included in the operation and maintenance work order queue. Among them, the impact of Category II affected services is lower than that of Category I affected services. For abnormal paths due to protocol conversion, the routing policy is sent to the network management port to perform route reconfiguration.

10. A power communication network operation risk situation awareness system, characterized in that, The system is used to implement the power communication network operation risk situation awareness method according to any one of claims 1-9, the system comprising: The operation and maintenance detector deployment module is used to deploy operation and maintenance detectors for power communication networks based on the mapping relationship between the optical cable physical layer, communication network layer and service layer and based on the decomposition and dynamic reorganization of the smallest protocol unit of the network protocol. The abnormal communication path location module is used to perform continuous sampling and analysis of performance data at key locations using the communication network layer within the operation and maintenance detector to locate abnormal communication paths. The operational risk situation acquisition module is used to retrieve multi-source heterogeneous data for the abnormal communication path and perform high-dimensional and low-dimensional processing, project it to the mapping layer to perform inter-layer correlation location and intra-layer causal reasoning, perform protocol abnormal behavior baseline analysis based on the determined layer propagation path, and output the operational risk situation. The risk control management execution module is used to perform risk control management on the power communication network based on the operational risk situation.

Images