Method and system for detecting control link exception of new energy station, equipment and medium

Abstract

The application discloses a new energy station control link anomaly detection method and system, equipment and a medium, the method takes a closed-loop consistency prototype time sequence network as a unified detection main line, and integrates control intention, device state response and physical operation constraint into the same closed-loop judgment process, can establish a closed-loop judgment mechanism among 'control instruction semantics, expected state response trajectory, actual state response trajectory and physical operation constraint' around a single control event, simultaneously depicts control intention, state response law and physical operation boundary in the same framework, can not only identify obvious abnormal control behavior, but also identify hidden control attacks with legal form but abnormal control results, has good detection accuracy, interpretability and engineering deployment value, can realize online identification, risk grading and anomaly positioning of control link abnormal behavior, and is suitable for online safety monitoring and hidden danger diagnosis of the new energy station control link.

Description

Technical Field

[0001] This invention relates to the field of network security technology for new energy power stations, and in particular, to a method and system for detecting control link anomalies in new energy power stations, electronic equipment, and computer-readable storage media. Background Technology

[0002] With the large-scale grid connection of new energy power sources such as photovoltaics, wind power, and energy storage, a control link has gradually formed within new energy power plants. This link consists of a station control system, an Automatic Generation Control / Automatic Voltage Control (AGC / AVC) control unit, a remote dispatch access terminal, inverters, Power Conversion Systems (PCS), Static Var Generators / Static Var Compensators (SVG / SVC), and other side-side execution devices. This control link undertakes functions such as active power regulation, reactive power regulation, voltage control, mode switching, start-stop and disconnection, and parameter configuration. It is a crucial foundation for new energy power plants to achieve grid-connected operation, power regulation, and stable control. Due to the large number of controlled objects, communication links, and rapid changes in operating conditions, any abnormal remote access, malicious command tampering, unauthorized parameter modification, falsified status transmission, or abnormal control mode switching in the control link can easily lead to equipment malfunctions, power fluctuations, over-limit operation, and partial grid disconnection. In severe cases, it can also affect the effectiveness of station-level coordinated control and the safe and stable operation of the regional power grid.

[0003] Existing methods for detecting abnormal behavior in new energy power plants or power side-side equipment mainly fall into three categories. The first category establishes a behavioral baseline based on network traffic, operation logs, or control command sequence patterns, identifying anomalies by judging whether communication traffic, operation records, or command distribution deviate from historical normal patterns. The second category identifies state anomalies based on measurement residuals, state estimation, threshold rules, or alarm logic, identifying faults or attacks by detecting whether equipment state quantities, measured values, or residual quantities exceed limits. The third category uses machine learning or deep learning models to perform pattern classification, cluster analysis, or anomaly detection on control command sequences, state quantity sequences, or multi-source monitoring data. While these three existing methods can identify some obvious anomalies, they still have significant shortcomings in the control link scenario of new energy power plants, specifically as follows: The core of the first type of method is to determine whether the control command deviates from the historical distribution. It focuses on the frequency of occurrence of the command, parameter combination, source characteristics or timing relationship. It does not further analyze what kind of equipment state response the control command should induce under the current operating conditions. When the attacker constructs a control command that is legal in form and seems reasonable in semantics but has an abnormal control target, this type of method often has difficulty distinguishing between legitimate control behavior under normal operating condition fluctuations and attack behavior with abnormal control intentions. The core of the second type of method is to determine whether the device state has gone out of bounds. It focuses on the absolute anomaly of the state quantity or measurement value, but it is difficult to determine whether the current state change is reasonably induced by the given control command. In actual operation, even if the device state has not obviously gone out of bounds, if its response direction, response delay, response amplitude, convergence process or mode switching result is inconsistent with the current control intention, then the control link is actually at risk of being tampered with, hijacked or destroyed. Existing state anomaly detection methods usually cannot accurately identify such hidden anomalies. For the third type of method, although machine learning or deep learning models can extract complex features from multi-source time series data, most existing methods focus on overall pattern discrimination of command sequences, state sequences or network behavior, lacking unified modeling of the relationship between control intention, expected state response, actual state response and physical operating constraints. Especially under the high dynamic operation conditions of new energy power plants, the rationality of the control response depends not only on the control command itself, but also on constraints such as equipment rated capacity, power ramp rate, voltage boundary, frequency boundary, energy storage state of charge (SOC) and power plant-level coordinated control logic. Existing machine learning or deep learning models do not explicitly introduce the above constraints, resulting in the detection results being out of touch with the actual engineering mechanism, leading to problems such as high false alarm rate and insufficient interpretability.

[0004] Therefore, there is an urgent need for an anomaly detection method for the control link of new energy power stations to solve the problems of insufficient ability to identify hidden anomalies, high false alarm rate and insufficient interpretability in existing technologies. Summary of the Invention

[0005] This invention provides a method and system for detecting control link anomalies in new energy power stations, electronic equipment, and a computer-readable storage medium, which can...

[0006] According to one aspect of the present invention, a method for detecting control link anomalies in a new energy power station is provided, characterized by comprising the following: Real-time control command data, equipment status feedback data and operating context data in the control link of new energy power stations are collected and aligned according to equipment identifiers and timestamps. At the same time, the historical control sequence window corresponding to the current control event is captured to construct the original input sample corresponding to the current control event. The real-time control command data is semantically parsed to determine the current control intent. The expected state response vector of the current control event is generated by combining the device status feedback data and the operating context data. The current control intent and the expected state response vector are added to the original input sample to obtain the enhanced control event sample of the current control event. A control event sample set of historical normal control behaviors and a closed-loop consistency prototype time-series network are constructed. The closed-loop consistency prototype time-series network is trained using the control event sample set of historical normal control behaviors until the model converges, resulting in a control link anomaly detection model. The control link anomaly detection model is used to generate response consistency deviation, sequence deviation, and physical constraint violation. The response consistency deviation represents the deviation between the actual state response trajectory and the expected state response trajectory. The sequence deviation represents the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. The physical constraint violation represents the degree to which the current control event violates physical constraints. The enhanced control event sample of the current control event is input into the trained control link anomaly detection model, and the response consistency deviation, sequence deviation and physical constraint violation corresponding to the current control event are output and jointly scored to obtain the control link anomaly detection result.

[0007] Furthermore, the closed-loop consistency prototype timing network includes a control command encoding subnetwork, a device initial state encoding subnetwork, an operating context encoding subnetwork, a prototype memory unit, a state response prediction subnetwork, a consistency discriminator, a sequence deviation evaluation branch, and a physical constraint scoring branch. The control command encoding subnetwork, the device initial state encoding subnetwork, and the operating context encoding subnetwork are respectively used to encode control command data, device state feedback data, and operating context data. The prototype memory unit is used to generate normal control behavior prototypes based on control intent categories. The state response prediction subnetwork is used to generate expected state response trajectories based on control event samples. The consistency discriminator is used to evaluate the deviation between the expected state response trajectory generated by the state response prediction subnetwork and the actual state response trajectory in the control event samples. The sequence deviation evaluation branch is used to generate historical sequence representations based on historical control sequence windows and evaluate the deviation between the historical sequence representations and the historical normal control behavior sequence reference centers corresponding to the control intent categories. The physical constraint scoring branch is used to evaluate the degree to which control events violate physical constraints based on the actual state response trajectories, control command data, and device operating boundary conditions in the control event samples.

[0008] Furthermore, the consistency discrimination head calculates the response consistency deviation based on the following formula: ; in, Indicates a deviation in response consistency. This represents the preset weighting coefficient. , , , , , These represent differences in response direction, response delay, response amplitude, response trajectory shape, steady-state error, and mode position variation, respectively. , Indicates the first i The response variable dimension corresponds to each control event, and sign() represents the sign function for determining the sign of a number. and Representing the response variables respectively The actual change and the predicted change, , and These represent the actual response start time and the predicted response start time, respectively. Indicates the duration of the response. This represents the preset adjustment constant. , and These represent the actual change vector and the predicted change vector for all response variables, respectively. and These represent the upper and lower limits of the allowed amplitude, respectively. , This represents the actual response trajectory. Indicates the predicted state response trajectory. This indicates the number of sampling points in the response trajectory. This represents the distance between the actual state response trajectory and the predicted state response trajectory. DTW() represents the dynamic time warp distance function. , and These represent the actual steady-state value and the predicted steady-state value, respectively. and These represent the lower bound and the upper bound of the steady-state error, respectively. , and Representing time respectively t The actual mode state and the predicted mode state.

[0009] Furthermore, the sequence deviation evaluation branch calculates the sequence deviation degree based on the following formula: ; in, Indicates the degree of sequence deviation. Represents a historical sequence. , Represents the historical control sequence window, Enc seq () represents the encoder. Indicates the current control intent category The corresponding historical normal control behavior sequence reference center.

[0010] Furthermore, the physical constraint scoring branch calculates the physical constraint violation degree based on the following formula: ; in, Indicates the degree of violation of physical constraints. This represents the preset weighting coefficient. , , , , These represent capacity out-of-bounds, ramp rate out-of-bounds, voltage boundary out-of-bounds, frequency boundary out-of-bounds, and logic rule violation, respectively. , This indicates the number of sampling points in the response trajectory. , Indicates time t active power, and These represent the upper limit of merit and the lower limit of merit, respectively. and These represent the lower bound and upper bound of reactive power, respectively. Indicates time t reactive power, , Indicates the sampling period. Indicates the maximum allowed gradeability. , Indicates time t voltage, and These represent the upper and lower bounds of the voltage, respectively. Indicates time t frequency, and These represent the lower and upper bounds of the frequency, respectively. , Indicates time t The actual mode state, Indicates control command The set of allowed mode transitions that are triggered.

[0011] Furthermore, a joint score is performed based on the following formula: ; in, Indicates joint anomaly score, , , These represent the response consistency deviation, sequence deviation, and physical constraint violation after normalization, respectively. This represents the preset weighting coefficient, when When, it is judged as normal, when When, it is judged as a low-risk abnormality, when At that time, it was judged as a medium-risk abnormality. At that time, it was judged as a high-risk anomaly. , , This is the preset threshold for anomaly detection.

[0012] Furthermore, the loss function of the closed-loop consistency prototype time-series network is: ; in, Indicates the total loss. , , , This represents the preset weighting coefficient. , , , These represent the prediction loss, prototype loss, physical constraint loss, and sequence loss, respectively. , N Indicates control events i Quantity, This represents the actual response trajectory. Indicates the predicted state response trajectory. This indicates the number of sampling points in the response trajectory. , Indicates the first i Feature representation of a control event sample , These represent the control command, the operating context, and the initial state of the device at the time the control command is issued, respectively. Indicates the category of control intent The corresponding normal control behavior prototype representation, , , , , These represent the capacity out-of-bounds loss, ramp rate out-of-bounds loss, boundary out-of-bounds loss, and mode violation loss, respectively. , Represents a historical sequence. , Represents the historical control sequence window, Enc seq () represents the encoder. Indicates the current control intent category The corresponding historical normal control behavior sequence reference center.

[0013] In addition, the present invention also provides a control link anomaly detection system for new energy power stations, comprising: The raw input sample construction module is used to collect real-time control command data, equipment status feedback data and operating context data in the control link of new energy power stations, align them according to equipment identifiers and timestamps, and simultaneously capture the historical control sequence window corresponding to the current control event to construct the raw input sample corresponding to the current control event. The control event sample construction module is used to perform semantic parsing on the real-time control command data, determine the current control intent, and generate the expected state response vector of the current control event by combining the device status feedback data and the operating context data. The current control intent and the expected state response vector are added to the original input sample to obtain the enhanced control event sample of the current control event. An anomaly detection model training module is used to construct a control event sample set of historical normal control behaviors and a closed-loop consistency prototype time-series network. The closed-loop consistency prototype time-series network is trained using the control event sample set of historical normal control behaviors until the model converges, resulting in a control link anomaly detection model. This control link anomaly detection model generates response consistency deviation, sequence deviation, and physical constraint violation. The response consistency deviation represents the deviation between the actual state response trajectory and the expected state response trajectory. The sequence deviation represents the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. The physical constraint violation represents the degree to which the current control event violates physical constraints. The control link anomaly detection module is used to input the enhanced control event sample of the current control event into the trained control link anomaly detection model, output the response consistency deviation, sequence deviation and physical constraint violation corresponding to the current control event, and perform joint scoring to obtain the control link anomaly detection result.

[0014] In addition, the present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method described above by calling the computer program stored in the memory.

[0015] In addition, the present invention also provides a computer-readable storage medium for storing a computer program for detecting anomalies in the control link of a new energy power station, wherein the computer program executes the steps of the method described above when running on a computer.

[0016] The present invention has the following beneficial effects: The control link anomaly detection method for new energy power stations of the present invention obtains the control intent by semantically parsing the control commands, and generates the expected state response vector of the control event by combining equipment status feedback data and operating context data. The control intent and expected state response vector are added to the sample, and the closed-loop consistency prototype time series network is trained using a sample set of control events of historical normal control behavior to obtain a control link anomaly detection model. This model can evaluate the deviation between the actual state response trajectory and the expected state response trajectory, the deviation between the historical control sequence window of the current control event and the reference center of the historical normal control behavior sequence of the corresponding control intent category, and the degree to which the current control event violates physical constraints, based on the closed-loop consistency prototype. As a unified detection backbone, the temporal network incorporates control intent, equipment status response, and physical operational constraints into the same closed-loop judgment process. It can establish a closed-loop judgment mechanism around a single control event, connecting "control command semantics, expected state response trajectory, actual state response trajectory, and physical operational constraints." Within the same framework, it simultaneously characterizes control intent, state response patterns, and physical operational boundaries. It can not only identify obvious abnormal control behaviors but also identify covert control attacks that are formally legitimate but produce abnormal control results. Furthermore, it has good detection accuracy, interpretability, and engineering deployment value, enabling online identification, risk classification, and anomaly localization of abnormal behaviors in the control link. It is suitable for online security monitoring and hidden danger diagnosis of the control link in new energy power plants.

[0017] In addition, the control link anomaly detection system for new energy power stations of the present invention also has the above-mentioned advantages.

[0018] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The invention will now be described in further detail with reference to the figures. Attached Figure Description

[0019] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart illustrating the control link anomaly detection method for a new energy power station according to a preferred embodiment of this application; Figure 2 This is a schematic diagram of the module structure of a control link anomaly detection system for a new energy power station according to another embodiment of this application. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] Reference Figure 1 A preferred embodiment of this application provides a method for detecting control link anomalies in a new energy power station, including the following: Step S1: Collect real-time control command data, equipment status feedback data and operating context data in the control link of the new energy power station, align them according to equipment identifier and timestamp, and simultaneously capture the historical control sequence window corresponding to the current control event to construct the original input sample corresponding to the current control event; Step S2: Perform semantic parsing on the real-time control command data to determine the current control intent, and generate the expected state response vector of the current control event by combining the device status feedback data and the operating context data. Add the current control intent and the expected state response vector to the original input sample to obtain the enhanced control event sample of the current control event. Step S3: Construct a control event sample set of historical normal control behavior and a closed-loop consistency prototype time-series network. Train the closed-loop consistency prototype time-series network using the control event sample set of historical normal control behavior until the model converges to obtain the control link anomaly detection model. The control link anomaly detection model is used to generate response consistency deviation, sequence deviation, and physical constraint violation. The response consistency deviation represents the deviation between the actual state response trajectory and the expected state response trajectory. The sequence deviation represents the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. The physical constraint violation represents the degree to which the current control event violates physical constraints. Step S4: Input the enhanced control event sample of the current control event into the trained control link anomaly detection model, output the response consistency deviation, sequence deviation and physical constraint violation corresponding to the current control event, and perform joint scoring to obtain the control link anomaly detection result.

[0022] It is understood that the control link anomaly detection method for new energy power stations in this embodiment obtains the control intent by semantically parsing the control commands, and generates the expected state response vector of the control event by combining equipment status feedback data and operating context data. The control intent and expected state response vector are added to the sample, and the closed-loop consistency prototype time-series network is trained using the control event sample set of historical normal control behavior to obtain the control link anomaly detection model. This model can evaluate the deviation between the actual state response trajectory and the expected state response trajectory, the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intent category, and the degree to which the current control event violates physical constraints, thus ensuring closed-loop consistency. As a unified detection backbone, the prototype temporal network incorporates control intent, equipment state response, and physical operational constraints into the same closed-loop judgment process. It can establish a closed-loop judgment mechanism around a single control event, connecting "control command semantics, expected state response trajectory, actual state response trajectory, and physical operational constraints." Within the same framework, it simultaneously characterizes control intent, state response patterns, and physical operational boundaries. It can not only identify obvious abnormal control behaviors but also identify covert control attacks that are formally legitimate but produce abnormal control results. Furthermore, it has good detection accuracy, interpretability, and engineering deployment value, enabling online identification, risk classification, and anomaly localization of abnormal behaviors in the control link. It is suitable for online security monitoring and hidden danger diagnosis of the control link in new energy power plants.

[0023] First, the control command stream, equipment status feedback stream, and operational context stream in the control link of the new energy power station are collected. Real-time control command data is extracted from the control command stream, equipment status feedback data from the equipment status feedback stream, and operational context data from the operational context stream. The control command data includes at least the command type, controlled object, command parameters, source identifier, and timestamp. The equipment status feedback data includes at least equipment operational status quantities, mode status quantities, and alarm status quantities, such as active power output, reactive power output, voltage measurement, current measurement, mode status bit, and alarm status bit. The operational context data includes at least the current operating condition of the equipment, electrical operating quantities, and operational boundary information, such as irradiance, wind speed, energy storage state of charge, bus voltage, system frequency, power limit, and scheduling boundary. Then, the real-time control command data, equipment status feedback data, and operational context data are aligned according to the equipment identifier, control event start time, and timestamp. Simultaneously, a historical control sequence window corresponding to the current control event is extracted to construct the original input sample corresponding to the current control event. For example, suppose the first... k Each controlled device at any time t The control commands are: , These represent the instruction type, controlled object, instruction parameters, source identifier, and timestamp, respectively, and their status feedback data are as follows: , These represent active power output, reactive power output, voltage measurement, current measurement, mode status bit, and alarm status bit, respectively. The running context data is as follows: , Let irradiance, wind speed, energy storage state of charge, bus voltage, system frequency, and dispatch boundary be represented respectively. Then the first... i The original input samples corresponding to each control event are denoted as follows: , Indicates control commands, Indicates the runtime context. This indicates the initial state of the device. This represents the actual state response trajectory within the response time window. This indicates the number of sampling points in the response trajectory. This represents the historical control sequence window, which contains behavioral information of the control link over a historical period prior to the current control event. This information is used by subsequent sequence deviation evaluation branches to determine whether the historical pattern of the current event deviates from the normal baseline. It represents the exact moment the current control event occurred. t i Based on this, a length of [value] is extracted from the historical database. L The data interval of each sampling point strictly covers the time period within... t i Previously, to ensure no information leakage between the current detection target and the data content, three types of historical control command sequences (command type, controlled object, command parameters, source identifier and timestamp), historical equipment status feedback sequences (active power output, reactive power output, voltage measurement, current measurement, mode status bit, alarm status bit), and historical operating context sequences (irradiance, wind speed, energy storage state of charge, bus voltage, system frequency, power limit, dispatch boundary) were formed by aligning the three types of data by time to form a historical control sequence window.

[0024] Then, the control commands Semantic parsing is performed to determine the current control intent category based on the instruction type, controlled object, and instruction parameters in the control command. The control intent categories include at least one of the following: active power regulation, reactive power regulation, voltage control, mode switching, start / stop / segmentation, and parameter modification. The specific semantic parsing process is existing technology and will not be elaborated here. Next, based on the current control intent categories... Matching the corresponding set of response variables, which includes at least one or more of the following: active power output, reactive power output, voltage measurement, mode status bit, alarm status bit, and limiting status bit, and then, based on the equipment's rated capacity, current operating conditions, control mode, and operating boundaries, the allowable direction of change, allowable amplitude range, allowable response delay, and allowable convergence time, an expected state response vector for the current control event is generated. The expected state response vector can be expressed as: , Represents the set of response variables. Indicates the response duration as Response time window This indicates that a change of direction is permitted. Indicates the allowable amplitude range. and These represent the upper and lower limits of the allowed amplitude, respectively. Indicates the allowed convergence time. Indicates the allowable steady-state error range. and These represent the lower and upper bounds of the steady-state error, respectively. Then, the current control intent category is... and expected state response vector Adding it to the original input sample yields the enhanced control event sample, which can be represented as: .

[0025] Next, control event samples of historical normal control behavior under conditions of no attack, no misoperation, and no serious failure are screened from historical operating data to obtain a control event sample set of normal control behavior. The control event samples of historical normal control behavior are constructed in the same way as in steps S1 and S2 above, that is, the original input sample corresponding to each control event of historical normal control behavior is semantically parsed and the expected state response vector is generated to construct the control event sample of historical normal control behavior. The specific process will not be elaborated here. This invention uses a Closed-loop Consistency Prototype Temporal Network (CCT-Net) as a unified anomaly detection backbone to jointly model the temporal mapping relationship between control commands, operating context, initial state of equipment, and equipment state response trajectory, and to uniformly organize the generation of expected state response, response consistency judgment, sequence deviation evaluation, and physical constraint scoring. The closed-loop consistency prototype timing network includes a control command encoding subnetwork, a device initial state encoding subnetwork, an operating context encoding subnetwork, a prototype memory unit, a state response prediction subnetwork, a consistency discriminator, a sequence deviation evaluation branch, and a physical constraint scoring branch. The control command encoding subnetwork, device initial state encoding subnetwork, and operating context encoding subnetwork are used to encode control command data, device state feedback data, and operating context data, respectively. The prototype memory unit is used to generate normal control behavior prototypes based on control intent categories, and can construct normal control behavior prototypes under different control intent categories. The state response prediction subnetwork is used to generate expected state response trajectories based on control event samples. The consistency discriminator is used to evaluate the deviation between the expected state response trajectory generated by the state response prediction subnetwork and the actual state response trajectory in the control event samples. The sequence deviation evaluation branch is used to generate historical sequence representations based on historical control sequence windows and evaluate the deviation between the historical sequence representations and the historical normal control behavior sequence reference center corresponding to the control intent category. The physical constraint scoring branch is used to evaluate the degree to which control events violate physical constraints based on the actual state response trajectories, control command data, and device operating boundary conditions in the control event samples.

[0026] The training process of the closed-loop consistency prototype time-series network (CCT-Net) is as follows: After inputting control event samples of historical normal control behavior into the CCT-Net, the network first passes through the control instruction encoding subnetwork, the runtime context encoding subnetwork, and the device initial state encoding subnetwork to extract feature representations from the input control instructions, runtime context, and device initial state. The control instruction representation, runtime context representation, and device initial state representation can be expressed as follows: , , , , , These represent control command representation, runtime context representation, and device initial state representation, respectively. `Enc()` represents the encoder network, `Emb()` represents the embedding layer processing, and `MLP()` represents the multilayer perceptron network. As for control intent categories... y The normal control behavior prototype constructed by the prototype memory unit can be represented as: , This represents the number of historical normal control events corresponding to control intent category y. This represents the feature extraction mapping. Then, the state response prediction subnetwork is based on the control command representation. Runtime context representation and device initial state representation By performing fusion, we obtain the fused representation: , , Represent learnable parameters, and then combine them with a fusion representation. Control Intent Categories Corresponding normal control behavior prototype and expected state response vector State response prediction can be expressed as , Represents the state-response prediction mapping. This represents the predicted state response trajectory. Then, the consistency discriminator uses the actual state response trajectory... and predicted state response trajectory As input, the differences between the two in six dimensions—response direction, response delay, response amplitude, response trajectory shape, steady-state error, and mode position change—are calculated to evaluate the deviation between the expected state response trajectory generated by the state response prediction sub-network and the actual state response trajectory in the control event samples. The consistency discriminator calculates the response consistency deviation based on the following formula: ; in, Indicates a deviation in response consistency. This represents the preset weighting coefficient. , , , , , These represent differences in response direction, response delay, response amplitude, response trajectory shape, steady-state error, and mode position variation, respectively. , Indicates the first iThe response variable dimension corresponds to each control event, and sign() represents the sign function for determining the sign of a number. and Representing the response variables respectively The actual change and the predicted change, , and These represent the actual response start time and the predicted response start time, respectively. Indicates the duration of the response. This represents the preset adjustment constant. , and These represent the actual change vector and the predicted change vector for all response variables, respectively. and These represent the upper and lower limits of the allowed amplitude, respectively. , This represents the actual response trajectory. Indicates the predicted state response trajectory. This indicates the number of sampling points in the response trajectory. This represents the distance between the actual state response trajectory and the predicted state response trajectory. DTW() represents the dynamic time warp distance function. , and These represent the actual steady-state value and the predicted steady-state value, respectively. and These represent the lower bound and the upper bound of the steady-state error, respectively. , and Representing time respectively t The actual mode state and the predicted mode state. Additionally, the sequence deviation evaluation branch is based on a window of historical control sequences in the control event samples. Generate sequence representation: , Representing a historical sequence, Enc seq () represents the encoder network, while the physical constraint scoring branch responds to the actual state trajectory. Control commands Taking operational boundary conditions as input, the physical constraint violation degree is calculated based on capacity constraints, power ramp-up rate constraints, voltage boundary constraints, frequency boundary constraints, and logic rule constraints to assess the degree to which control events violate physical constraints. The physical constraint scoring branch calculates the physical constraint violation degree based on the following formula: ; in, Indicates the degree of violation of physical constraints. This represents the preset weighting coefficient. , , , , These represent capacity out-of-bounds, ramp rate out-of-bounds, voltage boundary out-of-bounds, frequency boundary out-of-bounds, and logic rule violation, respectively. , This indicates the number of sampling points in the response trajectory. , Indicates time t active power, and These represent the upper limit of merit and the lower limit of merit, respectively. and These represent the lower bound and upper bound of reactive power, respectively. Indicates time t reactive power, , Indicates the sampling period. Indicates the maximum allowed gradeability. , Indicates time t voltage, and These represent the upper and lower bounds of the voltage, respectively. Indicates time t frequency, and These represent the lower and upper bounds of the frequency, respectively. , Indicates time t The actual mode state, Indicates control command The set of allowed mode transitions triggered. It can be understood that the above process demonstrates the forward data flow of CCT-Net, and the forward structure of CCT-Net is trained.

[0027] Next, offline training is performed to optimize the network parameters, control intent prototype, and historical normal sequence reference centers. The trained CCT-Net parameters, prototype memory units, and sequence reference centers are then output for subsequent online detection. The offline training phase uses a joint loss function, which can be expressed as: ; in, Indicates the total loss. , , , This represents the preset weighting coefficient. , , , These represent the prediction loss, prototype loss, physical constraint loss, and sequence loss, respectively. , N Indicates control events i Quantity, This represents the actual response trajectory. Indicates the predicted state response trajectory. This indicates the number of sampling points for the response trajectory. , Indicates the first i The feature representation of a control event sample is obtained by feature extraction mapping. generate, , These represent the control command, the operating context, and the initial state of the device at the time the control command is issued, respectively. Indicates the category of control intent The corresponding normal control behavior prototype representation. , , , , These represent the capacity out-of-bounds loss, ramp rate out-of-bounds loss, boundary out-of-bounds loss, and mode violation loss, respectively. The capacity out-of-bounds loss penalizes predictions that cause the device's active or reactive power output to exceed the rated capacity's upper and lower limits during training. Calculation involves checking each sampling point to see if the active power output exceeds the upper or lower limit, and the reactive power output exceeds the upper or lower limit. The average of all out-of-bounds values ​​is then taken as the capacity out-of-bounds value for that event. Then for all samples Take the average value , The larger the value, the more severely the predicted response trajectory deviates from the physical constraints in terms of capacity limits. The ramp rate overrun loss penalizes the predicted result where the active power change rate exceeds the equipment's maximum ramp rate capability. During calculation, this can be achieved by iterating through the active power change rates between adjacent sampling points, extracting the portion exceeding the maximum allowable ramp rate, and averaging the results. Then for all samples Take the average value Boundary overrun loss combines the boundary constraints of both voltage and frequency. During calculation, it checks whether the measured voltage value exceeds the allowable upper and lower voltage limits and whether the frequency value exceeds the allowable upper and lower frequency limits. After averaging the excess values ​​at each sampling point, the voltage and frequency overrun values ​​are added together, and then the average of all samples is calculated to obtain the result. The purpose of mode violation loss is to penalize situations where the device's mode state transition does not conform to the transition logic specified by the control command. During calculation, it checks each moment within the response time window whether the actual mode state at that moment belongs to the set of legal states allowed by the current control command from the previous moment. If it does not belong, a violation count is incremented. For example, if the control system issues a grid connection command, but the device actually performs a grid disconnection operation, the violation count is calculated. Finally, the number of violations is divided by the total number of transitions to obtain the result. Then for all samples Take the average value . , Represents a historical sequence. , Indicates the historical control sequence window, Enc seq () represents the encoder. Indicates the current control intent category The corresponding historical normal control behavior sequence reference center. After offline training, the trained network parameters and control intention prototype set are obtained. and the reference center set of historical normal control behavior sequences corresponding to each control intent category. This results in a well-trained CCT-Net, which is the control link anomaly detection model.

[0028] During online detection, the enhanced control event samples of the current control event are used. The input is fed into the trained control link anomaly detection model, which then performs the detection based on the current real-time control commands. runtime context Initial state of the equipment Current control intent category and expected state response vector Generate the expected state response trajectory Then compare it with the actual state response trajectory Input the consistency header together to obtain the response consistency deviation. Subsequently, the historical control sequence window in the enhanced control event sample of the current control event is used. The input sequence deviates from the evaluation branch, resulting in a historical sequence representation. and compare it with the current control intent category. The corresponding historical normal control behavior sequence reference center The sequence deviation is calculated by comparing the results, specifically based on the following formula: ; in, Indicates the degree of sequence deviation. Represents a historical sequence. , Indicates the historical control sequence window, Enc seq () represents the encoder. Indicates the current control intent category The corresponding historical normal control behavior sequence reference center. The above formula calculates the sequence deviation based on the distance between the historical control sequence window corresponding to the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. It can characterize the degree of abnormality of the current control event in terms of occurrence frequency, parameter combination, temporal relationship or source characteristics.

[0029] Then, the actual state response trajectory of the current control event. Control commands The physical constraint violation degree is calculated by combining the physical constraint scoring branch with the boundary condition input. .

[0030] Finally, regarding response consistency deviation Sequence deviation And physical constraint violation degree Normalization is performed, and the normalization method is as follows: , , These represent the minimum and maximum values ​​obtained from historical normal samples, respectively. Let represent the normalized adjustment constant, then the joint score can be performed based on the following formula: ; in, Indicates joint anomaly score, , , These represent the response consistency deviation, sequence deviation, and physical constraint violation after normalization, respectively. This represents the preset weighting coefficient, when When, it is judged as normal, when When, it is judged as a low-risk abnormality, when At that time, it was judged as a medium-risk abnormality. At that time, it was judged as a high-risk anomaly. , , This is a preset anomaly detection threshold. Additionally, a horizontal comparison can be made between the three types of scores to determine the dominant anomaly source, thereby determining the anomaly type based on the dominant anomaly source. Anomaly location information can be determined based on the device identifier that triggered the anomaly, the response variable, and the corresponding time window. The final anomaly detection result can include anomaly level, anomaly type, and anomaly location information for subsequent alarms, blocking, or manual review.

[0031] In addition, such as Figure 2 As shown, another embodiment of the present invention also provides a control link anomaly detection system for new energy power stations, preferably employing the control link anomaly detection method for new energy power stations as described above, including: The raw input sample construction module is used to collect real-time control command data, equipment status feedback data and operating context data in the control link of new energy power stations, align them according to equipment identifiers and timestamps, and simultaneously capture the historical control sequence window corresponding to the current control event to construct the raw input sample corresponding to the current control event. The control event sample construction module is used to perform semantic parsing on the real-time control command data, determine the current control intent, and generate the expected state response vector of the current control event by combining the device status feedback data and the operating context data. The current control intent and the expected state response vector are added to the original input sample to obtain the enhanced control event sample of the current control event. An anomaly detection model training module is used to construct a control event sample set of historical normal control behaviors and a closed-loop consistency prototype time-series network. The closed-loop consistency prototype time-series network is trained using the control event sample set of historical normal control behaviors until the model converges, resulting in a control link anomaly detection model. This control link anomaly detection model generates response consistency deviation, sequence deviation, and physical constraint violation. The response consistency deviation represents the deviation between the actual state response trajectory and the expected state response trajectory. The sequence deviation represents the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. The physical constraint violation represents the degree to which the current control event violates physical constraints. The control link anomaly detection module is used to input the enhanced control event sample of the current control event into the trained control link anomaly detection model, output the response consistency deviation, sequence deviation and physical constraint violation corresponding to the current control event, and perform joint scoring to obtain the control link anomaly detection result.

[0032] In addition, another embodiment of the present invention provides an electronic device including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method described above by calling the computer program stored in the memory.

[0033] In addition, another embodiment of the present invention provides a computer-readable storage medium for storing a computer program for detecting anomalies in the control link of a new energy power station. The computer program executes the steps of the method described above when it is run on a computer.

[0034] Common computer-readable storage media include: floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, any other optical media, punch cards, paper tape, any other physical media with perforated patterns, random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), flash erasable programmable read-only memory (FLASH-EPROM), any other memory chips or cartridges, or any other media readable by a computer. Instructions may further be transmitted or received by a transmission medium. The term transmission medium can include any tangible or intangible medium used to store, encode, or carry instructions for execution by a machine, and includes digital or analog carrier communication signals or intangible media that facilitate communication of such instructions. Transmission media include coaxial cables, copper wires, and optical fibers, which contain conductors for transmitting a bus of computer data signals.

[0035] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0036] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0037] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0038] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0039] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0040] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

[0041] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting control link anomalies in a new energy power station, characterized in that, Includes the following: Real-time control command data, equipment status feedback data and operating context data in the control link of new energy power stations are collected and aligned according to equipment identifiers and timestamps. At the same time, the historical control sequence window corresponding to the current control event is captured to construct the original input sample corresponding to the current control event. The real-time control command data is semantically parsed to determine the current control intent. The expected state response vector of the current control event is generated by combining the device status feedback data and the operating context data. The current control intent and the expected state response vector are added to the original input sample to obtain the enhanced control event sample of the current control event. A control event sample set of historical normal control behaviors and a closed-loop consistency prototype time-series network are constructed. The closed-loop consistency prototype time-series network is trained using the control event sample set of historical normal control behaviors until the model converges, resulting in a control link anomaly detection model. The control link anomaly detection model is used to generate response consistency deviation, sequence deviation, and physical constraint violation. The response consistency deviation represents the deviation between the actual state response trajectory and the expected state response trajectory. The sequence deviation represents the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. The physical constraint violation represents the degree to which the current control event violates physical constraints. The enhanced control event sample of the current control event is input into the trained control link anomaly detection model, and the response consistency deviation, sequence deviation and physical constraint violation corresponding to the current control event are output and jointly scored to obtain the control link anomaly detection result.

2. The control link anomaly detection method for new energy power stations as described in claim 1, characterized in that, The closed-loop consistency prototype timing network includes a control command encoding subnetwork, a device initial state encoding subnetwork, an operating context encoding subnetwork, a prototype memory unit, a state response prediction subnetwork, a consistency discriminator, a sequence deviation evaluation branch, and a physical constraint scoring branch. The control command encoding subnetwork, device initial state encoding subnetwork, and operating context encoding subnetwork are used to encode control command data, device state feedback data, and operating context data, respectively. The prototype memory unit is used to generate normal control behavior prototypes based on control intent categories. The state response prediction subnetwork is used to generate expected state response trajectories based on control event samples. The consistency discriminator is used to evaluate the deviation between the expected state response trajectory generated by the state response prediction subnetwork and the actual state response trajectory in the control event samples. The sequence deviation evaluation branch is used to generate historical sequence representations based on historical control sequence windows and evaluate the deviation between the historical sequence representations and the historical normal control behavior sequence reference center corresponding to the control intent category. The physical constraint scoring branch is used to evaluate the degree to which control events violate physical constraints based on the actual state response trajectories, control command data, and device operating boundary conditions in the control event samples.

3. The control link anomaly detection method for new energy power stations as described in claim 2, characterized in that, The consistency discrimination head calculates the response consistency deviation based on the following formula: ； in, Indicates a deviation in response consistency. This represents the preset weighting coefficient. , , , , , These represent differences in response direction, response delay, response amplitude, response trajectory shape, steady-state error, and mode position variation, respectively. , Indicates the first i The response variable dimension corresponds to each control event, and sign() represents the sign function for determining the sign of a number. and Representing the response variables respectively The actual change and the predicted change, , and These represent the actual response start time and the predicted response start time, respectively. Indicates the duration of the response. This represents the preset adjustment constant. , and These represent the actual change vector and the predicted change vector for all response variables, respectively. and These represent the upper and lower limits of the allowed amplitude, respectively. , This represents the actual response trajectory. Indicates the predicted state response trajectory. This indicates the number of sampling points in the response trajectory. This represents the distance between the actual state response trajectory and the predicted state response trajectory. DTW() represents the dynamic time warp distance function. , and These represent the actual steady-state value and the predicted steady-state value, respectively. and These represent the lower bound and the upper bound of the steady-state error, respectively. , and Representing time respectively t The actual mode state and the predicted mode state.

4. The control link anomaly detection method for new energy power stations as described in claim 2, characterized in that, The sequence deviation assessment branch calculates the sequence deviation based on the following formula: ； in, Indicates the degree of sequence deviation. Represents a historical sequence. , Represents the historical control sequence window, Enc seq () represents the encoder. Indicates the current control intent category The corresponding historical normal control behavior sequence reference center.

5. The control link anomaly detection method for new energy power stations as described in claim 2, characterized in that, The physical constraint scoring branch calculates the physical constraint violation degree based on the following formula: ； in, Indicates the degree of violation of physical constraints. This represents the preset weighting coefficient. , , , , These represent capacity out-of-bounds, ramp rate out-of-bounds, voltage boundary out-of-bounds, frequency boundary out-of-bounds, and logic rule violation, respectively. , This indicates the number of sampling points in the response trajectory. , Indicates time t active power, and These represent the upper limit of merit and the lower limit of merit, respectively. and These represent the lower bound and upper bound of reactive power, respectively. Indicates time t reactive power, , Indicates the sampling period. Indicates the maximum allowed gradeability. , Indicates time t voltage, and These represent the upper and lower bounds of the voltage, respectively. Indicates time t frequency, and These represent the lower and upper bounds of the frequency, respectively. , Indicates time t The actual mode state, Indicates control command The set of allowed mode transitions that are triggered.

6. The control link anomaly detection method for new energy power stations as described in claim 2, characterized in that, The joint scoring is based on the following formula: ； in, Indicates joint anomaly score, , , These represent the response consistency deviation, sequence deviation, and physical constraint violation after normalization, respectively. This represents the preset weighting coefficient, when When, it is judged as normal, when When, it is judged as a low-risk abnormality, when At that time, it was judged as a medium-risk abnormality. At that time, it was judged as a high-risk anomaly. , , This is the preset threshold for anomaly detection.

7. The control link anomaly detection method for new energy power stations as described in claim 2, characterized in that, The loss function of the closed-loop consistency prototype time-series network is: ； in, Indicates the total loss. , , , This represents the preset weighting coefficient. , , , These represent the prediction loss, prototype loss, physical constraint loss, and sequence loss, respectively. , N Indicates control events i Quantity, This represents the actual response trajectory. Indicates the predicted state response trajectory. This indicates the number of sampling points in the response trajectory. , Indicates the first i Feature representation of a control event sample , These represent the control command, the operating context, and the initial state of the device at the time the control command is issued, respectively. Indicates the category of control intent The corresponding normal control behavior prototype representation, , , , , These represent the capacity out-of-bounds loss, ramp rate out-of-bounds loss, boundary out-of-bounds loss, and mode violation loss, respectively. , Represents a historical sequence. , Represents the historical control sequence window, Enc seq () represents the encoder. Indicates the current control intent category The corresponding historical normal control behavior sequence reference center.

8. A control link anomaly detection system for a new energy power station, characterized in that, include: The raw input sample construction module is used to collect real-time control command data, equipment status feedback data and operating context data in the control link of new energy power stations, align them according to equipment identifiers and timestamps, and simultaneously capture the historical control sequence window corresponding to the current control event to construct the raw input sample corresponding to the current control event. The control event sample construction module is used to perform semantic parsing on the real-time control command data, determine the current control intent, and generate the expected state response vector of the current control event by combining the device status feedback data and the operating context data. The current control intent and the expected state response vector are added to the original input sample to obtain the enhanced control event sample of the current control event. An anomaly detection model training module is used to construct a control event sample set of historical normal control behaviors and a closed-loop consistency prototype time-series network. The closed-loop consistency prototype time-series network is trained using the control event sample set of historical normal control behaviors until the model converges, resulting in a control link anomaly detection model. This control link anomaly detection model generates response consistency deviation, sequence deviation, and physical constraint violation. The response consistency deviation represents the deviation between the actual state response trajectory and the expected state response trajectory. The sequence deviation represents the deviation between the historical control sequence window of the current control event and the historical normal control behavior sequence reference center of the corresponding control intention category. The physical constraint violation represents the degree to which the current control event violates physical constraints. The control link anomaly detection module is used to input the enhanced control event sample of the current control event into the trained control link anomaly detection model, output the response consistency deviation, sequence deviation and physical constraint violation corresponding to the current control event, and perform joint scoring to obtain the control link anomaly detection result.

9. An electronic device, characterized in that, The method includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method as described in any one of claims 1 to 7 by calling the computer program stored in the memory.

10. A computer-readable storage medium for storing a computer program for anomaly detection of the control link of a new energy power station, characterized in that, The computer program, when run on a computer, performs the steps of the method as described in any one of claims 1 to 7.

Images