Massive terminal-oriented micro-grid data stream security auditing method and system
By using programmable switching equipment in conjunction with HLL and CMS algorithms in microgrids, the problems of real-time monitoring and security protection of massive terminals are solved, efficient network flow security auditing is achieved, and the real-time performance and security of microgrids are guaranteed.
Patent Information
- Application Number
- CN202611136226.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-29
- Publication Date
- 2026-11-06
AI Technical Summary
Existing technologies struggle to monitor the online activity and communication status of massive numbers of terminals in real time within microgrids, and cannot effectively prevent DDoS attacks and massive abnormal message surges. Traditional methods suffer from memory explosion, high computational latency, and coarse granularity.
By employing programmable switching equipment combined with HyperLogLog (HLL) and Count-Min Sketch (CMS) algorithms, and generating feature key values, hash operations, and a two-dimensional counter array, efficient filtering and statistics of industrial protocol messages are achieved, reducing latency and improving processing capabilities.
It enables real-time interception of malicious traffic and provides confidence in device availability without affecting the timeliness of underlying communication, thereby improving the security and reliability of microgrid operation.
Smart Images
Figure CN123055353A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of microgrid technology, specifically relating to a method and system for security auditing of microgrid data streams for massive numbers of terminals. Background Technology
[0002] With the development of high-proportion renewable energy power systems, microgrids have become an important component of distribution networks. Microgrids need to aggregate a large number of distributed resources (such as photovoltaic inverters, energy storage PCS, smart meters, and flexible loads). These massive terminals communicate with the master station or edge nodes at extremely high frequencies through industrial protocols such as IEC104, GOOSE, or Modbus.
[0003] Against this backdrop, the system faces two major challenges: first, it needs to monitor the online activity and communication status of all network devices in real time to support performance evaluation and the issuance of scheduling instructions; second, it must meet strict information security and communication access standards to prevent DDoS attacks or massive abnormal message surges targeting the underlying control network.
[0004] Traditional online data stream monitoring methods include precise statistics and sliding window rate limiting, both of which have problems to varying degrees. 1. Traditional precise statistical methods (such as HashSet, tree structure): (1) Memory explosion. If it is necessary to count the independent IP or terminal MAC addresses of a large number of devices in real time, the space complexity of the hash table is O(N). In the resource-constrained microgrid edge terminal, the memory available for allocation is limited and cannot store such a large status table.
[0005] (2) Poor line-speed processing capability. Precise matching and database entry operations will result in extremely high computational latency. When network anomalies occur (such as encountering massive sudden traffic), the microgrid embedded terminal used to monitor network flow is often the first to crash, threatening the operational safety of the microgrid.
[0006] 2. Traditional sliding window rate limiting method: coarse granularity. It can only limit the total traffic by port and cannot accurately identify which specific terminal is sending abnormal data at a high frequency (i.e., "heavy hitters" are difficult to identify). Summary of the Invention
[0007] The purpose of this invention is to overcome the problem of how to perform real-time security auditing of massive network streams, and to propose a microgrid data stream security auditing method and system for massive terminals.
[0008] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a microgrid data flow security auditing method for a large number of terminals, comprising the following steps: The programmable switch receives industrial protocol messages; the programmable switch performs header stripping on the industrial protocol messages through its built-in programmable protocol parsing pipeline, extracts and combines the feature fields in the industrial protocol messages, and generates feature key values. For each industrial protocol message, the programmable switch performs a hash operation on the feature key value to generate a binary bit stream. The high-order part of the binary bit stream is used as the index of the register array. The length of the leading zero is calculated using the remaining part of the binary bit stream. The larger value between the length of the leading zero and the value stored at the index position is taken to update the stored value at the position. The register array is deployed on the data plane of the programmable switch. The programmable switch filters messages that match preset service events from industrial protocol messages to obtain filtered messages. The feature key values associated with the filtered messages are mapped to each row of a two-dimensional counter array through multiple independent hash functions. The count values of the hash-mapped counting units in each row are accumulated and updated. The two-dimensional counter array is deployed on the data plane of the programmable switch. The control plane periodically reads all stored values from the register array and estimates the active terminal base based on all stored values. The control plane inputs the feature key value to be queried, queries multiple count values obtained by mapping the feature key value to be queried in the two-dimensional counter array, takes the minimum value among the count values, and completes the business event frequency statistics.
[0009] Furthermore, the update of the stored value of the register array and the accumulation update of the count value of the two-dimensional counter array are both performed in the data plane of the programmable switch, while the control plane only performs the read of the stored value of the register array, the estimation of the active terminal base, and the statistical operation of the frequency of service events.
[0010] Furthermore, each industrial protocol message is parsed once through the programmable protocol parsing pipeline to generate a feature key value. The feature key value is used simultaneously for updating the stored value of the register array and for accumulating and updating the count value of the two-dimensional counter array.
[0011] Furthermore, the programmable switching device filters and matches messages for preset service events based on feature fields; all industrial protocol messages generated by the same microgrid terminal generate the same feature key value, which is used to uniquely identify the microgrid terminal, and the active terminal base is the number of deduplicated microgrid terminals.
[0012] Furthermore, the total number of registers in the register array is 2 to the power of p, the length of the high-order part of the binary bit stream is p bits, where p is a positive integer; the length of the leading zeros is the number of leading zeros in the remaining part of the binary bit stream.
[0013] Furthermore, the total number of rows in the two-dimensional counter array is consistent with the number of multiple independent hash functions, each of which maps to one row of the two-dimensional counter array.
[0014] Furthermore, programmable switching equipment is deployed at the edge aggregation nodes of the microgrid, and the data flow security audit of the microgrid is completed by combining the statistical results of the active terminal base and the frequency of service events.
[0015] Secondly, the present invention provides a microgrid data flow security auditing system for a large number of terminals, comprising: The feature key generation module is used by the programmable switching equipment to receive industrial protocol messages. The programmable switching equipment performs header stripping on the industrial protocol messages through the built-in programmable protocol parsing pipeline, extracts and combines the feature fields in the industrial protocol messages, and generates feature key values. The update storage value module is used for each industrial protocol message. The programmable switch performs a hash operation on the feature key value to generate a binary bit stream. The high-order part of the binary bit stream is used as the index of the register array. The length of the leading zero is calculated using the remaining part of the binary bit stream. The larger value between the length of the leading zero and the value stored at the index position is taken to update the stored value at that position. The register array is deployed on the data plane of the programmable switch. The counter value accumulation and update module is used by the programmable switch to filter messages that match preset service events from industrial protocol messages to obtain filtered messages. The feature key values associated with the filtered messages are mapped to each row of the two-dimensional counter array through multiple independent hash functions. The count values of the hash-mapped counting units in each row are accumulated and updated. The two-dimensional counter array is deployed on the data plane of the programmable switch. The business event frequency statistics module is used to periodically read all the stored values of the register array from the control plane and estimate the active terminal base based on all the stored values. The control plane inputs the feature key value to be queried, queries multiple count values in the two-dimensional counter array obtained by mapping the feature key value to be queried, takes the minimum value among the count values, and completes the business event frequency statistics.
[0016] Thirdly, the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a microgrid data flow security auditing method for a large number of terminals.
[0017] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements a microgrid data flow security auditing method for a large number of terminals.
[0018] Compared with the prior art, the present invention has the following beneficial technical effects: The proposed microgrid data flow security auditing method for massive terminals is based on a programmable switch and deploys a data flow security auditing model that combines the HLL algorithm and the CM-Sketch algorithm. It combines the network layer's flow processing capabilities with the business needs of the power system to achieve real-time security auditing of massive network flows. Without affecting the timeliness of underlying communication, it can both intercept malicious traffic and provide confidence in the availability of equipment for the upper-layer microgrid operation. Attached Figure Description
[0019] The accompanying drawings described herein are for illustrative purposes only and are not intended to limit the scope of the invention in any way. Furthermore, the shapes and proportions of the components in the drawings are merely schematic to aid in understanding the invention and do not specifically limit the shapes and proportions of the components. In the drawings: Figure 1 This is a flowchart of the microgrid data flow security auditing method for a large number of terminals according to the present invention.
[0020] Figure 2 This is a simplified structural diagram of the microgrid data flow security auditing system for a large number of terminals according to the present invention.
[0021] Figure 3 This is an electronic device diagram of the microgrid data flow security auditing method for a large number of terminals according to the present invention.
[0022] Figure 4 This is a flowchart of a microgrid data flow security auditing method for a large number of terminals according to an embodiment of the present invention.
[0023] Figure 5 This is a block diagram of the core P4 code in an embodiment of the present invention. Detailed Implementation
[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0025] Terminology Explanation: HyperLogLog (HLL) is a probabilistic cardinality estimation algorithm used to approximate the number of unique elements in massive datasets within a very small fixed memory (typically only a few kilobytes). It first maps each element to a uniformly distributed binary string using a hash function, estimating the cardinality by using the longest length of its leading zeros as a marker of rare events. The hash values are then distributed into multiple buckets, with each bucket's longest leading zero recorded independently. Finally, the harmonic mean of all bucket estimates is taken and multiplied by a correction factor. This allows for efficient support of real-time deduplication, unique visitor statistics, and other big data scenarios with an accuracy of approximately 1% standard error and significantly lower resource overhead than precise counting.
[0026] Count-Min Sketch (CM-Sketch) is a frequency estimation probabilistic data structure used in data stream scenarios. Its core feature is that it approximates the number of times each element appears in massive amounts of data with a very small memory footprint, allowing for a certain degree of error, but at an extremely high speed.
[0027] P4: Programming Protocol-Independent Packet Processors is a domain-specific high-level programming language specifically designed to define the data plane packet processing logic of network devices, and is also one of the core technology standards of current programmable networks.
[0028] Example 1 See Figure 1 A method for secure auditing of microgrid data streams for massive numbers of terminals includes the following steps: The programmable switch receives industrial protocol messages; the programmable switch performs header stripping on the industrial protocol messages through its built-in programmable protocol parsing pipeline, extracts and combines the feature fields in the industrial protocol messages, and generates feature key values. For each industrial protocol message, the programmable switch performs a hash operation on the feature key value to generate a binary bit stream. The high-order part of the binary bit stream is used as the index of the register array. The length of the leading zero is calculated using the remaining part of the binary bit stream. The larger value between the length of the leading zero and the value stored at the index position is taken to update the stored value at the position. The register array is deployed on the data plane of the programmable switch. The programmable switch filters messages that match preset service events from industrial protocol messages to obtain filtered messages. The feature key values associated with the filtered messages are mapped to each row of a two-dimensional counter array through multiple independent hash functions. The count values of the hash-mapped counting units in each row are accumulated and updated. The two-dimensional counter array is deployed on the data plane of the programmable switch. The control plane periodically reads all stored values from the register array and estimates the active terminal base based on all stored values. The control plane inputs the feature key value to be queried, queries multiple count values obtained by mapping the feature key value to be queried in the two-dimensional counter array, takes the minimum value among the count values, and completes the business event frequency statistics.
[0029] This invention's method relies on the data plane of a programmable switching device to perform statistical updates on all packets, while the control plane only performs stored value reading and statistical calculations. This maintains line-rate processing capabilities even in scenarios with massive terminal access, effectively reducing packet processing latency and adapting to the high-throughput auditing requirements of microgrid edge nodes. A single packet is parsed once to generate a feature key value, simultaneously supplying both the base count and business event frequency statistics processes, reducing computational overhead from repeated parsing and improving overall auditing efficiency. The method integrates two auditing dimensions: active terminal base estimation and business event frequency statistics, simultaneously covering terminal access status and business behavior monitoring, forming a complete microgrid data flow auditing system and improving the comprehensiveness of audit coverage. This invention uses probabilistic statistical algorithms to achieve terminal base and event frequency statistics, supporting the auditing needs of massive terminals with limited hardware storage resources and reducing resource consumption of edge devices. The programmable protocol parsing pipeline is adaptable to the field parsing of various industrial protocols, possessing strong scenario adaptability and flexibly adapting to the auditing needs of various microgrid scenarios.
[0030] Specifically, this invention provides a microgrid data flow security auditing method for massive numbers of terminals. The core of this method lies in combining the hardware speed advantages of programmable switches (nanosecond-level ultra-low latency and ultra-high throughput) with the algorithmic advantages of HLL and CM-Sketch algorithms (low computational complexity). This hardware-software integration enables rapid security auditing of network flows and detection of sudden increases in abnormal external flows, while only introducing ultra-low latency. See also... Figure 4 This includes the following steps: Step 1: Edge Protocol Parsing and Feature Extraction Based on Programmable Networks At the aggregation layer (such as microgrid grid connection points or virtual power plant aggregation rooms), deploy edge gateways or programmable switches with stream processing capabilities.
[0031] By using the P4 parsing pipe, the header information of IEC60870-5-104 or Modbus TCP messages can be stripped online.
[0032] Extract key feature fields: Extract source IP, device ID, control command code, alarm flag, etc. from the stripped header information and use them as hash input keys for subsequent probability algorithms, such as (Src_IP, Device_MAC, Protocol_Type, Action_Code).
[0033] Step 2: Use HyperLogLog to achieve online terminal number estimation and DDoS monitoring. When a large number of distributed nodes (such as rooftop PV, distributed energy storage, and flexible loads) are concurrently connected to the microgrid, the HLL algorithm is used to achieve accurate monitoring and security defense of all active nodes in the network with extremely low memory usage.
[0034] Microgrids need to know the total number of "truly alive and communicating" terminals in real time to determine the operational status of the communication modules of all devices in the entire microgrid. Algorithm statistics: Allocate a register array of length m (usually m=2) on the data plane of the P4 switch. 14 It occupies approximately 12KB of memory. Convert the device-unique hash value h(x) generated in step one into a binary bit stream; Take the first p bits as the register index j (where m=2) p The remaining bits are used to calculate the number of leading zeros; Periodically (e.g., every second), read the register status and use the harmonic mean formula to estimate the number of truly active independent devices E in the current communication domain; The core formula for estimating the base E is:
[0035] (in For the number of registers, To correct the deviation constant, For the first The maximum number of leading zeros recorded in each register. Security alert: When the number of independent source IPs estimated by HLL increases dramatically in a short period of time, which is inconsistent with the physical topology, the system immediately determines that a DDoS attack or device spoofing has occurred and triggers the information security blocking mechanism.
[0036] Step 3: Use Count-Min Sketch to track high-frequency abnormal messages and monitor backflow prevention. When abnormal frequency and non-compliant service commands occur in the network, CMS technology can accurately locate "high-risk / faulty equipment," which is particularly suitable for enforcing strict physical operating boundaries of microgrids.
[0037] Business logic: Identify "faulty nodes" in the network that frequently report errors or frequently trigger boundary constraints.
[0038] Algorithm deployment: Construct a {d A two-dimensional counter array of w}; when a specific event occurs (such as an energy storage node reporting a "backflow over-limit warning"), the device ID is mapped to different columns of each row through d independent hash functions, and the counter at the corresponding position is incremented by 1.
[0039] Statistics: When querying specific events of a device (e.g., the frequency of backflow prevention violations), take the minimum value among the d count values corresponding to that device.
[0040] Engineering linkage: When the CMS detects that a node frequently sends control messages that cross the physical constraint, it immediately outputs an alarm to achieve extremely low latency protocol layer anti-reverse flow auxiliary verification.
[0041] P4 code framework, such as Figure 5 As shown, the details are as follows: Deep Protocol Parsing (Parser Stage): The code first defines a state machine parser for power industry protocols (such as IEC 60870-5-104 or Modbus TCP). It then strips the Ethernet and IP headers online, delving into the application layer to extract key business fields (such as unit address, function code, and register instructions). These fields, along with the source IP address, are combined and calculated into a unified hash fingerprint (HashKey), serving as a unique identifier for subsequent statistical logic.
[0042] Cardinality estimation and activity monitoring (HLL Logic): Using the HyperLogLog (HLL) algorithm, the code maintains the online status of all network devices within a minimal register space. It uses a portion of the hash fingerprint as a bucket index and another portion to calculate the number of leading zeros in the binary representation. By continuously updating the maximum number of zeros in the register, the system can estimate the total number of truly active terminals in the microgrid in real time with sublinear space complexity. If the estimated number of independent connections shows an abnormal exponential increase, the code will identify it as a Sybil attack or a DDoS attack.
[0043] Frequency tracing and violation monitoring (CMS Logic): For specific violations (such as energy storage nodes violating the "anti-backflow" hard constraint and frequently attempting to discharge back into the main network), the code executes Count-Min Sketch (CMS) logic. This logic maps the characteristics of violating packets to a two-dimensional counter matrix using multiple independent hash functions. Whenever a violation command is captured, the counter at the corresponding position in the matrix atomically increments. This method allows the system to accurately identify frequently violating "faulty / high-risk nodes" without maintaining massive amounts of precise flow tables.
[0044] Real-time action decision-making (Enforcement Stage): At the pipeline exit (Apply phase), the code executes the final decision-making logic. The system obtains a frequency estimate by reading the minimum value in the CMS matrix and compares it with a preset threshold. For normal traffic, forwarding is allowed and telemetry data is reported. For abnormal / attack traffic, once the threshold is exceeded, the code immediately triggers an action on the data plane, directly dropping the violating packet and sending a real-time alert to the control plane.
[0045] This invention combines the HyperLogLog (HLL) algorithm with the Count-Min Sketch (CMS) algorithm to effectively integrate network layer flow processing capabilities with the business requirements of power systems. Leveraging the ultra-low latency, high bandwidth throughput, and hardware-level deployment advantages of programmable switches, development and deployment are completed at the data plane using the P4 language, enabling line-rate parsing and status tracking of industrial protocol data packets. This method, while ensuring the real-time performance of underlying communication, also considers security protection and scheduling requirements. On the one hand, it can intercept malicious traffic in real time; on the other hand, it can provide confidence in equipment availability for upper-layer peak shaving and valley filling optimization models.
[0046] Example 2 See Figure 2 A microgrid data flow security auditing system for massive numbers of terminals includes: The feature key generation module is used by the programmable switching equipment to receive industrial protocol messages. The programmable switching equipment performs header stripping on the industrial protocol messages through the built-in programmable protocol parsing pipeline, extracts and combines the feature fields in the industrial protocol messages, and generates feature key values. The update storage value module is used for each industrial protocol message. The programmable switch performs a hash operation on the feature key value to generate a binary bit stream. The high-order part of the binary bit stream is used as the index of the register array. The length of the leading zero is calculated using the remaining part of the binary bit stream. The larger value between the length of the leading zero and the value stored at the index position is taken to update the stored value at that position. The register array is deployed on the data plane of the programmable switch. The counter value accumulation and update module is used by the programmable switch to filter messages that match preset service events from industrial protocol messages to obtain filtered messages. The feature key values associated with the filtered messages are mapped to each row of the two-dimensional counter array through multiple independent hash functions. The count values of the hash-mapped counting units in each row are accumulated and updated. The two-dimensional counter array is deployed on the data plane of the programmable switch. The business event frequency statistics module is used to periodically read all the stored values of the register array from the control plane and estimate the active terminal base based on all the stored values. The control plane inputs the feature key value to be queried, queries multiple count values in the two-dimensional counter array obtained by mapping the feature key value to be queried, takes the minimum value among the count values, and completes the business event frequency statistics.
[0047] Example 3 See Figure 3 An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a method for secure auditing of microgrid data flows for a large number of terminals.
[0048] Example 4 A computer-readable storage medium storing a computer program, which, when executed by a processor, implements a method for secure auditing of microgrid data streams for a large number of terminals.
[0049] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, read-only optical discs, optical storage, etc.) containing computer-usable program code.
[0050] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0051] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0052] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0053] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the present invention.
Claims
1. A method for security auditing of microgrid data streams for massive numbers of terminals, characterized in that: Includes the following steps: The programmable switching device receives industrial protocol messages; the programmable switching device performs header stripping on the industrial protocol messages through a built-in programmable protocol parsing pipeline, extracts and combines the feature fields in the industrial protocol messages, and generates feature key values; For each of the aforementioned industrial protocol messages, the programmable switching device performs a hash operation on the feature key value to generate a binary bit stream. The high-order part of the binary bit stream is used as the index of the register array. The length of the leading zero is calculated using the remaining part of the binary bit stream. The larger value between the length of the leading zero and the value stored at the index position is taken to update the stored value at the index position. The register array is deployed on the data plane of the programmable switching device. The programmable switching device filters messages that match preset service events from the industrial protocol messages to obtain filtered messages. The feature key value associated with the filtered message is mapped to each row of a two-dimensional counter array through multiple independent hash functions. The count value of the hash-mapped counting unit in each row is accumulated and updated. The two-dimensional counter array is deployed on the data plane of the programmable switching device; The control plane periodically reads all stored values of the register array and estimates the active terminal base based on all stored values. The control plane inputs a feature key value to be queried, queries multiple count values in the two-dimensional counter array obtained by mapping the feature key value to be queried, takes the minimum value among the count values, and completes the business event frequency statistics.
2. The microgrid data flow security auditing method for massive terminals according to claim 1, characterized in that, The update of the stored value of the register array and the accumulation update of the count value of the two-dimensional counter array are both performed in the data plane of the programmable switching device. The control plane only performs the read of the stored value of the register array, the estimation of the active terminal base, and the statistical operation of the service event frequency.
3. The microgrid data flow security auditing method for massive terminals according to claim 1, characterized in that, Each industrial protocol message is parsed once by the programmable protocol parsing pipeline to generate the feature key value. The feature key value is used simultaneously for updating the stored value of the register array and for accumulating and updating the count value of the two-dimensional counter array.
4. The microgrid data flow security auditing method for massive terminals according to claim 1, characterized in that, The programmable switching device filters and matches the preset service event based on the feature field; all industrial protocol messages generated by the same microgrid terminal generate the same feature key value, which is used to uniquely identify the microgrid terminal, and the active terminal base number is the number of deduplicated microgrid terminals.
5. The microgrid data flow security auditing method for massive terminals according to claim 1, characterized in that, The total number of registers in the register array is 2 to the power of p, the length of the high-order part of the binary bit stream is p bits, where p is a positive integer; the length of the leading zeros is the number of leading zeros in the remaining part of the binary bit stream.
6. The microgrid data flow security auditing method for massive terminals according to claim 1, characterized in that, The total number of rows in the two-dimensional counter array is the same as the number of the plurality of independent hash functions, and each independent hash function is mapped to a row of the two-dimensional counter array.
7. The microgrid data flow security auditing method for massive terminals according to claim 1, characterized in that, The programmable switching device is deployed at the edge aggregation node of the microgrid, and completes the microgrid data flow security audit by combining the active terminal base and the service event frequency statistics.
8. A microgrid data flow security auditing system for massive numbers of terminals, characterized in that: include: A feature key generation module is used for the programmable switching device to receive industrial protocol messages; the programmable switching device performs header stripping on the industrial protocol messages through a built-in programmable protocol parsing pipeline, extracts and combines the feature fields in the industrial protocol messages, and generates feature key values. The update storage value module is used for each of the aforementioned industrial protocol messages. The programmable switching device performs a hash operation on the feature key value to generate a binary bit stream. The high-order part of the binary bit stream is used as the index of the register array. The length of the leading zero is calculated using the remaining part of the binary bit stream. The larger value between the length of the leading zero and the stored value at the index position is taken, and the stored value at that position is updated. The register array is deployed on the data plane of the programmable switching device. The count value accumulation and update module is used by the programmable switching device to filter messages that match preset service events from the industrial protocol messages to obtain filtered messages. The feature key value associated with the filtered message is mapped to each row of a two-dimensional counter array through multiple independent hash functions. The count value of the hash-mapped counting unit in each row is accumulated and updated. The two-dimensional counter array is deployed on the data plane of the programmable switching device; The service event frequency statistics module is used to periodically read all the stored values of the register array from the control plane and estimate the active terminal base based on all the stored values. The control plane inputs the feature key value to be queried, queries multiple count values in the two-dimensional counter array that are mapped by the feature key value to be queried, and takes the minimum value among the count values to complete the service event frequency statistics.
9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the microgrid data flow security auditing method for massive terminals as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the microgrid data flow security auditing method for massive terminals as described in any one of claims 1-7.