CN109379255A - One kind being based on intelligent exchange process-level network flow monitoring method for early warning - Google Patents
One kind being based on intelligent exchange process-level network flow monitoring method for early warning Download PDFInfo
- Publication number
- CN109379255A CN109379255A CN201811520908.XA CN201811520908A CN109379255A CN 109379255 A CN109379255 A CN 109379255A CN 201811520908 A CN201811520908 A CN 201811520908A CN 109379255 A CN109379255 A CN 109379255A
- Authority
- CN
- China
- Prior art keywords
- switch port
- value
- theoretical value
- message
- size
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Small-Scale Networks (AREA)
Abstract
The invention discloses one kind to be based on intelligent exchange process-level network flow monitoring method for early warning, extracts IED equipment message parameter information；Extract the VLAN configuration data of switch port；Calculate IED equipment transmitted traffic size theoretical value；Calculate the uninterrupted theoretical value of switch port；The report-control block of desampler sending and the real value and switch port output flow size real value for recording switch port input flow rate size；Warning information is compared, and generates warning information.The present invention monitors the operating condition of whole process layer network, and the switch port for being more than the error range of setting to flow provides alarm, and the security risk of timely discovery procedure layer network is conducive to the stable operation of intelligent substation network.
Description
Technical field
The invention belongs to intelligent substation fields, and in particular to one kind is based on intelligent exchange process-level network flow monitoring
Method for early warning.
Background technique
Process-level network is the core of entire intelligent substation network, but for the flow information of switch network
Monitoring is constantly in blank, once network goes wrong, the orientation problem time is long, checks problem hard, to operations staff and inspection
Personnel are repaired with many puzzlements.
With the application of interchanger novel in intelligent substation, the monitoring information obtained in the past by snmp protocol, now
It is changed to by being modeled to interchanger, exchanger information is obtained by MMS network in real time, monitoring switch device and monitoring in this way is protected
It is equally convenient to protect equipment.
The present invention propose a kind of flow theory size by computational intelligence Substation process-level network switch port with
It monitors the switch port actual flow size comparison method obtained in real time, monitors the operating condition of whole process layer network, it is right
Switch port more than setting error provides alarm, and the security risk of timely discovery procedure layer network is conducive to intelligent power transformation
It stands the stable operation of network.
Summary of the invention
It is a kind of based on intelligent exchange process layer the purpose of the present invention is in view of the above-mentioned problems existing in the prior art, providing
Network Traffic Monitoring method for early warning.
Above-mentioned purpose of the invention is achieved through the following technical solutions:
One kind being based on intelligent exchange process-level network flow monitoring method for early warning, includes the following steps:
Step 1, parsing intelligent substation SCD file extract IED equipment message parameter information, IED equipment message parameter letter
Breath includes:
The SV of all IED equipment sends the SV sample frequency value in control block message；
The GOOSE of all IED equipment sends control block message, and it includes: heartbeat message interval that GOOSE, which sends control block information,
Time T0, failure message transmission interval time T1, failure message transmission interval time T2, failure message transmit interval time T3；
Step 2, intelligent substation SCD file is parsed, the VLAN configuration data of switch port is extracted, is configured according to VLAN
Data parse the VLAN value of all switch ports；
Step 3, SV transmitted traffic size theoretical value=SV message length × SV sample frequency value is calculated；
Calculate GOOSE transmitted traffic size theoretical value=2 × primary fault GOOSE uninterrupted theoretical value, primary fault
GOOSE uninterrupted theoretical value is that primary fault period GOOSE message sends frequency and GOOSE message length；
Calculate IED equipment transmitted traffic size theoretical value=SV transmitted traffic size theoretical value+GOOSE transmitted traffic size
Theoretical value；
Step 4, the uninterrupted theoretical value of switch port is calculated,
Switch port uninterrupted theoretical value includes switch port input flow rate size theoretical value and switch port
Output flow size theoretical value.
Switch port input flow rate size theoretical value is each IED equipment SV transmitted traffic size corresponding with VLAN value
The summation of theoretical value and GOOSE transmitted traffic size theoretical value；
Switch port output flow size theoretical value is that each IED equipment SV corresponding with VLAN value receives uninterrupted
Theoretical value and GOOSE receive the summation of uninterrupted theoretical value；
Step 5, the transmission period of statistical report control block in interchanger is set, and interchanger is according to statistical report control block pair
Outer transmission accounting message, accounting message include that switch port input flow rate size real value and switch port output flow are big
Small real value, period receive accounting message and record the real value and switch port output of switch port input flow rate size
Uninterrupted real value；
Step 6, the switch port input flow rate size real value that will acquire and calculated switch port inlet flow
Amount size theoretical value is compared, if error range of the difference beyond setting, provides warning information, and generate warning information；
Compared with the switch port output flow size real value obtained simultaneously exports theoretical value with calculated switch port, if
Error range of the difference beyond setting, provides warning information, and generate warning information.
The present invention has the advantages that compared with the existing technology
1) switch port input flow rate size theoretical value and switch port output flow size theoretical value, are calculated, and
With real time monitoring obtain switch port input flow rate size real value and switch port output flow size real value into
Row compares, and monitors the operating condition of whole process layer network；
2) operating condition for, monitoring whole process layer network provides the switch port for the error range for being more than setting
Alarm, the security risk of timely discovery procedure layer network are conducive to the stable operation of intelligent substation network.
Detailed description of the invention
Fig. 1 is the heartbeat message interval time T0 of the GOOSE under malfunction, failure message transmits interval time T1, event
Hinder the distribution schematic diagram of message transmission interval time T2, failure message transmission interval time T3
Specific embodiment
For the ease of those of ordinary skill in the art understand and implement the present invention, below with reference to embodiment to the present invention make into
The detailed description of one step, it should be understood that implementation example described herein is merely to illustrate and explain the present invention, and is not used to limit
The fixed present invention.
As shown in Figure 1, a kind of intelligent substation Network Traffic Monitoring method for early warning, includes the following steps:
Step 1, parsing intelligent substation SCD file, extract IED equipment message parameter information, above-mentioned IED equipment message
Parameter information includes:
The SV of all IED equipment sends the SV sample frequency value in control block message；
The GOOSE of all IED equipment sends control block message, and it includes: heartbeat message interval that GOOSE, which sends control block information,
Time T0, failure message transmission interval time T1, failure message transmission interval time T2, failure message transmit interval time T3.
Heartbeat message interval time T0 by GOOSE report-control block in intelligent substation SCD file " MaxTime " parameter
It obtains；Failure message transmits interval time T1 by " MinTime " gain of parameter of GOOSE report-control block in SCD；Failure message
The value of transmission interval time T2 is 2 times of failure message transmission interval time T1；The value that failure message transmits interval time T3 is 4
Failure message again transmits interval time T1；
Step 2, intelligent substation SCD file is parsed, the VLAN configuration data of switch port is extracted, is configured according to VLAN
Data parse the VLAN value of all switch ports, generate the map information table of switch port and VLAN value.
Step 3, IED equipment transmitted traffic size theoretical value is calculated,
All contain VLAN value in the SV message and GOOSE message that IED equipment is sent, interchanger receives SV message and GOOSE
After message, the VLAN value in SV message and GOOSE message is parsed, respective switch port is forwarded to according to VLAN value.
IED equipment transmitted traffic size theoretical value=SV transmitted traffic size theoretical value+GOOSE transmitted traffic size is theoretical
Value,
SV transmitted traffic size theoretical value is equal to the product of SV message length and SV sample frequency value.SV message includes ether
Ethernet heading length, PDU identification length and APDU length are added composition SV report by network packet head, PDU mark and APDU
Literary length.
GOOSE transmitted traffic size theoretical value is divided into GOOSE transmitted traffic size theoretical value and failure shape under stable state
2 kinds of situations of GOOSE transmitted traffic size theoretical value under state,
When GOOSE transmitted traffic size theoretical value under stable state is equal to GOOSE message length and heartbeat message interval
Between T0 be multiplied；
GOOSE transmitted traffic size theoretical value under malfunction is relative complex, under nonserviceabling, first frame GOOSE
Failure message transmission interval time T1 is divided between message and the transmission of the second frame GOOSE message；Second frame GOOSE message and third
Frame GOOSE message and third frame GOOSE message are identical as the 4th frame GOOSE message transmission interval time, are failure message
Transmit interval time T2；Third frame GOOSE message and the 4th frame GOOSE message are divided into failure message transmission interval between sending when
Between T3；Heartbeat message interval time T0 is divided between the transmission of GOOSE message after 4th frame GOOSE message.
According to heartbeat message interval time T0, failure message transmission interval time T1, failure message transmission interval time T2,
Failure message transmission interval time T3 packet sending intervals can calculate primary fault period GOOSE message and send frequency,
It is that primary fault period GOOSE message sends frequency and this GOOSE message for primary fault GOOSE uninterrupted theoretical value
The product of length (in process layer, the length of GOOSE message length is fixed).
When continuous fault occurs, the transmission interval of GOOSE message is continuously that minimum interval is the minimum of interframe space
Value (for the transmission rate of 100M, the minimum value of interframe space is 96 bits), so its uninterrupted can achieve linear speed.
Comprehensively consider the stable state of GOOSE message and the transfer characteristic of malfunction, calculates GOOSE transmitted traffic
Certain nargin is considered when size theoretical value, sets GOOSE transmitted traffic size theoretical value=2 × primary fault GOOSE flow
Size theoretical value.
By calculating, the IED equipment transmitted traffic size theoretical value of all IED equipment is obtained.
Step 4, the uninterrupted theoretical value of switch port is calculated,
Switch port uninterrupted theoretical value includes switch port input flow rate size theoretical value and switch port
Output flow size theoretical value.
Switch port input flow rate size theoretical value is each IED equipment SV transmitted traffic size corresponding with VLAN value
The summation of theoretical value and GOOSE transmitted traffic size theoretical value；
Switch port output flow size theoretical value is that each IED equipment SV corresponding with VLAN value receives uninterrupted
Theoretical value and GOOSE receive the summation of uninterrupted theoretical value；
So the VLAN value by each port of interchanger can conveniently calculate all switch port input flow rate sizes
Theoretical value and switch port output flow size theoretical value.
Step 5, the real value and switch port output flow size of switch port input flow rate size are obtained in real time
Real value,
The transmission period of statistical report control block in interchanger is set, and interchanger is externally sent according to statistical report control block
Accounting message, accounting message include that switch port input flow rate size real value and switch port output flow size are real-time
Value, so that the statistics report comprising switch port input flow rate size real value and switch port output flow size real value
Text is externally sent according to the transmission period.
Period receives accounting message and records the real value and switch port output of switch port input flow rate size
Uninterrupted real value.
Step 6, the comparison of switch port flow real value and auto-alarming,
Show the switch port input flow rate size real value and exchange generator terminal of all records with table and curve form
Mouth output flow size real value,
The switch port input flow rate size real value and calculated switch port input flow rate size that will acquire
Theoretical value is compared, if error range of the difference beyond setting, provides warning information, and generate warning information；It obtains simultaneously
Compared with the switch port output flow size real value taken exports theoretical value with calculated switch port, if difference is super
The error range set out provides warning information, and generates warning information.
Specific embodiment described herein is only an example for the spirit of the invention.The neck of technology belonging to the present invention
The technical staff in domain can make various modifications or additions to the described embodiments or replace by a similar method
In generation, however, it does not deviate from the spirit of the invention or beyond the scope of the appended claims.
Claims (1)
1. one kind is based on intelligent exchange process-level network flow monitoring method for early warning, which comprises the steps of:
Step 1, parsing intelligent substation SCD file, extract IED equipment message parameter information, IED equipment message parameter information packet
It includes:
The SV of all IED equipment sends the SV sample frequency value in control block message；
The GOOSE of all IED equipment sends control block message, and it includes: heartbeat message interval time that GOOSE, which sends control block information,
T0, failure message transmission interval time T1, failure message transmission interval time T2, failure message transmit interval time T3；
Step 2, intelligent substation SCD file is parsed, the VLAN configuration data of switch port is extracted, according to VLAN configuration data
Parse the VLAN value of all switch ports；
Step 3, SV transmitted traffic size theoretical value=SV message length × SV sample frequency value is calculated；
Calculate GOOSE transmitted traffic size theoretical value=2 × primary fault GOOSE uninterrupted theoretical value, primary fault GOOSE
Uninterrupted theoretical value is that primary fault period GOOSE message sends frequency and GOOSE message length；
It is theoretical to calculate IED equipment transmitted traffic size theoretical value=SV transmitted traffic size theoretical value+GOOSE transmitted traffic size
Value；
Step 4, the uninterrupted theoretical value of switch port is calculated,
Switch port uninterrupted theoretical value includes switch port input flow rate size theoretical value and switch port output
Uninterrupted theoretical value；
Switch port input flow rate size theoretical value is that each IED equipment SV transmitted traffic size corresponding with VLAN value is theoretical
The summation of value and GOOSE transmitted traffic size theoretical value；
Switch port output flow size theoretical value is that each IED equipment SV corresponding with VLAN value receives uninterrupted theory
Value and GOOSE receive the summation of uninterrupted theoretical value；
Step 5, the transmission period of statistical report control block in interchanger is set, and interchanger is according to statistical report control block to outgoing
Accounting message is sent, accounting message includes that switch port input flow rate size real value and switch port output flow size are real
Duration, period receive accounting message and record the real value and switch port output flow of switch port input flow rate size
Size real value；
Step 6, the switch port input flow rate size real value and calculated switch port input flow rate that will acquire are big
Small theoretical value is compared, if error range of the difference beyond setting, provides warning information, and generate warning information；Simultaneously
Compared with the switch port output flow size real value of acquisition exports theoretical value with calculated switch port, if difference
Error range beyond setting provides warning information, and generates warning information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811520908.XA CN109379255B (en) | 2018-12-12 | 2018-12-12 | Intelligent switch based process layer network flow monitoring and early warning method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811520908.XA CN109379255B (en) | 2018-12-12 | 2018-12-12 | Intelligent switch based process layer network flow monitoring and early warning method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109379255A true CN109379255A (en) | 2019-02-22 |
| CN109379255B CN109379255B (en) | 2021-10-08 |
Family
ID=65374012
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811520908.XA Active CN109379255B (en) | 2018-12-12 | 2018-12-12 | Intelligent switch based process layer network flow monitoring and early warning method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109379255B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111817889A (en) * | 2020-07-02 | 2020-10-23 | 中国南方电网有限责任公司 | Method for positioning connection error of process layer port of intelligent substation |
| CN112073326A (en) * | 2020-07-30 | 2020-12-11 | 许继集团有限公司 | Intelligent substation process layer network data flow control method |
| CN112737859A (en) * | 2021-01-04 | 2021-04-30 | 中车青岛四方车辆研究所有限公司 | Vehicle-mounted flow auditing and alarming linkage system and flow abnormity judging method |
| CN114338096A (en) * | 2021-12-10 | 2022-04-12 | 南京南瑞继保电气有限公司 | Configuration method of process layer isolation device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20120082600A (en) * | 2011-01-14 | 2012-07-24 | 정정화 | Apparatus and method for parsing packet |
| CN102932167A (en) * | 2012-10-10 | 2013-02-13 | 华南理工大学 | Information stream control method and system for improving relay protection reliability of intelligent substation |
| CN103378654A (en) * | 2012-04-27 | 2013-10-30 | 南京南瑞继保电气有限公司 | Method for filtering network messages of process level of intelligent substation |
| CN103595594A (en) * | 2013-12-02 | 2014-02-19 | 中国联合网络通信集团有限公司 | Flow detection method and electronic equipment |
| CN103916292A (en) * | 2014-04-14 | 2014-07-09 | 贵州电力试验研究院 | Digital substation switch online monitoring system based on IEC61850 standard |
| WO2015024497A1 (en) * | 2013-08-19 | 2015-02-26 | 国家电网公司 | Intelligent substation network sampling and control link self-diagnosis method |
| CN108494747A (en) * | 2018-03-08 | 2018-09-04 | 上海观安信息技术股份有限公司 | Traffic anomaly detection method, electronic equipment and computer program product |
-
2018
- 2018-12-12 CN CN201811520908.XA patent/CN109379255B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20120082600A (en) * | 2011-01-14 | 2012-07-24 | 정정화 | Apparatus and method for parsing packet |
| CN103378654A (en) * | 2012-04-27 | 2013-10-30 | 南京南瑞继保电气有限公司 | Method for filtering network messages of process level of intelligent substation |
| CN102932167A (en) * | 2012-10-10 | 2013-02-13 | 华南理工大学 | Information stream control method and system for improving relay protection reliability of intelligent substation |
| WO2015024497A1 (en) * | 2013-08-19 | 2015-02-26 | 国家电网公司 | Intelligent substation network sampling and control link self-diagnosis method |
| CN103595594A (en) * | 2013-12-02 | 2014-02-19 | 中国联合网络通信集团有限公司 | Flow detection method and electronic equipment |
| CN103916292A (en) * | 2014-04-14 | 2014-07-09 | 贵州电力试验研究院 | Digital substation switch online monitoring system based on IEC61850 standard |
| CN108494747A (en) * | 2018-03-08 | 2018-09-04 | 上海观安信息技术股份有限公司 | Traffic anomaly detection method, electronic equipment and computer program product |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111817889A (en) * | 2020-07-02 | 2020-10-23 | 中国南方电网有限责任公司 | Method for positioning connection error of process layer port of intelligent substation |
| CN112073326A (en) * | 2020-07-30 | 2020-12-11 | 许继集团有限公司 | Intelligent substation process layer network data flow control method |
| CN112073326B (en) * | 2020-07-30 | 2023-05-12 | 许继集团有限公司 | Intelligent substation process layer network data flow control method |
| CN112737859A (en) * | 2021-01-04 | 2021-04-30 | 中车青岛四方车辆研究所有限公司 | Vehicle-mounted flow auditing and alarming linkage system and flow abnormity judging method |
| CN114338096A (en) * | 2021-12-10 | 2022-04-12 | 南京南瑞继保电气有限公司 | Configuration method of process layer isolation device |
| CN114338096B (en) * | 2021-12-10 | 2023-11-17 | 南京南瑞继保电气有限公司 | Configuration method of process layer isolation device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109379255B (en) | 2021-10-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109379255A (en) | One kind being based on intelligent exchange process-level network flow monitoring method for early warning | |
| CN106559436A (en) | A kind of safety monitoring management method for being applied to power system transformer | |
| CN104683168B (en) | A kind of transformer station process layer network communication failure automatic positioning method | |
| CN104125103B (en) | Intelligent transformer substation process layer network communication fault locating method based on list of proof | |
| CN103457791A (en) | Self-diagnosis method of network sampling and control link of intelligent substation | |
| CN105790990B (en) | A kind of method and its system for supervising adapted telecommunication business | |
| CN104486153B (en) | A kind of transformer station process layer network transmission performance monitoring method based on FPGA | |
| CN103026664A (en) | Determining vlan-ids for a switched-based communication network of a process control system | |
| CN206237204U (en) | System and power communication system for monitoring communication state in power system | |
| CN104038383A (en) | Switch based process level network message analysis method | |
| CN107968486A (en) | A kind of method for scheduling task of intelligent power distribution room monitoring system | |
| CN106533832A (en) | Distributed-deployment-based network flow detection system | |
| CN110288866A (en) | A kind of dispatch data net simulation training system and method | |
| CN108734418A (en) | A kind of electric network fault statistical analysis system and its analysis method | |
| CN206115422U (en) | Long -range print system of relay protection information | |
| CN102970278B (en) | For process between industrial information system and the system pushing warning message | |
| CN105356618B (en) | the fault oscillograph networking method of integrated monitoring system | |
| CN101185288A (en) | RF utilization calculation and reporting method for 802.11 wireless local area networks | |
| CN105207855B (en) | A kind of net source information monitoring and evaluating system and method | |
| CN108759901A (en) | Power grid voluntarily diagnostic system and its method | |
| CN112364060B (en) | Transmission method of photovoltaic intelligent operation and maintenance data | |
| CN207817676U (en) | Transforming plant protecting device centralization printing device | |
| CN208890819U (en) | A kind of intelligent substation switch monitoring system | |
| CN208736451U (en) | A kind of in-line meter monitoring system | |
| CN107505535B (en) | Transformer substation secondary system data information analysis system and analysis method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |