CN111682642B - Lightweight intelligent substation information abnormality detection system and method thereof - Google Patents

Lightweight intelligent substation information abnormality detection system and method thereof Download PDF

Info

Publication number
CN111682642B
CN111682642B CN202010508821.1A CN202010508821A CN111682642B CN 111682642 B CN111682642 B CN 111682642B CN 202010508821 A CN202010508821 A CN 202010508821A CN 111682642 B CN111682642 B CN 111682642B
Authority
CN
China
Prior art keywords
information
message
intelligent substation
detection
module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202010508821.1A
Other languages
Chinese (zh)
Other versions
CN111682642A (en
Inventor
孔建寿
姚瑶
刘钊
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nanjing University of Science and Technology
Original Assignee
Nanjing University of Science and Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nanjing University of Science and Technology filed Critical Nanjing University of Science and Technology
Priority to CN202010508821.1A priority Critical patent/CN111682642B/en
Publication of CN111682642A publication Critical patent/CN111682642A/en
Application granted granted Critical
Publication of CN111682642B publication Critical patent/CN111682642B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
    • H02J13/00—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network
    • H02J13/00001—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by the display of information or by user interaction, e.g. supervisory control and data acquisition systems [SCADA] or graphical user interfaces [GUI]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/10—Text processing
    • G06F40/12—Use of codes for handling textual entities
    • G06F40/14—Tree-structured documents
    • G06F40/146—Coding or compression of tree-structured data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/06—Energy or water supply
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y10/00—Economic sectors
    • G16Y10/35—Utilities, e.g. electricity, gas or water
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y40/00—IoT characterised by the purpose of the information processing
    • G16Y40/10—Detection; Monitoring
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y40/00—IoT characterised by the purpose of the information processing
    • G16Y40/20—Analytics; Diagnosis
    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
    • H02J13/00—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network
    • H02J13/00006—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by information or instructions transport means between the monitoring, controlling or managing units and monitored, controlled or operated power network element or electrical equipment
    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
    • H02J13/00—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network
    • H02J13/00006—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by information or instructions transport means between the monitoring, controlling or managing units and monitored, controlled or operated power network element or electrical equipment
    • H02J13/00016—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by information or instructions transport means between the monitoring, controlling or managing units and monitored, controlled or operated power network element or electrical equipment using a wired telecommunication network or a data transmission bus
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02B—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO BUILDINGS, e.g. HOUSING, HOUSE APPLIANCES OR RELATED END-USER APPLICATIONS
    • Y02B90/00—Enabling technologies or technologies with a potential or indirect contribution to GHG emissions mitigation
    • Y02B90/20—Smart grids as enabling technology in buildings sector
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02E—REDUCTION OF GREENHOUSE GAS [GHG] EMISSIONS, RELATED TO ENERGY GENERATION, TRANSMISSION OR DISTRIBUTION
    • Y02E60/00—Enabling technologies; Technologies with a potential or indirect contribution to GHG emissions mitigation
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S10/00—Systems supporting electrical power generation, transmission or distribution
    • Y04S10/50—Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/12—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them characterised by data transport means between the monitoring, controlling or managing units and monitored, controlled or operated electrical equipment
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/12—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them characterised by data transport means between the monitoring, controlling or managing units and monitored, controlled or operated electrical equipment
    • Y04S40/124—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them characterised by data transport means between the monitoring, controlling or managing units and monitored, controlled or operated electrical equipment using wired telecommunication networks or data transmission busses

Landscapes

  • Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Power Engineering (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Economics (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Biomedical Technology (AREA)
  • Public Health (AREA)
  • Development Economics (AREA)
  • Accounting & Taxation (AREA)
  • General Engineering & Computer Science (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Human Computer Interaction (AREA)
  • Artificial Intelligence (AREA)
  • Computational Linguistics (AREA)
  • Water Supply & Treatment (AREA)
  • Human Resources & Organizations (AREA)
  • Marketing (AREA)
  • Primary Health Care (AREA)
  • Strategic Management (AREA)
  • Tourism & Hospitality (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Debugging And Monitoring (AREA)

Abstract

The invention provides a system and a method for detecting information abnormality of a lightweight intelligent substation, wherein a system configuration module is used for analyzing a substation configuration file, comparing the substation configuration file with captured message configuration information and acquiring all whole frame message information of the intelligent substation; the sniffing module is used for acquiring message information flowing through the system in real time, and screening, classifying and storing the message information; the detection alarm module is used for receiving the data packets GOOSE, SMV and MMS and comparing the data packets with a preset abnormal rule set to alarm; the management module is used for realizing user permission giving, duty log recording and system data recording. The invention can carry out abnormality detection alarm on the message information of the system by combining the current intelligent power transformation configuration file, feed back the information running state, realize multi-dimensional classification record of the abnormal information, assist operation and maintenance workers to carry out online analysis and summarize the abnormal information afterwards, and has certain application value in engineering.

Description

Lightweight intelligent substation information abnormality detection system and method thereof
Technical Field
The invention relates to an intelligent detection technology of an electrical system, in particular to a system and a method for detecting information abnormality of a lightweight intelligent substation.
Background
The intelligent transformer substation is a novel transformer substation which is based on an IEC61850 protocol, information can be shared among intelligent electrical equipment in the transformer substation, and meanwhile interoperation can be performed among the intelligent electrical equipment in the transformer substation. The intellectualization of the transformer substation breaks the original relative sealing performance of the intelligent transformer substation network, and the information safety of the intelligent transformer substation becomes an object which is widely concerned by the academic and engineering fields. In order to guarantee the normal operation of the intelligent substation, operation and maintenance workers are assisted to perform fault location and fault analysis, and many scientific researchers are focused on research on the aspect of guaranteeing the safe operation of the intelligent substation.
Related analysis systems aiming at intelligent substation configuration files and intelligent substation information abnormity capture systems exist in the market, the related analysis systems can independently analyze and analyze substation configuration software, and the intelligent substation information abnormity capture systems can capture intelligent substation abnormity information. The prior art scheme does not analyze the reasons of message faults, does not set an abnormal alarm mechanism, lacks the classified record of abnormal information, and is inconvenient for analyzing the reasons of abnormal generation at multiple angles; and the abnormal information of the intelligent substation is not combined with the related content in the current intelligent substation configuration file, so that operation and maintenance workers can more visually analyze the fault generation reason and quickly locate the fault.
Disclosure of Invention
The invention aims to provide a system and a method for detecting information abnormality of a lightweight intelligent substation.
The technical solution for realizing the purpose of the invention is as follows: the utility model provides a towards lightweight intelligent substation information anomaly detection system, includes system configuration module, sniffs module, detection alarm work module and management module, wherein:
the system configuration module is used for analyzing the substation configuration file, comparing the substation configuration file with the captured message configuration information and acquiring all whole frame message information of the intelligent substation;
the sniffing module is used for acquiring message information flowing through the system in real time, and screening, classifying and storing the message information;
the detection alarm module is used for receiving the data packets GOOSE, SMV and MMS, and comparing the data packets GOOSE, SMV and MMS with a preset abnormal rule set to alarm;
the management module is used for realizing user permission giving, duty log recording and system data recording.
Furthermore, the system configuration module comprises an import analysis unit and a monitoring network card unit of the intelligent substation SCD file, wherein the import analysis unit of the intelligent substation SCD file is used for analyzing the substation configuration file and comparing the substation configuration file with the captured message configuration information; and the monitoring network card unit is used for acquiring all full-frame message messages of the intelligent substation.
Furthermore, the import parsing unit of the intelligent substation SCD file parses the substation configuration file by using the DOM4J library, that is, reads a document of an XML source by using saxreader. The element specific index XML node is obtained by element.node (index), and all attributes of one element are obtained by element.attributes (), so that all node information required by the system is obtained, and the captured message configuration information is compared one by one.
Further, the message information acquired by the sniffing module includes a message appid, a source address, a destination address, and a detection time.
Further, the detection alarm module includes a GOOSE alarm unit, an SMV alarm unit, and an MMS message alarm unit, wherein:
the GOOSE alarm unit comprises a GOOSE message format and configuration detection subunit, a GOOSE message state change detection subunit, a GOOSE message interruption detection subunit and a GOOSE message test state detection subunit;
the SMV alarm unit comprises an SMV message format and configuration error detection subunit, an SMV message interruption and jitter detection subunit, an SMV message asynchronous detection subunit and an SMV message quality factor change detection subunit;
the MMS message alarm unit comprises an MMS message format error detection subunit.
Furthermore, the management module comprises a user management unit, a manager log unit and a document management unit, wherein the user management unit is used for realizing user authority endowment; the administrator log unit is used for realizing log record on duty; the document management unit is used for realizing system data recording.
Furthermore, a graphical operation interface is developed for the intelligent substation information abnormality detection system by using JavaFX.
A method for detecting information abnormality of a lightweight intelligent substation comprises the following steps:
the system configuration module analyzes the substation configuration file, compares the substation configuration file with the captured message configuration information, and simultaneously acquires all whole frame message information of the intelligent substation;
the sniffing module acquires message information flowing through the system in real time, and performs screening, classification and storage;
the detection alarm module receives the GOOSE, SMV and MMS data packets, and compares the GOOSE, SMV and MMS data packets with a preset abnormal rule set to alarm;
and the management module performs user authority management, duty log recording and system data recording.
A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
the system configuration module analyzes the substation configuration file, compares the substation configuration file with the captured message configuration information, and simultaneously acquires all whole frame message information of the intelligent substation;
the sniffing module acquires message information flowing through the system in real time, and performs screening, classification and storage;
the detection alarm module receives the GOOSE, SMV and MMS data packets, and compares the GOOSE, SMV and MMS data packets with a preset abnormal rule set to alarm;
and the management module performs user authority management, duty log recording and system data recording.
A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:
the system configuration module analyzes the substation configuration file, compares the substation configuration file with the captured message configuration information, and simultaneously acquires all whole frame message information of the intelligent substation;
the sniffing module acquires message information flowing through the system in real time, and performs screening, classification and storage;
the detection alarm module receives the GOOSE, SMV and MMS data packets, and compares the GOOSE, SMV and MMS data packets with a preset abnormal rule set to alarm;
and the management module is used for carrying out user authority management, duty log recording and system data recording.
Compared with the prior art, the invention has the following beneficial effects: the intelligent substation system information anomaly detection alarm is combined with the current intelligent substation configuration file to feed back the information running state, the diversity classification record of the anomaly information is realized, the operation and maintenance staff can be assisted to carry out online analysis, fault determination and subsequent summary and induction on the anomaly information, meaningful and regular information summary is provided for the operation and maintenance staff, a powerful basic technical support is provided for future anomaly information safety detection and repair, and the intelligent substation system information anomaly detection alarm has a certain application value in engineering.
Drawings
FIG. 1 is a system overall design framework diagram;
FIG. 2 is a system home interface diagram;
FIG. 3 is a system block interface diagram;
fig. 3(a) is an SCD configuration file import analysis diagram, fig. 3(b) is a sniffing module interface diagram, fig. 3(c) is a specific information diagram of an abnormal message, and fig. 3(d) is a user management diagram;
FIG. 4 System Login configuration diagram
FIG. 4(a) is a login interface diagram, and FIG. 4(b) is a configuration success interface diagram;
FIG. 5 is a diagram of system anomaly detection alarm
Fig. 5(a) is a GOOSE message state change detection alarm diagram, fig. 5(b) is a GOOSE message interruption detection alarm diagram, fig. 5(c) is a GOOSE message restart detection alarm diagram, fig. 5(d) is an SMV message interruption anomaly detection alarm diagram, fig. 5(e) is an SMV loss anomaly detection alarm diagram, fig. 5(f) is an SMV asynchronous anomaly detection alarm diagram, and fig. 5(g) is a system detection anomaly document diagram.
Detailed Description
To further illustrate the technical means adopted by the present invention and the effects thereof, the present invention is further described below with reference to the embodiments and the accompanying drawings. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention.
The invention provides an intelligent substation information abnormality detection system, which comprises a system configuration module, a sniffing module, a detection alarm module and a management module, wherein:
the system configuration module comprises an import analysis unit and a monitoring network card unit of the SCD file of the intelligent substation.
And the import analysis unit of the SCD file of the intelligent substation is used for analyzing the current configuration file of the intelligent substation and comparing the current configuration file with the captured message configuration information.
In the invention, the import and analysis function of the SCD file of the intelligent substation is the import of the configuration file of the intelligent substation, and the detection system analyzes the current configuration file so as to be convenient for detecting the normal use of the alarm module. Because the SCD configuration file of the intelligent substation is written by using SCL language, the SCD configuration file accords with XML language in syntax, the detection of message content configuration can be carried out only by analyzing the SCD file, the invention analyzes and configures the file by using a DOM4J library, and reads the document of an XML source by using SAXReader. The root element of XML obtained by document.getroot element () obtains an XML node at an element specific index by element.node (index), and obtains all attributes of an element by element.attributes (). Therefore, all the node information required by the system is obtained, and the node information is compared with the captured message configuration information one by one.
The monitoring network card unit is used for acquiring all whole frame message information flowing through the intelligent substation.
According to the invention, the network card equipment can analyze the flowing messages in advance under the default condition, only the destination address is accepted locally, and other addresses are discarded uniformly; in the mixed mode, as long as the message passes through the network card, no matter the message address, the format and the destination address, the message passing through the network card can be received, so that the network adapter needs to be set into a hybrid mode so as to acquire all the whole frame message information.
The sniffing module is used for intercepting and capturing a message appid, a source address, a destination address and detection time, and is convenient for operation and maintenance personnel to observe information data on line.
The sniffing module is also used for storing information flowing through the system in real time, when the operation and maintenance personnel need to refer to the current data information, the operation and maintenance personnel can press the corresponding button to realize the function, and the function of storing the information as required can reduce the memory pressure.
Meanwhile, the module screens the sniffed message information according to the current intelligent substation system appid, and then carries out statistics and classification according to time, so that operation and maintenance observers can select a specific certain device and mainly detect various message flows of the device, and further can deeply analyze the system message information. And when the sniffing module is started, the system counts the number of messages in real time and displays the messages on the main page in a line graph mode.
The detection alarm module comprises a GOOSE alarm unit, an SMV alarm unit and an MMS alarm unit, and is used for receiving the data packets GOOSE, SMV and MMS, comparing the data packets with a preset abnormal rule set, and alarming to record a log when the data packets conform to a certain rule; if the data packet does not match any rule, the data packet is discarded, and no record is left in the whole system, so that the data storage pressure of the whole system can be reduced, and the waste of storage resources is avoided.
The GOOSE alarm unit comprises a GOOSE message format and configuration error detection subunit, a GOOSE message state change detection subunit, a GOOSE message interruption detection subunit and a GOOSE message test state detection subunit.
The SMV alarm unit comprises an SMV message format and configuration error detection subunit, an SMV message interruption and jitter detection subunit, an SMV message asynchronous detection subunit and an SMV message quality factor change detection subunit.
The MMS message alarm unit comprises an MMS message format error detection subunit.
The operation and maintenance personnel can check the abnormal information according to a plurality of sorts of messages such as APPID, MAC, error types, detection time and the like, thereby providing a lot of convenience for the statistics and analysis of the abnormality and facilitating the quick positioning of the abnormality by the operation and maintenance personnel. After the current abnormal information is checked and processed by the operation and maintenance personnel in combination with the analysis content of the SCD file, processing suggestions and system records can be given, and the operation and maintenance personnel can conveniently gather and analyze the current abnormal information. When the module is started, the system main interface carries out real-time classification recording on detection alarm information and real-time recording on alarm processing progress in a sector statistical graph mode.
The management module comprises a user management unit, a manager log unit and a document management unit.
The user management unit gives the user authority, the admin authority is highest, all functions of the system can be executed, users can be newly added, and different user attributes are given; the user cannot modify other usernames and passwords, but can use sniffing, detection, and opinion management functions; the guest only has a browsing function and cannot operate the system. The administrator log unit is used for realizing the on-duty log filling of normal operation and maintenance workers, and other people cannot randomly tamper and delete the administrator log. The document management unit is used for realizing data storage of the system and viewing data files.
Examples
To verify the validity of the inventive scheme, the following simulation experiment was performed.
A graphical operation interface is developed for the intelligent substation information anomaly detection system by utilizing the JavaFX, and the functions of configuring system files and parameters, starting/closing detection (including a sniffing mode and a detection alarm mode), filling logs and viewing system record files can be completed through simple operation of the graphical interface. In order to facilitate the operation and check the detection result of a user, corresponding controls are selected in various interfaces according to a common expression mode to realize corresponding functions. And configuring the SCD and network card modes of the configuration file of the intelligent substation in a system configuration module, and then starting the whole detection system. After the message in the intelligent substation is captured by the system, the normal message can roll on the sniffing interface of the monitoring system in real time under the action of the sniffing module, the abnormal message can give an alarm in the detection alarm module and is recorded in the abnormal message class under the management module, and the operation and maintenance staff can check the abnormal message information in real time and can also check the abnormal message offline afterwards. The operation and maintenance staff can record the actions of the staff according to the corresponding logs after carrying out exception handling.
The operating environment of the test system is that JAVA devildoop toolkit (JDK)1.8 is installed in windows, a binary file directory (/ bin) of runtime environment (JRE) attached to JDK is configured in system environment variables, and a Dynamic Link Library (DLL) and a JAVA class library (JAR) of a data packet capturing middleware Jpcap are integrated into the JDK. The hardware configuration adopts 8G memory, 500G hard disk and i5-10210 UCPU.
When the intelligent substation experiment system normally operates, abnormal data can not be generated basically. In the performance and function test of the system of the invention, NPI-801 test tool is used, which can simulate the sending function of single-path or multi-path GOOSE and SMV messages and the receiving function of the GOOSE messages in real conditions. The tester can select and combine some message states according to the needs of the tester, so that various events under the real condition and the abnormal conditions of the messages can be simulated, but compared with an actual intelligent substation information system, the information flow is simpler, and the data volume is less.
(1) System integral module design
The detection system consists of a main interface and 4 window interfaces thereof, which are respectively as follows: the system comprises a system configuration interface, a sniffing mode working interface, a detection alarm working interface and a management interface. The functions of configuring system parameters, turning on/off detection (including a sniffing mode and a detection alarm mode) and filling in treatment comments can be completed through simple operation of a graphical interface. Corresponding controls are selected to realize corresponding functions in various interfaces according to a common expression mode, and graphical operation interface application software is developed for the intelligent substation network abnormity detection function by utilizing JavaFX in the embodiment in order to facilitate operation and check detection results of users. JavaFX is a novel tool kit provided by JAVA for a graphical interface, comprises a plurality of built-in controls such as windows, labels, buttons, textboxes, password boxes and the like, and can be well compatible with cross-platforms. The whole program display window is designed by using JavaFX Scene Builder, the interface is clear, and the whole system frame is shown in FIG. 1.
(1) Configuring an interface: using java, stage, fileChooser as an entrance of a resource manager for selecting an information storage path and an scd file path; display a file path using a javafx. scene. control. textfield control; network card selection is achieved using two components javafx.
(2) A sniffing mode interface, a detection alarm mode interface and a management mode interface all use javafx. scene. control. radio button controls to realize user operation buttons; the sniff mode is used to present the detected data content using javafx. scene. control. table column and javafx. scene. control. table view, graphically represented using javafx. scene. character. linechart, javafx. scene. character. category axis, javafx. scene. character. linehart number.
(2) System module function and implementation
The intelligent substation information abnormality detection system designed in the embodiment is composed of 4 modules, and a main interface is shown in fig. 2.
Configuration module design
In the configuration module, two functions are mainly adopted, namely configuration of an intelligent substation configuration file SCD and configuration of a monitoring network card.
(1) Import parsing of SCD configuration files
As shown in fig. 3(a), the function of importing and parsing the SCD file of the intelligent substation is to import the configuration file of the intelligent substation, and the detection system parses the current configuration file, so as to detect the normal use of the alarm module.
Because the SCD configuration file of the intelligent substation is written by using the SCL language and accords with the XML language in syntax, the detection of the message content configuration can be carried out only by analyzing the SCD file. The present embodiment uses the library of DOM4J to implement this function. Read (xmlSource) reads documents from XML sources using SAXReader. Gettoolelement () gets the root element of XML. Node (index) gets the XML node at the element specific index. Element attributes () gets all the attributes of an element. Therefore, the node information required by the system is obtained and compared with the captured message configuration information.
(2) Configuration of monitoring network card
Because the network card equipment analyzes the flowing message in advance under the default condition, only the destination address is accepted locally, and other addresses are discarded uniformly; in the mixed mode, as long as the message passes through the network card, no matter the message address, the format and the destination address, the message passing through the network card can be received, so the network adapter needs to be set into a promiscuous mode so as to acquire all the whole frame message information.
Sniffing module design
After the current system SCD file is successfully configured and the monitoring network card is selected, the sniffing mode button can be clicked, and the system enters the sniffing mode. Clicking the "not started" button reads the packet information from the network and scrolls the window to display in real time until the inspector clicks the "started" button to terminate the sniff mode.
The system adopts a JpcapCaptor. Two implementation classes are designed for a parameter interface PacketReceiver of the loopPacket method and are respectively used for processing data packets in a sniffing mode and an alarm mode. The system can distinguish three types of messages according to the type of Ethernet when capturing message information. The information which is not in line with the three types of messages is directly discarded, so that the overlarge system data flow and the prolonged detection time can be avoided.
The detection system presses down a sniff mode interface start key, the system interface displays the path message as shown in fig. 3(b), the path message is an interface screenshot in the sniff mode, and the intercepted content contains a series of data information such as a message appid, a source address, a destination address and detection time, so that operation and maintenance personnel can conveniently observe information data on line. The function of saving the current information flowing through the system is added in the sniffing mode, when the operation and maintenance personnel need to refer to the current data information, the corresponding button can be pressed, the function is realized, and the memory pressure can be reduced according to the function of saving the information as required.
Meanwhile, the module combines the sniffed message information with the analysis result of the current substation configuration file, the system can be screened according to the intelligent substation system equipment appid, and then the intelligent substation system equipment appid is classified according to time statistics, so that operation and maintenance observers can select a specific certain equipment and focus on detecting various message flows of the equipment, and the system message information can be deeply analyzed. And when the sniffing module is started, the system counts the number of the messages in real time and displays the messages on the main page in a line graph mode.
Detection alarm module design
The detection alarm module: and comparing the received three types of data packets GOOSE, SMV and MMS with the previously set abnormal rule set to find the abnormal behavior of the network communication. When the data packet conforms to a certain rule, the data packet alarms and records a log; if the data packet does not match any rule, the data packet is discarded, and no record is left in the whole system, so that the data storage pressure of the whole system can be reduced, and the waste of storage resources is avoided.
(1) GOOSE alarm detection unit
The GOOSE message alarm detection unit is divided into 4 categories, namely a first category GOOSE message format/configuration error detection subunit. Under the rule, a packet LENGTH ERROR GOOSE _ LENGTH _ ERROR, a packet TLV decoding ERROR GOOSE _ TLV _ ENCODING _ ERROR, and a packet configuration ERROR GOOSE _ SCD _ MISMATCH are defined.
The second category is the GOOSE message state change detection subunit. Under the rule, GOOSE message RESTART GOOSE _ RESTART, GOOSE message ghost GOOSE _ STATUS _ CHANGE, and GOOSE message disorder GOOSE _ DUMMY _ CHANGE) are defined.
The third category is the GOOSE message interrupt detection subunit. Under this rule, GOOSE message interrupt GOOSE _ interrupt is defined.
The fourth major category is that the GOOSE message is in a TEST state detection subunit, GOOSE _ TEST is defined under this rule, and the judgment of this function can be judged only by detecting that GOOSE apdu.test is equal to 1 when the GOOSE message format configuration state is normal.
(2) SMV alarm detection unit
The first major class of SMV message formats/configuration error alarm detection sub-units. Under the rule, a message LENGTH ERROR SMV _ LENGTH _ ERROR, a message TLV decoding ERROR SMV _ TLV _ ENCODING _ ERROR and a message configuration ERROR SMV _ SCD _ MISMATCH are defined.
The second major class of SMV message interrupt/jitter detection subunit. Under this rule, an SMV interrupt SMV _ LOST is defined.
And the third type SMV message asynchronous detection subunit. Under the rule, the message asynchronous exception SMV _ MV _ NSYNCHRONOUS is defined.
And a fourth type SMV message quality factor change detection subunit. Under this rule, SMV _ valid is defined.
(3) MMS message alarm detecting unit
And the MMS message format ERROR detection subunit defines MMS _ ASN _ ERROR under the rule.
Clicking the button of 'not starting' starts the abnormal detection mode, clicking the same button and stopping the detection alarm mode. In the process, if an abnormal data packet passes through, the abnormal data packet is captured and recorded, and a corresponding log file is generated.
The operation and maintenance personnel can check the abnormal information according to various sequences such as APPID, MAC, error types, detection time and the like, a lot of convenience is provided for abnormal statistics and analysis, and the operation and maintenance personnel can conveniently and quickly locate the abnormality. Double-clicking any abnormal message information, processing the control event by adding a monitoring method to the rows of the detection table, and popping up specific information of the abnormal message, as shown in fig. 3 (c).
After the current abnormal information is checked and processed by the operation and maintenance personnel in combination with the analysis content of the SCD file, processing suggestions and system records can be given, and the operation and maintenance personnel can conveniently gather and analyze the current abnormal information. Meanwhile, the main interface of the system classifies the detection alarm information in a sector statistical graph form and records the alarm processing progress in real time.
Management module design
The management module is divided into three parts, namely a user management unit, a manager log unit and a document management unit.
(1) User management is the assignment and establishment of user rights. And a setting button is clicked, so that different authorities can be set for different operation and maintenance workers. The admin authority is highest, users can be newly added, different user attributes are given, and the used functions of the system are used; the user cannot modify other usernames and passwords, but can use sniffing, detection, and opinion management functions; the guest only has a browsing function and cannot operate the system. The specific operation function is shown in fig. 3 (d).
(2) The manager log is the current log on duty or the processing result and method of the alarm abnormal information which can be recorded by the current operation and maintenance staff. Clicking an 'add' button to fill in the current log, and once successfully submitted, the current log cannot be modified. While blank filling is not possible. Therefore, other abnormal operation and maintenance workers can be prevented from randomly tampering and deleting the log content of the manager.
(3) Document management can refer to the currently saved data file, and this function can only be executed by admin to prevent the file contents from being deleted or removed. And clicking a button of 'viewing data files' to enter a data file library, wherein four Excel files comprise a user account file user, a normal information file message, an abnormal information file alert and a manager log file option. The four files can facilitate other operation and maintenance workers to inquire the working records at any time and know the running state of the system.
A user number userid, a user account number username, a user password and a user role are defined in the user Excel table. The message Excel table defines a normal information number msgid, a normal information id appid, a normal information source IP destination address mac, a normal message storage path filename, a normal message capture time and a normal message type. an abnormal information number alert id, an abnormal message type alert type, an abnormal message capturing time, a current abnormal information labeling option, an abnormal information source IP destination address mac, an abnormal information id appid and an abnormal message storage path filepath are defined in the alert Excel table. The opinion Excel table defines a log number opinionid, a log time and a log content.
POI class library, and excel file as data storage medium. The data persistence layer completely realizes the functions of adding, deleting, modifying and checking the traditional database foundation, is convenient for non-professional personnel to analyze data, and also makes up the problem that the traditional database needs to be additionally installed and deployed.
(3) Testing step of intelligent substation information anomaly detection system
In the first step, when logging in the intelligent substation information anomaly monitoring system, operation and maintenance related personnel need to perform password logging operation, as shown in fig. 4(a), only if logging is successful, the personnel can enter a main operation page of the system. Meanwhile, different users have different authorities, and the admin authority can be selected to obtain the function of the maximum test system. If the user name and the password are not uniform or the user name is not available, the user cannot enter the system.
And secondly, selecting a network card as a hybrid network card mode in a configuration module, importing the SCD file of the current transformer substation into the system and correctly analyzing the SCD file. As shown in fig. 4 (b). If the current SCD file is wrong or the system fails to analyze the SCD file, the system cannot enter a sniffing and detection mode.
And clicking a sniffing mode button, wherein the intelligent substation information abnormity monitoring system cannot give an alarm under the normal running state of the intelligent substation system, and a sniffing mode window can display the road channel message information in real time.
And thirdly, typical abnormal information detection is carried out. Clicking the "detection mode" button, the system enters the detection function.
(4) Test result of intelligent substation information anomaly detection system
The present embodiment tests system function with several typical exceptions, as shown in table 1.
TABLE 1 test case
Figure BDA0002527631300000101
(1) GOOSE message state change
In the normal sending state, any content in the message data set is changed, and the GOOSE message state is changed, and the detection result is shown in fig. 5 (a).
(2) GOOSE interrupt state
The test principle is as follows: in this case, the message sending button is clicked to ensure that other configurations are correct and the message format is correct. And pressing a sending stop state button of the test software to achieve the abnormal test condition of the GOOSE interrupt state. The system detects the abnormality information and issues an alarm as shown in fig. 5 (b).
(3) GOOSE message restart state
The test principle is as follows: and continuously pressing the sending button, and then the GOOSE message enters the restart test process again. And achieving the abnormal testing condition of the GOOSE restarting state. The system detects the abnormality information and issues an alarm as shown in fig. 5 (c).
(4) SMV message interrupt anomaly detection
The testing principle is as follows: in the normal sending process of the SMV, the SMV interruption abnormity test condition is achieved by clicking to stop sending. The system detects the abnormal alarm information and issues an alarm as shown in fig. 5 (d).
(5) SMV packet loss anomaly detection
The test principle is as follows: in the SMV packet sending process, the analog frame loss mode button is clicked, the packet loss anomaly detection condition is achieved, and the test result is shown in fig. 5 (e). And the detection system sends an SMV packet loss abnormity alarm.
(6) SMV asynchronous anomaly detection
The testing process comprises the following steps: if the synchronous threshold value is changed during normal transmission and it is not true, the asynchronous abnormal test condition is achieved. The test results are shown in fig. 5 (f). The detection system issues an SMV asynchronous exception alarm.
And the test cases can pass the test after verification. After the test is finished, the system data file is recorded as shown in fig. 5 (g). The system can successfully record the system information and can manually judge the reason of the system information according to the abnormity.
In conclusion, the intelligent substation information anomaly detection system is developed on a Windows platform by applying JAVA programming language, comprises four functional modules, namely a configuration module, a sniffing module, a detection alarm module and a management module, and tests and verifies the intelligent substation information anomaly monitoring system, so that the designed information anomaly rule is correct and the system function is effective.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims (7)

1. The utility model provides a towards lightweight intelligent substation information anomaly detection system which characterized in that, includes system configuration module, sniffs module, detection alarm module and management module, wherein:
the system configuration module is used for analyzing the substation configuration file, comparing the substation configuration file with the captured message configuration information and acquiring all whole frame message information of the intelligent substation;
the sniffing module is used for acquiring message information flowing through the system in real time, and screening, classifying and storing the message information;
the detection alarm module is used for receiving the data packets GOOSE, SMV and MMS, and comparing the data packets GOOSE, SMV and MMS with a preset abnormal rule set to alarm;
the management module is used for realizing user permission giving, duty log recording and system data recording;
the system configuration module comprises an import analysis unit and a monitoring network card unit of the SCD file of the intelligent substation, wherein the import analysis unit of the SCD file of the intelligent substation is used for analyzing the SCD file of the intelligent substation and comparing the SCD file with captured message configuration information; the monitoring network card unit is used for acquiring all full-frame message messages of the intelligent substation;
the import analysis unit of the intelligent substation SCD file analyzes the substation configuration file by using a DOM4J library, namely, a document of an XML source is read by using SAXReader. Obtaining a root element of XML (extensive Makeup language) obtained by document.getroot element (), obtaining an XML node of element specific index by element.node (index), and obtaining all attributes of one element by element.attributes (), thereby obtaining all node information required by a system and performing one-to-one comparison with captured message configuration information;
the detection alarm module comprises a GOOSE alarm unit, an SMV alarm unit and an MMS message alarm unit, wherein:
the GOOSE alarm unit comprises a GOOSE message format and configuration detection subunit, a GOOSE message state change detection subunit, a GOOSE message interruption detection subunit and a GOOSE message test state detection subunit;
the SMV alarm unit comprises an SMV message format and configuration error detection subunit, an SMV message interruption and jitter detection subunit, an SMV message asynchronous detection subunit and an SMV message quality factor change detection subunit;
the MMS message alarm unit comprises an MMS message format error detection subunit.
2. The system for detecting abnormality of information of a lightweight-oriented intelligent substation according to claim 1, wherein the message information acquired by the sniffing module includes a message appid, a source address, a destination address and a detection time.
3. The system for detecting the abnormality of the information of the lightweight-oriented intelligent substation according to claim 1, wherein the management module comprises a user management unit, a manager log unit and a document management unit, wherein the user management unit is used for realizing user permission assignment; the administrator log unit is used for realizing log record on duty; the document management unit is used for realizing system data recording.
4. The system for detecting abnormality of information of lightweight-oriented intelligent substation according to claim 1, characterized in that a graphical operation interface is developed for the system for detecting abnormality of information of intelligent substation by using JavaFX.
5. A method for detecting information abnormality of a lightweight-oriented intelligent substation is characterized in that the detection of the information abnormality of the lightweight-oriented intelligent substation is realized based on the system for detecting the information abnormality of the lightweight-oriented intelligent substation of any one of claims 1 to 4.
6. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor, when executing the computer program, implements a lightweight intelligent substation information abnormality detection based on the lightweight intelligent substation information abnormality detection system according to any one of claims 1 to 4.
7. A computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements lightweight-oriented intelligent substation information abnormality detection based on the lightweight-oriented intelligent substation information abnormality detection system according to any one of claims 1 to 4.
CN202010508821.1A 2020-06-06 2020-06-06 Lightweight intelligent substation information abnormality detection system and method thereof Active CN111682642B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010508821.1A CN111682642B (en) 2020-06-06 2020-06-06 Lightweight intelligent substation information abnormality detection system and method thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010508821.1A CN111682642B (en) 2020-06-06 2020-06-06 Lightweight intelligent substation information abnormality detection system and method thereof

Publications (2)

Publication Number Publication Date
CN111682642A CN111682642A (en) 2020-09-18
CN111682642B true CN111682642B (en) 2022-09-27

Family

ID=72454334

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010508821.1A Active CN111682642B (en) 2020-06-06 2020-06-06 Lightweight intelligent substation information abnormality detection system and method thereof

Country Status (1)

Country Link
CN (1) CN111682642B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112258804A (en) * 2020-10-21 2021-01-22 浙江浙能兰溪发电有限责任公司 Comprehensive analysis fault alarm system based on data packet data comparison
CN113507460A (en) * 2021-06-30 2021-10-15 贵州电网有限责任公司电力科学研究院 Abnormal message detection method and device, computer equipment and storage medium
CN113656368B (en) * 2021-07-29 2024-07-23 济南浪潮数据技术有限公司 Cloud platform log processing method and system
CN114301621B (en) * 2021-11-17 2024-06-14 北京智芯微电子科技有限公司 Intelligent transformer substation and network communication safety control method and device thereof
CN116865932B (en) * 2023-09-04 2023-12-05 国网江苏省电力有限公司无锡供电分公司 Temporary switch box system for transformer substation infrastructure and monitoring method thereof

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103296755A (en) * 2013-05-10 2013-09-11 国家电网公司 Network online monitoring system for transformer substation
CN107995050A (en) * 2017-12-29 2018-05-04 国网安徽省电力有限公司 Secondary system of intelligent substation process layer communication failure diagnostic system and method
CN108234237A (en) * 2017-12-18 2018-06-29 国网技术学院 A kind of empty circuit health examination method and system acquired in real time based on interchanger

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103296755A (en) * 2013-05-10 2013-09-11 国家电网公司 Network online monitoring system for transformer substation
CN108234237A (en) * 2017-12-18 2018-06-29 国网技术学院 A kind of empty circuit health examination method and system acquired in real time based on interchanger
CN107995050A (en) * 2017-12-29 2018-05-04 国网安徽省电力有限公司 Secondary system of intelligent substation process layer communication failure diagnostic system and method

Also Published As

Publication number Publication date
CN111682642A (en) 2020-09-18

Similar Documents

Publication Publication Date Title
CN111682642B (en) Lightweight intelligent substation information abnormality detection system and method thereof
CN112995196B (en) Method and system for processing situation awareness information in network security level protection
US9639456B2 (en) Network-based testing service and method of testing in a network
CN109391613A (en) A kind of intelligent substation method for auditing safely based on SCD parsing
CN112631913B (en) Method, device, equipment and storage medium for monitoring operation faults of application program
CN108304704A (en) Authority control method, device, computer equipment and storage medium
CN111092869A (en) Security management and control method for terminal access to office network and authentication server
CN107241229B (en) Service monitoring method and device based on interface testing tool
CN114077525A (en) Abnormal log processing method and device, terminal equipment, cloud server and system
CN112905548B (en) Security audit system and method
CN104506351A (en) Method and system for performing online full-automatic configuration of compliance safety audit
CN112131057B (en) AI test method, client and system of network security equipment
CN112163198B (en) Host login security detection method, system, device and storage medium
CN112565232B (en) Log analysis method and system based on template and flow state
CN114338104A (en) Security gateway parsing function verification method, device, equipment and storage medium
CN113328914A (en) Fuzzy test method and device for industrial control protocol, storage medium and processor
CN111026637B (en) Method and device for positioning problem code
CN117411804A (en) Server network testing method and device, electronic equipment and storage medium
CN109165513B (en) System configuration information inspection method and device and server
CN111585830A (en) User behavior analysis method, device, equipment and storage medium
CN107104853B (en) Test bed system and test method for terminal safety management software
CN112415404B (en) Battery pack testing method and battery pack testing device
CN113392079B (en) Distributed storage cluster log storage optimization method, system and terminal
CN109412861B (en) Method for establishing security association display of terminal network
CN112162906A (en) Server behavior monitoring method of probe management platform architecture

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant