CN115801412B - Extraction method of electric power Internet of things information network attack behavior characteristics - Google Patents
Extraction method of electric power Internet of things information network attack behavior characteristics Download PDFInfo
- Publication number
- CN115801412B CN115801412B CN202211445229.7A CN202211445229A CN115801412B CN 115801412 B CN115801412 B CN 115801412B CN 202211445229 A CN202211445229 A CN 202211445229A CN 115801412 B CN115801412 B CN 115801412B
- Authority
- CN
- China
- Prior art keywords
- data
- order
- things
- side channel
- electric power
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Abstract
The invention discloses an extraction method of electric power Internet of things information network attack behavior characteristics, which is used for introducing collateral data and constructing secondary data for side channel information of electric power Internet of things terminal equipment, realizing primary quantitative extraction of the attack behavior characteristics and constructing an electric power Internet of things security monitoring data system as a front data screening tool or in combination with other electric power network security monitoring data tools. The characteristic data obtained through the data processing process can carry out preliminary screening on the space-time abnormal nodes of the global network, so that an optimized data set can be provided for the subsequent data security, the calculation power requirement level of a security screening data tool system is reduced, and the working efficiency of the system is correspondingly improved; the invention realizes the integral and global data processing model construction of the abnormal behavior of the electric power Internet of things based on the side channel information and the orthogonal side data information and the interaction thereof.
Description
Technical Field
The invention relates to the technical field of power grid safety, in particular to data characteristic analysis and extraction of abnormal attack behaviors of an electric power Internet of things information network based on a side channel.
Background
At present, the power network has more and more development trends of discretization and internet of things. Particularly, with the continuous research and development of energy storage technology and distributed power sources, the architecture of a power grid working system is gradually changed, and the system is replaced by a discrete type from an integrated type. Such as a single resident rooftop solar power plant, should be considered as a child node of the grid safety protection system as long as it is connected to the grid system according to certain standards.
It can be seen that in future power systems, intelligent electronic products with communication transmission and information collection processing will be increasingly installed and applied, including network internet of things and discretization brought by the distributed power supply and the energy storage system, and connotation terminals of traditional power internet of things networks such as power distribution terminals, intelligent electric meters, power mobile operation terminals and the like, so that more and more open communication protocols are used and more safety problems are brought to intelligent electronic devices.
At present, the electric power network in China is deployed according to the principles of safety partition, network special, transverse isolation and longitudinal authentication, and the safety partition is completed by utilizing passive defense devices such as physical isolation, logical isolation, firewall and the like. However, as mentioned above, with the development of internet of things, discretization and multicentric of the power grid, the existing safety protection system is increasingly unable to meet the current protection requirements.
On the basis, the national network company holds network security discussion conferences for a plurality of times, and aims to improve the network security core capability and solve the security problem of the power grid information system by researching a novel method macroscopically. Each upgrade power company and related research and development units have conducted intensive analysis and development from different angles and depths.
The power internet of things safety monitoring platform based on side channel information is developed through collaborative research and development, not only has complete theory and technology chains, but also builds a complete data contrast platform, and performs algorithm refinement based on artificial intelligence introduction, thereby having high theoretical and practical values. Then, the system still shows a plurality of practical defects in the later trial, for example, when the exogenous of an artificial intelligent algorithm leads to the adjustment and improvement operation of the power grid system on the safety system, multiparty cooperative operation is needed, and particularly, scientific research institutions outside the power grid system are involved, so that a plurality of inconveniences are brought; if the system needs to traverse global data and screen abnormal data from the global data, and also needs to perform self-learning and updating of an artificial intelligence algorithm, the system can run in a small simulation network, and a system calculation bottleneck inevitably exists when the system is popularized and applied to a wider network.
Disclosure of Invention
The invention aims to solve the technical problems of overcoming various defects in the prior art and providing a method for extracting the abnormal attack behavior characteristics of an electric power Internet of things information network.
In order to solve the technical problems, the technical scheme adopted by the invention is as follows.
The method is used for carrying out collateral data introduction and secondary data construction on side channel information of electric power Internet of things terminal equipment, realizing primary quantitative extraction of the attack behavior characteristics, and being used as a preposed data screening tool or combined with other electric power network security monitoring data tools for constructing an electric power Internet of things security monitoring data system.
As a preferable embodiment of the present invention, the necessary configuration of the side channel information includes: (1) the hardware of the terminal equipment of the electric power Internet of things leaves a factory to be compatible with the provided side channel information or the side channel information of the terminal equipment of the electric power Internet of things, which can be directly obtained through hardware serial connection; (2) the side channel information carries digital or digitalized information related to the operation of the electric power internet of things terminal equipment.
As a preferable technical scheme of the invention, the secondary data construction of the side channel information comprises the introduction construction of a collateral database, the data optimization processing and the data feature extraction based on the collateral database.
As a preferred technical scheme of the invention, the collateral database comprises collateral data which has orthogonal attribute with the side channel information and is related to real-time operation of the terminal equipment of the electric power internet of things, and the data optimization processing and the data feature extraction take data interaction of the side channel information and the collateral database as a main data channel.
As a preferred technical solution of the present invention, the method comprises the steps of:
A. acquiring side channel information of terminal equipment of the electric power Internet of things;
B. constructing a zero-order database; the method comprises the steps that the number of programs running by the terminal equipment of the electric power Internet of things is built into a zero-order database according to a zero-order + dynamic + discrete data configuration;
C. primary distribution feature extraction; the method comprises the following steps: (1) preprocessing the data factors; (2) data dynamic consistency pre-processing; (3) and (3) distributed quantized extraction of zero-order primary features.
As a preferred technical scheme of the invention, the step C- (3) sets at least four data processing processes with mutually exclusive properties based on the data properties of the side channel information and the subsequent compatibility expansibility requirements of the higher-order database and the higher-order data feature extraction.
As a preferred technical scheme of the invention, the method specifically comprises the following steps:
A. Acquiring side channel information of the terminal equipment of the electric power Internet of things, wherein the side channel information is selected from power consumption information, current information, voltage information or other information which can be directly acquired through hardware concatenation;
B. constructing a zero-order database: the method comprises the steps that the number of programs operated by the terminal equipment of the electric power Internet of things is built into a zero-order database, and the number of programs serving as scalar data is automatically acquired based on a system log or other approaches; the data configuration is set to be zero-order + dynamic + discrete, namely, the data dimension is set to be 1, the data dimension is built into a zero-order dynamic database through the introduction of a dynamic parameter t, real-time information corresponding to the number of programs operated by the terminal equipment of the electric power internet of things is accommodated, and meanwhile, the real-time information is set to be presented as a discrete real-time data configuration based on the interval of the dynamic parameter t based on the discontinuity of data acquisition;
C. primary distribution feature extraction:
(1) preprocessing of data factors: because the data dimension configuration of the zero-order database constructed in the step B is 1, the substantial pre-construction of the distribution factors is not needed when the terminal equipment side channel information acquired in the step A is distributed to the zero-order database; whereby the pre-processing of the data factors is set to formalized allocation factor construction, the allocation factor of the data bits in a single data dimension of the zero order database being set to some fixed value, such as a number 1; formalized factor assignment is not necessary for primary feature extraction but is necessary for expansion and compatibility of primary feature extraction with subsequent feature extraction;
(2) Data dynamic consistency pre-processing; in the step A, the acquisition of the side channel information is presented as specific interval discrete and record and output, or is presented as discrete data based on curve drawing execution; before executing the execution and distribution of the data, firstly, the dynamic acquisition point of the side channel information in the step A is consistent with the interval setting of the dynamic parameter t in the step B; for discretized side channel information, dynamic data consistency is realized by setting the sampling points of the side channel information and the sampling points of the running number of the program to be consistent and synchronous or to be integral and synchronous; b, setting a time point of curve subsampling to be consistent with an interval endpoint of a dynamic parameter t in the step B for the side channel information represented by the curve so as to realize dynamic data consistency;
(3) and (3) carrying out distributed quantitative extraction of zero-order primary characteristics:
(3) 1, when side channel information is digitized to obtain scalar data with dimension of 1, and no subsequent expansion or compatibility requirement of higher-order database and higher-order data feature extraction exists, taking a single scalar of a zero-order database as a factor, and directly obtaining dynamic and singular zero-order primary features related to the real-time running state of the electric power internet of things terminal equipment by linearly distributing two groups of data arrays which are uniformly expanded according to the same dynamic parameter t through any dynamic parameter points;
(3) When the side channel information is digitized to obtain vector data with the dimension larger than 1 and no subsequent expansion or compatibility requirements of a higher-order database and higher-order data feature extraction exist, firstly, vector data are quantized by adopting a tensor analysis method, specifically, each component of a side channel data vector is extracted, the components of the vector are noted instead of the dimension of the vector, a plurality of scalar data corresponding to the vector dimension number are obtained, then, a data process equivalent to (3) -1 is adopted for data processing, and dynamic and majority-valued zero-order primary features related to the real-time running state of the terminal equipment of the electric power internet of things are obtained; and taking the majority value as single data or combining the single data into vector data for subsequent processing according to the expansion and compatibility requirements of subsequent data processing;
(3) -3, when scalar data with dimension 1 is obtained after the side channel information is digitized and there is a subsequent expansion or compatibility requirement of a higher order database and higher order data feature extraction, setting the data dimension of the zero order database to be equivalent to the subsequent higher order database and higher order data feature extraction, for example, setting the data dimension to be o for vector data processing, setting the data dimension to be oxp for second order tensor data processing, setting the data dimension to be oxp×q for third order tensor data processing, wherein the values of o, p and q are set according to the actual data attribute of the subsequent higher order data processing; at this time, since the zero-order database has only one actual data dimension, the data factor is set to 1, the data filling after the higher-order expansion of the data bits is required to meet the global compatibility, the component bit zero filling principle and the component bit integer factor principle are adopted to perform the data filling of the newly added data bits, for example, after the zero-order database configuration is expanded to be the third-order tensor data oxp×q, the single data of the zero-order database is filled to any component bit of the third-order tensor, for example, the tensor subscript is 111 data bits, then the data 0 is filled to all the remaining (oxp×q-1) component data bits, the distribution factor including all the component data bits with subscript 111 is set to 1, and finally the component data attribute on the data bits with subscript 111 is set to read-only, and the data attribute on the rest (oxp×q-1) data bits is set to be non-read-only; then adopting a data process equivalent to (3) -1 to perform data processing to obtain a zero-order primary characteristic of a dynamic phenotype Zhang Lianghua related to the real-time running state of the terminal equipment of the electric power internet of things; the tensor phenotype can realize data docking compatibility with subsequent high-order data processing, and the numerical values of the rest components except for the component with the tensor subscript of 111 are zero before interaction with the high-order data processing process;
(3) 4, when scalar data with dimension larger than 1 is obtained after the side channel information is digitized and the subsequent expansion or compatibility requirements of higher-order databases and higher-order data feature extraction exist, the data processing process is compounded based on the data processing processes of (3) -1, (3) -2 and (3) -3 respectively;
8. the primary extraction method of the electric power internet of things information network attack behavior characteristics according to claim 7, wherein the method is characterized in that: the multi-data processing process composition in steps (3) -4 specifically comprises:
(3) -4-a, first performing a scalar quantization on the side channel vector data using the data processing procedure of (3) -2 to try out the data processing procedure of (3) -1;
(3) 4-b, further adopting the data processing of (3) -3 to perform high-order tensor configuration expansion on the zero-order database, such as expansion into a third-order oxpxq tensor;
(3) 4-c, then carrying out data processing on all scalar data obtained in the step (3) -4-a by adopting the data process of the step (3) -3 in sequence, for example, obtaining a group of third-order oxpxq tensors, wherein the number of the group corresponds to the dimension number of the side channel vector data;
(3) -4-d storing/transmitting the set of oxpxq tensors obtained in (3) -4-c as data processing results; or it is combined into a single tensor data according to the dimension k of the side channel vector itself, such as a fourth-order tensor configuration combined into a kxo x p x q configuration, wherein only the "numerical cross-section" in the k dimension has real data and the numerical values on the remaining (k-1) x o x p x q data are all zero prior to subsequent higher-order data interactions.
The primary extraction method of the electric power Internet of things information network attack behavior characteristics is applied to construction of an electric power Internet of things safety monitoring data system, the characteristic data obtained in the steps C- (3) -1 and C- (3) -2 are subjected to data classification or data self-comparison to obtain abnormal characteristic value clusters, the data clusters are subjected to inverse mapping to obtain corresponding electric power Internet of things space-time node sets, the data volume of the sets is greatly reduced compared with the electric power Internet of things space-time node sets to be checked, the reduced subsets replace the electric power Internet of things space-time node sets to be monitored by a safety monitoring tool, and therefore data processing efficiency is greatly improved, and calculation power requirements of the system are reduced.
The primary extraction method of the electric power Internet of things information network attack behavior characteristics is applied to construction of an electric power Internet of things safety monitoring data system, two kinds of characteristic data are obtained in the steps C- (3) -3 and C- (3) -4, after compatible matching of data formats is carried out according to corresponding high-order data processing, abnormal characteristic value clusters are further obtained through data classification or data self-comparison, the data clusters are subjected to inverse mapping to obtain corresponding electric power Internet of things space-time node sets, the data quantity of the sets is greatly reduced compared with the electric power Internet of things space-time node sets to be checked, the reduced subsets replace the electric power Internet of things space-time node sets to be monitored by a safety monitoring tool, and therefore data processing efficiency is greatly improved, and calculation power requirements of the system are reduced. .
As a preferable technical scheme of the application method of the invention, the data classification is based on setting a data threshold value to distinguish normal data from abnormal data.
As a preferred technical scheme of the application method of the invention, the data self-comparison is based on dynamic data level self-comparison to realize data clustering, the side data of any time node and the side data of one or a plurality of adjacent (such as 1-10) time nodes and the side channel data corresponding to each node are subjected to differential processing, and the differential data processing has the advantages that although the side channel data has high dynamic characteristics, the side data has relative high stability, the data change is data transition of integer level, so that the data difference of the side data on the differential data processing process is very easy to distinguish, the differential value non-zero of the side data is used as an anchor point, the side channel data at the non-zero point is checked in sequence, and the side channel data change with higher average data fluctuation is marked as abnormal characteristic data, thereby completing abnormal data clustering. The pre-filtering of data noise can be further carried out before the differential processing of the data so as to further improve the accuracy and the precision of the differential self-comparison of the data.
The beneficial effects of adopting above-mentioned technical scheme to produce lie in: the method solves a plurality of problems in the prior art, and the characteristic data such as (C- (3) -1 and C- (3) -2) obtained through the data processing process can be used for carrying out preliminary screening on space-time abnormal nodes of a global network, so that an optimized data set can be provided for subsequent data security, the calculation power requirement level of a security screening data tool system is reduced, and the working efficiency of the system is correspondingly improved.
The invention performs primary data characteristic analysis and extraction aiming at the side channel information type (scalar data such as power) which is most simplified and is most common and most commonly used and the scalar side data type which is most simplified, and the data construction process of the invention has basic value and expandable value. The basicity means that the primary data processing model provides a basic model for the high-order data feature processing in the high-dimensional data space, and the data processing process of the high-order feature extraction can be directly applied; the expansibility is that we finish the database configuration expansion construction based on the high-order data processing requirement, and a whole set of data configuration with high compatibility and expansibility is constructed through zero filling of data and whole distribution of data factors, so that the expansion work and the applicability of the basic data processing process can be said to basically finish the electric power Internet of things abnormal behavior integration and global data processing model construction based on side channel information, orthogonal side data information and interaction thereof.
In addition, the dynamic level difference self-comparison data processing model which is further developed by the method can directly extract network abnormal behavior characteristics with high confidence from primary scalar data, and secondary data connotation extraction of the merged scalar data is realized to a certain extent. The primary network abnormal behavior feature data constructed by the method can be used as an independent data source for safety supervision of the abnormal behavior of the electric power Internet of things. The precision is relatively lower than the safety supervision based on a high-order database, but the method has great progress significance and technical value with the function implementation of the primary data characteristic serving as an auxiliary tool only. The data processing model has special affinity for scalar data, and is the basis of the data processing model for realizing the data efficiency, specifically, the data level difference comprises a side channel difference and a side data difference, the dynamic state is that the difference is constructed according to time parameters, the side data of any time node and the side data of one or a plurality of (such as 1-10) time nodes nearby and the side channel data corresponding to each node are subjected to differential processing, in fact, one or a plurality of the side channel differences can be selected from 1-10, so that the differential data of different time sections can be compared; the most critical is that we notice that we have established the difference between the side channel and the side data, the difference data of the two do not seem to have great data value, but only the data change trend is reflected, but the two are interactively compared, so that new level difference valuable data can be obtained immediately, in particular, although the side channel data has high dynamic characteristics, the side data has relative high stability, and the data change is data transition of integer level, so that the data difference of the side data on the differential data processing process is very easy to distinguish, the difference value non-zero of the side data is taken as an anchor point, the side channel data at the non-zero point is checked in sequence, and the side channel data change with higher average data fluctuation can be directly calibrated as preliminary abnormal characteristic data.
Detailed Description
In the following description of embodiments, for purposes of explanation and not limitation, specific details are set forth, such as particular system architectures, techniques, etc. in order to provide a thorough understanding of the embodiments of the application. It will be apparent, however, to one skilled in the art that the present application may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.
It should be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. It should also be understood that the term "and/or" as used in this specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations.
As used in this specification and the appended claims, the term "if" may be interpreted as "when..once" or "in response to a determination" or "in response to detection" depending on the context. Similarly, the phrase "if a determination" or "if a [ described condition or event ] is detected" may be interpreted in the context of meaning "upon determination" or "in response to determination" or "upon detection of a [ described condition or event ]" or "in response to detection of a [ described condition or event ]". In addition, in the description of the present application and the appended claims, the terms "first," "second," "third," and the like are used merely to distinguish between descriptions and are not to be construed as indicating or implying relative importance.
Reference in the specification to "one embodiment" or "some embodiments" or the like means that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," and the like in the specification are not necessarily all referring to the same embodiment, but mean "one or more but not all embodiments" unless expressly specified otherwise. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless expressly specified otherwise.
Example 1
Common sources of side channel information include: the hardware of the terminal equipment of the electric power Internet of things leaves a factory to be compatible with the provided side channel information or the side channel information of the terminal equipment of the electric power Internet of things, which can be directly obtained through hardware serial connection; the side channel information carries digitized or digitized information related to the operation of the electric power internet of things terminal equipment. The side channel information is selected from power consumption information, current information, voltage information and other information; in particular power consumption information. Under the common situation, as proposed by Jibei corporation and communication corporation, the sampling resistor R is connected in series through the terminal, and the real-time current value of the resistor is collected through the high-speed data collection module, so that the real-time voltage value, the power data and the like measured by the high-speed data collection module are obtained.
Example 2
One core starting point of the research is the introduction of side data, two-dimensional expansion is carried out on side channel information with single dimension, and data characteristic analysis and extraction of abnormal behaviors of the discrete power Internet of things are carried out based on expanded data interaction. The collateral database contains collateral data that has orthogonal properties to the side channel information and is related to the real-time operation of the power internet of things terminal equipment, and generally, its data sources include: the system operation log, external monitoring and/or recording equipment, data acquisition and other sources; the data forms comprise scalar program data, vectorization program data, tensor program-task data and other data forms; the simplest and feasible data means can be the system with a self-contained running log or a running log data extraction program based on design improvement. The data optimization processing and the data feature extraction take the data interaction of the side channel information and the collateral database as a main data channel.
Example 3
The primary extraction of the abnormal behavior characteristics of the electric power Internet of things information network mainly aims at realizing the primary quantitative extraction of the abnormal attack behavior characteristics, and is used as a front data screening tool or is combined with other electric power network security monitoring data tools to construct an electric power Internet of things security monitoring data system. The method specifically comprises the following steps:
A. Acquiring side channel information of the terminal equipment of the electric power Internet of things, wherein the side channel information of the terminal equipment of the electric power Internet of things is acquired in an acquisition mode, and the side channel information is selected from power consumption information, current information, voltage information or other information which can be directly acquired through hardware concatenation;
B. constructing a zero-order database: the method comprises the steps that the number of programs operated by the terminal equipment of the electric power Internet of things is built into a zero-order database, and the number of programs serving as scalar data is automatically acquired based on a system log or other approaches; the data configuration is set to be zero-order + dynamic + discrete, namely, the data dimension is set to be 1, the data dimension is built into a zero-order dynamic database through the introduction of a dynamic parameter t, real-time information corresponding to the number of programs operated by the terminal equipment of the electric power internet of things is contained, and meanwhile, discontinuous real-time information based on data acquisition is set to be presented as a discrete real-time data configuration based on the interval of the dynamic parameter t;
C. primary distribution feature extraction:
(1) preprocessing of data factors: because the data dimension configuration of the zero-order database constructed in the step B is 1, the substantial pre-construction of the distribution factors is not needed when the terminal equipment side channel information acquired in the step A is distributed to the zero-order database; whereby the pre-processing of the data factors is set to formalized allocation factor construction, the allocation factor of the data bits in a single data dimension of the zero order database being set to some fixed value, such as a number 1; formalized factor assignment is not necessary for primary feature extraction but is necessary for expansion and compatibility of primary feature extraction with subsequent feature extraction;
(2) Data dynamic consistency pre-processing; in the step A, the acquisition of the side channel information is presented as specific interval discrete and record and output, or is presented as discrete data based on curve drawing execution; before executing the execution and distribution of the data, firstly, the dynamic acquisition point of the side channel information in the step A is consistent with the interval setting of the dynamic parameter t in the step B; for discretized side channel information, dynamic data consistency is realized by setting the sampling points of the side channel information and the sampling points of the running number of the program to be consistent and synchronous or to be integral and synchronous; b, setting a time point of curve subsampling to be consistent with an interval endpoint of a dynamic parameter t in the step B for the side channel information represented by the curve so as to realize dynamic data consistency;
(3) and (3) carrying out distributed quantitative extraction of zero-order primary characteristics:
(3) 1, when side channel information is digitized to obtain scalar data with dimension of 1, and no subsequent expansion or compatibility requirement of higher-order database and higher-order data feature extraction exists, taking a single scalar of a zero-order database as a factor, and directly obtaining dynamic and singular zero-order primary features related to the real-time running state of the electric power internet of things terminal equipment by linearly distributing two groups of data arrays which are uniformly expanded according to the same dynamic parameter t through any dynamic parameter points;
(3) When the side channel information is digitized to obtain vector data with the dimension larger than 1 and no subsequent expansion or compatibility requirements of a higher-order database and higher-order data feature extraction exist, firstly, vector data are quantized by adopting a tensor analysis method, specifically, each component of a side channel data vector is extracted, the components of the vector are noted instead of the dimension of the vector, a plurality of scalar data corresponding to the vector dimension number are obtained, then, a data process equivalent to (3) -1 is adopted for data processing, and dynamic and majority-valued zero-order primary features related to the real-time running state of the terminal equipment of the electric power internet of things are obtained; and taking the majority value as single data or combining the single data into vector data for subsequent processing according to the expansion and compatibility requirements of subsequent data processing;
example 4
The primary anomalous network behavior data features are applied as an auxiliary tool. In the previous embodiment 3, the characteristic data obtained in the steps C- (3) -1 and C- (3) -2 are subjected to data classification or data self-comparison to obtain an abnormal characteristic value cluster, the data cluster is subjected to inverse mapping to obtain a corresponding power internet of things space-time node set, the data volume of the set is greatly reduced compared with the power internet of things space-time node set to be checked, and the reduced subset replaces the power internet of things space-time node set to be monitored by a safety monitoring tool, so that the data processing efficiency is greatly improved, and the calculation power requirement of a system is reduced.
Example 5
The power Internet of things abnormal behavior data analysis system is oriented to compatibility expansion of high-order data feature processing. On the basis of example 3, step C, further set: (3) -3, when scalar data with dimension 1 is obtained after the side channel information is digitized and there is a subsequent expansion or compatibility requirement of a higher order database and higher order data feature extraction, setting the data dimension of the zero order database to be equivalent to the subsequent higher order database and higher order data feature extraction, for example, setting the data dimension to be o for vector data processing, setting the data dimension to be oxp for second order tensor data processing, setting the data dimension to be oxp×q for third order tensor data processing, wherein the values of o, p and q are set according to the actual data attribute of the subsequent higher order data processing; at this time, since the zero-order database has only one actual data dimension, the data factor is set to 1, the data filling after the higher-order expansion of the data bits is required to meet the global compatibility, the component bit zero filling principle and the component bit integer factor principle are adopted to perform the data filling of the newly added data bits, for example, after the zero-order database configuration is expanded to be the third-order tensor data oxp×q, the single data of the zero-order database is filled to any component bit of the third-order tensor, for example, the tensor subscript is 111 data bits, then the data 0 is filled to all the remaining (oxp×q-1) component data bits, the distribution factor including all the component data bits with subscript 111 is set to 1, and finally the component data attribute on the data bits with subscript 111 is set to read-only, and the data attribute on the rest (oxp×q-1) data bits is set to be non-read-only; then adopting a data process equivalent to (3) -1 to perform data processing to obtain a zero-order primary characteristic of a dynamic phenotype Zhang Lianghua related to the real-time running state of the terminal equipment of the electric power internet of things; the tensor phenotype can realize data docking compatibility with subsequent high-order data processing, and the numerical values of the rest components except for the component with the tensor subscript of 111 are zero before interaction with the high-order data processing process; further setting: (3) 4, when scalar data with dimension larger than 1 is obtained after the side channel information is digitized and the subsequent expansion or compatibility requirements of higher-order databases and higher-order data feature extraction exist, the data processing process is compounded based on the data processing processes of (3) -1, (3) -2 and (3) -3 respectively; the method specifically comprises the following steps: (3) -4-a, first performing a scalar quantization on the side channel vector data using the data processing procedure of (3) -2 to try out the data processing procedure of (3) -1; (3) 4-b, further adopting the data processing of (3) -3 to perform high-order tensor configuration expansion on the zero-order database, such as expansion into a third-order oxpxq tensor; (3) 4-c, then carrying out data processing on all scalar data obtained in the step (3) -4-a by adopting the data process of the step (3) -3 in sequence, for example, obtaining a group of third-order oxpxq tensors, wherein the number of the group corresponds to the dimension number of the side channel vector data; (3) -4-d storing/transmitting the set of oxpxq tensors obtained in (3) -4-c as data processing results; or it is combined into a single tensor data according to the dimension k of the side channel vector itself, such as a fourth-order tensor configuration combined into a kxo x p x q configuration, wherein only the "numerical cross-section" in the k dimension has real data and the numerical values on the remaining (k-1) x o x p x q data are all zero prior to subsequent higher-order data interactions.
Example 6
Similar to example 4, the primary anomalous network behavior data features after the higher-order configuration expansion are applied as an auxiliary tool. The steps C- (3) -3 and C- (3) -4 in the previous embodiment 5 are subjected to compatible matching of data formats according to corresponding high-order data processing, abnormal characteristic value clusters are further obtained through data classification or data self-comparison, the data clusters are subjected to inverse mapping to obtain corresponding power Internet of things space-time node sets, the data volume of the sets is greatly reduced compared with the power Internet of things space-time node sets to be checked, the reduced subsets replace the power Internet of things space-time node sets to be monitored by a safety monitoring tool, and therefore data processing efficiency is greatly improved, and calculation power requirements of the system are reduced. .
Example 7
The application of the primary anomalous network behavior data features as a stand-alone tool is possible. The core is the construction of a data processing model of dynamic level difference self-comparison.
The data self-comparison realizes data clustering based on dynamic data level self-comparison, the side data of any time node and the side data of one or a plurality of adjacent (such as 1-10) time nodes are subjected to differential processing, and the side channel data corresponding to each node are subjected to differential data processing. The pre-filtering of data noise can be further carried out before the differential processing of the data so as to further improve the accuracy and the precision of the differential self-comparison of the data.
The dynamic level difference self-comparison data processing model can directly extract network abnormal behavior characteristics with high confidence from primary scalar data, and realizes secondary data connotation extraction of the merged scalar data to a certain extent. The primary network abnormal behavior feature data constructed by the method can be used as an independent data source for safety supervision of the abnormal behavior of the electric power Internet of things. The precision is relatively lower than the safety supervision based on a high-order database, but the method has great progress significance and technical value with the function implementation of the primary data characteristic serving as an auxiliary tool only. The data processing model has special affinity for scalar data, and is the basis of the data processing model for realizing the data efficiency, specifically, the data level difference comprises a side channel difference and a side data difference, the dynamic state is that the difference is constructed according to time parameters, the side data of any time node is subjected to differential processing with the side data of adjacent time nodes and the side channel data corresponding to each node, and in fact, one or more than one of adjacent time nodes such as 1-10 time nodes can be selected, so that the differential data of different time sections can be compared; the most critical is that we notice that we have established the difference between the side channel and the side data, the difference data of the two do not seem to have great data value, but only the data change trend is reflected, but the two are interactively compared, so that new level difference valuable data can be obtained immediately, in particular, although the side channel data has high dynamic characteristics, the side data has relative high stability, and the data change is data transition of integer level, so that the data difference of the side data on the differential data processing process is very easy to distinguish, the difference value non-zero of the side data is taken as an anchor point, the side channel data at the non-zero point is checked in sequence, and the side channel data change with higher average data fluctuation can be directly calibrated as preliminary abnormal characteristic data.
In the foregoing embodiments, the descriptions of the embodiments are emphasized, and in part, not described or illustrated in any particular embodiment, reference is made to the related descriptions of other embodiments.
In various embodiments, the hardware implementation of the technology may directly employ existing smart devices, including, but not limited to, industrial personal computers, PCs, smartphones, handheld standalone machines, floor stand-alone machines, and the like. The input device is preferably a screen keyboard, the data storage and calculation module adopts an existing memory, a calculator and a controller, the internal communication module adopts an existing communication port and protocol, and the remote communication module adopts an existing gprs network, a universal Internet and the like. It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-described division of the functional units and modules is illustrated, and in practical application, the above-described functional distribution may be performed by different functional units and modules according to needs, i.e. the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-described functions. The functional units and modules in the embodiment may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit, where the integrated units may be implemented in a form of hardware or a form of a software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present application. The specific working process of the units and modules in the above system may refer to the corresponding process in the foregoing method embodiment, which is not described herein again. In the embodiments provided in the present invention, it should be understood that the disclosed apparatus/terminal device and method may be implemented in other manners. For example, the apparatus/terminal device embodiments described above are merely illustrative, e.g., the division of modules or units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection via interfaces, devices or units, which may be in electrical, mechanical or other forms. The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
The above embodiments are only for illustrating the technical solution of the present invention, and not for limiting the same; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention, and are intended to be included in the scope of the present invention.
Claims (7)
1. A primary extraction method of electric power Internet of things information network attack behavior characteristics is characterized by comprising the following steps: the method comprises the steps of introducing collateral data and constructing secondary data for side channel information of the terminal equipment of the electric power Internet of things, and realizing primary quantitative extraction of attack behavior characteristics, wherein the primary quantitative extraction is used as a front-end data screening tool or is combined with other electric power network safety monitoring data tools to construct an electric power Internet of things safety monitoring data system;
the necessary settings of the side channel information include: (1) the hardware of the terminal equipment of the electric power Internet of things leaves a factory to be compatible with the provided side channel information or the side channel information of the terminal equipment of the electric power Internet of things, which can be directly obtained through hardware serial connection; (2) the side channel information carries digital or digitalized information related to the operation of the terminal equipment of the electric power Internet of things;
Performing secondary data construction on the side channel information, wherein the secondary data construction comprises introduction construction of a collateral database, data optimization processing based on the collateral database and data feature extraction;
the collateral database comprises collateral data which has orthogonal attribute with the side channel information and is related to real-time operation of the terminal equipment of the electric power internet of things, and the data optimization processing and the data feature extraction take data interaction of the side channel information and the collateral database as a main data channel.
2. The primary extraction method of the electric power internet of things information network attack behavior characteristics according to claim 1, wherein the method is characterized by comprising the following steps: the method comprises the following steps:
A. acquiring side channel information of terminal equipment of the electric power Internet of things;
B. constructing a zero-order database; the method comprises the steps that the number of programs running by the terminal equipment of the electric power Internet of things is built into a zero-order database according to a zero-order + dynamic + discrete data configuration;
C. primary distribution feature extraction; the method comprises the following steps: (1) preprocessing the data factors; (2) data dynamic consistency pre-processing; (3) and (3) distributed quantized extraction of zero-order primary features.
3. The primary extraction method of the electric power internet of things information network attack behavior characteristics according to claim 2, wherein the method is characterized by comprising the following steps: and C- (3) setting at least four data processing processes with mutual repulsion attribute based on the data attribute of the side channel information and the subsequent compatible expansibility requirement of the higher-order database and the higher-order data feature extraction.
4. The primary extraction method of the electric power internet of things information network attack behavior characteristics according to claim 3, wherein the method is characterized by comprising the following steps of: the method specifically comprises the following steps:
A. acquiring side channel information of the terminal equipment of the electric power Internet of things, wherein the side channel information is selected from power consumption information, current information, voltage information or other information which can be directly acquired through hardware concatenation;
B. constructing a zero-order database: the method comprises the steps that the number of programs operated by the terminal equipment of the electric power Internet of things is built into a zero-order database, and the number of programs serving as scalar data is automatically acquired based on a system log or other approaches; the data configuration is set to be zero-order + dynamic + discrete, namely, the data dimension is set to be 1, the data dimension is built into a zero-order dynamic database through the introduction of a dynamic parameter t, real-time information corresponding to the number of programs operated by the terminal equipment of the electric power internet of things is accommodated, and meanwhile, the real-time information is set to be presented as a discrete real-time data configuration based on the interval of the dynamic parameter t based on the discontinuity of data acquisition;
C. primary distribution feature extraction:
(1) preprocessing of data factors: because the data dimension configuration of the zero-order database constructed in the step B is 1, the substantial pre-construction of the distribution factors is not needed when the terminal equipment side channel information acquired in the step A is distributed to the zero-order database; whereby the pre-processing of the data factors is set to formalized allocation factor construction, the allocation factor of the data bits in a single data dimension of the zero order database being set to some fixed value, such as a number 1; formalized factor assignment is not necessary for primary feature extraction but is necessary for expansion and compatibility of primary feature extraction with subsequent feature extraction;
(2) Data dynamic consistency pre-processing; in the step A, the acquisition of the side channel information is presented as specific interval discrete and record and output, or is presented as discrete data based on curve drawing execution; before executing the execution and distribution of the data, firstly, the dynamic acquisition point of the side channel information in the step A is consistent with the interval setting of the dynamic parameter t in the step B; for discretized side channel information, dynamic data consistency is realized by setting the sampling points of the side channel information and the sampling points of the running number of the program to be consistent and synchronous or to be integral and synchronous; b, setting a time point of curve subsampling to be consistent with an interval endpoint of a dynamic parameter t in the step B for the side channel information represented by the curve so as to realize dynamic data consistency;
(3) and (3) carrying out distributed quantitative extraction of zero-order primary characteristics:
(3) 1, when side channel information is digitized to obtain scalar data with dimension of 1, and no subsequent expansion or compatibility requirement of higher-order database and higher-order data feature extraction exists, taking a single scalar of a zero-order database as a factor, and directly obtaining dynamic and singular zero-order primary features related to the real-time running state of the electric power internet of things terminal equipment by linearly distributing two groups of data arrays which are uniformly expanded according to the same dynamic parameter t through any dynamic parameter points;
(3) When the side channel information is digitized to obtain vector data with the dimension larger than 1 and no subsequent expansion or compatibility requirements of a higher-order database and higher-order data feature extraction exist, firstly, vector data are quantized by adopting a tensor analysis method, specifically, each component of a side channel data vector is extracted, the components of the vector are noted instead of the dimension of the vector, a plurality of scalar data corresponding to the vector dimension number are obtained, then, a data process equivalent to (3) -1 is adopted for data processing, and dynamic and majority-valued zero-order primary features related to the real-time running state of the terminal equipment of the electric power internet of things are obtained; and taking the majority value as single data or combining the single data into vector data for subsequent processing according to the expansion and compatibility requirements of subsequent data processing;
(3) -3, when scalar data with dimension 1 is obtained after the side channel information is digitized and there is a subsequent expansion or compatibility requirement of a higher order database and higher order data feature extraction, setting the data dimension of the zero order database to be equivalent to the subsequent higher order database and higher order data feature extraction, for example, setting the data dimension to be o for vector data processing, setting the data dimension to be oxp for second order tensor data processing, setting the data dimension to be oxp×q for third order tensor data processing, wherein the values of o, p and q are set according to the actual data attribute of the subsequent higher order data processing; at this time, since the zero-order database has only one actual data dimension, the data factor is set to 1, the data filling after the higher-order expansion of the data bits is required to meet the global compatibility, the component bit zero filling principle and the component bit integer factor principle are adopted to perform the data filling of the newly added data bits, for example, after the zero-order database configuration is expanded to be the third-order tensor data oxp×q, the single data of the zero-order database is filled to any component bit of the third-order tensor, for example, the tensor subscript is 111 data bits, then the data 0 is filled to all the remaining (oxp×q-1) component data bits, the distribution factor including all the component data bits with subscript 111 is set to 1, and finally the component data attribute on the data bits with subscript 111 is set to read-only, and the data attribute on the rest (oxp×q-1) data bits is set to be non-read-only; then adopting a data process equivalent to (3) -1 to perform data processing to obtain a zero-order primary characteristic of a dynamic phenotype Zhang Lianghua related to the real-time running state of the terminal equipment of the electric power internet of things; the tensor phenotype can realize data docking compatibility with subsequent high-order data processing, and the numerical values of the rest components except for the component with the tensor subscript of 111 are zero before interaction with the high-order data processing process;
(3) And 4, when scalar data with dimension larger than 1 is obtained after the side channel information is digitized and the subsequent expansion or compatibility requirements of higher-order databases and higher-order data feature extraction exist, the data processing process is compounded based on the data processing processes of (3) -1, (3) -2 and (3) -3 respectively.
5. The primary extraction method of the electric power internet of things information network attack behavior characteristics according to claim 4, wherein the method is characterized by comprising the following steps: the multi-data processing process composition in steps (3) -4 specifically comprises:
(3) -4-a, first performing a scalar quantization on the side channel vector data using the data processing procedure of (3) -2 to try out the data processing procedure of (3) -1;
(3) 4-b, further adopting the data processing of (3) -3 to perform high-order tensor configuration expansion on the zero-order database, such as expansion into a third-order oxpxq tensor;
(3) 4-c, then carrying out data processing on all scalar data obtained in the step (3) -4-a by adopting the data process of the step (3) -3 in sequence, for example, obtaining a group of third-order oxpxq tensors, wherein the number of the group corresponds to the dimension number of the side channel vector data;
(3) -4-d storing/transmitting the set of oxpxq tensors obtained in (3) -4-c as data processing results; or it is combined into a single tensor data according to the dimension k of the side channel vector itself, such as a fourth-order tensor configuration combined into a kxo x p x q configuration, wherein only the "numerical cross-section" in the k dimension has real data and the numerical values on the remaining (k-1) x o x p x q data are all zero prior to subsequent higher-order data interactions.
6. The application of the method in the construction of the electric power internet of things safety monitoring data system according to claim 4 or 5, which is characterized in that: and C- (3) -1 and C- (3) -2 are subjected to data classification or data self-comparison to obtain abnormal characteristic value clusters, the data clusters are subjected to inverse mapping to obtain corresponding power Internet of things space-time node sets, the data volume of the sets is greatly reduced compared with the power Internet of things space-time node sets to be checked, and the reduced subsets replace the power Internet of things space-time node sets to be monitored by a safety monitoring tool.
7. The application of the method in the construction of the electric power internet of things safety monitoring data system according to claim 4 or 5, which is characterized in that: and C- (3) -3 and C- (3) -4 are subjected to compatibility matching of data formats according to corresponding high-order data processing, abnormal characteristic value clusters are further obtained through data classification or data self-comparison, the data clusters are subjected to inverse mapping to obtain corresponding power Internet of things space-time node sets, the data volume of the sets is greatly reduced compared with the power Internet of things space-time node sets to be checked, and the reduced subsets replace the power Internet of things space-time node sets to be monitored by a safety monitoring tool.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211445229.7A CN115801412B (en) | 2022-11-18 | 2022-11-18 | Extraction method of electric power Internet of things information network attack behavior characteristics |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211445229.7A CN115801412B (en) | 2022-11-18 | 2022-11-18 | Extraction method of electric power Internet of things information network attack behavior characteristics |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115801412A CN115801412A (en) | 2023-03-14 |
| CN115801412B true CN115801412B (en) | 2023-05-02 |
Family
ID=85438828
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211445229.7A Active CN115801412B (en) | 2022-11-18 | 2022-11-18 | Extraction method of electric power Internet of things information network attack behavior characteristics |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115801412B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116488909B (en) * | 2023-04-26 | 2023-11-17 | 国网河南省电力公司信息通信分公司 | Electric power Internet of things safety protection method based on data dimension hierarchy expansion |
| CN116595578B (en) * | 2023-04-26 | 2024-01-19 | 国网河南省电力公司信息通信分公司 | Power network self-checking attack and defense safety data system |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2019233047A1 (en) * | 2018-06-07 | 2019-12-12 | 国电南瑞科技股份有限公司 | Power grid dispatching-based operation and maintenance method |
| CN114638728A (en) * | 2022-03-25 | 2022-06-17 | 国网河北省电力有限公司 | Big data-based real-time operation monitoring method for power service center |
Family Cites Families (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103873229B (en) * | 2014-03-13 | 2017-01-11 | 华南师范大学 | Rapid protection method for resisting timing and cache side channel attack under KLEIN encryption AVR environment |
| CA2902587A1 (en) * | 2015-09-01 | 2017-03-01 | Andre J. Brisson | Whitenoise secure circuit design implementation techniques to prevent power analysis attacks and other side channel attacks, secure other physical cryptosystem implementations, and implementation of whitenoise into low cost micro processing and smart components retaining one-time-pad characteristics |
| US20180262525A1 (en) * | 2017-03-09 | 2018-09-13 | General Electric Company | Multi-modal, multi-disciplinary feature discovery to detect cyber threats in electric power grid |
| CA3072045A1 (en) * | 2017-08-02 | 2019-02-07 | Strong Force Iot Portfolio 2016, Llc | Methods and systems for detection in an industrial internet of things data collection environment with large data sets |
| CN108650075B (en) * | 2018-05-11 | 2020-09-08 | 中国科学院信息工程研究所 | Soft and hard combined AES (advanced encryption standard) rapid encryption implementation method and system for resisting side channel attack |
| EP3841504B1 (en) * | 2018-08-24 | 2023-12-06 | HRL Laboratories, LLC | System and method for cyber attack detection based on rapid unsupervised recognition of recurring signal patterns |
| CN110390357A (en) * | 2019-07-17 | 2019-10-29 | 国网浙江省电力有限公司电力科学研究院 | A kind of DTU safety monitoring method based on side channel |
| CN112787971B (en) * | 2019-11-01 | 2023-02-28 | 国民技术股份有限公司 | Construction method of side channel attack model, password attack equipment and computer storage medium |
| CN110971677B (en) * | 2019-11-19 | 2021-11-09 | 国网吉林省电力有限公司电力科学研究院 | Electric power internet of things terminal equipment side channel safety monitoring method based on countermeasure reinforcement learning |
-
2022
- 2022-11-18 CN CN202211445229.7A patent/CN115801412B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2019233047A1 (en) * | 2018-06-07 | 2019-12-12 | 国电南瑞科技股份有限公司 | Power grid dispatching-based operation and maintenance method |
| CN114638728A (en) * | 2022-03-25 | 2022-06-17 | 国网河北省电力有限公司 | Big data-based real-time operation monitoring method for power service center |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115801412A (en) | 2023-03-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN115801412B (en) | Extraction method of electric power Internet of things information network attack behavior characteristics | |
| CN101232180B (en) | Power distribution system load obscurity model building device and method | |
| CN108073722B (en) | Automatic verification device and method for newly-built substation main and sub-station graphs and models | |
| CN115801411B (en) | High-order data feature extraction and identification method for electric power Internet of things attack behavior | |
| CN105373601B (en) | A kind of multi-model matching method based on keyword words-frequency feature | |
| CN101262682A (en) | A configuration management for monitoring batch management of base station devices | |
| CN109286188B (en) | 10kV power distribution network theoretical line loss calculation method based on multi-source data set | |
| CN104077393B (en) | A kind of optimal splitting fracture surface searching method based on semi-supervised spectral clustering | |
| CN106908668B (en) | Processing method and system for actually measured ground synthetic electric field data | |
| CN102930111A (en) | Converting station substation configuration description (SCD) model file generating method and device thereof | |
| CN113092935A (en) | Method, system, equipment and storage medium for identifying small-load line topology | |
| CN112819649A (en) | Method and device for determining station area subscriber change relationship | |
| CN112100402A (en) | Power grid knowledge graph construction method and device | |
| CN111046189A (en) | Modeling method of power distribution network knowledge graph model | |
| Yao et al. | Contingency analysis based on partitioned and parallel holomorphic embedding | |
| CN104881436B (en) | A kind of electric power communication device method for analyzing performance and device based on big data | |
| CN109271925A (en) | A kind of electrical equipment kind identification method on intelligent socket | |
| CN111125079A (en) | Remote operation and maintenance data cleaning method for power transmission and transformation equipment | |
| CN110888850B (en) | Data quality detection method based on electric power Internet of things platform | |
| CN106127602B (en) | Electricity stealing identification method and device based on reduction outlier algorithm | |
| CN112182499A (en) | Low-voltage distribution network topological structure identification method based on time sequence electric quantity data | |
| CN115600494A (en) | Low-voltage distribution area topology automatic identification method and device | |
| CN113037574B (en) | Airborne equipment real-time signal processing method and system based on software definition | |
| CN115809795A (en) | Digitalized production team bearing capacity evaluation method and device | |
| CN114971053A (en) | Training method and device for online prediction model of network line loss rate of low-voltage transformer area |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |