Search

CN-122020464-A - Block chain power abnormal data tracing method

CN122020464ACN 122020464 ACN122020464 ACN 122020464ACN-122020464-A

Abstract

The invention relates to the technical field of computers, in particular to a block chain power abnormal data tracing method. The method comprises the steps of obtaining running data and system logs of a power system, extracting model input identification abnormality and completing event source classification, generating differential change records for the abnormality, extracting a time stamp to construct a chain record and serializing the chain record into a traceable path, performing cross-source alignment and sequence correction to form a consistent event sequence, classifying and sorting to obtain an event sequence structure, verifying and generating a cross-system tracing path, finally verifying a conclusion through a consensus mechanism, extracting a tracing report, and updating an abnormality detection model according to the tracing report. The method improves cross-source time sequence consistency and evidence replayability, enhances conclusion credibility and closed loop iteration capability, and is suitable for scenes such as metering data, equipment monitoring and the like.

Inventors

  • WANG JING
  • LI JIAYING

Assignees

  • 北京斐波信达科技有限公司

Dates

Publication Date
20260512
Application Date
20260127

Claims (10)

  1. 1. The block chain power abnormal data tracing method is characterized by comprising the following steps of: acquiring operation data and system logs of the power system, performing time stamp alignment, abnormal point identification and marking and event source classifying processing based on a marking rule base and an event source classifying process of a time service system formed by a network time protocol and an accurate time protocol, and generating an event source marking record; Performing differential record processing comprising constructing a preamble baseline and a subsequent baseline, time stamp chain generation comprising time anchoring and serialization operation comprising path serialization based on the abnormal data set, and generating a traceable path of data change; Performing cross-source data alignment and sequence correction, node classification and event sequencing, optimization and connectivity optimization and consistency verification processing based on an event sequence structure to generate a cross-system tracing path; Based on a cross-system tracing path, common-knowledge mechanism verification, tracing report extraction and formatting processing, uploading and model updating operations including role division of proposal nodes, endorsement nodes and witness nodes and practical Bayesian and busy class round driving are carried out, and an anomaly detection model is updated.
  2. 2. The method of claim 1, wherein the power system operational data and system log comprises: The system log comprises a device operation event log, a state change log, an alarm log, an operation audit log and a service operation log, wherein the device operation event log, the state change log, the alarm log, the operation audit log and the service operation log are generated by a dispatching master station, a substation automation device, a protection and measurement and control device, an edge acquisition gateway, an application server and safety equipment.
  3. 3. The method of claim 1, wherein the abnormal dataset comprises: The anomaly dataset includes anomaly numbers, anomaly types, time ranges, associated equipment, associated measurement points, source categories, evidence summaries, and context indices.
  4. 4. The method of claim 1, wherein the event sequence structure comprises: the event sequence structure comprises three parts of information of a node layer, an event segment layer and a relation layer, wherein the node layer stores a node attribute set and classified snapshot references, the event segment layer stores event segment boundaries and member chains, and the relation layer stores directed relations and parallel sequence indexes between event segments.
  5. 5. The method of claim 1, wherein performing cross-source data alignment and order correction, node categorization and event ordering, optimization, and processes including connectivity optimization and consistency verification processing based on the event sequence structure comprises: The method comprises the steps of performing connectivity optimization on an event segment layer, giving candidate communication sequences according to matching relation between source credibility level and reference points for event segment groups with parallel sequence indexes, giving gap reservation or gap merging suggestions for event segment pairs containing gap fragments according to gap lengths and context abstracts, then performing redundancy relation rejection and weak relation weight reduction on a relation layer, performing weight reduction or removal on relations with insufficient source evidence, context conflict or lower time coverage, optimizing compression and playback capacity of a focused member node chain by a node layer, folding for similar, continuous and conflict-free member nodes, and recording a node number set before folding in a folding description.
  6. 6. The method of claim 1, wherein performing cross-source data alignment and order correction, node categorization and event ordering, optimization, and processes including connectivity optimization and consistency verification processing based on the event sequence structure further comprises: Entering consistency verification, wherein the verification flow consists of time consistency verification, source consistency verification and context consistency verification; Verifying the time consistency, namely verifying the main anchor and the auxiliary anchor of the read time stamp chain segment by segment, checking the sequence of the event segment boundary and the chain segment, returning to the candidate communication sequence if the main anchor conflicts, writing time conflict explanation and turning to a standby path if the auxiliary anchor conflicts; checking the main classification and the auxiliary classification of the event segment and the source class set according to the event source mark record, and if the main classification is not matched with the source class or the auxiliary classification is not matched with the source class, marking the event segment as a source conflict and triggering alternative branch selection; And verifying the consistency of the context, namely, verifying a fragment sequence and a differential entry fingerprint set in a traceable path of calling data change, playing back differential entries in a time range corresponding to an event segment, checking whether the description of the change direction and the description of the change amplitude are consistent with the form of the event segment, and if the description of the change direction and the description of the change amplitude are inconsistent with the form of the event segment, recording the context conflict and triggering local reconstruction.
  7. 7. The method of claim 6, wherein path curing is performed, the curing process converting the connected chain into deliverable objects and writing path numbers, path types, overlay objects, and overlay time ranges, attaching evidence references for each path, the evidence references including a segment number set, a reference point set, a differential entry fingerprint set, and a categorized snapshot reference set; The path solidification object is named as a cross-system tracing path, one cross-system tracing path can comprise a single chain or multiple chains, and under the condition of multiple chains, the chains are connected through a cross-object coupling relation, and a coupling description and a source description are written in the connection part.
  8. 8. The method according to claim 1, wherein based on the cross-system tracing path, performing a common-knowledge mechanism verification including proposing node, endorsing node and witness node role division and practical bayer-based fault-tolerant class round driving, specifically comprises: registering cross-system tracing paths into candidate areas one by one, wherein the registration content comprises a path number, a coverage object, a coverage time range, a chain segment number set, a reference point set, a differential entry fingerprint set and a classified snapshot reference set, and constructing an evidence packet for each candidate path, wherein an event block playback index, a chain segment playback index and a log co-occurrence playback index are embedded in the evidence packet; Starting node role election, wherein three roles of a proposal node, an endorsement node and a witness node are selected in a node pool, the proposal node is responsible for proposal of candidate paths, broadcasting of evidence packets and round driving, the endorsement node is responsible for local playback checking and voting, and the witness node is responsible for voting counting, threshold judgment and abnormal recording; The round driving follows a practical Bayesian fault-tolerant class flow, and comprises three stages of preparation, voting and submission.
  9. 9. The method of claim 8 wherein in the preparation phase, the proposed node performs a primary check of evidence consistency on a single candidate path, the primary check action reads a primary anchor and a secondary anchor of a timestamp chain, checks a path segment sequence and a segment sequence, and reads a segment sequence in a traceable path with changed data for sampling comparison with a differential entry fingerprint set; After receiving the proposal, the endorsement node starts a local playback check, wherein the playback check comprises a time consistency check, a source consistency check and a context consistency check, and the result of each check is written into a local endorsement opinion and carries evidence to quote a deviation description; and after the voting convergence or the round overtime reaches, the witness node executes threshold judgment, the threshold judgment comprehensively judges the minimum participation quantity according to the configured agreement proportion, and the candidate path meeting the condition enters the submitting stage.
  10. 10. The method of claim 9, wherein the system starts a conflict resolution sub-process when a plurality of candidate paths cover the same object and the same time range, wherein the conflict resolution sorts the paths according to the source confidence level, the evidence citation integrity and the reference point matching degree, the path with the front sorting enters the round first, the next path is automatically triggered to enter the round if the path with the front sorting does not pass, and the witness node outputs a parallel pass description and writes the path numbers of the parallel passes into the parallel list if the paths pass.

Description

Block chain power abnormal data tracing method Technical Field The invention relates to the technical field of computers, in particular to a block chain power abnormal data tracing method. Background In the technical field of computers, an existing scheme for tracing abnormal data of power system operation data and system logs generally surrounds data centralized access, log audit and event trace expansion, and by performing time alignment on the power system operation data and the system logs, performing preliminary identification based on an abnormal detection model and archiving abnormal events according to log entries, a part of scheme links change information to construct a storage certificate, and has the limitations of unstable cross-source time alignment, coarse granularity of data change records, lack of cross-node verification of tracing conclusions and the like. The existing method is dependent on single-source time stamp or centralized audit flow, adopts static threshold and fixed rule to judge the abnormality, organizes event records according to single-source time sequence, easily breaks event fragments and cannot play back paths under the time sequence association and responsibility attribution scenes related to cross sources, cross systems and cross objects, and is difficult to meet the requirement of generating stable realization of traceability reports which can be directly used for responsibility classification and record retention. Aiming at the joint processing of a time-synchronous data set, differential data change records and time stamp information, the prior art generally has a common short plate with low coupling degree, link incompletion and evidence quotation nonstandard in the links of data differential registration, time stamp chain construction and serialization output, and is difficult to form continuous processes of acquisition, alignment, judgment, recording and verification in complex application scenes of power system operation data and system logs, so that an event sequence structure is difficult to stably form, a cross-system tracing path is difficult to reliably generate, and closed loop linkage is absent between common recognition mechanism verification and tracing report. Disclosure of Invention In order to solve the technical problems, the invention provides a block chain power abnormal data tracing method, which comprises the following steps: acquiring operation data and system logs of the power system, performing time stamp alignment, abnormal point identification and marking and event source classifying processing based on a marking rule base and an event source classifying process of a time service system formed by a network time protocol and an accurate time protocol, and generating an event source marking record; Performing differential record processing comprising constructing a preamble baseline and a subsequent baseline, time stamp chain generation comprising time anchoring and serialization operation comprising path serialization based on the abnormal data set, and generating a traceable path of data change; Performing cross-source data alignment and sequence correction, node classification and event sequencing, optimization and connectivity optimization and consistency verification processing based on an event sequence structure to generate a cross-system tracing path; Based on a cross-system tracing path, common-knowledge mechanism verification, tracing report extraction and formatting processing, uploading and model updating operations including role division of proposal nodes, endorsement nodes and witness nodes and practical Bayesian and busy class round driving are carried out, and an anomaly detection model is updated. Further, the power system operation data and the system log include: The system log comprises a device operation event log, a state change log, an alarm log, an operation audit log and a service operation log, wherein the device operation event log, the state change log, the alarm log, the operation audit log and the service operation log are generated by a dispatching master station, a substation automation device, a protection and measurement and control device, an edge acquisition gateway, an application server and safety equipment. Further, the anomaly dataset includes: The anomaly dataset includes anomaly numbers, anomaly types, time ranges, associated equipment, associated measurement points, source categories, evidence summaries, and context indices. Further, the event sequence structure includes: the event sequence structure comprises three parts of information of a node layer, an event segment layer and a relation layer, wherein the node layer stores a node attribute set and classified snapshot references, the event segment layer stores event segment boundaries and member chains, and the relation layer stores directed relations and parallel sequence indexes between event segments. Further, the process of cross-source data ali