I. Introduction
With the completion of intelligent substations and the extensive use of IEDs, the substation collects multiple times of data from various data monitoring systems than before, which increases the difficulty of data processing and filtering while improving data integrity. Especially when a fault occurs, the substation monitoring interface will receive a large number of alarm signals in a short time, so that the monitoring personnel cannot find the key information which reflects the characteristics of the fault in time. If the alarm signals can be filtered and analyzed in the substation layer, substation-level rapid fault diagnosis will be achieved, which avoids sending all the original data to the control center and reduces data traffic significantly. In addition, by making full use of the local rich alarm information of the substation, the uncertainty of diagnosis and alarm can be greatly eliminated, and the direct reason of the fault can be found quickly.