Line loss data anomaly monitoring method and system based on time sequence anomaly detection

Abstract

The invention relates to a line loss data anomaly monitoring method and system based on time sequence anomaly detection. The system comprises the following steps: S1, collecting operation data of a power grid; s2, preprocessing the acquired operation data of the power grid; s3, according to the time sequence data set, through a Patch Transform, segmenting a time sequence into local windows and calculating attention, and through GraphSAGE, aggregating line topology correlation features to obtain a training feature set; s4, constructing a hierarchical anomaly detection model and training based on the training feature set; and S5, performing anomaly detection according to the trained layered anomaly detection model, and generating a causal thermodynamic diagram based on an anomaly detection result. According to the invention, through multi-source data fusion, dynamic distribution modeling and causal analysis, accurate identification and diagnosis of abnormal reasons in a complex line loss scene are realized.

Description

Technical Field

[0001] The present invention relates to the field of line loss monitoring, and particularly to a method and system for abnormal monitoring of line loss data based on time series anomaly detection. Background Art

[0002] In the operation of modern power grids, the monitoring and management of line losses are one of the key tasks to ensure the safe operation of the power grid and reduce operating costs. Grid line losses are the energy losses caused by various factors such as equipment losses, network topologies, environmental changes, and user behaviors during the transmission and distribution of electricity. Among them, abnormal line losses may reflect problems such as equipment failures, external environmental abnormal interferences, or illegal electricity consumption. With the development of smart grids, the power system generates a large amount of real-time operation data, including power time series data (such as voltage, current, power, etc.), equipment status data (such as aging degree, load rate, etc.), and external environmental data (such as weather conditions, temperature, wind speed, etc.). How to utilize these multi-source data to construct an efficient, high-precision, and interpretable anomaly monitoring method has become a hot and difficult issue in current research.

[0003] Traditional line loss anomaly monitoring means often rely on fixed rules or statistical thresholds. These methods are less sensitive to non-linear and complex accidental events, and it is difficult to capture hidden anomalies and accurately quantify the comprehensive influence of multiple factors. At the same time, the analysis methods based on a single feature dimension lack the ability to model spatio-temporal dynamics and grid topological relationships, and cannot effectively cope with the complex characteristics composed of multi-source line loss anomalies. Summary of the Invention

[0004] In order to solve the above problems, the purpose of the present invention is to provide a method and system for abnormal monitoring of line loss data based on time series anomaly detection, which can accurately identify and diagnose the causes of anomalies in complex line loss scenarios through multi-source data fusion, dynamic distribution modeling, and causal analysis.

[0005] To achieve the above purpose, the present invention adopts the following technical solutions: A method for abnormal monitoring of line loss data based on time series anomaly detection, comprising the following steps: S1: Collect the operation data of the power grid, including power time series data and equipment status data; S2: Preprocess the collected operation data of the power grid, including denoising high-frequency noise data by wavelet transform, interpolating based on the ST-MVL model, and then combining with external environmental data to construct a time series data set; S3: According to the time series data set, use Patch Transformer to segment the time series into local windows and calculate attention, and aggregate the line topology association features through GraphSAGE to obtain a training feature set; S4: Construct a hierarchical anomaly detection model and train it based on the training feature set; S5: Perform anomaly detection according to the trained hierarchical anomaly detection model, and generate a causal heat map based on the anomaly detection results.

[0006] Further, S2 is specifically as follows: All operation data are uniformly aligned to a unified granularity, and for high-frequency noise data, wavelet transform is used for denoising; Map the operation data to line nodes according to the power grid topology to construct a spatio-temporal matrix , where represents the real number field, N is the number of nodes, T is the time point, and D is the feature dimension; Define the missing values in the spatio-temporal matrix X as Ω, and the goal is to complete it through low-rank constraint: ; Among them, Z is the optimized completion matrix, representing the completion result of the spatio-temporal matrix X; P Ω is the projection operator; is the nuclear norm, representing the sum of the singular values of the matrix Z; is the Frobenius norm, representing the sum of the squared errors between the completion matrix Z and the original observation matrix X at the missing value positions; λ is the regularization parameter; is the graph Laplacian regularization term; L is the graph Laplacian matrix; Z T represents the transpose of Z; is the regularization parameter; Use the alternating direction method of multipliers ADMM to decompose it into sub-problems for iterative solution: ; Among them, represents the updated value of Z in the (k + 1)-th iteration; U is the auxiliary variable in the optimization process; represents the updated value of U in the (k + 1)-th iteration; Y represents the Lagrange multiplier variable; represents the updated value of Y in the (k + 1)-th iteration; ρ is the penalty parameter in the augmented Lagrangian method; represents the square of the Frobenius norm of the matrix; represents the nuclear norm of the matrix; represents using the graph Laplacian regularization to constrain the matrix U, and maintaining the consistency of data between adjacent nodes through the smoothness assumption of the graph; When the convergence condition is satisfied, the optimized completion matrix Z is obtained, where represents the Frobenius norm of the matrix; Concatenate the external environment data and the operation data into an extended feature vector :

[0007] Among them, is the completed running data; E temp (t), E hum (t) and E wind (t) are temperature, humidity and wind speed respectively; Concat represents concatenation.

[0008] Furthermore, through Patch Transformer, the time series is segmented into local windows and attention is calculated, specifically as follows: The time series data of each node is segmented into P local windows, each window with length L and step size S: ; Among them, represents the time series data from time point t = 1 to t = L + 1; represents the data segment from time point t = S to t = S + L; is the set of local windows; Add learnable position encoding E pos : ; Among them, is the Patch after adding learnable position encoding; Calculate multi-head attention for each Patch and output time series features: ; Among them, represents the output of the i-th head; Q, K, and V are query, key, and value matrices respectively, all obtained by linear transformation; h is the number of attention heads; d is the feature dimension of each Patch; , , are the projection matrices of query, key, and value respectively; is the output projection matrix of multi-head attention; Softmax is the activation function; MSA represents the multi-head self-attention mechanism; Improve the stability and expressive power of the model through residual connection and layer normalization: ; Among them, It represents the temporal feature of node n, which is the time segment feature after Patch Transformer encoding; MSA represents the multi-head attention mechanism; LayerNorm represents layer normalization.

[0009] Furthermore, the training feature set is obtained by aggregating the line topology correlation features through GraphSAGE, as follows: Define the power grid topology graph G=(V e ,E), where node v∈V e represents power grid equipment, and edge e ij ∈E represents a physical connection; For the nth node v n , aggregate the temporal features of the neighbors N(v n ) of node v n : ; Among them, is the temporal feature of neighbor node v k ; is the neighbor aggregation feature; MEAN represents the aggregation function; Combine its own features with neighbor information: ; Among them, is the spatial feature of node v n ; W1 and W2 are learnable weight matrices; σ is the activation function; Based on the gated fusion mechanism, dynamically weight and fuse the spatio-temporal features:

[0010]

[0011] Among them, is the fusion feature of node v n ; W g is the weight matrix, ⊙ is the element-wise multiplication; g n is the gated weight; Sigmoid represents the activation function.

[0012] Furthermore, the hierarchical anomaly detection model includes a fast preliminary screening layer, a fine detection layer, and a dynamic verification layer. Among them, the fast preliminary screening layer uses a lightweight TCN, and the fine detection layer uses T-EfficientAD; the dynamic verification layer detects hidden anomalies through diffusion model reconstruction residual analysis.

[0013] Furthermore, the fast preliminary screening layer uses a lightweight TCN, as follows: The lightweight TCN uses three layers of causal dilated convolutions, compresses the number of channels to a 32-dimensional output layer, and obtains the abnormal probability p by calculating with the Sigmoid activation function. t ; For the input time series features, the output of the l-th layer of causal dilated convolution is: ; Among them, represents the weight of the convolution kernel of the l-th layer at the -th time step; is the convolution kernel size; H l (t) is the output of the l-th layer of dilated convolution at time t; is the output of the -th layer; r is the dilation factor; ReLU is the activation function; The loss function uses Focal Loss: ; Among them, y t is the true label; is the adjustment parameter; is the weight coefficient; T is the training duration; If the abnormal probability p t is less than the preset threshold, it is judged as normal, otherwise the fine detection layer is activated.

[0014] Furthermore, the fine detection layer uses T-EfficientAD, specifically as follows: The T-EfficientAD is a teacher-student architecture: The teacher network Teacher learns the normal data distribution through a pre-trained autoencoder; the student network Student uses a lightweight UNet structure to predict the residual of the teacher's output; Teacher network reconstruction: ; Among them, Z fused is the input time series feature; is the reconstruction output of the teacher network; Student network prediction: ; Among them, R is the residual predicted by the student network; Abnormal score calculation: ; Among them, A fine is the abnormal score of the fine detection; Teacher pre-training, minimizing MSE with normal data: ; Among them, is the teacher network loss function; For student network training, adversarial training is adopted to force the residual R to approximate the teacher error: ; Among them, is the reconstruction error for approximating the teacher network; is the TotalVariation regularization, which is used to constrain the smoothness of the residual; is the student network loss function; Finally, based on a preset threshold, a set of suspicious samples is obtained.

[0015] Furthermore, the dynamic verification layer detects hidden anomalies through diffusion model reconstruction residual analysis, specifically as follows: Gradually add noise to the spatio-temporal feature fusion result Z fused to expand it to the standard Gaussian distribution, The latent variable Z generated at each step t ; ; Among them, β t is the noise scheduling parameter; I is the identity matrix; is the conditional probability distribution; Train the denoising network Predict the noise, and use the denoising network in the reverse process to infer the latent variable of one step after denoising , until it is restored to Z0: ; Among them, is the cumulative retention ratio; is the single-step noise reduction factor; is the output of the noise prediction network; is the standard deviation parameter; is the random noise; In dynamic verification, the diffusion model traverses the latent variables at different step sizes , calculates the L1 norm difference between the input and the model reconstruction result , and calculates the multi-scale residual : ; Among them, is the step size weight; is the corresponding reverse reconstruction result; K’ is the total number of step sizes; If A diff > μdiff +3σ diff Then, if it is determined to be a hidden anomaly, μ diff , σ diff are the mean and standard deviation calculated from the normal samples in the validation set.

[0016] Furthermore, S5 is specifically as follows: Perform anomaly detection based on the trained hierarchical anomaly detection model, and based on the anomaly detection results, use the PC algorithm to construct a causal graph of anomalies and external variables; And use Do-Calculus to quantify the anomaly contribution degrees of equipment aging and electricity theft factors to obtain the contribution degree matrix of each line node; Generate a causal heat map based on the causal graph of line loss anomalies and external variables and the contribution degree matrix of each line node.

[0017] A line loss data anomaly monitoring system based on time series anomaly detection, including a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps in the above-mentioned line loss data anomaly monitoring method based on time series anomaly detection.

[0018] The present invention has the following beneficial effects: 1. The present invention combines power time series data with equipment status data to capture dual information of time dynamics and equipment health status, which can improve the comprehensiveness of anomaly detection, and introduces external environmental data (such as temperature, wind speed, etc.) to enhance the modeling ability of the influence of external factors (such as weather and environmental changes) on line loss data, thereby improving the detection accuracy; 2. The present invention uses Patch Transformer to divide the time series into local windows to capture local time series patterns, and extracts key features through the attention mechanism. It uses GraphSAGE to aggregate line topology association features to model the topological relationship between power grid devices, enhancing the sensitivity of anomaly detection to the structural characteristics of the power grid. By combining the local time series features of PatchTransformer with the topological features of GraphSAGE, a training feature set with spatio-temporal feature fusion is formed, comprehensively improving the detection ability for anomalies; 3. The hierarchical anomaly detection model of the present invention combines fast detection, fine detection, and dynamic verification, taking into account both detection efficiency and accuracy: the fast detection layer quickly screens samples to reduce the calculation cost, and the fine detection layer and the dynamic verification layer gradually capture complex anomalies and hidden anomalies, effectively improving the overall detection robustness and accuracy. Description of the Drawings

[0019] Figure 1 It is a flowchart of the method of the present invention. Detailed Embodiments

[0020] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments: Reference Figure 1 , in this embodiment, a method for abnormal monitoring of line loss data based on time series anomaly detection is provided, including the following steps: S1: Collect the operation data of the power grid, including power time series data and equipment status data; The power time series data includes voltage V(t), current I(t), and active power P(t); the equipment status data includes line temperature T(t), vibration amplitude A(t), and insulation resistance R(t); S2: Preprocess the operation data of the collected power grid, including denoising high-frequency noise data using wavelet transform, interpolating based on the ST-MVL model, and then combining external environment data to construct a time series data set; The external environment data includes temperature E temp (t), humidity E hum (t), and wind speed E wind (t); S3: According to the time series data set, use Patch Transformer to segment the time series into local windows and calculate the attention, and aggregate the line topology association features through GraphSAGE to obtain a training feature set; S4: Construct a hierarchical anomaly detection model and train it based on the training feature set; S5: Perform anomaly detection according to the trained hierarchical anomaly detection model, and generate a causal heat map based on the anomaly detection results.

[0021] In this embodiment, S2 is specifically as follows: All operation data are uniformly aligned to a unified granularity, and high-frequency noise data are denoised using wavelet transform; Map the operation data to line nodes according to the power grid topology to construct a spatio-temporal matrix , where represents the real number field, N is the number of nodes, T is the time point, and D is the feature dimension; Define the missing value in the spatio-temporal matrix X as Ω, and the goal is to complete it through low-rank constraint: ; Among them, Z is the optimized completion matrix, representing the completion result of the spatio-temporal matrix X; P Ω is the projection operator; is the nuclear norm, representing the sum of the singular values of the matrix Z; is the Frobenius norm, representing the sum of the squared errors between the completed matrix Z and the original observation matrix X at the missing value positions; λ is the regularization parameter; is the graph Laplacian regularization term; L is the graph Laplacian matrix; Z T represents the transpose of Z; is the regularization parameter; is decomposed into sub - problems and iteratively solved using the Alternating Direction Method of Multipliers (ADMM): ; where, represents the updated value of Z in the (k + 1)-th iteration; U is the auxiliary variable in the optimization process; represents the updated value of U in the (k + 1)-th iteration; Y represents the Lagrange multiplier variable; represents the updated value of Y in the (k + 1)-th iteration; ρ is the penalty parameter in the augmented Lagrangian method; represents the square of the Frobenius norm of the matrix; represents the nuclear norm of the matrix; represents using the graph Laplacian regularization to constrain the matrix U, maintaining the consistency of data between adjacent nodes through the smoothness assumption of the graph; When the convergence condition is satisfied, the optimized completed matrix Z is obtained, where represents the Frobenius norm of the matrix; The external environment data and the running data are concatenated into an extended feature vector :

[0022] where, is the completed running data; E temp (t), E hum (t) and E wind (t) are the temperature, humidity, and wind speed respectively; Concat represents concatenation.

[0023] In this embodiment, through the Patch Transformer, the time series is segmented into local windows and the attention is calculated, specifically: The time series data of each node is segmented into P local windows, each window with length L and step size S: ; where, represents the time series data from time point t = 1 to t = L + 1; Represents a data segment from time point t = S to t = S + L; is a set of local windows; Add learnable positional encoding E to each Patch pos : ; Among them, is the Patch after adding the learnable positional encoding; Calculate multi-head attention for each Patch and output temporal features: ; Among them, represents the output of the i-th head; Q, K, and V are the query, key, and value matrices respectively, all obtained by linear transformation; h is the number of attention heads; d is the feature dimension of each Patch; , , are the projection matrices of the query, key, and value respectively; is the output projection matrix of the multi-head attention; Softmax is the activation function; MSA represents the multi-head self-attention mechanism; Improve the stability and expressive power of the model through residual connection and layer normalization: ; Among them, is the temporal feature of node n, representing the time segment feature after Patch Transformer encoding; MSA represents the multi-head attention mechanism; LayerNorm represents layer normalization.

[0024] In this embodiment, aggregate the line topology correlation features through GraphSAGE to obtain the training feature set, specifically as follows: Define the power grid topology graph G=(V e ,E), where the node v ∈ V e represents the power grid equipment, and the edge e ij ∈ E represents the physical connection; For the n-th node v n , aggregate the temporal features of the neighbors N(v n ) of node v n : ; Among them, is the temporal feature of the neighbor node v k ; is the neighbor aggregation feature; MEAN represents the aggregation function; Combine its own features with neighbor information: ; Among them, is the spatial feature of node v n ; W1 and W2 are learnable weight matrices; σ is an activation function; Based on the gated fusion mechanism, dynamically weighted fusion of spatio-temporal features:

[0025]

[0026] Among them, is the fusion feature of node v n ; W g is the weight matrix, ⊙ is element-wise multiplication; g n is the gated weight; Sigmoid represents the activation function.

[0027] In this embodiment, the hierarchical anomaly detection model includes a fast initial screening layer, a fine detection layer, and a dynamic verification layer. Among them, the fast initial screening layer uses a lightweight TCN (temporal convolutional network), and the fine detection layer uses T-EfficientAD; the dynamic verification layer detects hidden anomalies (such as slow power theft) through diffusion model reconstruction residual analysis.

[0028] In this embodiment, the fast initial screening layer uses a lightweight TCN (temporal convolutional network), specifically as follows: The lightweight TCN uses 3 layers of causal dilated convolution and compresses the number of channels to a 32-dimensional output layer to obtain the anomaly probability p calculated by the Sigmoid activation function t ; Inputting the temporal feature, the output of the l-th layer of causal dilated convolution is: ; Among them, is the weight representing the convolution kernel of the l-th layer at the -th time step; is the convolution kernel size; H l (t) is the output of the l-th layer of dilated convolution at time t; is the output of the -th layer; r is the dilation factor; ReLU is the activation function; The loss function uses Focal Loss: ; Among them, y t is the true label; is the adjustment parameter; is the weight coefficient; T is the training duration; If the anomaly probability pt If it is less than the preset threshold, it is judged as normal; otherwise, the fine detection layer is activated.

[0029] In this embodiment, the fine detection layer adopts T-EfficientAD, specifically as follows: The T-EfficientAD is a teacher-student architecture: The teacher network Teacher learns the normal data distribution through a pre-trained autoencoder; the student network Student adopts a lightweight UNet structure to predict the residual of the teacher's output; Teacher network reconstruction: ; where Z fused is the input temporal feature; is the reconstruction output of the teacher network; Student network prediction: ; where R is the residual predicted by the student network; Abnormal score calculation: ; where A fine is the abnormal score of the fine detection; Teacher pre-training, minimizing MSE with normal data: ; where is the loss function of the teacher network; Student network training, using adversarial training to force the residual R to approximate the teacher's error: ; where is the reconstruction error approximating the teacher network; is the TotalVariation regularization, used to constrain the smoothness of the residual; is the loss function of the student network; Finally, based on the preset threshold, a set of suspicious samples is obtained.

[0030] In this embodiment, the dynamic verification layer detects hidden anomalies through diffusion model reconstruction residual analysis, specifically as follows: Gradually add noise to the spatio-temporal feature fusion result Z fused to expand it to the standard Gaussian distribution, The latent variable Z generated at each step t ; ; where β tis the noise scheduling parameter; I is the identity matrix; is the conditional probability distribution; Train the denoising network Predict the noise, and use the denoising network in the reverse process to infer the latent variable of the denoised step , until it is restored to Z0: ; Among them, is the cumulative retention ratio; is the single-step noise reduction factor; is the output of the noise prediction network; is the standard deviation parameter; is the random noise; In dynamic verification, the diffusion model traverses different step sizes of the latent variable , calculate the L1 norm difference between the input and the model reconstruction result , and calculate the multi-scale residual : ; Among them, is the step size weight; is corresponding reverse reconstruction result; K' is the total number of step sizes; If A diff > μ diff + 3σ diff then determine the hidden anomaly, μ diff , σ diff are the mean and standard deviation calculated from the normal samples in the validation set.

[0031] In this embodiment, S5 is specifically: Perform anomaly detection according to the trained hierarchical anomaly detection model, and based on the anomaly detection results, use the PC algorithm to construct a causal graph of anomalies and external variables; And use Do-Calculus to quantify the anomaly contribution degrees of equipment aging and electricity theft factors to obtain the contribution degree matrix of each line node; Generate a causal heat map based on the causal graph of line loss anomalies and external variables and the contribution degree matrix of each line node.

[0032] A line loss data anomaly monitoring system based on time series anomaly detection, including a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps in the above-mentioned line loss data anomaly monitoring method based on time series anomaly detection.

[0033] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0034] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices produce means for implementing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0035] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory produce a manufactured article including instruction means that implement the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0036] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0037] As described above, it is only the preferred embodiments of the present invention, and the present invention is not limited to other forms. Any person skilled in the art may use the technical content disclosed above to make changes or modifications into equivalent embodiments with equivalent changes. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the technical solution content of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. A method for abnormal monitoring of line loss data based on time series anomaly detection, characterized in that, It includes the following steps: S1: Collect the operation data of the power grid, including power time-series data and equipment status data; S2: Preprocess the operation data of the collected power grid, including denoising high-frequency noise data using wavelet transform, interpolating based on the ST-MVL model, and then combining external environmental data to construct a time-series data set; S3: According to the time-series data set, use Patch Transformer to segment the time series into local windows and calculate attention, and aggregate line topology correlation features through GraphSAGE to obtain a training feature set; S4: Construct a hierarchical anomaly detection model and train it based on the training feature set; S5: Perform anomaly detection according to the trained hierarchical anomaly detection model, and generate a causal heat map based on the anomaly detection results.

2. The abnormal monitoring method for line loss data based on timing anomaly detection according to claim 1, wherein The specific content of S2 is as follows: All operation data are uniformly aligned to a unified granularity, and high-frequency noise data are denoised using wavelet transform; Map the operation data to the line nodes according to the power grid topology to construct a spatio-temporal matrix , where represents the real number field, N is the number of nodes, T is the time point, and D is the feature dimension; Define the missing values in the spatio-temporal matrix X as Ω, and the goal is to complete it through low-rank constraint: ； Among them, Z is the optimized completion matrix, representing the completion result of the spatio-temporal matrix X; P Ω is the projection operator; is the nuclear norm, representing the sum of the singular values of the matrix Z; is the Frobenius norm, representing the sum of the squared errors between the completion matrix Z and the original observation matrix X at the missing value positions; λ is the regularization parameter; is the graph Laplacian regularization term; L is the graph Laplacian matrix; Z T represents the transpose of Z; is the regularization parameter; Use the alternating direction multiplier method ADMM to decompose it into sub-problems for iterative solution: ； Among them, represents the updated value of Z in the (k + 1)-th iteration; U is an auxiliary variable in the optimization process; represents the updated value of U in the (k + 1)-th iteration; Y represents the Lagrange multiplier variable; represents the updated value of Y in the (k + 1)-th iteration; ρ is the penalty parameter in the augmented Lagrangian method; represents the square of the Frobenius norm of the matrix; represents the nuclear norm of the matrix; represents using graph Laplacian regularization to constrain the matrix U, and maintaining the consistency of data between adjacent nodes through the smoothness assumption of the graph; is the regularization parameter; When the convergence condition is met , the optimized completion matrix Z is obtained, where represents the Frobenius norm of the matrix; Concatenate external environment data and running data into an extended feature vector : ； Among them, is the completed operation data; E temp (t), E hum (t) and E wind (t) are temperature, humidity and wind speed respectively; Concat represents splicing.

3. The abnormal monitoring method for line loss data based on timing anomaly detection according to claim 2, characterized in that, The specific content of segmenting the time series into local windows and calculating attention through Patch Transformer is as follows: The timing data of each node is divided into P local windows, each with a length of L and a step size of S: ; Among them, represents time-series data a data segment from time point t = 1 to t = L + 1; represents a data segment from time point t = S to t = S + L; is a set of local windows; Add learnable positional encoding E for each Patch pos : ； Among them, is the Patch after adding learnable positional encoding; Calculate multi-head attention for each Patch and output time-series features: ； Among them, represents the output of the i-th head; Q, K, and V are the query, key, and value matrices respectively, all obtained by linear transformation; h is the number of attention heads; d is the feature dimension of each Patch; , , are the projection matrices of the query, key, and value respectively; is the output projection matrix of the multi-head attention; Softmax is the activation function; MSA represents the multi-head self-attention mechanism; Improve the stability and expressive ability of the model through residual connection and layer normalization: ； Among them, is the temporal feature of node n, representing the time segment feature after being encoded by the Patch Transformer; MSA represents the multi-head attention mechanism; LayerNorm represents layer normalization.

4. The method for abnormal monitoring of line loss data based on timing anomaly detection according to claim 3, wherein The specific content of aggregating line topology correlation features through GraphSAGE to obtain a training feature set is as follows: Define the power grid topology graph G=(V e ,E), where the node v∈V e represents power grid equipment, and the edge e ij ∈E represents a physical connection; For the n-th node v n , aggregate the temporal features of the neighbors N(v n ) of the node v n : ； Among them, is the temporal feature of neighbor node v k ; is the neighbor aggregation feature; MEAN represents the aggregation function; Combine its own features with neighbor information: ； Among them, is the spatial feature of node v n ; W1 and W2 are learnable weight matrices; σ is an activation function; Based on the gated fusion mechanism, dynamically weight and fuse spatio-temporal features: ； ； Among them, is the fusion feature of node v n ; W g is the weight matrix, and ⊙ is the element-wise multiplication; g n is the gating weight; Sigmoid represents the activation function.

5. The abnormal monitoring method for line loss data based on timing anomaly detection according to claim 1, wherein The hierarchical anomaly detection model includes a fast initial screening layer, a fine detection layer, and a dynamic verification layer. Among them, the fast initial screening layer uses a lightweight TCN, and the fine detection layer uses T-EfficientAD; the dynamic verification layer detects hidden anomalies through diffusion model reconstruction residual analysis.

6. The abnormal monitoring method for line loss data based on time series anomaly detection according to claim 5, characterized in that, The specific content of the fast initial screening layer using a lightweight TCN is as follows: The lightweight TCN adopts three layers of causal dilated convolution, compresses the number of channels to the 32-dimensional output layer, and obtains the abnormal probability p by calculating with the Sigmoid activation function t ; Input time-series features, and the causal dilated convolution output of the l-th layer: ； Among them, represents the weight of the convolutional kernel of the -th time step and the l-th layer of convolution; is the convolutional kernel size; H l (t) is the output of the dilated convolution of the l-th layer at time t; is the output of the -th layer; r is the dilation factor; ReLU is the activation function; The loss function uses Focal Loss: ; where y t is the true label; is the adjustment parameter; is the weight coefficient; T is the training duration; If the abnormal probability p t is less than the preset threshold, it is judged as normal; otherwise, the fine detection layer is activated.

7. The abnormal monitoring method for line loss data based on timing anomaly detection according to claim 5, characterized in that, The specific content of the fine detection layer using T-EfficientAD is as follows: The T-EfficientAD is a teacher-student architecture: The teacher network Teacher learns the normal data distribution through a pre-trained autoencoder; the student network Student uses a lightweight UNet structure to predict the residual of the teacher's output; Teacher network reconstruction: ； Among them, Z fused is the input timing feature; is the reconstructed output of the teacher network; Student network prediction: ； Among them, R is the residual predicted by the student network; Anomaly score calculation: ； Among them, A fine is the anomaly score for fine detection; Teacher pre-training, minimizing MSE with normal data: ； Among them, is the teacher network loss function; Student network training, using adversarial training to force the residual R to approximate the teacher's error: ； wherein, is the reconstruction error for approximating the teacher network; is the Total Variation regularization, which is used to constrain the smoothness of the residuals; is the loss function of the student network; Finally, based on a preset threshold, obtain a suspicious sample set.

8. The abnormal monitoring method for line loss data based on timing anomaly detection according to claim 7, characterized in that, The specific content of the dynamic verification layer detecting hidden anomalies through diffusion model reconstruction residual analysis is as follows: Gradually add noise to the spatio-temporal feature fusion result Z fused Expand it to a standard Gaussian distribution, The latent variable Z generated at each step t ; ； where β t is the noise scheduling parameter; I is the identity matrix; is the conditional probability distribution; Train the denoising network Predict the noise, and use the denoising network in the reverse process to infer the denoised latent variable at one step , until it is restored to Z0: ； wherein, is the cumulative retention ratio; is the single-step noise reduction factor; is the output of the noise prediction network; is the standard deviation parameter; is the random noise; In dynamic verification, the diffusion model traverses latent variables at different step sizes , calculates the L1 norm difference between the input and the model reconstruction result , and calculates the multi-scale residual : ； Among them, is the step weight; is the corresponding inverse reconstruction result; K' is the total number of steps; If A diff > μ diff + 3σ diff then a hidden anomaly is determined, where μ diff , σ diff are the mean and standard deviation calculated from the normal samples in the validation set.

9. The abnormal monitoring method for line loss data based on timing anomaly detection according to claim 1, characterized in that The specific content of S5 is: Perform anomaly detection according to the trained hierarchical anomaly detection model, and construct a causal graph of anomalies and external variables using the PC algorithm based on the anomaly detection results. And use the Do-Calculus to quantify the abnormal contribution degrees of device aging and electricity theft factors, and obtain the contribution degree matrix of each line node; Generate a causal heat map based on the causal graph of line loss anomaly and external variables and the contribution degree matrix of each line node.

10. An abnormal monitoring system for line loss data based on time series anomaly detection, characterized in that, It includes a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps in a line loss data anomaly monitoring method based on timing anomaly detection according to any one of claims 1-9.

Images