Electricity stealing behavior detection method based on feature fusion and CNN-LSTM hybrid model

Abstract

The invention provides an electricity stealing behavior detection method based on feature fusion and a CNN-LSTM hybrid model, and belongs to the technical field of electric power information technology and deep learning. According to the method, after power load data and user behavior characteristics are subjected to data processing and enhancement, a deep learning model is combined with a self-attention mechanism to process user electricity consumption data, user electricity stealing behavior anomaly detection is carried out, and the electricity stealing risk identification accuracy and calculation efficiency can be remarkably improved. According to the invention, power grid enterprises can be helped to efficiently deal with electricity stealing conditions, and comprehensive and accurate identification of electricity stealing behaviors is guaranteed. By learning user historical load data, integrating time sequence characteristics of user loads and optimizing a data abnormity diagnosis and judgment mechanism, the electricity stealing user detection accuracy is improved, and reliable support is provided for power grid enterprise decision making.

Description

Technical Field

[0001] The present invention discloses an electricity theft detection method based on feature fusion and a CNN-LSTM hybrid model, relates to electricity theft detection technology, and belongs to the technical fields of power information technology and deep learning. Background Art

[0002] With the advancement of smart grid construction and the widespread application of power Internet of Things (IoT) technologies, electricity theft has become significantly more covert and technical. Traditional detection methods based on manual inspections and simple statistics are no longer able to cope with the complex and ever-changing non-technical losses. Consumer electricity consumption data collected by power systems exhibits significant multimodal characteristics. The time-series load curves generated by smart meters reflect the temporal dependence of electricity consumption. Substation monitoring data includes the spatial correlation of grid operations. Furthermore, the text contains a wealth of semantic information composed of specialized terminology from the power sector.

[0003] Currently, existing electricity theft identification methods mostly use a single machine learning model, such as CNN-based spatial feature extraction or LSTM-based time series modeling, which is difficult to effectively integrate the spatiotemporal correlation characteristics of power grid data, and there are problems such as feature loss and semantic understanding deviation when processing high-dimensional heterogeneous data.

[0004] Existing industry solutions generally face challenges such as difficulty integrating data across business systems and insufficient ability to track the dynamic evolution of abnormal patterns. This is particularly true when faced with new and complex scenarios like mass electricity theft, where the generalization performance and real-time response efficiency of existing models are significantly reduced. Building an intelligent analysis framework with spatiotemporal joint modeling capabilities to automatically mine deep features in power data and accurately capture abnormal patterns has become a key research direction for improving anti-electricity theft prevention. Summary of the Invention

[0005] The purpose of the present invention is to address the shortcomings of the above-mentioned background technology and provide a method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model. The present invention effectively improves the accuracy of electricity theft prediction and optimizes computational efficiency through abnormal electricity consumption detection using feature fusion and CNN-LSTM hybrid model.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] The electricity theft detection method based on feature fusion and CNN-LSTM hybrid model is characterized by comprising the following steps:

[0008] S1. Obtain power user load data, construct a trajectory matrix for the obtained power user load data, perform principal component decomposition using singular spectrum analysis, iteratively fill in long-term missing values, separate trend and periodic components, and then generate initial filling values ​​through cubic spline interpolation;

[0009] S2, detect outliers based on the sliding Z-score method, and perform linear interpolation correction on segments that exceed the normal distribution threshold for more than three consecutive cycles;

[0010] S3. We use user behavior features as time-aligned embedding vectors and design a cross-attention mechanism to calculate the cross-attention score between the load time series features and the behavior embedding vector. We then apply a smoothing constraint to the attention score matrix using a Gaussian kernel function to suppress high-frequency noise interference.

[0011] S4, nonlinearly superimposes the period-trend component of power user load data with the high-frequency characteristics of user behavior, and finally outputs a joint feature vector that integrates multi-dimensional information, and uses a Sigmoid gating unit to dynamically adjust the fusion weight;

[0012] S5. Build a 1D-WGAN framework, use a transposed convolutional network as the generator, use a dilated causal convolutional structure as the discriminator, pre-train the discriminator on normal load data until convergence, control the parameters and iteratively optimize the generator weights;

[0013] S6, through the Wasserstein distance loss combined with the gradient penalty term, to control the diversity of abnormal patterns in the generated data;

[0014] S7. Build a CNN-LSTM hybrid model. The CNN branch uses eight convolution kernels of different widths to extract multi-scale features. The LSTM layer introduces a fully connected enhanced gating mechanism to capture periodic mutations. The convolution kernel parameters of the first three CNN layers are adjusted, and the weights of the LSTM and fully connected layers are adjusted to achieve cross-domain migration.

[0015] S8. Extract the real load value collected by users in real time from the power grid database, call the predicted load data output by the CNN-LSTM hybrid model, calculate the dynamic residual and daily load fluctuation standard deviation, and use the adjustment factor to weight them to obtain the user's electricity theft risk value.

[0016] As a preferred technical solution of the present invention: in step S2,

[0017] The load data after the normal distribution outlier test was used to screen out outliers and optimize the data to make its dimension consistent.

[0018] As a preferred technical solution of the present invention: in step S3,

[0019] The power load sequence is mapped to a shared embedding space aligned with the user behavior habit characteristics. A cross-attention mechanism is adopted to dynamically calculate the association weights between load timing features and user behavior features through a multi-head fine-grained joint attention layer. A Gaussian smoothing constraint is imposed on the attention score matrix to suppress noise interference.

[0020] As a preferred technical solution of the present invention: in step S5,

[0021] A training set is constructed based on normal power load data. After standardized preprocessing and sliding window segmentation into continuous one-dimensional sequences, an adversarial generation framework is constructed. The generator uses a one-dimensional transposed convolutional network to receive random noise input and output a synthetic sequence with abnormal characteristics. The discriminator uses a one-dimensional convolutional network to distinguish between real abnormal data and generated data, and introduces the Wasserstein distance loss function and gradient penalty mechanism to optimize training stability. In the adversarial training stage, the generator and discriminator parameters are alternately optimized to enable the generator to gradually learn the temporal distribution law of real abnormal data. The generator that has converged in training is used to batch output synthetic data that conforms to the statistical characteristics of the abnormality.

[0022] As a preferred technical solution of the present invention: in step S6,

[0023] Find the maximum and minimum values ​​in the original data set as the benchmark values ​​for the linear transformation. Based on the upper and lower limits of the target interval, remap the value of each data point to the new interval through linear scaling calculation to ensure that the relative distance of all data remains unchanged. Subtract the minimum value from the original data, and then eliminate the dimensional difference through scaling. Finally, compress the data losslessly to a uniform scale to achieve comparability between different features.

[0024] As a preferred technical solution of the present invention: in step S7,

[0025] Feature extraction is performed through a one-dimensional convolutional neural network. The convolution kernel slides along the time axis. The spatial correlation within the local time window is captured through multiple cascaded convolutional layers and pooling layers to obtain short-term fluctuations and periodic trends in power consumption patterns.

[0026] As a preferred technical solution of the present invention: in step S7,

[0027] The high-dimensional feature sequence output by CNN is reconstructed into a time step format and input into the long short-term memory network. LSTM dynamically adjusts the information flow through the forget gate, input gate, and output gate, learns the long-term dependencies in the feature sequence, and enhances the expression ability of complex temporal patterns by stacking multiple layers of LSTM units. The local feature vector extracted by CNN is gated and weighted with the temporal hidden state output by LSTM, and then mapped to the prediction space through the fully connected layer to generate the final result, retaining the spatial abstraction ability and strengthening the temporal dimension modeling.

[0028] As a preferred technical solution of the present invention: in step S7,

[0029] A CNN-LSTM hybrid model is pre-trained on the power load dataset to extract the local spatiotemporal features and long-term dependencies of the load data, build feature abstraction capabilities, retain the underlying structure of the pre-trained model, replace and reinitialize the top fully connected layer to form a migration adaptation structure, adopt a layered fine-tuning strategy, freeze some CNN parameters to retain the general feature extraction capability, dynamically adjust the learning rate of the LSTM layer and the fully connected layer, use the target data to optimize the time series modeling details through back propagation, and narrow the data gap between the source domain and the target domain through domain adaptation technology, thereby improving the generalization performance of the model in the target user load scenario.

[0030] As a preferred technical solution of the present invention: in step S8,

[0031] Based on the predicted load data and the actual user load values ​​collected in real time, the deviation rate between the two is calculated through dynamic residual analysis, and a risk adjustment factor is generated in combination with the historical load fluctuation characteristics. The adjustment factor is applied to the predicted load curve, and the abnormal time period is weighted and amplified to highlight the load mutation area that exceeds the preset threshold. The sliding time window statistical method is used to accumulate the frequency and severity of load deviation events within a specified period.

[0032] In the above structure: The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model proposed in the present invention first performs data cleaning and dynamic filling of missing values ​​on the original load sequence collected by the smart meter, decouples the electricity consumption curve into baseload component, periodic fluctuation component and random residual component through variational mode decomposition, and constructs a multimodal feature matrix based on the electricity consumption pattern label in the user portrait. To address the problem of imbalance between positive and negative samples, an improved 1D-WGAN adversarial network is used to generate abnormal electricity consumption patterns under the topological constraints of the substation area, and the physical interpretability of the generated data is enhanced through gradient penalty terms and spectral normalization processing. A two-layer attention mechanism is designed to realize the dynamic coupling of CNN spatial feature extraction and LSTM temporal dependency modeling, and the focus on key abnormal frames is achieved through multi-head attention weight allocation. Transfer learning adopts a pre-training-fine-tuning architecture, constructs a pre-trained objective function based on the line loss rate prediction task of massive normal electricity consumption data, and realizes the adaptive parameter migration of the target anomaly detection model through distance measurement.

[0033] The 1D-WGAN is used to enhance and process the power load data of power grid users. After integrating the characteristics of power users' electricity usage habits, the CNN-LSTM is used to accurately predict the user's power load. At the same time, transfer learning is used to improve the model's prediction accuracy. Finally, the risk of power theft by users is determined by the risk warning value.

[0034] Through feature fusion and abnormal electricity consumption detection using the CNN-LSTM hybrid model, the accuracy of electricity theft prediction is improved and the computing efficiency is optimized.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] (1) Solve the vanishing gradient problem and optimize sample scarcity: 1D-WGAN effectively solves the vanishing gradient problem of traditional GAN ​​by introducing Wasserstein distance optimization to generate adversarial training. Its stable data generation capability enhances the load data of power grid users. In the scenario where electricity theft data has sample scarcity, it generates time series data that conforms to the real distribution, making up for the lack of data in traditional manual inspections. At the same time, it reduces the model's sensitivity to hyperparameters and provides a reliable input basis for subsequent model predictions.

[0037] (2) Breaking through the limitations of a single model and improving model accuracy: The CNN-LSTM hybrid model captures the spatial correlation in the substation monitoring data through a convolutional neural network, and combines it with a long short-term memory network to mine the dynamic temporal dependency of the user load curve, breaking through the limitation of a single model that only focuses on local features or temporal segments. The deep feature extraction mechanism reduces the semantic understanding bias in user features.

[0038] (3) Strengthening scenario generalization capabilities and improving real-time response efficiency: Feature fusion technology integrates multi-source heterogeneous data to construct multi-level feature representations, alleviating the problem of feature loss in high-dimensional data. Through the decision cascade mechanism, the contribution of different features to electricity theft risk is dynamically weighted, significantly improving the generalization capabilities for complex scenarios such as mass electricity theft. The introduction of transfer learning further optimizes the model's adaptability to cross-regional and cross-business system data, ultimately achieving a double breakthrough in electricity theft risk warning accuracy and real-time response efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of the method of the present invention.

[0040] Figure 2 This is the flow chart of the CNN-LSTM algorithm.

[0041] Figure 3 This is a comparative experimental evaluation table of different data augmentation methods used in this application.

[0042] Figure 4 This is a comparative experimental evaluation table of multiple models with and without transfer learning.

[0043] Figure 5 It is an evaluation index table for comparing multiple models. DETAILED DESCRIPTION

[0044] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0045] like Figure 1As shown, the present invention proposes a method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model, which includes the following steps:

[0046] S1. Obtain power user load data, construct a trajectory matrix for the obtained power user load data, perform principal component decomposition using singular spectrum analysis, iteratively fill in long-term missing values, separate trend and periodic components, and then generate initial filling values ​​through cubic spline interpolation;

[0047] S2, detect outliers based on the sliding Z-score method, and perform linear interpolation correction on segments that exceed the normal distribution threshold for more than three consecutive cycles;

[0048] S3. We use user behavior features as time-aligned embedding vectors and design a cross-attention mechanism to calculate the cross-attention score between the load time series features and the behavior embedding vector. We then apply a smoothing constraint to the attention score matrix using a Gaussian kernel function to suppress high-frequency noise interference.

[0049] S4, nonlinearly superimposes the period-trend component of power user load data with the high-frequency characteristics of user behavior, and finally outputs a joint feature vector that integrates multi-dimensional information, and uses a Sigmoid gating unit to dynamically adjust the fusion weight;

[0050] S5. Build a 1D-WGAN framework, use a transposed convolutional network as the generator, use a dilated causal convolutional structure as the discriminator, pre-train the discriminator on normal load data until convergence, control the parameters and iteratively optimize the generator weights;

[0051] S6, through the Wasserstein distance loss combined with the gradient penalty term, to control the diversity of abnormal patterns in the generated data;

[0052] S7. Build a CNN-LSTM hybrid model. The CNN branch uses eight convolution kernels of different widths to extract multi-scale features. The LSTM layer introduces a fully connected enhanced gating mechanism to capture periodic mutations. The convolution kernel parameters of the first three CNN layers are adjusted, and the weights of the LSTM and fully connected layers are adjusted to achieve cross-domain migration.

[0053] S8. Extract the real load value collected by users in real time from the power grid database, call the predicted load data output by the CNN-LSTM dual-channel structure, calculate the dynamic residual and daily load fluctuation standard deviation, and use the adjustment factor to weight them to obtain the user's electricity theft risk value.

[0054] This paper introduces audio information as input for a new modality and fuses multi-source information through an improved cross-attention mechanism. It then leverages the interaction between multimodal features and the attention mechanism to enrich feature representations, while also using shared parameters to reduce the number of model parameters. The cross-modal perception module consists of a linear layer, a multimodal feature fusion layer, and a feedforward network. The linear layer ensures dimensionality consistency, while the multimodal feature fusion layer includes a cross-attention layer, a feedforward layer, residual connections, and a multi-head attention layer to enhance interaction between different modalities and obtain richer feature representations.

[0055] In the cross-attention layer, two different modal features are used as the input of self-attention to fuse the semantic information between the two modalities, realize cross-modal information interaction, and output features with more discriminative ability. In , the visual features are used as key-value pairs K and V, while the audio features are used as query queues Q. In the audio feature is used as the key value, and the video feature is used as the query. In audio-visual data, since it is necessary to align the audio and visual features, cross attention is used to calculate the fusion weight between the two modalities. and audio characteristics One of them is used as the query set, and the other is the key value set. The output is For each vector, calculate its attention weight for all row vectors and adopt a shared parameter strategy to reduce the amount of calculation. The specific calculation is as follows:

[0056]

[0057] Finally, through addition and regularization operations, the fusion of multimodal feature information and cross-modal information interaction are achieved, which improves the cross-modal information perception ability and the recognition accuracy of the model.

[0058] Considering that the original electricity consumption data samples are extremely unbalanced, that is, the ratio of normal electricity consumption data to abnormal electricity consumption data is very different, if the original data is directly brought into the detection model, a large amount of normal electricity consumption data will dilute the abnormal electricity consumption features, thereby making the model detection effect worse. To this end, this application uses 1D-WGAN to generate abnormal electricity consumption data, thereby enhancing sample diversity. Considering that the measured electricity consumption data of power customers is one-dimensional time series data. Based on Waserstein distance, similarity constraints and true constraints, 1D-WGAN learns the objective laws of measurement data from a small amount of sample data, thereby generating high-precision measurement data that conforms to abnormal electricity consumption characteristics.

[0059] Considering that using Waserstein distance can alleviate the problem of vanishing gradients during training, this patent selects the minimum Waserstein distance as the target for training 1D-WGAN. Wasserstein distance can be described as:

[0060]

[0061] To make the generated data more authentic and trustworthy, the loss function needs to comply with both authenticity and similarity constraints. The authenticity constraint ensures that the generated data is as close to the distribution of real data as possible. Therefore, the authenticity loss formula can be described as:

[0062]

[0063] At the same time, the similarity loss Ls is used to constrain the generated data to meet the similarity requirements with the real data:

[0064]

[0065] The objective formula to be optimized during 1D-WGAN training can be described as:

[0066]

[0067] like Figure 2 As shown, to accurately detect electricity theft, the present invention uses a CNN to extract non-periodic features from electricity usage data and an LSTM to extract periodic features. A feature fusion layer is then constructed, horizontally concatenating the feature vectors extracted by the two networks to generate a new fused vector. This fused vector contains both non-periodic local features and periodic time series features, thereby enhancing the sensitivity of electricity theft features. Finally, a softmax activation function is used to generate probabilistic outputs for different types of electricity theft. The model then predicts the user category based on the probabilities, enabling electricity theft detection. This results in a CNN-LSTM hybrid model. The input user electricity usage data is converted into one-dimensional and two-dimensional time series, respectively, with the two-dimensional series having a daily period. A CNN is used to extract local features from the one-dimensional user electricity usage data, generating n feature vectors. Global pooling is then performed to obtain a single feature vector. Finally, an LSTM is used to extract the time series features from the two-dimensional user electricity usage data, generating a single feature vector. The two different feature vectors are then horizontally concatenated to generate a single feature vector containing both non-periodic local features and periodic time series features, known as the fused feature vector. The fused features are input into the fully connected layer, and the softmax activation function is used to obtain the probability output of each user type. The category with the highest probability is the user type predicted by the model, thereby realizing the detection of electricity theft.

[0068] The following three examples illustrate the implementation of the present invention.

[0069] Example 1: A comparative experiment was conducted on the electricity theft detection method based on feature fusion and CNN-LSTM hybrid model using different data enhancement methods. The results were evaluated through precision, F1 score and recall rate data. Figure 3 shown.

[0070] Experiments using feature fusion and a CNN-LSTM hybrid model compared the impact of different data augmentation methods on electricity theft detection performance. Due to the severe class imbalance in power grid data, the baseline model achieved a high precision of 0.79 but a recall of only 0.40, indicating overreliance on the majority class and significant underdetection of electricity theft. SMOTE, which generates minority class samples through interpolation, significantly improves recall to 0.70 and F1 score to 0.72, but precision drops to 0.75, reflecting the potential introduction of noise in generated samples. GANs, using a generative adversarial network approach, generates samples closer to real-world samples, achieving a good balance between recall and precision, and improving F1 score. High-quality generated samples are more adaptable to complex time series features. 1D-WGAN, combined with an improved Wasserstein distance optimization, achieves greater stability on one-dimensional electricity load data, achieving significantly higher precision and recall than other models, with an F1 score of 0.79. This demonstrates its synergy with the CNN-LSTM time series modeling capabilities, capturing the dynamic patterns of electricity theft while reducing noise interference. Experiments show that when using the method proposed in this patent, compared with the baseline model, the accuracy of the 1D-WGAN method is improved by 13%, the F1 score is improved by 44%, and the recall rate is improved by 95%. The adversarial generation method is obviously superior in power grid theft detection, providing a data enhancement foundation for subsequent deep learning model training.

[0071] Example 2: In the electricity theft detection method based on feature fusion and CNN-LSTM hybrid model proposed in this invention, in order to determine the impact of transfer learning on model training, a comparative experiment with and without transfer learning was conducted on multiple models. The results were evaluated using precision, F1 score, and recall rate data. Figure 4 shown.

[0072] Results show that transfer learning significantly improves model performance and efficiency in the field of power theft detection. After transfer learning, the CNN model's precision increased from 0.75 to 0.82, a 9.3% improvement, and its runtime decreased from 126 seconds to 85 seconds, a 32.5% reduction. The LSTM model's recall increased by 25%, and its F1 score increased by 16.9%. The Transformer model's F1 score improved by 19.0% after transfer learning, but its runtime remained the longest at 396 seconds. The CNN-LSTM model achieved the best overall performance. Its F1 score was higher than that of other models without transfer learning, and after transfer learning, it was further optimized to 0.79, an 8.2% improvement. Its recall increased by 11.4%, and its runtime was significantly lower than that without transfer learning, decreasing by 45.2%.

[0073] The F1 score of the CNN-LSTM model after transfer learning surpasses that of the LSTM, Transformer, and CNN models, demonstrating its advantage in integrating spatiotemporal features. Although CNN is slightly higher in precision than the CNN-LSTM model, its recall rate and overall F1 score are significantly lower than those of the CNN-LSTM model, indicating that the CNN-LSTM model has stronger performance as a balanced model in electricity theft detection.

[0074] Example 3: An experiment was conducted to compare the evaluation indicators MAE, MSE, RMAE, and RMSE of multiple models. The results are shown in Table 3. The CNN-LSTM model performed best in terms of error indicators. MAE was reduced by 40.0% compared with the CNN model and by 16.7% compared with the LSTM model, indicating that the spatiotemporal feature fusion mechanism effectively suppressed local noise and enhanced the ability to model long-term patterns. The MAE and RMSE of the LSTM model were reduced by 28.0% and 25.0% respectively compared with the CNN model, but the RMSE was higher than that of the CNN-LSTM, proving that a single time series model still has limitations. The Transformer model is between the CNN model and the LSTM model, reflecting its sensitivity to outliers in small sample data. The CNN model lacks time series modeling capabilities, and its error indicators are the highest, such as Figure 5 shown.

[0075] By integrating spatiotemporal features, the CNN-LSTM model reduces MAE and RMSE by 16.7% and 16.7% respectively compared with the second-best model LSTM, demonstrating the advantages of the hybrid architecture in complex time series anomaly detection.

[0076] The above description is merely a preferred embodiment of the present invention and does not constitute any other form of limitation to the present invention. Any modification or equivalent variation based on the technical essence of the present invention shall still fall within the scope of protection claimed by the present invention.

Claims

1. The electricity theft detection method based on feature fusion and CNN-LSTM hybrid model is characterized by: The steps include: S1. Obtain power user load data, construct a trajectory matrix for the obtained power user load data, perform principal component decomposition using singular spectrum analysis, iteratively fill in long-term missing values, separate trend and periodic components, and then generate initial filling values ​​through cubic spline interpolation; S2, detect outliers based on the sliding Z-score method, and perform linear interpolation correction on segments that exceed the normal distribution threshold for more than three consecutive cycles; S3. We use user behavior features as time-aligned embedding vectors and design a cross-attention mechanism to calculate the cross-attention score between the load time series features and the behavior embedding vector. We then apply a smoothing constraint to the attention score matrix using a Gaussian kernel function to suppress high-frequency noise interference. S4, nonlinearly superimposes the period-trend component of power user load data with the high-frequency characteristics of user behavior, and finally outputs a joint feature vector that integrates multi-dimensional information, and uses a Sigmoid gating unit to dynamically adjust the fusion weight; S5. Build a 1D-WGAN framework, use a transposed convolutional network as the generator, use a dilated causal convolutional structure as the discriminator, pre-train the discriminator on normal load data until convergence, control the parameters and iteratively optimize the generator weights; S6, through the Wasserstein distance loss combined with the gradient penalty term, to control the diversity of abnormal patterns in the generated data; S7. Build a CNN-LSTM hybrid model. The CNN branch uses eight convolution kernels of different widths to extract multi-scale features. The LSTM layer introduces a fully connected enhanced gating mechanism to capture periodic mutations. The convolution kernel parameters of the first three CNN layers are adjusted, and the weights of the LSTM and fully connected layers are adjusted to achieve cross-domain migration. S8. Extract the real load value collected by users in real time from the power grid database, call the predicted load data output by the CNN-LSTM hybrid model, calculate the dynamic residual and daily load fluctuation standard deviation, and use the adjustment factor to weight them to obtain the user's electricity theft risk value.

2. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S2, The load data after the normal distribution outlier test was used to screen out outliers and optimize the data to make its dimension consistent.

3. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S3, The power load sequence is mapped to a shared embedding space aligned with the user behavior habit characteristics. A cross-attention mechanism is adopted to dynamically calculate the association weights between load timing features and user behavior features through a multi-head fine-grained joint attention layer. A Gaussian smoothing constraint is imposed on the attention score matrix to suppress noise interference.

4. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S5, A training set is constructed based on normal power load data. After standardized preprocessing and sliding window segmentation into continuous one-dimensional sequences, an adversarial generation framework is constructed. The generator uses a one-dimensional transposed convolutional network to receive random noise input and output a synthetic sequence with abnormal characteristics. The discriminator uses a one-dimensional convolutional network to distinguish between real abnormal data and generated data, and introduces the Wasserstein distance loss function and gradient penalty mechanism to optimize training stability. In the adversarial training stage, the generator and discriminator parameters are alternately optimized to enable the generator to gradually learn the temporal distribution law of real abnormal data. The generator that has converged in training is used to batch output synthetic data that conforms to the statistical characteristics of the abnormality.

5. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S6, Find the maximum and minimum values ​​in the original data set as the benchmark values ​​for the linear transformation. Based on the upper and lower limits of the target interval, remap the value of each data point to the new interval through linear scaling calculation to ensure that the relative distance of all data remains unchanged. Subtract the minimum value from the original data, and then eliminate the dimensional difference through scaling. Finally, compress the data losslessly to a uniform scale to achieve comparability between different features.

6. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S7, Feature extraction is performed through a one-dimensional convolutional neural network. The convolution kernel slides along the time axis. The spatial correlation within the local time window is captured through multiple cascaded convolutional layers and pooling layers to obtain short-term fluctuations and periodic trends in power consumption patterns.

7. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S7, The high-dimensional feature sequence output by CNN is reconstructed into a time step format and input into the long short-term memory network. LSTM dynamically adjusts the information flow through the forget gate, input gate, and output gate, learns the long-term dependencies in the feature sequence, and enhances the expression ability of complex temporal patterns by stacking multiple layers of LSTM units. The local feature vector extracted by CNN is gated and weighted with the temporal hidden state output by LSTM, and then mapped to the prediction space through the fully connected layer to generate the final result, retaining the spatial abstraction ability and strengthening the temporal dimension modeling.

8. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S7, A CNN-LSTM hybrid model is pre-trained on the power load dataset to extract the local spatiotemporal features and long-term dependencies of the load data, build feature abstraction capabilities, retain the underlying structure of the pre-trained model, replace and reinitialize the top fully connected layer to form a migration adaptation structure, adopt a layered fine-tuning strategy, freeze some CNN parameters to retain the general feature extraction capability, dynamically adjust the learning rate of the LSTM layer and the fully connected layer, use the target data to optimize the time series modeling details through back propagation, and narrow the data gap between the source domain and the target domain through domain adaptation technology, thereby improving the generalization performance of the model in the target user load scenario.

9. The method for detecting electricity theft based on feature fusion and CNN-LSTM hybrid model according to claim 1 is characterized in that: In step S8, Based on the predicted load data and the actual user load values ​​collected in real time, the deviation rate between the two is calculated through dynamic residual analysis, and a risk adjustment factor is generated in combination with the historical load fluctuation characteristics. The adjustment factor is applied to the predicted load curve, and the abnormal time period is weighted and amplified to highlight the load mutation area that exceeds the preset threshold. The sliding time window statistical method is used to accumulate the frequency and severity of load deviation events within a specified period.

Images