Power monitoring system anomaly detection method based on multi-model voting mechanism

Abstract

The invention discloses a power monitoring system anomaly detection method based on a multi-model voting mechanism, and the method mainly comprises the following steps: firstly, collecting network flow data and equipment behavior data in a power monitoring system, and converting the network flow data and the equipment behavior data into multi-dimensional feature vectors; secondly, multiple types of anomaly detection models are constructed, and each model independently judges the anomaly of the input data; performing fusion processing on judgment results of the models through a majority voting or weighted voting mechanism, and outputting a comprehensive anomaly judgment result; and finally, dynamically adjusting the weight and detection parameters of each model based on a feedback mechanism, outputting alarm information when a fusion result exceeds a set threshold value, and linking a system response module. The power monitoring system anomaly detection method provided by the invention for the first time has the advantages of high detection accuracy, low false alarm and missing report rate, dynamic adjustability, high adaptability, flexible deployment and the like, and is particularly suitable for industrial control network security protection scenes in key infrastructures.

Description

Technical Field

[0001] The present invention relates to the fields of computer artificial intelligence and industrial control system security, and in particular to an anomaly detection method for a power monitoring system based on multi-model fusion and voting mechanism. Background Art

[0002] Anomaly detection technology for power monitoring systems based on a multi-model voting mechanism has crucial applications in the fields of artificial intelligence and industrial control system security. With the accelerating progress of intelligentization and informatization in the power industry, power monitoring systems have become crucial infrastructure for ensuring the safe and efficient operation of power production, transmission, dispatching, and distribution. These systems typically encompass core components such as industrial control systems (ICS), distributed control systems (DCS), and human-machine interfaces (HMIs), and feature a high degree of automation, strong continuous operation, and strict real-time requirements. Furthermore, with the deep integration of industrial control networks and information technology, power monitoring systems are facing increasingly severe cybersecurity challenges.

[0003] Currently, the main threats facing power monitoring systems include virus propagation, worm attacks, denial of service (DoS), advanced persistent threats (APTs), and zero-day attacks. Attackers typically exploit improper system configuration, industrial control protocol vulnerabilities, and weak permission management to infiltrate the system, causing equipment loss of control, data tampering, operational disruptions, and even large-scale power outages. Given the critical importance of power systems to national energy security and social stability, improving their network security capabilities has become a critical issue that needs to be addressed. To address these challenges, researchers and industry have proposed a variety of network anomaly detection methods, primarily including the following: Rule-based detection methods: These methods rely on manually written rule libraries or feature signatures, offering high recognition rates for known attack patterns. However, they are unable to identify unknown attacks, suffer from delayed rule updates, high maintenance costs, and are easily bypassed. Machine learning-based detection methods: These methods build classification models trained on historical normal and abnormal data, capable of automatically identifying certain attack patterns. However, these methods often rely on large amounts of labeled data and suffer from poor generalization and decreased detection accuracy when faced with new attacks or environmental changes. Detection methods based on deep learning: In recent years, deep neural networks have been widely used in anomaly detection tasks, demonstrating strong feature extraction capabilities. However, their training process is complex, requiring large amounts of high-quality data. Furthermore, the models suffer from poor interpretability, making them unsuitable for direct deployment in critical infrastructure. Due to the complex operating environment of power monitoring systems, the diverse network data types, and the ever-changing attack vectors, a single model often fails to effectively identify the entire situation. Detection results from different models may conflict, and there is a lack of a unified fusion and decision-making mechanism. Furthermore, industrial control networks are characterized by low bandwidth, high real-time performance, and strong protocol specificity, placing stringent requirements on the latency and computational load of detection systems. Traditional methods that fail to achieve millisecond-level response times will impact detection timeliness and may even miss intervention windows, leading to significant security risks. Furthermore, noisy data and false alarms also severely impact the practical usability of detection systems.

[0004] In summary, the existing anomaly detection technology for power monitoring systems has defects such as insufficient real-time performance, poor adaptability, limited detection accuracy, and difficulty in dealing with complex multi-source data. There is an urgent need for a highly robust detection technology that can integrate multi-model judgment results, has adaptive adjustment capabilities, and is suitable for critical infrastructure, so as to improve the overall security protection capabilities of the power system. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism. The purpose of the present invention is achieved through the following technical solutions: A method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism, comprising the following steps: (1) Collect network traffic data and device behavior data in the power monitoring system and convert them into multidimensional feature vectors; (2) Construct various types of anomaly detection models, including machine learning models based on statistical features, deep learning models based on time series features, and anomaly recognition models based on rule bases. Each model independently determines the anomaly of the input data. (3) Through majority voting or weighted voting mechanism, the judgment results of each model are integrated and processed to output the comprehensive abnormality judgment result; (4) Based on the feedback mechanism, the weights and detection parameters of each model are dynamically adjusted to make the power monitoring system robust and adaptive in different network environments. When the fusion result exceeds the set threshold, an alarm message is output and the system response module is linked.

[0006] Furthermore, the step (1) includes the following sub-steps: (1.1) Collect multi-source data from the power monitoring system, including network traffic data, control instructions, log data, and equipment operating status data; and deploy deep packet inspection (DPI) probes, industrial protocol parsing modules, and edge acquisition terminals to capture and aggregate real-time data at network boundaries, master control nodes, and key equipment locations. (1.2) Clean and normalize the collected data, extract multi-dimensional features, and construct a unified feature vector representation.

[0007] Furthermore, the step (1.2) is specifically as follows: Outlier detection, packet loss completion, and data denoising algorithms are used to clean the raw data and remove invalid data and sensor noise. Subsequently, the minimum-maximum normalization method is used based on various feature dimensions to unify the numerical distribution to eliminate dimensional effects. In the feature construction phase, statistical feature extraction, time series feature extraction, and protocol field parsing methods are used to deeply model communication behavior and device response behavior. Finally, a structured multidimensional feature vector matrix that meets the model input requirements is formed to drive subsequent model learning and anomaly determination. The mathematical expression of the data input process is as follows: Assume that the network traffic data and equipment behavior data of the power monitoring system can be represented by a multidimensional feature vector express: ;in, is the feature dimension, each feature May include traffic statistics characteristics, protocol characteristics, time series behavior characteristics; given time window , the input dataset is represented as: ;in is the number of sampling points.

[0008] Furthermore, the step (2) includes the following sub-steps: (2.1) First, based on the characteristic distribution and attack patterns of the power monitoring system, three types of anomaly detection models were designed to achieve coverage and complementary identification of different types of threats. Each model was then trained and validated using historical datasets. Cross-validation was used to evaluate model performance. The model structure was optimized by adjusting hyperparameters and loss functions to ensure its generalization and robustness on unknown data. (2.2) Deploy the various detection models trained in step (2.1) into the system and perform independent anomaly analysis on the real-time input feature vectors; each model outputs anomaly confidence or binary judgment results based on its own characteristics, providing a basis for subsequent fusion decision-making.

[0009] Specifically, the three types of anomaly detection models in step (2.1) include a machine learning model based on statistical features, a deep learning model based on time series features, and an anomaly recognition model based on a rule base; the machine learning model based on statistical features includes random forests, support vector machines, and gradient boosting decision trees, which are used to process structured feature data and identify abnormal patterns that deviate from normal statistical behaviors; the deep learning model based on time series features is targeted at the timing dependencies and contextual characteristics in the power system communication process, including deep learning models based on recurrent neural networks, long short-term memory networks, or gated recurrent units, which are used to identify complex behavioral evolution processes; the anomaly recognition model based on a rule base, that is, a rule detection model based on security expert experience and industrial protocol specifications, locates known attacks by combining a whitelist mechanism, state automaton matching, and field range limitation.

[0010] Specifically, in step (2.2), the real-time input feature vector is subjected to independent anomaly analysis, and each model outputs anomaly confidence or binary judgment results according to its own characteristics; specifically, the multi-class anomaly detection model that has been trained and verified is deployed in the detection module of the power monitoring system to form a multi-model parallel analysis architecture. The system is assumed to include Different types of detection models, each model is denoted as ,in , the input is the data feature vector to be detected ; The model output is the corresponding anomaly confidence , which is used to quantify the possibility that the current input sample is judged as abnormal; in the actual judgment process, each model According to your own set threshold Output of its confidence Perform binarization processing to form discrete judgment results : ; Finally, the binary judgment results of each sub-model form a length of Vector , as the intermediate decision layer result of the system's multi-model output; the decision vector will be used as the input of the majority voting or weighted voting mechanism in the subsequent fusion module to support higher-level comprehensive anomaly judgment and strategic response decision-making.

[0011] Furthermore, the step (3) includes the following sub-steps: (3.1) The system collects the anomaly detection results output by each sub-model in real time, including probability scores, label judgments, or rule matching results. To ensure the comparability of the outputs of each model, the results are converted to a unified format and normalized to form a standardized anomaly score vector. The anomaly score vector is represented as: ; (3.2) Based on the set voting mechanism, the standardized model results are fused and decided; the fusion decision is to use the preset voting mechanism to perform fusion calculation on the standardized anomaly score vector or the binary judgment result vector; and output the final unified anomaly judgment result. , serving as the triggering basis for subsequent alarms or response controls.

[0012] Furthermore, the preset voting mechanism in step (3.2) includes a majority voting or weighted voting mechanism, specifically: (a) Majority Voting: When using the majority voting strategy, the system performs statistical aggregation based on the binary judgment results of each model; if Among the models, more than half of them judge that the current input If it is abnormal, the system outputs the final judgment , otherwise it is 0; its fusion logic is expressed by the following formula: ; (b) Weighted Voting Mechanism: For each sub-model Assign a non-negative weight , the weights reflect the indicators of the model, namely historical detection accuracy, current environment adaptability, and training confidence; meet the normalization conditions ; The system is based on the normalized confidence scores of all models Calculate the comprehensive judgment score , the formula is as follows: ; The system will The abnormality judgment threshold set globally After comparison, the final judgment result is: ; After the fusion judgment mechanism is completed, the system generates a unified binary abnormality mark , and serves as the basis for subsequent alarm triggering logic and security response strategy, entering the dynamic feedback and disposal stage.

[0013] Furthermore, the step (4) includes the following sub-steps: (4.1) The system has designed a feedback-driven parameter self-optimization mechanism. This mechanism continuously collects deviation data between model voting output and manual label confirmation, dynamically scores the performance of each model through online performance evaluation indicators, and updates its weight parameters in the weighted voting mechanism accordingly. At the same time, the system will adaptively adjust the global anomaly judgment threshold during the fusion process. That is, it uses sliding window statistics and exponentially weighted moving average methods to evaluate recent detection quality, and combines Bayesian optimization or genetic algorithms to automatically adjust model parameters and judgment thresholds. (4.2) After completing the fusion judgment and outputting the unified abnormality judgment result, the system compares the result with the set global alarm triggering rules; when the result exceeds the preset global abnormality judgment threshold, the system automatically triggers the alarm mechanism, outputs abnormality information, and links the external security response module, thereby achieving rapid isolation and intervention control of abnormal events.

[0014] The present invention also discloses an abnormality detection system for a power monitoring system based on a multi-model voting mechanism, which specifically includes the following units: Data acquisition and preprocessing unit: collects network traffic data and equipment behavior data in the power monitoring system and converts them into multi-dimensional feature vectors; Constructing sub-model pool units: Build various types of anomaly detection models, including machine learning models based on statistical features, deep learning models based on time series features, and anomaly recognition models based on rule bases. Each model independently determines the anomaly of the input data. Multi-model voting judgment unit: Through majority voting or weighted voting mechanism, it integrates the judgment results of each model and outputs the comprehensive abnormality judgment result; Feedback optimization and alarm unit: Based on the feedback mechanism, the weights and detection parameters of each model are dynamically adjusted to make the power monitoring system robust and adaptive in different network environments. When the fusion result exceeds the set threshold, an alarm message is output and the system response module is linked.

[0015] The beneficial effects of the present invention are as follows: By integrating machine learning models, deep learning models, and rule-based detection models, the present invention can comprehensively analyze network traffic and device behavior in the power monitoring system from multiple dimensions, significantly improving the accuracy of anomaly detection. The adoption of majority voting and weighted voting mechanisms effectively alleviates the limitations of single model judgment and the problems of conflicting results between models. While improving detection accuracy, it significantly reduces the false alarm rate and missed alarm rate, thereby improving the reliability and practicality of the system. In addition, the present invention also introduces a feedback mechanism to dynamically optimize the model weights and parameters, and can adaptively adjust the detection strategy according to the actual detection effect and changes in the network environment, thereby enhancing the robustness and adaptability of the system in the face of new attacks and complex operating environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0017] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0018] The purpose of this invention is to provide a method for detecting abnormalities in a power monitoring system based on a multi-model voting mechanism in order to address the deficiencies of the existing technology. Figure 1 As shown, the following steps are included: (1) Data acquisition and preprocessing: Collect network traffic data and equipment behavior data from the power monitoring system and convert them into multidimensional feature vectors; (2) Constructing a sub-model pool: Constructing various types of anomaly detection models, including machine learning models based on statistical features, deep learning models based on time series features, and anomaly recognition models based on rule bases. Each model independently determines the anomaly of the input data. (3) Multi-model voting judgment: Through majority voting or weighted voting mechanism, the judgment results of each model are integrated and processed to output the comprehensive abnormality judgment result; (4) Feedback optimization and alarm: Based on the feedback mechanism, the weights and detection parameters of each model are dynamically adjusted to improve the robustness and adaptability of the system in different network environments. When the fusion result exceeds the set threshold, an alarm message is output and the system response module is linked.

[0019] Furthermore, the step (1) includes the following sub-steps: (1.1) Collect multi-source data in the power monitoring system. The power monitoring system covers a wide variety of operating data, mainly including network traffic data in the industrial control network (such as Modbus TCP, DNP3 and other protocol messages), control command data (such as remote control and remote adjustment operation commands), system log data (such as SCADA logs, HMI operation logs, event logs) and equipment operating status data (such as switch status, analog readings, power, voltage, current and other measurement point information). By deploying Deep Packet Inspection (DPI) probes, industrial protocol parsing modules and edge acquisition terminals, real-time data capture and aggregation are completed at the network boundary, master control nodes and key equipment locations, and the acquisition process is ensured to have low latency, high coverage and protocol compatibility. The acquisition system should support time synchronization mechanisms (such as NTP or PTP) to ensure the time consistency of data sources in multi-dimensional correlation analysis; (1.2) Preprocessing the collected raw data is a key step to improve the model recognition capability and detection stability. First, the raw data is cleaned using outlier detection, packet loss completion, and data denoising algorithms to remove invalid data and sensor noise. Subsequently, the Min-Max Normalization method is used based on various feature dimensions to unify the numerical distribution to eliminate the dimensional effect. In the feature construction phase, a combination of statistical feature extraction (such as inter-packet delay, traffic volatility, port activity), timing feature extraction (such as sliding window sequence, frequency domain features), and protocol field parsing (such as function code, address field, data length field) is used to deeply model communication behavior and device response behavior. Ultimately, a structured multi-dimensional feature vector matrix that meets the model input requirements is formed to drive subsequent model learning and anomaly determination processes. The data input process is mathematically represented as follows: Assume that the network traffic data and equipment behavior data of the power monitoring system can be represented by a multidimensional feature vector express: ;in, is the feature dimension, each feature It may include traffic statistics characteristics, protocol characteristics, time series behavior characteristics, etc. Given a time window , the input data set can be expressed as: ;in is the number of sampling points.

[0020] Furthermore, the step (2) includes the following sub-steps: (2.1) Based on the characteristic distribution patterns of multi-source data and common attack behaviors in the power monitoring system, three representative anomaly detection models are constructed to achieve coverage and complementary identification of different types of threats. First, machine learning models such as random forests, support vector machines (SVMs), and gradient boosted decision trees (GBDTs) are constructed based on statistical features to process structured feature data and identify abnormal patterns that deviate from normal statistical behavior. Second, based on the temporal dependencies and contextual characteristics of power system communication processes, deep learning models based on recurrent neural networks (RNNs), long short-term memory networks (LSTMs), or gated recurrent units (GRUs) are constructed to improve the ability to identify complex behavioral evolution processes. Finally, a rule-based detection model based on the experience of security experts and industrial protocol specifications is designed, combining whitelist mechanisms, state automaton matching, field range restrictions, and other methods to quickly locate known attacks. Each model is trained on labeled historical datasets, and cross-validation is used to evaluate model performance. The model structure is optimized by adjusting hyperparameters (such as learning rate, tree depth, number of neural layers, window size, etc.) and loss function design to ensure its generalization ability and robustness on unknown data. (2.2) In this step, the multi-class anomaly detection model that has been trained and verified is deployed in the detection module of the power monitoring system to form a multi-model parallel analysis architecture. Different types of detection models, each model is denoted as ,in , the input is the data feature vector to be detected The model output is the corresponding anomaly confidence , which is used to quantify the probability that the current input sample is judged as abnormal. For example, a machine learning-based model can output scores in the form of logistic regression probability, decision boundary distance, etc., a deep learning model can output the confidence of the corresponding abnormal class of the Softmax layer, and a rule-based model can convert it into an equivalent probability representation based on the rule matching strength. These confidence values ​​are uniformly mapped to interval to achieve comparability of results across models and consistency of fusion basis.

[0021] In the actual judgment process, each model You can set your own threshold Output of its confidence Perform binarization processing to form discrete judgment results .

[0022] Finally, the binary judgment results of each sub-model form a Vector , serving as the intermediate decision layer output from the system's multiple models. This decision vector is used as input for majority voting or weighted voting mechanisms in subsequent fusion modules to support higher-level comprehensive anomaly assessment and strategic response decisions. This structure offers excellent scalability and compatibility with heterogeneous models, supporting the dynamic integration and tailoring of new models while meeting the dual requirements of real-time performance and high accuracy in industrial scenarios.

[0023] Furthermore, the step (3) includes the following sub-steps: (3.1) The system collects the anomaly detection results output by each sub-model in real time, including probability scores, label judgments or rule matching results. After the independent anomaly analysis, the system enters the unified result aggregation and standardization processing stage to provide consistent input for subsequent fusion judgment. The system collects the detection outputs from all sub-models in real time, including continuous anomaly confidence scores (such as ), discrete binary label judgment (such as ), as well as the rule matching results or matching strength indicators given by the rule model (such as the number of hit rules, rule priority score, etc.).

[0024] To solve the above-mentioned heterogeneous output problem, the system has designed a unified format conversion and normalization module. First, the discrete values ​​(such as "hit / miss") output by the rule model are probabilistically mapped and converted into a probability regression model through the rule confidence mapping table. For the output results of deep learning and machine learning models, linear scaling or Min-Max normalization is used to make the outputs of different models meet the uniform distribution assumption. Adjust to generate a standardized confidence score , in order to facilitate the weight application and voting threshold design in the subsequent weighted fusion strategy.

[0025] Finally, all normalized model outputs form a set of anomaly score vectors in a unified format, expressed as: ;

[0026] This scoring vector not only ensures the comparability of model outputs and the effectiveness of fusion, but also retains the detection confidence information of each model, providing high-quality input for the weighted judgment mechanism of the subsequent fusion module.

[0027] (3.2) After completing the standardization of all sub-model output results, the system enters the fusion decision stage of anomaly determination. This stage uses a preset voting mechanism to perform fusion calculations on the standardized anomaly score vector or binary determination result vector and outputs the final unified anomaly determination result. , serving as the triggering basis for subsequent alarms or response controls.

[0028] The system supports two main voting fusion strategies: (a) Majority Voting: When using the majority voting strategy, the system will perform statistical aggregation based on the binary judgment results of each model. Among the models, more than half of them judge that the current input If it is abnormal, the system outputs the final judgment , otherwise it is 0. Its fusion logic can be expressed by the following formula: ; (b) Weighted Voting: To further improve the judgment accuracy and synergy between models, this step supports weighted voting mechanism. Assign a non-negative weight The weight reflects the historical detection accuracy, current environment adaptability, training confidence and other indicators of the model, and meets the normalization conditions The system is based on the normalized confidence scores of all models Calculate the comprehensive judgment score , the formula is as follows: ; The system will The abnormality judgment threshold set globally After comparison, the final judgment result is: ; This method has high flexibility and robustness, and can dynamically adjust the contribution according to the model performance. It is particularly suitable for complex industrial control network scenarios with uneven performance of multiple models or frequent dynamic changes in the environment. After the fusion judgment mechanism is completed, the system generates a unified binary anomaly mark , and serves as the basis for subsequent alarm triggering logic and security response strategy, entering the dynamic feedback and disposal stage.

[0029] Furthermore, the step (4) includes the following sub-steps: (4.1) To enhance the robustness and dynamic adaptability of the anomaly detection system in complex power monitoring network environments, a feedback-driven parameter self-optimization mechanism was designed. This mechanism continuously collects deviation data between model voting outputs and manual label confirmations, dynamically scores each model's performance using online performance evaluation metrics (such as accuracy, false positive rate, false negative rate, F1-score, etc.), and updates its weight parameters in the weighted voting mechanism accordingly. Simultaneously, the system adaptively adjusts the global anomaly judgment threshold during the fusion process to ensure that judgment accuracy is maintained despite environmental changes, updated attack methods, or data distribution shifts (such as concept drift). Specifically, this method uses sliding window statistics and exponentially weighted moving average methods to evaluate recent detection quality, and combines Bayesian optimization or genetic algorithms to automatically adjust model parameters and judgment thresholds.

[0030] (4,2) After completing the fusion judgment and outputting the unified abnormal judgment result, the system compares the result with the set global alarm trigger rules. When the judgment result is abnormal, the system will immediately enter the alarm response process and trigger the built-in security incident response mechanism. The system can generate structured abnormal event objects based on the alarm level, detection confidence, device location and context information, and output them to the alarm center, SCADA platform or third-party security information and event management system (SIEM). In addition, the system supports linkage control with external security devices such as firewalls, intrusion prevention systems (IDS), and border control gateways to achieve operations such as isolating abnormal communication traffic, switching devices to safe mode, blocking suspicious IP addresses, and blocking command transmission channels, thereby quickly blocking the attack chain at the early stage of the threat outbreak.

[0031] The present invention also provides a power monitoring system anomaly detection system based on a multi-model voting mechanism, which specifically includes the following units: Data acquisition and preprocessing unit: collects network traffic data and equipment behavior data in the power monitoring system and converts them into multi-dimensional feature vectors; Constructing sub-model pool units: Build various types of anomaly detection models, including machine learning models based on statistical features, deep learning models based on time series features, and anomaly recognition models based on rule bases. Each model independently determines the anomaly of the input data. Multi-model voting judgment unit: Through majority voting or weighted voting mechanism, it integrates the judgment results of each model and outputs the comprehensive abnormality judgment result; Feedback optimization and alarm unit: Based on the feedback mechanism, the weights and detection parameters of each model are dynamically adjusted to make the power monitoring system robust and adaptive in different network environments. When the fusion result exceeds the set threshold, an alarm message is output and the system response module is linked.

[0032] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0033] The above embodiments are intended only to illustrate the design concepts and features of the present invention. Their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The scope of protection of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design concepts disclosed in the present invention are within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism, characterized in that: The steps include: (1) Collect network traffic data and device behavior data in the power monitoring system and convert them into multidimensional feature vectors; (2) Construct various types of anomaly detection models, including machine learning models based on statistical features, deep learning models based on time series features, and anomaly recognition models based on rule bases. Each model independently determines the anomaly of the input data. (3) Through majority voting or weighted voting mechanism, the judgment results of each model are integrated and processed to output the comprehensive abnormality judgment result; (4) Based on the feedback mechanism, the weights and detection parameters of each model are dynamically adjusted to make the power monitoring system robust and adaptive in different network environments. When the fusion result exceeds the set threshold, an alarm message is output and the system response module is linked.

2. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 1, characterized in that: The step (1) includes the following sub-steps: (1.1) Collect multi-source data from the power monitoring system, including network traffic data, control instructions, log data, and equipment operating status data; and deploy deep packet inspection (DPI) probes, industrial protocol parsing modules, and edge acquisition terminals to capture and aggregate real-time data at network boundaries, master control nodes, and key equipment locations; (1.2) Clean and normalize the collected data, extract multi-dimensional features, and construct a unified feature vector representation.

3. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 2, characterized in that: The step (1.2) specifically comprises: using outlier detection, packet loss completion, and data denoising algorithms to clean the raw data and remove invalid data and sensor noise; then, using a minimum-maximum normalization method based on various feature dimensions to unify the numerical distribution to eliminate dimensional effects; In the feature construction phase, we use statistical feature extraction, time series feature extraction, and protocol field parsing methods to deeply model communication behavior and device response behavior. Ultimately, we form a structured multi-dimensional feature vector matrix that meets the model input requirements and is used to drive subsequent model learning and anomaly determination. The mathematical expression of the data input process is as follows: Assume that the network traffic data and equipment behavior data of the power monitoring system can be represented by a multidimensional feature vector express: ;in, is the feature dimension, each feature May include traffic statistics characteristics, protocol characteristics, and time series behavior characteristics; Given a time window , the input dataset is represented as: ;in is the number of sampling points.

4. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 1, characterized in that: The step (2) includes the following sub-steps: (2.1) First, based on the characteristic distribution and attack patterns of the power monitoring system, three types of anomaly detection models were designed to achieve coverage and complementary identification of different types of threats. Each model was then trained and validated using historical datasets. Cross-validation was used to evaluate model performance. The model structure was optimized by adjusting hyperparameters and loss functions to ensure its generalization and robustness on unknown data. (2.2) Deploy the various detection models trained in step (2.1) into the system and perform independent anomaly analysis on the real-time input feature vectors; each model outputs anomaly confidence or binary judgment results based on its own characteristics, providing a basis for subsequent fusion decision-making.

5. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 4 is characterized in that: The three types of anomaly detection models in the step (2.1) include a machine learning model based on statistical features, a deep learning model based on time series features, and an anomaly recognition model based on a rule base; the machine learning model based on statistical features includes random forests, support vector machines, and gradient boosting decision trees, which are used to process structured feature data and identify abnormal patterns that deviate from normal statistical behaviors; the deep learning model based on time series features is targeted at the timing dependencies and contextual characteristics in the power system communication process, including deep learning models based on recurrent neural networks, long short-term memory networks, or gated recurrent units, which are used to identify complex behavioral evolution processes; the anomaly recognition model based on a rule base, that is, a rule detection model based on security expert experience and industrial protocol specifications, locates known attacks by combining a whitelist mechanism, state automaton matching, and field range limitation.

6. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 4, characterized in that: In the step (2.2), an independent anomaly analysis is performed on the feature vector input in real time, and each model outputs an anomaly confidence or a binary judgment result according to its own characteristics; specifically, in the step (2.2), an independent anomaly analysis is performed on the feature vector input in real time, and each model outputs an anomaly confidence or a binary judgment result according to its own characteristics; specifically, multiple types of anomaly detection models that have been trained and verified are deployed in the detection module of the power monitoring system to form a multi-model parallel analysis architecture, and the system is assumed to include Different types of detection models, each model is denoted as ,in , the input is the data feature vector to be detected ; The model output is the corresponding anomaly confidence , used to quantify the possibility that the current input sample is judged as abnormal; In the actual judgment process, each model According to your own set threshold Output of its confidence Perform binarization processing to form discrete judgment results : ; Finally, the binary judgment results of each sub-model form a length of Vector , as the intermediate decision layer result of the system's multi-model output; the decision vector will be used as the input of the majority voting or weighted voting mechanism in the subsequent fusion module to support higher-level comprehensive anomaly judgment and strategic response decision-making.

7. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 1, characterized in that: The step (3) includes the following sub-steps: (3.1) The system collects the anomaly detection results output by each sub-model in real time, including probability scores, label judgments, or rule matching results. To ensure the comparability of the outputs of each model, the results are converted to a unified format and normalized to form a standardized anomaly score vector. The anomaly score vector is represented as: ； (3.2) Based on the set voting mechanism, the standardized model results are fused and decided; the fusion decision is to use the preset voting mechanism to perform fusion calculation on the standardized anomaly score vector or the binary judgment result vector; and output the final unified anomaly judgment result. , serving as the triggering basis for subsequent alarms or response controls.

8. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 7, characterized in that: The preset voting mechanism in step (3.2) includes a majority voting or a weighted voting mechanism, specifically: (a) Majority Voting: When using the majority voting strategy, the system performs statistical aggregation based on the binary judgment results of each model; if Among the models, more than half of them judge that the current input If it is abnormal, the system outputs the final judgment , otherwise 0; Its fusion logic is expressed by the following formula: ; (b) Weighted Voting Mechanism: For each sub-model Assign a non-negative weight , the weights reflect the indicators of the model, namely historical detection accuracy, current environment adaptability, and training confidence; meet the normalization conditions ; The system is based on the normalized confidence scores of all models Calculate the comprehensive judgment score , the formula is as follows: ； The system will The abnormality judgment threshold set globally After comparison, the final judgment result is: ; After the fusion judgment mechanism is completed, the system generates a unified binary abnormality mark , and serves as the basis for subsequent alarm triggering logic and security response strategy, entering the dynamic feedback and disposal stage.

9. The method for detecting anomalies in a power monitoring system based on a multi-model voting mechanism according to claim 1, characterized in that: The step (4) includes the following sub-steps: (4.1) The system has designed a feedback-driven parameter self-optimization mechanism. This mechanism continuously collects deviation data between model voting output and manual label confirmation, dynamically scores the performance of each model through online performance evaluation indicators, and updates its weight parameters in the weighted voting mechanism accordingly. At the same time, the system will adaptively adjust the global anomaly judgment threshold during the fusion process. That is, it uses sliding window statistics and exponentially weighted moving average methods to evaluate recent detection quality, and combines Bayesian optimization or genetic algorithms to automatically adjust model parameters and judgment thresholds. (4.2) After completing the fusion judgment and outputting the unified abnormality judgment result, the system compares the result with the set global alarm triggering rules; when the result exceeds the preset global abnormality judgment threshold, the system automatically triggers the alarm mechanism, outputs abnormality information, and links the external security response module, thereby achieving rapid isolation and intervention control of abnormal events.

10. An abnormality detection system for power monitoring system based on multi-model voting mechanism, characterized in that: The system specifically includes the following units: Data acquisition and preprocessing unit: collects network traffic data and equipment behavior data in the power monitoring system and converts them into multi-dimensional feature vectors; Constructing sub-model pool units: Build various types of anomaly detection models, including machine learning models based on statistical features, deep learning models based on time series features, and anomaly recognition models based on rule bases. Each model independently determines the anomaly of the input data. Multi-model voting judgment unit: Through majority voting or weighted voting mechanism, it integrates the judgment results of each model and outputs the comprehensive abnormality judgment result; Feedback optimization and alarm unit: Based on the feedback mechanism, the weights and detection parameters of each model are dynamically adjusted to make the power monitoring system robust and adaptive in different network environments. When the fusion result exceeds the set threshold, an alarm message is output and the system response module is linked.

Images