Power system network abnormal data clustering vulnerability detection technology based on FCM algorithm

Abstract

The invention discloses a power system network abnormal data clustering vulnerability detection technology, and belongs to the field of power system network security. Aiming at the problems of insufficient high-dimensional data processing capability, poor dynamic adaptability, high false alarm rate and the like of a traditional anomaly detection method, a detection technology based on an improved FCM algorithm is provided. According to the technology, through a dynamic feature weight matrix design module, a time adaptive membership updating module, a physical constraint regularization module, an incremental density peak initialization module and the like, an intelligent clustering framework fusing spatial-temporal features and physical constraints is constructed. And extracting multi-dimensional features by using GCN and Transform, dynamically adjusting the weight in combination with an attention mechanism, and introducing a time decay factor and a fuzzy logic constraint to realize accurate clustering. Experiments show that when the technology is applied to a provincial power grid, the anomaly detection accuracy is improved to 94.3%, the decision generation time is shortened to 14.8 ms, the constraint violation rate is reduced to 2.1%, and the real-time performance and reliability of power grid safety protection are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of power system network security technology, specifically a power system network abnormal data clustering vulnerability detection technology based on an improved fuzzy C-means (FCM) algorithm, which is used to solve the problems of anomaly identification, dynamic vulnerability detection and real-time security protection of high-dimensional power data. Background Art

[0002] With the development of networked and intelligent power systems, network security issues are becoming increasingly prominent. There is a large amount of heterogeneous data (such as SCADA system data and smart meter data). Traditional anomaly detection methods based on rule bases or statistical analysis have the following limitations:

[0003] Insufficient high-dimensional data processing capabilities: Power data has high dimensions and complex nonlinear relationships, making it difficult to effectively extract features;

[0004] Poor dynamic adaptability: Network attack patterns evolve, and static rule bases cannot cover new vulnerabilities;

[0005] High false alarm rate: Sensitive to noisy data and normal fluctuations, leading to misjudgment.

[0006] The traditional FCM algorithm still has problems in power system applications, such as sensitive initialization of cluster centers and uneven weight distribution of high-dimensional features. There is an urgent need for an intelligent detection technology that integrates spatiotemporal features with physical constraints.

[0007] Full terms and abbreviations

[0008] FCM: Fuzzy C-Means Clustering

[0009] GCN: Graph Convolutional Network

[0010] ReLU: Rectified Linear Unit

[0011] MLP: Multi-Layer Perceptron

[0012] SCADA: Supervisory Control And Data Acquisition

[0013] VSM: Voltage Security Margin

[0014] TSM: Thermal Stability Margin Summary of the Invention

[0015] The present invention provides a power system network abnormal data clustering vulnerability detection method based on an improved fuzzy C-means (FCM) algorithm to solve the problems of insufficient high-dimensional heterogeneous data processing capabilities, poor dynamic adaptability, and high false alarm rates in the existing technology. By constructing a dynamic feature weight matrix, a time-adaptive membership update mechanism, a physical constraint regularization model, and an incremental density peak initialization strategy, intelligent clustering of power system network data is achieved through temporal and spatial feature fusion, dynamic weight optimization, and physical constraint perception. The anomaly detection accuracy rate is improved to 94.3%, the decision-making time is shortened to 14.8ms, and the constraint violation rate is reduced to 2.1%. At the same time, the dynamic response requirements of the real-time operation of the power grid are met, providing an efficient solution for power system security protection under high-proportion renewable energy access.

[0016] Technical Solution

[0017] In order to solve the problems mentioned in the background technology, the present invention proposes a power system network abnormal data clustering vulnerability detection technology based on the FCM algorithm. As an unsupervised learning method, the fuzzy C-means clustering (FCM) algorithm can describe the correlation between data points and cluster centers through fuzzy membership, and is suitable for processing the uncertainty and fuzziness of power data. However, the traditional FCM algorithm has the problems of sensitive initialization of cluster centers and uneven distribution of high-dimensional feature weights in power system applications. To this end, the present invention proposes an improved FCM algorithm, which combines dynamic feature weight optimization and adaptive threshold mechanism to achieve efficient clustering and vulnerability detection of abnormal data in power system networks. The specific implementation steps are as follows:

[0018] 1. Technical Framework

[0019] The power system intelligent security protection technology framework proposed in this invention (such as Figure 1 As shown in Figure 2, a modular design is used to implement multi-source data processing and anomaly detection. The framework includes the following core modules (based on existing technologies):

[0020] Data preprocessing module: Integrates multi-source power data (network traffic, equipment status), performs standardization and noise reduction;

[0021] Multi-dimensional feature fusion module: extracts temporal, spatial, and protocol features and constructs multi-dimensional feature vectors;

[0022] Cluster analysis module: Dynamically cluster feature vectors based on the improved FCM algorithm;

[0023] Vulnerability detection and assessment module: Generates anomaly scores based on clustering results and triggers graded alarms.

[0024] 2. Improve FCM algorithm design

[0025] 2.1 Dynamic feature weight matrix design

[0026] 2.1.1 Spatiotemporal Feature Fusion Representation

[0027] Feature extraction architecture:

[0028] Use the cascade structure of GCN (graph convolutional network) and Transformer to extract spatiotemporal features:

[0029] 1.GCN layer:

[0030]

[0031] in:

[0032] Add self-loops to the adjacency matrix;

[0033] for degree matrix of ;

[0034] H (l) is the feature matrix of the lth layer;

[0035] W (l) is the trainable weight matrix;

[0036] σ is the LeakyReLU activation function (slope 0.2).

[0037] 2. Transformer Encoder:

[0038] MultiHead(Q,K,V)=Concat(head1,…,head h )W o

[0039] in:

[0040]

[0041] Number of heads h = 8, dimension d k =64;

[0042] Position encoding uses sine-cosine functions:

[0043]

[0044] Space-time fusion means:

[0045] h k =Concat(GCN k (X), Transformer k (T))

[0046] in:

[0047] GCN k (X) is the spatial feature representation of node k (dimension 128);

[0048] Transformer k (T) is the temporal feature representation of node k (dimension 128).

[0049] 2.1.2 Attention Weight Calculation Network

[0050] MLP structure details:

[0051] MLP(h k )=W3·σ(W2·σ(W1·h k +b1)+b2)+b3

[0052] in:

[0053]

[0054] σ is the Swish activation function: Swish(x) = x·sigmoid(x);

[0055] Layer Normalization and Dropout (ratio 0.1) are used to prevent overfitting.

[0056] Weight normalization:

[0057]

[0058] Weight matrix Ω=[ω1,ω2,…,ω n ]satisfy

[0059] 2.1.3 Adaptive Weight Adjustment Mechanism

[0060] 1. Scene response function:

[0061] When the new energy output fluctuation rate σ is monitored pv Exceeding the threshold T σ When , the feature weight enhancement is triggered:

[0062]

[0063] in:

[0064] α is the enhancement coefficient (the optimal experimental value is 0.35);

[0065] Affected feature set

[0066] The weights after augmentation are renormalized:

[0067] 2. Dynamic update cycle:

[0068] Normal operation status: update the weight matrix every 5 minutes;

[0069] Abnormal state (such as σ pv >2T σ ): Shorten the update time to 30 seconds.

[0070] 2.1.4 Physical Constraint Embedding

[0071] Feature correlation matrix:

[0072]

[0073] in:

[0074] c ij represents the correlation between the i-th feature and the j-th physical constraint (obtained through expert knowledge and historical data training);

[0075] Constraint Set

[0076] Constraint-aware weight adjustment:

[0077]

[0078] in:

[0079] Margin j is the safety margin of constraint j (e.g. );

[0080] β j is the constraint importance coefficient (dynamically adjusted by the grid operation status).

[0081] 2.2 Time-adaptive membership update

[0082] 2.2.1 Theoretical Basis and Improvement Motivation

[0083] Traditional FCM membership function defects:

[0084] Traditional FCM membership formula:

[0085]

[0086] The following problems exist:

[0087] 1. Treating historical data and current data equally, ignoring the time-varying characteristics of the power system;

[0088] 2. Cluster center updates lag behind changes in grid operation status;

[0089] 3. Slow response to sudden abnormalities (such as short circuit faults).

[0090] Time decay theory is introduced:

[0091] Drawing on the forgetting curve theory (Ebbinghaus forgetting curve), a time factor correction model is proposed:

[0092] Memory(t)=e -γt

[0093] in:

[0094] γ is the forgetting factor, which controls the memory decay rate;

[0095] In power system applications, - reflects the dynamic characteristics of the power grid (such as inertia and regulation rate).

[0096] 2.2.2 Derivation of Time-Adaptive Membership Formula

[0097] Objective function expansion:

[0098]

[0099] in:

[0100] R(u) is a regularization term that ensures the properties of the membership matrix;

[0101] Δt i =tt i , t i is the collection time of sample i.

[0102] Lagrange multiplier method to solve:

[0103] Introducing constraints Construct the Lagrangian function:

[0104]

[0105] To u ij Find the partial derivative and set it to zero:

[0106]

[0107] The solution is:

[0108]

[0109] Combined constraints After normalization, we get:

[0110]

[0111] When assuming that the sample collection time interval is uniform, it simplifies to:

[0112]

[0113] 2.2.3 Time decay coefficient optimization

[0114] Adaptive gamma adjustment mechanism:

[0115]

[0116] in:

[0117] γ0 is the basic attenuation coefficient (default 0.05);

[0118] σ sys is the system state volatility (calculated through multi-dimensional features);

[0119] σ0 is the benchmark volatility (95% quantile of historical data);

[0120] α is the adjustment factor (the optimal value in the experiment is 0.2).

[0121] Physical meaning:

[0122] When the system is stable (σ sys <σ0), γ≈γ0, maintaining appropriate historical memory;

[0123] When the system is disturbed (σ sys >σ0), γ increases, accelerating the forgetting of historical data and improving response speed.

[0124] 2.2.4 Incremental Cluster Center Update

[0125] Time-weighted cluster center formula:

[0126]

[0127] Update strategy:

[0128] 1. Sliding window mechanism: only retain data within the most recent N time windows (the optimal N in the experiment is 20);

[0129] 2. Forgetting factor enhancement: For data outside the window, the membership is forced to 0;

[0130] 3. Incremental update formula:

[0131]

[0132] Where η is the learning rate (dynamic adjustment range 0.1 to 0.5).

[0133] 2.3 Physical Constraint Regularization

[0134] 2.3.1 Physical Constraint Modeling and Mathematical Expression

[0135] Formal definition of constraint set C:

[0136] 1. Voltage amplitude constraint:

[0137]

[0138] in is the per-unit value of the voltage amplitude at the cluster center, and the violation function is:

[0139]

[0140] (V nom is the rated voltage, take 1.0pu)

[0141] 2. Thermal stability constraints:

[0142]

[0143] in is the effective value of the line current at the cluster center, and the violation function is:

[0144]

[0145] 3. Power balance constraints:

[0146]

[0147] The violation function is approximated by the DC power flow:

[0148]

[0149] (P hase is the reference power, taking 100MW)

[0150] 2.3.2 Constraint Violation Calculation Process

[0151] Power flow calculation embedded:

[0152] 1. DC power flow equation:

[0153] ΔP=BΔθ

[0154] The admittance matrix B is calculated by the line parameters: (X ij is the line reactance)

[0155] 2. Rapid assessment of constraint violations:

[0156] Voltage constraint: Real-time voltage measurement and comparison with safety margin;

[0157] Thermal stability: calculate the ratio of line current to rated value;

[0158] Power balance: evaluated through DC power flow residuals.

[0159] Numerical stability optimization:

[0160] The sparse matrix technology is used to store the admittance matrix B, and the AMD sorting algorithm is used to reduce the amount of calculation;

[0161] When the power flow calculation residual ∈=||ΔP-BΔθ||2>0.01\pu, the secondary iterative correction is triggered.

[0162] 2.3.3 Dynamic Regularization Parameter λ Adjustment

[0163] Fuzzy logic control model:

[0164] 1. Input variables:

[0165] Voltage safety margin:

[0166] Thermal stability margin:

[0167] Frequency deviation: Δf=|ff nom |(f nom =50Hz);

[0168] 2. Output variable: regularization parameter λ (range [0.1, 0.5])

[0169] 3. Fuzzy rule table:

[0170] Rule No. VSM TSM Δf λ 1 Low Low big 0.5 2 high high Small 0.1 3 Low middle middle 0.3 4 middle Low big 0.4 5 middle middle middle 0.2

[0171] 4. Fuzzy reasoning implementation:

[0172] Membership function: triangular distribution (e.g. VSM "low" corresponds to [0, 0.2, 0.4]);

[0173] Reasoning method: Mamdani minimum operation;

[0174] Defuzzification: Centroid method.

[0175] 2.3.4 Solution of Constrained Regularization Objective Function

[0176] Lagrangian function construction:

[0177]

[0178] where μ i is the Lagrange multiplier.

[0179] Iterative solution steps:

[0180] 1. Initialization: Determine the initial center c based on density peak clustering j ;

[0181] 2. Membership update:

[0182]

[0183] 3. Cluster center update:

[0184]

[0185] (η is the step size, ranging from 0.01 to 0.1);

[0186] 4. Dynamic adjustment of λ: Update λ based on fuzzy logic;

[0187] 5. Convergence judgment: When Stop iteration when .

[0188] 2.4 Incremental density peak initialization

[0189] 2.4.1 Local density calculation optimization

[0190] Distance metric function definition:

[0191] 1. Feature space distance:

[0192]

[0193] where ω k is the dynamic feature weight (calculated by the method in Section 2.2.1).

[0194] 2. Dynamic update of cutoff distance:

[0195] d c =percentile(D,90%)

[0196] Where D = {d ij |i <j,i,j=1…n}为所有样本对距离集合,更新周期为每500次样本插入或当系统状态波动率超过阈值(σ sys >2σ0).

[0197] Fast calculation optimization:

[0198] The Annoy (Approximate Nearest Neighbors Oh Yeah) index structure is used to reduce the local density calculation complexity from O(n 2 ) is reduced to O(n log n);

[0199] By using CUDA parallel computing to accelerate distance matrix calculation, the local density calculation time of 100,000 samples with 1000-dimensional features on a single node was reduced from 45s to 2.3s.

[0200] 2.4.2 Relative distance and cluster center determination

[0201] Density-distance scatter plot construction:

[0202] Horizontal axis: local density ρ i , vertical axis: relative distance δ i ;

[0203] Calculate the global density mean and standard deviation σ ρ , the global relative distance mean and standard deviation σ δ .

[0204] Cluster center determination criteria:

[0205]

[0206] Physical meaning:

[0207] ρ i High means that the sample is located in a high-density area (cluster core);

[0208] δ i Large indicates that the sample is far away from the higher density area (cluster boundary).

[0209] 2.4.3 Incremental Clustering Update Mechanism

[0210] New sample processing process:

[0211] 1. Membership calculation:

[0212]

[0213] where u ij Calculated using the time-adaptive membership formula in Section 2.2.2.

[0214] 2. Trigger condition judgment:

[0215]

[0216] in:

[0217] (N is the size of the case library);

[0218] Min_Chuster is the minimum number of clusters (default is 5).

[0219] 3. Dynamic cluster creation:

[0220] When the triggering condition is met:

[0221] Recalculate p c and d i for samples within a range around the new sample. i ;

[0222] If the new sample meets the center determination criterion, a new cluster is created, otherwise it is incorporated into the nearest high-density cluster.

[0223] 2.4.4 Outlier identification and processing

[0224] Outlier determination formula:

[0225]

[0226] Processing strategy:

[0227] Short-term storage: outliers are kept in a temporary buffer (capacity 1000 samples);

[0228] Secondary verification: if the number of outliers of the same type in the buffer exceeds 50, trigger global density peak recalculation, and possibly form a new cluster;

[0229] Permanent discard: outliers that have not been verified for more than 24 hours are deleted from the case library.

[0230] Beneficial effects

[0231] The application discloses a power system network anomaly data clustering vulnerability detection technology based on an improved FCM algorithm, aiming to solve the deficiencies of traditional methods in high-dimensional data processing, dynamic adaptability and false alarm rate, etc. The technology constructs an intelligent clustering framework that integrates spatial and temporal features and physical constraints through innovative modules such as dynamic feature weight matrix, time-adaptive membership update, physical constraint regularization and incremental density peak initialization.

[0232] In terms of technical implementation, GCN and Transformer are used to extract multi-dimensional features including time series, space, protocol, etc., and through attention mechanism, the feature weights are dynamically adjusted, combined with time decay factor and fuzzy logic constraints, to realize accurate clustering of power grid anomaly data. Experiments show that in the application of a provincial power grid, the accuracy of anomaly detection is improved to 94.3%, the decision generation time is shortened to 14.8ms, and the constraint violation rate is reduced to 2.1%, significantly improving the real-time and reliability of power grid security protection, providing an effective solution for intelligent security protection of power systems with high proportion of new energy access. BRIEF DESCRIPTION OF DRAWINGS

[0233] Figure 1 The method technology architecture of the application is shown in the figure, which is divided into data layer, algorithm layer and application layer.

[0234] Figure 2 The present invention is a flowchart of the method. DETAILED DESCRIPTION

[0235] The present invention will be further described below in conjunction with specific embodiments:

[0236] 1 Application Scenario

[0237] A provincial power grid covers over 1,200 nodes, with a renewable energy penetration rate of 45%. During the high temperatures of the summer of 2024, voltage anomalies caused by sudden drops in photovoltaic power output frequently occurred. Traditional detection methods, due to their lack of dynamic adaptability, resulted in a false alarm rate as high as 28%, and decision-making times exceeding 80ms, failing to meet the real-time security requirements of the power grid. This embodiment utilizes an improved FCM algorithm to achieve efficient clustering of anomaly data and vulnerability detection, enhancing the power grid's security response capabilities.

[0238] 2 System Architecture Deployment

[0239] 2.1 Hardware Configuration

[0240] GPU cluster: 8 servers (NVIDIA A100 x 8), each card has 40GB of video memory and supports CUDA 11.4 parallel computing;

[0241] Storage cluster: HDFS distributed file system (32 nodes, total capacity 100PB), 128MB block size, 3 replicas;

[0242] Interface equipment: Complies with the IEC 61970 CIM standard and connects to the EMS system via a 10Gbps dedicated line.

[0243] 2.2 Software Stack

[0244] Data layer: Kafka (100,000 TPS throughput) + HBase (10ms query) + Parquet (compression rate 40%-70%);

[0245] Algorithm layer: PyTorch 2.0 (GCN + Transformer model) + TensorRT 8.0 (inference optimization) + Spark 3.3 (distributed computing);

[0246] Application layer: React front-end + TensorRT Serving (inference service), supporting RESTful API and GRPC interface.

[0247] 3 Key parameter configuration

[0248] 3.1 Improving FCM algorithm parameters

[0249]

[0250]

[0251] 3.2 Feature Engineering Parameters

[0252]

[0253] 4 Implementation Process

[0254] 4.1 Data Preprocessing

[0255] 1. Multi-source data access:

[0256] Collect PV power plant power data (50ms sampling rate), bus voltage (per unit value, retaining 4 decimal places), and Modbus protocol frames (function code / register value);

[0257] Savitzky-Golay filtering was used to remove high-frequency noise, and the isolation forest algorithm was used to detect outliers (with anomaly score threshold of 0.6).

[0258] 2. Standardization processing:

[0259] Perform Z-score normalization on numerical data such as voltage amplitude and power flow:

[0260]

[0261] One-hot encoding is used for discrete features (such as transformer tap position) and converted into a 64-dimensional continuous vector.

[0262] 4.2 Feature Fusion and Weight Calculation

[0263] 1. Spatiotemporal feature extraction:

[0264] GCN layer: 2-layer graph convolutional network, input dimension 300 → output dimension 64, LeakyReLU activation (α = 0.2), Dropout = 0.3;

[0265]

[0266] Transformer layer: 8-head attention mechanism, sequence length T = 100 (5 seconds of data), position encoding uses sine function.

[0267] 2. Dynamic weight calculation:

[0268] When the photovoltaic output fluctuation rate σ is monitored pv =0.35 (exceeds the threshold value T σ =0.2), trigger weight enhancement:

[0269] ω′k =ω k (1+0.35 ReLU(1.75-1))

[0270] The voltage deviation feature weight increased from 0.12 to 0.28, and the frequency change rate weight increased from 0.08 to 0.15.

[0271] 4.3 Improving the FCM clustering process

[0272] 1. Time-adaptive membership calculation:

[0273] The membership of sample i to cluster j is:

[0274]

[0275] Where Δt = 10 minutes, m = 1.5, dynamic weight ω j =0.2 (voltage characteristics).

[0276] 2. Physical Constraint Regularization:

[0277] Voltage safety margin VSM = 0.08 (<0.1), triggering fuzzy logic adjustment λ = 0.85;

[0278] Constraint violation calculation:

[0279] Voltage amplitude 0.92pu < lower limit 0.95pu).

[0280] 3. Density peak initialization:

[0281] Local density calculation (d c = 0.3, 90th percentile):

[0282]

[0283] New samples satisfy ρ i >ρ - +1.5σρ and δ i >δ - +1.5σδ, create a new cluster.

[0284] 4.4 Vulnerability Detection and Response

[0285] 1. Anomaly score generation:

[0286] Multidimensional anomaly index:

[0287]

[0288] Trigger alarm threshold S>μ S +2σ S=0.85, which is determined to be a Level 1 alarm (high risk).

[0289] 2. Generate disposal suggestions:

[0290] Search the case database and return similar cases from 2022 (similarity 0.92) within 0.8ms;

[0291] Correction decision: Adjust the tap of transformer T1 to level 28, increase the reactive output of G5 by 20Mvar, and restore the voltage to 0.98pu.

[0292] 5. Implementation effect verification

[0293] 5.1 Comparative experimental data

[0294]

[0295] 5.2 Engineering Application Value

[0296] Safety protection capability: The number of voltage over-limit alarms has been reduced from an average of 12 per day to 3, and the accuracy of line overload warnings has been increased from 68% to 92%.

[0297] Improved real-time performance: Fault response delay is shortened from 2.8 seconds to 0.6 seconds, meeting the real-time requirements of the power grid's "four remote" functions;

[0298] Compatibility advantage: Seamless integration of existing EMS systems through the IEC 61970 interface improves hardware resource utilization by 50%.

[0299] The embodiments of the present invention are not limited to the above description. The spatiotemporal feature fusion algorithm based on the GCN and Transformer cascade, the improved FCM algorithm parameters, and the physical constraint regularization and time-adaptive membership update mechanism can be adjusted according to the actual power system operation scenario. Such improvements fall within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal data clustering vulnerabilities in power system networks, characterized in that: include: (1) The data preprocessing module integrates multi-source power data and performs standardization and noise reduction; (2) The multi-dimensional feature fusion module extracts temporal, spatial, and protocol features and constructs a multi-dimensional feature vector; (3) The cluster analysis module dynamically clusters the feature vectors based on the improved FCM algorithm, which includes dynamic feature weight matrix design, time-adaptive membership update, physical constraint regularization, and incremental density peak initialization; (4) The vulnerability detection and assessment module generates anomaly scores based on the clustering results and triggers graded alarms.

2. The method according to claim 1, characterized in that The dynamic feature weight matrix design includes: (1) Using the cascade structure of GCN and Transformer to extract spatiotemporal features; (2) Use the MLP structure to calculate the attention weights and perform normalization; (3) Adaptive weight adjustment mechanism based on the enhanced characteristic weight triggered by the output volatility of renewable energy; (4) Embed the feature correlation matrix to achieve weight adjustment of physical constraint perception.

3. The method according to claim 1, characterized in that The time-adaptive membership updating includes: (1) The time decay factor is introduced to modify the traditional FCM membership function and a time-adaptive membership formula is constructed; (2) Dynamically adjust the time decay coefficient based on the system state volatility; (3) A sliding window mechanism is used to implement incremental cluster center updates.

4. The method according to claim 1, wherein The physical constraint regularization includes: (1) Modeling physical constraints such as voltage amplitude, thermal stability, and power balance and defining violation functions; (2) Embedding DC power flow equations to achieve rapid constraint violation assessment; (3) Dynamically adjust the regularization parameter λ using the fuzzy logic control model; (4) Construct a Lagrangian function including the constraint violation degree for iterative solution.

5. The method according to claim 1, wherein The incremental density peak initialization includes: (1) Annoy index structure is used to optimize local density calculation; (2) Determine the cluster center based on the density-distance scatter plot and judgment criteria; (3) Design an incremental cluster update mechanism to trigger the creation of new clusters based on membership thresholds; (4) Identify outliers based on local density and relative distance and perform classification processing.

6. The method according to claim 2, characterized in that In the GCN and Transformer cascade structure, the GCN layer calculates the feature matrix by adding self-loops to the adjacency matrix and normalizing the degree matrix. The Transformer encoder adopts an 8-head attention mechanism and sine-cosine position encoding. The spatiotemporal fusion is represented by the concatenation of node spatial features and temporal features.

7. The method according to claim 2, characterized in that The attention weight calculation network adopts a three-layer MLP structure, the activation function is the Swish function, and Layer Normalization and Dropout are combined to prevent overfitting, and the weight matrix meets the normalization conditions.

8. The method according to claim 3, characterized in that The time-adaptive membership formula introduces a time decay factor and a regularization term into the objective function and is solved by the Lagrange multiplier method. When the sample collection time interval is uniform, it is simplified to a membership calculation formula containing the time decay factor.

9. The method according to claim 4, characterized in that The fuzzy logic control model takes voltage safety margin, thermal stability margin and frequency deviation as inputs, outputs regularization parameter λ, and realizes dynamic adjustment through triangular membership function, Mamdani minimum reasoning and centroid method defuzzification.

10. A power system network abnormal data clustering vulnerability detection system, characterized in that: include: (1) Data preprocessing module, used to integrate multi-source power data and perform standardization and noise reduction; (2) Multi-dimensional feature fusion module, used to extract temporal, spatial, and protocol features and construct a multi-dimensional feature vector; (3) a cluster analysis module for dynamically clustering feature vectors based on an improved FCM algorithm, wherein the improved FCM algorithm includes a dynamic feature weight matrix, a time-adaptive membership update, a physical constraint regularization, and an incremental density peak initialization module; (4) Vulnerability detection and assessment module, which is used to generate anomaly scores based on clustering results and trigger graded alarms.

11. A computer-readable storage medium, characterized in that The medium stores a computer program configured to execute the steps of the power system network abnormal data clustering vulnerability detection method according to any one of claims 1 to 9.

12. A computer program product, characterized in that The product includes computer-executable instructions, which are used to implement the functions of the power system network abnormal data clustering vulnerability detection method according to any one of claims 1 to 9.

Images