User security feature recognition method based on behavior pattern analysis

Abstract

The invention discloses a user security feature recognition method based on behavior pattern analysis, and aims to solve the problems of inaccurate recognition of power utilization security features of power consumers and insufficient robustness in the prior art. The method comprises the following steps: preprocessing and segmenting original power consumption time sequence data; then, a self-supervised learning model based on an expert hybrid architecture is constructed, the architecture integrates five neural networks to construct an expert model, expert weights are dynamically distributed through a gating network, and a power utilization mode deep embedding vector is output through self-supervised training; clustering the embedded vectors by using a clustering algorithm, determining an optimal clustering number in combination with an elbow method and a contour coefficient method, generating a user portrait, and performing visualization and feature analysis; and finally, according to the user portrait data, carrying out transaction behavior pattern recognition on the input to-be-recognized user data, and outputting a security feature recognition result. The method can comprehensively and accurately identify the power utilization safety characteristics of the user, and is suitable for scenes such as intelligent power grid safety monitoring.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security and intelligent analysis, and particularly relates to a user security feature recognition method based on behavior pattern analysis, which is used for user security feature recognition of power transaction behavior sequence data. BACKGROUND

[0002] With the accelerated construction of global energy internet and the deep popularization of smart grid technology, advanced metering infrastructure (AMI) has become the “nerve ending” of modern power system safety monitoring. Through intelligent electric meters, edge data acquisition terminals, power internet of things sensors and other devices, it continuously collects power transaction and operation data of residential and industrial users at a frequency of every minute (such as high-precision tamper-resistant electric meters), every hour or even higher, forming a PB (Petabyte, trillion bytes) level of safety-sensitive time series data set. These data not only record the basic information of user's real-time power consumption, load fluctuation, etc., but also contain deep value directly related to power safety. From a micro perspective, it maps the user's security-related behavior traces (such as hidden load fluctuation during electricity theft, gradual abnormal power consumption signal before equipment failure, three-phase imbalance associated power consumption mode caused by illegal wiring), security risk inducements (such as overload precursor caused by unordered charging of new energy vehicles, intermittent leakage associated load change of old equipment); from a macro perspective, its aggregated features can reflect regional security risk distribution (such as the possibility of electricity theft gang activities indicated by the phenomenon of “low voltage and high load in the early morning” in a certain area), and weak links of power grid safety (such as frequent occurrence of equipment failure associated power consumption anomaly in a certain area, indicating aging of distribution network facilities). For power grid companies, these “security data gold mines” without manual annotation are the core basis for realizing accurate security early warning (such as pushing maintenance prompts to users with equipment failure precursors), strengthening anti-electricity theft inspection (such as identifying hidden electricity theft behavior), and optimizing security operation strategy (such as giving priority to on-site inspection of high-risk users), which are directly related to the power supply safety, operation compliance and asset protection capability of the power system.

[0003] However, the current mainstream technology for identifying security features of power users still has significant bottlenecks. The existing solutions highly depend on the self-supervised learning paradigm of a single deep learning model: researchers usually choose one from models such as Multilayer Perceptron (MLP), Long Short-Term Memory (LSTM), Temporal Convolution Networks (TCN), Mamba, or Transformer, force the model to learn a deep embedding representation of power security-related patterns from unlabeled data by designing self-supervised tasks such as time series reconstruction (e.g., filling in missing data during suspected power theft periods, predicting normal load baselines before equipment failure), contrastive learning (e.g., distinguishing the similarity between normal and abnormal power usage patterns), and then grouping the embedding vectors using clustering algorithms such as K-means, DBSCAN (Density-Based Spatial Clustering of Applications with Noise), and other clustering algorithms to try to screen out user groups with security risks. This method may have some effect in simple security scenarios (such as obvious load surge-type power theft), but it exposes multiple limitations in the face of complex power security data and diverse risk scenarios: First, there is a fundamental mismatch between the model's ability and the complexity of security feature data. The complexity of power user security feature data far exceeds that of ordinary time series, specifically: the superposition of strong periodicity and security anomalies (such as normal daily load cycle embedded in non-periodic fluctuations caused by electricity theft), multi-time scale security features (from minute-level sudden abnormality of electricity theft equipment access, hour-level sustained abnormality of device overload, to monthly device aging-related gradual abnormality), heterogeneity of user security behavior (different electricity theft methods lead to different load characteristics - such as hidden fluctuations of wiring electricity theft vs overall deviation of meter tampering, different device faults have different electricity signals - such as intermittent impact load of motor failure vs sustained low load of line aging). However, existing single models all have inherent security feature capture shortcomings: LSTM can capture long-range dependencies, but the gradient vanishing problem of backpropagation leads to low training efficiency, and it is difficult to accurately capture short-term security features such as "electricity theft leading to minute-level load surge"; TCN efficiently extracts local multi-scale patterns through dilated convolution, but lacks global attention mechanism, making it difficult to model long-periodicity security associations such as "regular electricity theft patterns every Saturday morning at fixed time" ; Transformer achieves global dependency modeling with multi-head self-attention, but the computational complexity grows quadratically with sequence length, which has serious performance bottlenecks on high-frequency sampling data (such as 1-minute granularity anti-tamper meter data), making it difficult to support real-time security monitoring for large-scale users; Mamba, as a new state space model, has made breakthroughs in long sequence processing efficiency, but is extremely sensitive to hyperparameter adjustment, and has poor stability in "electricity mode mutation (such as sudden access of electricity theft equipment, instantaneous overload of faulty equipment)", which easily leads to missing key security features. The limitations of single models make it impossible to fully cover the multi-dimensional characteristics of power security data, becoming a core bottleneck for security risk identification.

[0004] Second, the model robustness is difficult to cope with extreme and edge scenarios in the security field. In power security monitoring, rare security events (such as equipment overload anomaly caused by extreme cold, short-time behavior of stealing electricity after sudden power recovery, and hidden load change caused by new electricity stealing technology) and special time scale fluctuations (such as short-time high-power electricity stealing pulse at midnight 1-3 o'clock, and fault-related impact load at the moment of equipment start-up) have low occurrence frequency, but they are often the main cause of power grid security loss. Due to fixed architecture and limited generalization ability, a single model will significantly reduce the quality of embedded representation when facing such "security-oriented out-of-distribution data": for example, LSTM may misjudge "extreme peak caused by electricity stealing" as "normal heating load under extreme weather" and ignore it; TCN may not be able to capture "persistent electricity stealing across the early morning period" due to the receptive field limitation (such as covering only 12 hours); although Transformer can model globally, it may over-smooth "intermittent fluctuations caused by equipment failure" as "normal load noise". This robustness defect directly leads to the clustering algorithm to misgroup "similar security risk patterns (such as different users' same type of electricity stealing)" or fail to distinguish "essentially different edge security features (such as normal peak and superimposed peak of electricity stealing)", and eventually generates serious deviation in the security feature recognition result, even causing security risk misjudgment (judging normal electricity as electricity stealing) or omission (judging electricity stealing behavior as normal).

[0005] Thirdly, the single model bottleneck leads to the suboptimal representation of security features. In different users' power consumption behaviors, the superimposed mode of security features and normal behaviors has high heterogeneity: in the "normal morning and evening power consumption peak" of office worker families, there may be "hidden loads connected after work to steal electricity"; in the "stable power consumption during the day" of retired families, there may be "gradual abnormal fluctuations caused by equipment aging"; in the "small difference between day and night loads" of commercial and residential users, there may be "electricity stealing behavior after closing at night". Forcing all heterogeneous data containing security features to pass through the fixed architecture of a single model (such as uniform hidden layer dimensions, attention weight distribution logic), which is equivalent to measuring diversified security risk patterns with the same standard, will inevitably lead to the compression or distortion of some key security features: for example, TCN, which focuses on local features, cannot accurately separate "minor fluctuation security features of equipment failure" in the global context of "stable power consumption of retired families"; Transformer, which is good at global modeling, may over-smooth "sharp load pulse caused by electricity stealing in office worker families", making it indistinguishable from normal load; and MLP, which lacks time series modeling capability, cannot distinguish between "normal load time series changes" and "time series anomalies caused by electricity stealing". This suboptimal representation directly limits the discriminability of security features, making it difficult to support the power grid company's fine classification of "normal power consumption-suspected security risk-diagnosed security risk", and even more difficult to achieve precise differentiation of different types of security risks such as electricity stealing, equipment failure, and overload.

[0006] In addition, although the Mixture of Experts (MoE) architecture has been tried to improve the capacity of power system models (by assigning complex tasks to multiple "expert" sub-models for parallel processing) as an integrated learning approach, its existing applications have focused on supervised learning tasks in power systems (such as short-term load forecasting, classification tasks for equipment failure diagnosis), and have not been adapted to the unsupervised scenario of "electricity user security feature identification": on the one hand, existing MoE models have not systematically integrated MLP, LSTM, TCN, Transformer, Mamba, and other complementary time series models, making it difficult to capture "multiple security features (such as sudden anomalies of electricity stealing, gradual anomalies of equipment failure, and cumulative anomalies of overload)" through multi-expert collaboration; on the other hand, its training objectives are still designed around specific supervised tasks (such as predicting the probability of failure occurrence), and have not been designed to extract "security-oriented general embeddings (such as discriminative features of normal and abnormal loads, and distinguishable representations of different security risk types)" through self-supervised learning, making it difficult to directly serve downstream unsupervised security feature clustering and identification, and unable to meet the needs of power grid exploration of "unknown security risks (such as new electricity stealing methods)".

[0007] To solve the above problems, the application provides a user security feature recognition method based on behavior pattern analysis, a plurality of complementary time series deep learning models are organically integrated into an "expert network" through a MoE architecture, and a gating mechanism is introduced to dynamically assign the optimal expert combination for different power transaction patterns; at the same time, combining self-supervised learning of time series reconstruction and scientific clustering analysis method, automatically learn high-quality user security feature representation from unlabeled data, generate an unsupervised security feature portrait that comprehensively covers power consumption patterns, is robust to extreme scenarios and finely distinguishes user differences, and finally rely on mixed expert models, neural networks and security feature portraits to classify different user transaction behaviors by patterns and identify their security features, providing breakthrough technical support for fine operation of smart grids. SUMMARY

[0008] The application provides a user security feature recognition method based on behavior pattern analysis, which innovatively integrates multilayer perceptron, long short-term memory network, time convolution network, transformer and manba five complementary time series deep learning models as "experts", dynamically assigns the optimal expert combination for different power transaction behavior patterns through a gating network, and comprehensively captures complex security features in power transaction behaviors. At the same time, combining self-supervised learning tasks of time series reconstruction and K-means clustering analysis, first let the model learn high-quality deep embedding of power transaction behavior patterns through self-supervised training, then generate accurate user security feature portraits through scientific clustering method, and finally identify security features according to mixed expert models, portraits and efficient neural networks. This framework breaks through the limitations of single models, significantly improves the comprehensiveness and accuracy of security analysis of power transaction behavior patterns in terms of coverage, feature extraction and portrait accuracy, and realizes accurate security feature recognition, providing more reliable data support for fine operation of smart grids. The user security feature recognition method based on behavior pattern analysis comprises the following steps: S1: preprocessing and segmentation of original power transaction time series data to generate standardized time series segments; S2: constructing a self-supervised learning model based on MoE architecture, which includes a gating network and a plurality of expert networks, wherein the expert networks adopt a plurality of complementary time series deep learning models, and the MoE model is trained through a self-supervised task of time series reconstruction, so that the gating network dynamically assigns weights to the expert networks according to the characteristics of the input segments processed in S1, and outputs deep embedding vectors of power transaction patterns; S3: unsupervised clustering of the deep embedding vectors obtained in S2 by using a clustering algorithm, combining elbow method and contour coefficient method to determine the optimal clustering number, and forming user power transaction portraits; S4: Visualize and analyze the user portrait of each cluster obtained in S3, including generating daily average load curve and multi-dimensional security feature radar chart, analyzing transaction behavior patterns, and classifying user portraits according to behavior patterns.

[0009] S5: Perform behavior pattern analysis on the input user data according to the classified user portrait data obtained in S4 to identify the security features.

[0010] Compared with the prior art, the present application has the following advantages: Comprehensive capture of complex security patterns: By integrating five complementary expert models through the MoE architecture, the capability limitations of single models are solved. By using the gating network to dynamically assign weights to these expert models according to the input data features, the long-term dependence, local fluctuations, global correlations and other multi-element power transaction security patterns are comprehensively captured, and the capability limitations of single models in complex security patterns are completely solved.

[0011] Improved robustness: The gating network selects the optimal expert combination according to the input features, avoiding the performance decline of single models in less skilled patterns, making the embedded representation more stable. Automation and interpretability: The method process constructed by the present application can realize end-to-end automatic processing from raw power transaction data to user security feature portrait without manual intervention. At the same time, by generating the daily average load curve, the time distribution rule of user electricity load can be intuitively presented; by using the multi-dimensional radar chart, the feature situation of the user in the abnormal load growth rate, the proportion of atypical electricity consumption period and other security related dimensions can be clearly displayed, which is convenient for business interpretation. High efficiency and practicality: The self-supervised learning method is adopted, which does not need manual annotation of massive power transaction data, greatly reducing the data preparation cost, and is very suitable for processing massive and unlabeled power transaction data in the smart grid scenario. In the clustering number determination link, the elbow method and the contour coefficient method are combined to scientifically and objectively determine the optimal clustering number from the aspects of cluster tightness and cluster difference, avoiding the deviation caused by subjective setting of clustering number, and improving the practicality and reliability of the generated user power transaction portrait, providing more accurate data support for load forecasting, demand side management and other businesses of smart grid.

[0012] In summary, the user security feature recognition method based on behavior pattern analysis provided by the present application comprehensively utilizes the advantages of five different neural networks and effectively avoids their shortcomings by using the hybrid expert model technology, significantly improves the model's ability to capture complex security data, enhances robustness and interpretability, can efficiently and practically form different power transaction user security feature portraits through unsupervised clustering, adapt to various behavior patterns, and efficiently and accurately complete the security feature recognition task of user behavior patterns in power transactions, providing strong data support for the fine operation of smart grids, and helping to improve the accuracy of load forecasting and optimize demand side management. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0014] Figure 1 The user security feature recognition method based on behavior pattern analysis of an embodiment of the present application is a general flow chart.

[0015] Figure 2 The software flow chart of the user security feature recognition method based on behavior pattern analysis of an embodiment of the present application.

[0016] Figure 3 The MoE architecture detail diagram of an embodiment of the present application.

[0017] Figure 4 The example diagram of the radar chart used in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to better understand the technical solutions, the method of the present application will be described in detail below in combination with the drawings.

[0019] As shown in the accompanying Figure 1 The user security feature recognition method based on behavior pattern analysis provided by the present application aims to realize the security feature recognition of user power transaction behavior patterns. Its core idea is as follows: Figure 2As shown, multiple advanced and complementary time series deep learning models (including Mamba, Transformer, TCN, LSTM, and MLP) are integrated into the MoE framework as "experts". These experts are jointly trained on the self-supervised task of time series reconstruction to learn rich security features of transaction behavior patterns and obtain comprehensive user security feature embeddings. After obtaining high-quality embeddings, the invention uses the K-means algorithm to cluster these embeddings, automatically discovering and forming different security feature portraits of user behavior patterns. By combining the elbow method and the robust analysis of the silhouette coefficient to determine the optimal number of clusters, the automation and objectivity of portrait construction are further improved. For each cluster, the invention aggregates all original (non-normalized) daily load segments assigned to the cluster and calculates the average 24-hour total consumption curve to obtain a daily average curve visualization image; to support more structured and quantitative comparison of different portraits, the method extracts eight high-level behavior features from the average load curve of each cluster: total security consumption, time features, ratio-based features, shape-based features, stability features, and after normalization, these features are visualized through radar charts. After obtaining user security feature portraits, the method pre-trains a Bi-LSTM-CNN-Attention network based on them, and then uses the network with a hybrid expert model to identify security features of user transaction behavior patterns in subsequent applications. The specific steps are as follows: S1, data preprocessing and segmentation In the method described in the invention, the original power transaction data collected and processed is a one-dimensional time series, which needs to be segmented by sliding window and standardized to the input format of the model. In the method described in the invention, sliding window segmentation is used to capture local temporal patterns from continuous data streams and provide sufficient training samples for subsequent models. Specifically, for each continuous time series, a fixed window length L and step size S are defined. The length L window is slid by step size S to traverse the original sequence, generating a series of time series segments , in the case of network security-related data being a univariate time series, i.e. . For example, if the invention has a time series data recording the number of user operations per hour, set the window length L to 24 hours and the step size S to 1 hour, then a 24-hour long segment will be cut from the time series, with 1 hour overlap between each segment. These segments contain local information of user behavior in different time periods.

[0020] To eliminate the difference in absolute values of different time period data, make the model focus on learning the relative shape and trend of the behavior pattern, Z-score normalization is performed on each extracted time series segment x. Its formula is: (1), Where is a very small positive number to prevent division by zero. x is a series of time series segments, and x is the normalized segment, is the mean of x, is the standard deviation of x.

[0021] This piece-by-piece normalization helps eliminate the impact of the absolute difference in electricity consumption between different users or time periods, allowing the model to focus more on learning the relative shape and trend of user behavior patterns. Each processed segment has a shape of to adapt to the (batch size, sequence length, feature) input format usually expected by deep learning models.

[0022] S2, construct a self-supervised learning model based on MoE architecture, and use it for self-supervised learning to obtain deep embedding vectors S21, construct a self-supervised model of MoE architecture As shown in the accompanying Figure 3 , the MoE architecture consists of a gating network and multiple expert networks. The MoE-based integrated embedding architecture is outlined in Figure 2 , which uses five different deep learning architectures as expert networks, each of which is designed to capture different features of time series: Time Series MLP Embedder: As a baseline model, the multi-layer perceptron (MLP) learns a non-linear mapping from the input segment to the embedding vector through multiple fully connected layers. The input segment is first flattened into a one-dimensional vector . Then, it goes through a series of linear layers and nonlinear activation functions.

[0023] (2), (3), The final output layer maps the last hidden layer to a dimensional embedding . MLP can capture static nonlinear features.

[0024] Where, is the kth layer of the multi-layer perceptron, is the kth layer weight matrix of the multi-layer perceptron,​ is the weight matrix of the k-th layer of the multi-layer perceptron.

[0025] (2) TimeSeriesLSTMEmbedder: Long Short-Term Memory (LSTM) is a type of recurrent neural network that is particularly suitable for capturing sequential dependencies and long-term patterns in time series. The present invention employs a bidirectional LSTM, enabling it to utilize both past and future information. The input is passed through a bidirectional LSTM layer. At each time step , the LSTM computes a forward hidden state and a backward hidden state : (4), (5), concatenating the forward and backward hidden states produces a bidirectional output .

[0026] (6), Finally, an adaptive average pooling and projection layer produces the embedding .

[0027] where is the forward cell state at time t, and is the backward cell state at time t.

[0028] (3) TimeSeriesTCNEmbedder: Temporal Convolutional Network (TCN) utilizes causal and dilated convolutions to capture local patterns at different time scales. The input is first transposed to fit the (batch size, number of features, sequence length) format for convolutional layers. The TCN is stacked with multiple TemporalBlock layers, each containing two dilated causal convolutional layers with weight normalization and residual connections. For an input feature map , a dilated causal convolutional layer outputs : (7), where is the kernel size, and is the dilation rate. The residual connection ensures stable information flow: (8), After passing through multiple TCN blocks, the final output is , which is then passed through an adaptive average pooling and projection layer to obtain the embedding .

[0029] wherein is the j-th weight parameter of the convolution kernel, is the element value of the input sequence F at is the n-th convolution operation, is a down-sampling operation on the input sequence F, i, j are natural numbers.

[0030] (4) TimeSeriesTransformerEmbedder: Transformer models utilize multi-head self-attention mechanisms (MHSA) to capture global dependencies between arbitrary positions in a sequence. The input is first linearly projected to dimensions. Then, the input sequence is passed through Transformer encoder layers. Each encoder layer consists of a MHSA and a feedforward neural network (FFN), augmented with residual connections and layer normalization. Notably, to preserve sequential order information, position encodings are added to the input embeddings. For the input to an encoder layer (9), (10), (11), After the encoder stack, the final output is which is then passed through an adaptive average pooling and projection layer to obtain the embedding .

[0031] wherein is the output after multi-head self-attention processing, is the position encoding, is the first layer normalization result, is the second layer normalization result, is the layer normalization operation.

[0032] (5) TimeSeriesMambaEmbedder: Mamba models combine the efficiency of state space models (SSM) with the global receptive field of Transformers. It enables long sequence modeling with linear complexity through a selective state space model (selective SSM). The input is also linearly projected to ​Then input into The core of each Mamba block is a dynamically generated selection of parameters based on the input, which modulates the recursive operation of the SSM. A simplified Mamba block can be summarized as: (12), (13), where are the hidden state at time t, state transition matrix, input transition matrix, input projection matrix, respectively, which changes dynamically according to the input, is the input projection matrix, is the output of the Mamba block at time t, is the history information at time t.

[0033] S22, constructing a gating network and combining the gating network with a mixture of experts model In the method of the present application, a gating network is provided for dynamically assigning weights to different experts for each input time series segment. The method of the present application uses a sparse mixture of experts model design, in which each input segment is mainly processed by a small number of experts, thereby improving computational efficiency.

[0034] The gating network receives a simplified representation of the original time series segment (e.g., through a small linear layer or a shallow multi-layer perceptron), and then outputs a probability distribution of expert activations through a linear layer and a Softmax function: (14), where is a probability vector, is the number of experts, is the feature extraction operation.

[0035] To achieve sparsity, the present application uses a Top-K mechanism, only selecting the top K experts with the highest probability for calculation. The final mixture of experts model embeds is the weighted sum of the outputs of these K selected experts: (15), where is the embedding extracted by the th expert for input .

[0036] S23, self-supervised training using a mixture of experts (MoE) model In the method of the present application, after obtaining the above model, the preprocessed segment Self-supervised training is performed by mixing expert models. During training, in addition to the reconstruction loss, the invention introduces a load balancing loss to encourage the gating network to evenly distribute tasks among all experts, preventing some experts from being overused or completely idle, ensuring that all experts are fully trained.

[0037] Further, in the method of the invention, all the mixture of experts (MoE) encoders are paired with a shared decoder. The decoder is a simple multi-layer perceptron network that receives the MoE embedding of dimension and expands it back to dimension to reconstruct the original input segment . The total training loss function is: (16), where is the mean squared error, is the load balancing loss is the weight coefficient of the load balancing loss, is the model's predicted output, is the model's actual output. The invention uses the Adam optimizer to jointly train the gating network, all expert encoders, and the decoder.

[0038] S3, using a clustering algorithm to unsupervisedly cluster the deep embedding vectors obtained in S2, combining the elbow method and the silhouette coefficient method to determine the optimal number of clusters, forming a user electricity trading portrait After training the MoE encoders in a self-supervised manner and extracting the embedding vectors of all daily electricity segments, the method of the invention applies the classic K-means algorithm to high-dimensional embedding, performs user portrait analysis through K-means clustering and k value selection, in order to automatically identify user groups with similar consumption behavior.

[0039] K-means algorithm is a partition-based iterative clustering method, which aims to assign N data points to k clusters so that the sum of squared distances to the centroid within each cluster is minimized. By alternately updating data point assignments and recalculating centroids, K-means converges to K compact and well-separated clusters. Each resulting cluster is interpreted as a unique user electricity portrait.

[0040] One prerequisite for optimal k value selection is to pre-specify the number of clusters K. In order to select a suitable k value that best reflects the intrinsic structure of the data, the method of the invention employs two complementary and widely accepted evaluation strategies: Elbow method: the invention calculates The inertia value of each cluster is plotted. Generally, the inertia monotonically decreases as k increases. The optimal k is determined as the "elbow" point - the point where the curve transitions from steeply decreasing to more gently decreasing - which represents the trade-off between model complexity and fit quality.

[0041] Contour coefficient method: As a more comprehensive evaluation method, the contour coefficient considers both the compactness within clusters and the separation between clusters. The method described herein computes the average contour coefficient score of all data points for each k value and selects the k value that maximizes this score. A higher contour coefficient indicates that the cluster definition is clearer and the boundaries between different profiles are more distinct.

[0042] By integrating the insights of these two methods, the method described herein derives a data-driven and interpretable foundation for determining the number of user profiles to be used in subsequent visualizations and analyses.

[0043] S4, visualizing and analyzing the user profiles of each cluster obtained in S3 To obtain interpretability and compare the security features of each discovered cluster, the present invention designs a two-level visualization and feature analysis strategy.

[0044] (1) Daily average curve visualization For each cluster, the present invention aggregates all original (non-normalized) daily load segments assigned to the cluster and computes the average 24-hour trading curve. These average curves intuitively and directly explain each user profile, revealing the time rhythm of electricity consumption - for example, peak and off-peak periods or overall load intensity. This lays the foundation for the qualitative naming and preliminary classification of each profile.

[0045] (2) Multidimensional feature engineering and radar chart analysis To support more structured and quantitative comparisons of different profiles, the present invention extracts eight high-level behavior features from the average load curve of each cluster. These features capture different aspects of electricity consumption patterns: • Total transaction volume: the total amount of energy used daily.

[0046] • Time features: peak time (number of hours with the highest usage).

[0047] • Ratio-based features: night-to-day ratio, morning-to-evening dominance (morning - evening dominance), and off-peak period proportion • Shape-based features: morning rise slope (rate of increase during the early morning period) and evening peak sharpness (steepness of the evening electricity consumption peak).

[0048] • Stability features: daytime volatility (electricity consumption volatility during 9 am to 5 pm).

[0049] After normalization, as shown in the attached Figure 4 The figure shows a radar chart visualizing these features for the case of k = 2. Each user profile is presented as a polygonal "fingerprint" with a different score on each axis. This visualization significantly facilitates horizontal comparison of subtle differences between profiles and provides a strong quantitative basis for further qualitative interpretation. Based on this quantitative basis, unique security features are extracted and matched with the resulting user profiles to generate security feature profiles for different behavioral patterns, thereby constructing a security feature profile library.

[0050] S5. Analyze the behavior patterns of the input user data based on the classified user portrait data obtained in S4 to identify its security features.

[0051] In the method described in the present invention, the constructed Mixed Experts Model (MoE) and security feature profile library are used to automatically identify the target user data to match the security features of their behavior patterns. The specific steps are as follows: S51. Input preprocessing and deep feature extraction In the method described in the present invention, the original power transaction time series data of the user whose behavior pattern is to be analyzed is processed by the same preprocessing and segmentation method as in S1, that is, the continuous time series is segmented using a sliding window of the same length (Window Length L) and stride (Stride S) to generate segments of fixed length; and each segment is subjected to the same Z-score normalization processing, and the calculation formula is the same as (1).

[0052] The preprocessed, standardized time series segments are fed into an encoder model based on a (MoE) architecture, which has converged after self-supervised training in S2. The parameters of the gating network and expert network in this MoE model are frozen and no longer undergo training updates. The MoE model performs forward computation on the input segments, with the gating network dynamically selecting the most appropriate expert combination and ultimately outputting a low-dimensional, dense, deep embedding vector that comprehensively represents the segment's behavioral patterns. This embedding vector captures the essential security temporal characteristics of the input segments.

[0053] S52, Security Feature Profile Probabilistic Matching The deep embedding vector obtained in S51 is input into a pre-trained security feature classifier. This classifier is constructed based on the user security feature profile library (i.e., the K cluster centers and the security behavior pattern categories they represent) formed in S3 and S4. In the method described herein, this classifier is a bidirectional long short-term memory-convolution-attention neural network.

[0054] Further, the Bi-LSTM-CNN-Attention network is composed of 2 bidirectional long short-term memory layers, 1 convolutional layer and 1 multi-head attention layer. Further, in the Bi-LSTM-CNN-Attention network, the bidirectional long short-term memory layer includes 256 hidden units, the convolutional layer includes 128 hidden units, and the multi-head attention layer includes 8 attention heads.

[0055] Classifier training: In the offline stage, all the deep embedding vectors obtained after S3 clustering and their corresponding cluster labels (i.e. the cluster ID to which each embedding vector is assigned) are used as the training data set to supervise the training of the Bi-LSTM-CNN-Attention network. The training goal of the network is to learn the mapping relationship from the embedding vector to the K security portrait categories. The introduction of the attention mechanism helps the network focus on the most critical feature dimensions in the embedding vector for distinguishing different security categories.

[0056] Online inference: In online application, the trained Bi-LSTM-CNN-Attention network receives a new embedding vector and outputs a probability distribution vector P of dimension K , where represents the confidence probability that the input user behavior segment belongs to the kth security feature portrait (i.e. the typical behavior pattern represented by the kth cluster), and .

[0057] S53, security feature determination and output According to the probability distribution vector P obtained in S5.3, the security portrait category with the highest probability value is selected as the final security feature recognition result of the input segment.

[0058] Therefore, through the dual driving of multi-expert model integration and self-supervised learning, the present application ensures comprehensive capture and accurate representation of complex power security behavior patterns, effectively mines deep risk features from massive unlabeled data, and adaptively assigns appropriate modeling experts to diversified power usage modes, thereby significantly improving the discriminability, robustness and explainability of user security feature portraits, and providing core support for building a highly reliable intelligent power grid security monitoring system.

Claims

1. A method for identifying user security features based on behavioral pattern analysis, characterized in that: The following steps are involved: S1: Preprocess and segment the original power transaction time series data; S2: Build a self-supervised learning model based on the MoE architecture and use it for self-supervised learning to obtain a deep embedding vector; S3: Use clustering algorithm to perform unsupervised clustering on the deep embedding vector obtained in S2; S4: Visualize and analyze the user profiles of each cluster; S5: Identify security features of the input user data based on the user portrait data.

2. The method according to claim 1, characterized in that The preprocessing and segmentation in S1 include: using a sliding window to segment the continuous time series to generate segments of fixed length; performing Z-score normalization on each segment, and the normalization calculation formula is: ， in, is a very small positive number used to prevent division by zero, x is a series of time series segments, is the normalized fragment, is the mean of x, is the standard deviation of x.

3. The method according to claim 1, characterized in that In S2, a self-supervised learning model based on the MoE architecture is constructed and used for self-supervised learning. The method constructs a self-supervised learning model based on the MoE architecture, namely, the MoE model, which includes a gating network and multiple expert networks. The expert network adopts multiple complementary time series deep learning models. The MoE model is trained through the self-supervised task of time series reconstruction, so that the gating network dynamically assigns weights to the expert network according to the input segment features, and outputs a deep embedding vector of the power trading model. The specific steps are: S21: Build a self-supervised model for the MoE architecture; S22: Build a gating network and combine it with a mixture of experts model; S23: Self-supervised training using the MoE model.

4. The method according to claim 1, wherein The expert networks in S2 include multi-layer perceptrons, long short-term memory networks, temporal convolutional networks, transformers, and Mambas. Each expert network is responsible for capturing the static nonlinear characteristics, long-term dependencies, local multi-scale patterns, global dependencies, and efficient modeling features of long sequences of time series.

5. The method according to claim 1, wherein The working mechanism of the gated network in S2 is as follows: after extracting the features of the input time series fragment, the weight distribution of the expert network is output through the linear layer and the Softmax function, and the Top-K mechanism is used to select the K expert networks with the highest weights to participate in the calculation, and the final embedding vector is is the weighted sum of the selected experts' outputs: ， in The jth expert is the input Extracted embeddings; , that is, j belongs to the numerical value The first k largest values; Is the gating network for the jth expert as input The weight of the assignment.

6. The method according to claim 1, characterized in that The self-supervised training in S2 uses the mean square error loss function and the load balance loss function, and the total loss is: ,in is the mean square error, Load balancing loss, is the predicted output of the model, is the weight coefficient of load balancing loss.

7. The method according to claim 1, characterized in that The clustering algorithm in S3 is the K-means algorithm, which determines the optimal cluster number k by calculating the inertia value and average silhouette coefficient under different cluster numbers.

8. The method according to claim 1, characterized in that The multidimensional features in S4 include total transaction volume, peak time, night-to-day ratio, morning and evening dominance, off-peak period ratio, morning rising slope, evening peak sharpness, and daytime volatility. The characteristic differences of different user profiles are visualized through radar charts.

9. The method according to claim 1, characterized in that Behavioral pattern analysis in S5, including: S51: Input preprocessing and deep feature extraction; S52: security feature probabilistic matching; S53: Security feature determination and output.

10. The method according to claim 9, characterized in that The Bi-LSTM-CNN-Attention network used in S52 consists of two bidirectional long short-term memory layers, one convolutional layer, and one multi-head attention layer. The bidirectional long short-term memory layer includes 256 hidden units, the convolutional layer includes 128 hidden units, and the multi-head attention layer includes 8 attention heads.

Images