Power consumer anomaly detection and risk assessment method, system and device based on spatial-temporal feature fusion and storage medium

Abstract

The invention relates to the technical field of power grid data analysis, in particular to a power consumer anomaly detection and risk assessment method, system and device based on spatial-temporal feature fusion and a storage medium. The method comprises the following steps: acquiring multi-source power consumption data of various power consumers, constructing a space-time correlation feature extraction model, and establishing a user behavior space-time coupling relationship through time sequence analysis and spatial distribution characteristic analysis; constructing a multi-dimensional risk mapping model based on a long short term memory network and a convolutional neural network, establishing a nonlinear mapping relation from feature information to a risk assessment result, and identifying an abnormal power consumption behavior; establishing a distributed node credibility evaluation system, and performing credibility quantitative analysis on the data nodes in combination with a fuzzy comprehensive evaluation method; and based on an abnormal detection result and credibility evaluation, intelligent analysis and dynamic early warning of the electric charge management and control risk are realized. The time-space coupling characteristic of power consumption data can be fully mined, and high-precision identification of abnormal power consumption behaviors and accurate detection of non-technical power loss are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power grid data analysis, and in particular to a power user abnormality detection and risk assessment method, system, device and storage medium based on spatiotemporal feature fusion. BACKGROUND

[0002] With the continuous improvement of the intelligent level of the power system, the power user electricity consumption behavior presents complex and diverse characteristics, and the traditional electricity fee control and risk assessment method faces many challenges. The power user electricity consumption data has obvious time series characteristics and spatial distribution characteristics, and the electricity consumption behaviors of different users at different time periods and different geographical locations are different, and these differences imply rich abnormal information and risk characteristics.

[0003] The current power abnormality detection method mainly adopts a single-dimensional analysis method, and lacks comprehensive consideration of time and space characteristics. Although the traditional statistical analysis method can identify part of the abnormal electricity consumption behavior, the mining ability for complex nonlinear relationships and multi-dimensional coupling characteristics is limited. Most of the existing neural network methods focus on single time series analysis or spatial analysis, and fail to fully utilize the fusion advantages of spatiotemporal features, resulting in difficulty in meeting the actual needs of the power system in terms of accuracy and real-time of abnormality detection.

[0004] In terms of electricity fee control risk assessment, the existing method mainly relies on expert experience and simple threshold judgment, and lacks a systematic risk quantification analysis framework. The traditional risk assessment model often ignores the relevance and credibility difference between data nodes, and cannot accurately identify non-technical power loss, affecting the precision and efficiency of electricity fee control. At the same time, the existing assessment method lacks comprehensive analysis ability for multi-source data, and it is difficult to build a comprehensive risk assessment system. SUMMARY

[0005] In view of the problems existing in the prior art, the present application is proposed.

[0006] Therefore, the technical problems to be solved by the present application are: how to establish an abnormality detection method that can fully mine the spatiotemporal coupling characteristics of power user electricity consumption data, to realize high-precision identification of abnormal electricity consumption behavior; how to build an electricity fee risk assessment framework based on multi-dimensional feature fusion, to establish an accurate mapping relationship from feature information to risk assessment results; how to realize intelligent analysis and dynamic assessment of electricity fee control risk through the combination of distributed architecture and fuzzy theory, to improve the safety of power system operation.

[0007] To solve the above technical problems, the present application provides the following technical solutions:

[0008] In a first aspect, the embodiments of the present application provide a power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, which comprises: acquiring multi-source power consumption data of various power users, constructing a spatio-temporal correlation feature extraction model, analyzing the time sequence characteristics and spatial distribution characteristics of the power consumption data through the spatio-temporal correlation feature extraction model, establishing a user behavior spatio-temporal coupling relationship, and extracting a periodic regular pattern;

[0009] Based on the extracted spatio-temporal coupling characteristics, a multi-dimensional risk mapping model is constructed to establish a nonlinear mapping relationship from the feature information to the risk assessment result, and through the nonlinear mapping relationship, abnormal power consumption behavior is identified, and an abnormality detection early warning mechanism is constructed.

[0010] A distributed node credibility evaluation system is established, and a fuzzy comprehensive evaluation method is used to quantitatively analyze the credibility of each data node.

[0011] Based on the abnormality detection result and the credibility evaluation, intelligent analysis and dynamic early warning of electricity fee control risk are realized.

[0012] As a preferred scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, the method comprises: adopting a time series analysis method to mine the time sequence characteristics and periodic model of a specific power user.

[0013] Through correlation analysis and clustering mining, an association relationship between abnormal user behavior and the spatio-temporal state of each data node is established.

[0014] A spatio-temporal coupling feature matrix is constructed to quantify the mutual influence of user power consumption behavior in time and space dimensions.

[0015] As a preferred scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, the method comprises: constructing a time correlation mining model based on a long short-term memory network and a gated recurrent unit to learn the time sequence dependency relationship between data features; constructing a spatial correlation mining model through a convolutional neural network to mine the spatial distribution characteristics of power data at a specific time; and establishing a multi-layer nonlinear mapping function from spatio-temporal features to risk assessment.

[0016] As a preferred scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, the method comprises: fusing the time correlation mining model and the spatial correlation mining model at the feature layer to construct a unified abnormality detection network; setting an abnormal behavior recognition threshold to label and classify outlier feature data; and establishing a non-technical power loss detection mechanism based on a hybrid neural network.

[0017] As a preferred scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, the abnormality detection early warning mechanism comprises: establishing a risk level classification system based on the abnormality detection result; adjusting the risk weight in combination with the credibility evaluation result; establishing a fuzzy relation matrix, and performing comprehensive risk evaluation based on the maximum membership principle.

[0018] As a preferred scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, the establishment of the distributed node credibility evaluation system comprises: constructing a comprehensive evaluation model of the fuzzy weight vector and the membership matrix.

[0019] A data node credibility security domain based on a control factor is established, and a dynamic credibility evaluation is realized through a node credibility weight updating algorithm.

[0020] As a preferred scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, the intelligent analysis and dynamic early warning of the electricity fee control risk comprises: establishing a multi-view weighted balanced risk evaluation index system.

[0021] A calculation rule of the comprehensive risk index is constructed, and intelligent early warning information is generated based on the risk evaluation result and is dynamically adjusted.

[0022] In a second aspect, the embodiment of the present application provides a power user abnormality detection and risk assessment system based on spatio-temporal feature fusion, which comprises a data acquisition module, a multi-source power consumption data of various power users is acquired, a spatio-temporal correlation feature extraction model is constructed, a time sequence feature and a spatial distribution characteristic of the power consumption data are analyzed through the spatio-temporal correlation feature extraction model, a user behavior spatio-temporal coupling relationship is established, and a periodic regular pattern is extracted.

[0023] A risk mapping module, based on the extracted spatio-temporal coupling characteristics, constructs a multi-dimensional risk mapping model, establishes a nonlinear mapping relationship of feature information to risk evaluation result, identifies abnormal power consumption behavior through the nonlinear mapping relationship, and constructs an abnormality detection early warning mechanism.

[0024] A credibility evaluation module, a distributed node credibility evaluation system is established, and a credibility quantitative analysis is performed on each data node in combination with a fuzzy comprehensive evaluation method.

[0025] A risk evaluation module, based on the abnormality detection result and the credibility evaluation, realizes intelligent analysis and dynamic early warning of the electricity fee control risk.

[0026] In a third aspect, an embodiment of the present application provides a computer device comprising a memory and a processor, and the memory stores a computer program, wherein the computer program instructions are executed by the processor to implement the steps of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion according to the first aspect of the present application.

[0027] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program instructions are executed by the processor to implement the steps of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion according to the first aspect of the present application.

[0028] The present application has the following beneficial effects: by constructing a spatio-temporal correlation feature extraction model and a tensor decomposition method, the coupling characteristics of the power consumption data in the time series and spatial distribution dimensions can be simultaneously mined, and the problem of insufficient mining ability for complex nonlinear relationships is solved; a multi-dimensional risk mapping model constructed based on a long short-term memory network, a gated recurrent unit and a convolutional neural network realizes accurate nonlinear mapping of spatio-temporal features to risk assessment results, and improves the accuracy of abnormal power consumption behavior identification; through a distributed node credibility evaluation system and a fuzzy comprehensive evaluation method, the problem of ignoring data node correlation and credibility difference in traditional risk assessment methods is solved, and accurate identification and positioning of non-technical power loss are realized; finally, through a multi-perspective weighted balanced risk assessment framework and an intelligent early warning mechanism, systematic risk quantification analysis and dynamic early warning capability are provided for electricity fee control. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0030] Figure 1 Flowchart of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion;

[0031] Figure 2 Computer device diagram of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion;

[0032] Figure 3 Technical roadmap of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion. DETAILED DESCRIPTION

[0033] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0034] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be appreciated that the present application maybe practiced in a variety of ways beyond the specific embodiments described herein without departing from the present application. Accordingly, the present application is not limited to the specific embodiments described in the following description.

[0035] Second, the "one embodiment" or "an embodiment" as referred to herein means a specific feature, structure, characteristic, or combination of features and / or characteristics described herein that can be included in at least one implementation of the present application. The various instances of the "in one embodiment" that appear in various places in this specification are not necessarily all referring to the same embodiment nor are they necessarily all mutually exclusive of one another.

[0036] Embodiment 1

[0037] With reference to Figure 1 - Figure 2 For the first embodiment of the present application, the embodiment provides a power user abnormality detection and risk assessment method based on spatio-temporal feature fusion, comprising,

[0038] S100: Obtain multi-source power consumption data of various types of power users, construct a spatio-temporal correlation feature extraction model, analyze the time sequence features and spatial distribution characteristics of the power consumption data through the spatio-temporal correlation feature extraction model, establish the spatio-temporal coupling relationship of user behavior, and extract the periodic regular pattern;

[0039] S200: Based on the extracted spatio-temporal coupling characteristics, construct a multi-dimensional risk mapping model, establish a nonlinear mapping relationship of feature information to risk assessment results, identify abnormal power consumption behavior through the nonlinear mapping relationship, and construct an abnormality detection and early warning mechanism;

[0040] S300: Establish a distributed node credibility evaluation system, and combine a fuzzy comprehensive evaluation method to quantitatively analyze the credibility of each data node;

[0041] S400: Based on the abnormality detection results and the credibility evaluation, realize intelligent analysis and dynamic early warning of electricity fee control risks.

[0042] It should be noted that the power user power consumption data has complex space-time coupling characteristics and multi-dimensional abnormal performance forms, and the traditional single-dimensional analysis method is difficult to accurately identify hidden abnormal behavior and non-technical power loss. In the space-time correlation analysis process of power consumption data, the power consumption mode of different user nodes has time sequence periodicity difference and spatial distribution difference, and is affected by multiple factors such as external environmental factors, user behavior changes, equipment state, etc., so that the accuracy and real-time of abnormal detection are challenged. The existing risk assessment method often lacks quantitative analysis of the credibility of the data node, resulting in deviation of the risk assessment result, and cannot provide accurate decision support for electricity cost control.

[0043] Therefore, in view of the above-mentioned power consumption behavior abnormality detection and risk assessment problems, through the steps of S100-S400, a space-time correlation feature extraction model is constructed to mine the time sequence and spatial distribution rules of power consumption data, accurate establishment of user behavior space-time coupling relationship and periodic pattern extraction are realized; based on the multi-dimensional risk mapping model, the nonlinear mapping relationship of feature information to risk assessment result is established, the accurate identification of abnormal power consumption behavior and the construction of early warning mechanism are realized; through the distributed node credibility evaluation system combined with the fuzzy comprehensive evaluation method, the dynamic quantitative analysis of the credibility of the data node is realized; finally, based on the abnormal detection result and the credibility evaluation, the intelligent analysis and dynamic early warning of the electricity cost control risk are realized.

[0044] Embodiment 2

[0045] Referring to Figure 1 - Figure 3 , the second embodiment of the present application.

[0046] In this embodiment, the time sequence characteristics and spatial distribution characteristics of the power consumption data are analyzed by the space-time correlation feature extraction model in step S100 to establish the space-time coupling relationship of user behavior, including the following steps A1-A3:

[0047] A1: Adopting time series analysis method, mining the time sequence characteristics and periodic model of specific power users;

[0048] Specifically, in A1, the multi-source power consumption data of power users is first collected, including power consumption load data every 15 minutes, real-time monitoring data of voltage and current, power factor change data, and power equipment operation state information. Based on these collected data, time series feature extraction is performed through a sliding time window mechanism, and four different scale time windows are set, including hourly, daily, weekly, and monthly time windows. The hourly window is used to capture the fluctuation rules of short-term power consumption load of users and identify the power surge characteristics caused by device start-stop; the daily window is used to analyze the power consumption mode differences between weekdays and holidays and extract the peak-valley characteristics of typical daily load curves; the weekly window is used to mine the regular changes of power consumption behavior within a week and distinguish the power consumption modes of work periods and rest periods; the monthly window is used to identify seasonal power consumption rules, such as the periodic changes of air conditioning load in summer and heating load in winter. Through statistical analysis of the power consumption data in each time window, the time series feature vector of each user is constructed, including statistical features such as load mean, variance, skewness, kurtosis, and engineering features such as load peak-valley difference, peak-valley ratio, and load rate. An autoregressive integrated moving average model is used to decompose the time series data, separate the trend term to reflect the long-term growth or decay trend of power consumption load, the seasonal term to reflect the periodicity of power consumption, and the residual term to represent the random fluctuation component. The time domain signal is converted to frequency domain representation through fast Fourier transform to identify the main frequency components in the power consumption data, especially to extract the amplitude and phase information of typical periodic characteristics such as daily frequency and weekly frequency, forming user-specific frequency domain feature fingerprints. Specifically, the mutual information calculation formula of the time series features in A1 is:

[0049]

[0050] In the formula, I(X, Y) is the mutual information of the power consumption time series between users X and Y; P(x, y) is the joint probability distribution; P(x) and P(y) are the marginal probability distributions, respectively. This formula is used to quantify the nonlinear correlation of power consumption behavior between different users and provides a basis for subsequent association relationship analysis.

[0051] A2: Through association relationship analysis and clustering mining, the association relationship between abnormal user behavior and the space-time state of each data node is established;

[0052] Specifically, in A2, based on the time series features extracted in step A1, the association relationship between users and the spatial aggregation characteristics are further analyzed. First, the mutual information value of the power consumption time series between different user nodes is calculated to quantify the nonlinear time series correlation between nodes and identify user groups with similar power consumption patterns in the time dimension. At the same time, the geographical location information, power type label (residential, commercial, industrial), load level classification, and other attribute information of the users are combined to construct a multi-dimensional attribute feature vector of the user nodes.

[0053] The comprehensive similarity between users is calculated, and the time sequence similarity, geographical proximity and attribute similarity are comprehensively considered. A density-based spatial clustering algorithm is used to group users, identify user clusters with similar power consumption behavior patterns, and detect outlier user nodes that significantly deviate from normal patterns in power consumption behavior. For each user cluster, the power consumption behavior consistency index within the cluster and the difference index between clusters are calculated to establish a baseline mode of normal power consumption behavior.

[0054] In the spatial correlation analysis, a spatial adjacency graph of user nodes is constructed, and the spatial weight between nodes is defined based on geographical distance and power grid topology connection relationship. By analyzing the spatial autocorrelation of power consumption load between adjacent nodes, the propagation and influence mode of power consumption behavior in space is identified. Using the lag correlation analysis method, the correlation coefficient between user nodes under different time lags is calculated to determine the propagation time delay and influence range of abnormal power consumption behavior in the spatio-temporal network, providing a quantitative basis for modeling the spatio-temporal state correlation of abnormal behavior.

[0055] A3: Construct a spatio-temporal coupling feature matrix to quantify the mutual influence of user power consumption behavior in time and space dimensions.

[0056] Specifically, in A3, based on the analysis results of A1 and A2 steps, a tensor decomposition method is used to construct a spatio-temporal coupling feature matrix, and a three-dimensional spatio-temporal power consumption data tensor (user x time x space) is decomposed into a low-rank. First, arrange the time sequence features of each user extracted in A1 step in time order to form a user-time feature matrix; encode the spatial correlation relationship obtained by A2 step analysis according to geographical position to form a user-space correlation matrix; combine user attribute information to construct a complete three-dimensional data tensor.

[0057] Through CANDECOMP / PARAFAC decomposition of the tensor, the original tensor is decomposed into a linear combination of multiple rank-one tensors, and each decomposition component corresponds to a potential spatio-temporal coupling mode. The user dimension feature vector obtained by decomposition reflects the participation degree of different users in various spatio-temporal modes; the time dimension feature vector reflects the time sequence evolution law of various spatio-temporal modes; the space dimension feature vector represents the spatial distribution characteristics of various spatio-temporal modes.

[0058] Specifically, the mathematical expression of tensor decomposition in A3 is:

[0059]

[0060] In the formula, X is the original spatio-temporal power consumption data tensor; R is the rank number of decomposition; λ r is the weight of the rth component; a r , b r , c rare the feature vectors of user, time, and space dimension respectively; and denotes the tensor outer product operation. The formula extracts the latent structure of the spatio-temporal data through low-rank decomposition, and provides a basis for modeling the spatio-temporal coupling relationship of user behavior.

[0061] Based on the results of tensor decomposition, the coupling strength coefficient of any two user nodes under different spatio-temporal conditions is calculated. The coefficient comprehensively considers the similarity of users in time sequence characteristics, the proximity in spatial position, and the common participation in various spatio-temporal patterns. By setting a coupling strength threshold, user node pairs that exist mutual influence in the spatio-temporal dimension are identified, and a spatio-temporal influence network graph of user nodes is constructed.

[0062] Further, the spatio-temporal coupling feature matrix is normalized to eliminate the influence of different dimensional features, and principal component analysis method is used to reduce the dimension of high-dimensional spatio-temporal features, and the main components that best represent the spatio-temporal coupling relationship of users are extracted. These principal components are used as the spatio-temporal coupling feature vectors of user behavior, which are input into the subsequent risk mapping model for anomaly detection and risk assessment.

[0063] It should be noted that the A3 step can simultaneously consider the interaction of the three dimensions of time, space and user through tensor decomposition. The low-rank decomposition hypothesis conforms to the latent structure characteristics of the actual power consumption data, which is helpful for noise reduction and feature extraction. The construction of the spatio-temporal coupling strength matrix quantifies the degree of mutual influence between user nodes in the spatio-temporal dimension, and provides a quantitative dependence basis for subsequent risk mapping and anomaly detection.

[0064] In the present embodiment, based on the extracted spatio-temporal coupling characteristics in step S200, a multi-dimensional risk mapping model is constructed, a nonlinear mapping relationship from feature information to risk assessment results is established, and through the nonlinear mapping relationship, abnormal power consumption behavior is identified, and an anomaly detection and early warning mechanism is constructed, including the following steps B1-B3:

[0065] B1: The multi-dimensional risk mapping model includes constructing a time correlation mining model based on a long short-term memory network and a gated recurrent unit to learn the time sequence dependence relationship between data features; a spatial correlation mining model is constructed through a convolutional neural network to mine the spatial distribution characteristics of power data at a specific time; and a multi-layer nonlinear mapping function from spatio-temporal features to risk assessment is established.

[0066] Specifically, based on the spatiotemporal coupling feature vector extracted in B1, a deep learning model is constructed in each of the time and space dimensions. The time correlation mining model adopts a bidirectional long short-term memory network architecture, and the user spatiotemporal coupling feature vector obtained in step A3 is used as the network input. The influence of historical time sequence patterns on the current time is learned through the forward LSTM layer, and the guiding role of future time sequence trends on the current decision is learned through the backward LSTM layer. The network structure includes two layers of bidirectional LSTM, the hidden layer dimension is set to 128, and the dropout technology is used to prevent overfitting. The final output of each time step hidden state is used as the time dimension feature representation.

[0067] At the same time, a gated recurrent unit network is constructed as a lightweight supplement to the LSTM, which controls the degree of preservation of state information at the previous moment through the reset gate and determines the degree of acceptance of current input information through the update gate. The input of the GRU network is also the spatiotemporal coupling feature vector, which learns the long-term dependence of electricity consumption behavior through a single-layer GRU structure. The output dimension is consistent with the LSTM, and the outputs of the two networks are weighted and fused through the attention mechanism to obtain a comprehensive time correlation feature representation.

[0068] Specifically, the key calculation formula of the LSTM unit in B1 is:

[0069] h t =o t ⊙tanh(C t )

[0070]

[0071] In the formula, h t is the hidden state at time t; C t is the cell state; o t is the output gate; f t is the forget gate; i t is the input gate; and is the element-level multiplication. is the candidate cell state. This formula selectively retains and updates time sequence information through the gating mechanism, learning the long-term time sequence dependence of electricity consumption behavior.

[0072] The spatial correlation mining model is based on a two-dimensional convolutional neural network. First, the user spatial distribution information obtained in step A2 is converted into a regular grid representation, and each grid cell contains the aggregated electricity consumption information and spatiotemporal coupling features of the users in that region. The convolutional network adopts a multi-scale convolution kernel design, including a 3x3 convolution kernel to extract local spatial features, a 5x5 convolution kernel to capture medium-range spatial patterns, and a 7x7 convolution kernel to learn large-scale spatial correlations. The network includes three convolutional layers, each followed by batch normalization and ReLU activation functions. Through max-pooling operations, the spatial resolution is gradually reduced and the translational invariance of the features is enhanced.

[0073] The multi-layer nonlinear mapping function of the spatio-temporal features to the risk assessment is implemented by a deep feedforward neural network, and the network input is a splicing vector of the time correlation features and the space correlation features. The mapping network includes four fully connected layers, the first layer maps the input features to a 256-dimensional hidden space, the second layer and the third layer are dimensionally reduced to 128 dimensions and 64 dimensions respectively, and the complex nonlinear relationship between the features is learned through layer-by-layer abstraction. The output layer uses a sigmoid activation function to map the risk assessment result to the interval [0, 1], indicating the probability of occurrence of abnormal behavior.

[0074] B2: identifying abnormal power consumption behavior through a nonlinear mapping relationship includes fusing the time correlation mining model and the space correlation mining model at the feature layer to construct a unified anomaly detection network; setting an abnormal behavior recognition threshold to label and classify the outlier feature data; and establishing a non-technical power loss detection mechanism based on a hybrid neural network.

[0075] Specifically, in B2, the time and space correlation mining models constructed based on the B1 step are fused at the feature layer to construct a unified anomaly detection network. First, the output features of the time correlation model and the space correlation model are dimensionally aligned, and different dimensional features are mapped to a unified feature space through linear transformation. A weighted fusion strategy is adopted, and the fusion weight is learned by a separate attention network, which takes the similarity and complementarity of the time and space features as input and outputs dynamic weight coefficients of the time and space features.

[0076] The fused features are input into the anomaly detection classification network, which adopts a binary classification architecture and is trained by a cross-entropy loss function. The network outputs an abnormal probability score, and a dynamic threshold is set in combination with the user's historical behavior benchmark and the current detection scenario. The threshold determination adopts a statistical analysis method based on validation data, calculates the risk assessment distribution of normal power consumption behavior, selects the optimal threshold point that balances the false positive rate and the false negative rate, and adjusts considering the differences of different power consumption types and power consumption scales.

[0077] Specifically, the calculation formula of the local outlier factor in B2 is:

[0078]

[0079] In the formula, LOF k (p) is the local outlier factor of data point p; N k (p) is the k-neighborhood set of p; lrd k is the local reachable density. The formula identifies outliers by comparing the density difference between the data point and its neighborhood, and is used to label abnormal power consumption behavior.

[0080] For the identified outlier feature data, a local outlier factor-based labeling method is adopted. The local density of each data point is calculated, and the outlier points with low local density are identified by comparing the density difference of the data point with other points in its neighborhood. The degree of outlying is quantified by the outlier factor, and the data points exceeding the set threshold are labeled as abnormal behavior candidates. Further combined with the temporal continuity and spatial consistency constraints of power consumption behavior, false abnormalities caused by data noise or incidental events are filtered out.

[0081] The non-technical power loss detection mechanism is specifically designed for electricity theft, metering failure, line loss anomaly, etc. By comparing the difference between the user reported power consumption and the grid metering data, the user nodes with metering anomalies are identified. Combined with the normal power consumption space-time pattern learned in B1 step, it is analyzed whether the abnormal power consumption behavior conforms to the typical non-technical loss characteristics, such as load sudden reduction, power factor anomaly, voltage and current waveform distortion, etc. The detection algorithm integrates statistical threshold detection, machine learning classification and expert rule judgment three methods, and determines the final detection result through weighted voting mechanism.

[0082] B3: Constructing an abnormal detection and early warning mechanism includes establishing a risk level classification system based on the abnormal detection results, adjusting the risk weight combined with the credibility evaluation results, and establishing a fuzzy relationship matrix for comprehensive risk evaluation based on the maximum membership principle.

[0083] Specifically, in B3 based on the abnormal detection results of B2 step, a multi-level risk early warning system is constructed. The risk level classification adopts a four-level system: low risk corresponds to the detection probability 0.0-0.3 interval, indicating normal power consumption behavior and no special attention is needed; medium risk corresponds to the interval 0.3-0.6, indicating there are slight abnormal signs, which need to be monitored regularly and trend analyzed; high risk corresponds to the interval 0.6-0.8, indicating there are obvious abnormal behaviors, which need to be checked and verified by human and on-site inspection in time; extremely high risk corresponds to the interval 0.8-1.0, indicating there are serious abnormal behaviors, which need to be checked and disposed immediately.

[0084] The risk weight adjustment mechanism combines the credibility evaluation results of S300 step to differentially process the detection results of different data sources. The abnormality detected by high credibility nodes is given higher confidence weight, and the detection results of low credibility nodes are down-weighted. The adjustment algorithm calculates the comprehensive credibility coefficient according to the historical detection accuracy, equipment health status, communication quality and other factors of the node, and adjusts the original risk evaluation score through exponential weighting method.

[0085] Specifically, the risk weight adjustment formula in B3 is:

[0086] Risk adjusted =Risk original ×(Credibility weight )α

[0087] where Risk adjusted is the adjusted risk score; Risk original is the original risk score; Credibility weight is the node credibility weight; a is the adjustment index, usually taking the value of 0.5-1.0. The formula adjusts the weight of the anomaly detection result according to the credibility of the data node.

[0088] The establishment of the fuzzy relationship matrix comprehensively considers various risk factors, including the abnormality degree of power consumption, the time sequence pattern deviation degree, the spatial correlation anomaly, and the equipment state anomaly. The matrix elements represent the membership relationship between each risk factor and the final risk level, and the membership degree function parameters are determined through expert knowledge and historical data statistics. The maximum membership degree decision principle selects the level with the maximum membership degree as the final risk assessment result by calculating the comprehensive membership degree of each risk level, and outputs the membership degree distribution of each level as a decision confidence reference.

[0089] The warning information generation is based on risk level and user importance for priority sorting, and high-risk high-importance users are given priority for early warning. The warning content includes abnormal behavior description, risk level evaluation, and suggested disposal measures. The warning information is pushed through multiple channels, including system interface display, SMS notification, email report, etc., to ensure that relevant personnel receive and handle abnormal situations in a timely manner.

[0090] In the present embodiment, the distributed node credibility evaluation system is established in step S300, including the following steps C1-C3:

[0091] C1: Construct a comprehensive evaluation model of fuzzy weight vector and membership matrix;

[0092] Specifically, in C1, based on the analysis results of the previous steps A1-A3 and B1-B3, a multi-dimensional evaluation index system of node credibility is constructed. The evaluation indexes include four aspects of data quality dimension, equipment state dimension, communication quality dimension, and historical performance dimension. The data quality dimension evaluates the integrity, consistency and rationality of the data through the time sequence feature analysis results of step A1, including indicators such as missing rate, abnormal value proportion, time sequence continuity, etc.; the equipment state dimension evaluates the health status of the data acquisition equipment in combination with the equipment operation monitoring data, including indicators such as sensor accuracy, equipment failure rate, maintenance cycle, etc.; the communication quality dimension evaluates the reliability of data transmission through network transmission performance, including indicators such as transmission delay, packet loss rate, signal strength, etc.; the historical performance dimension evaluates the detection accuracy and stability of the node based on the historical records of anomaly detection in step B2.

[0093] Specifically, the combined weight calculation formula in C1 is:

[0094] W = a x W subjective + (1 - a) x W objective

[0095] where W is the final combination weight vector; W subjective is the subjective weight obtained by expert evaluation; W objective is the objective weight calculated based on information entropy; a is the combination coefficient, usually taking the value of 0.6-0.8. The formula balances subjective experience and objective data, ensuring the rationality of weight distribution.

[0096] The construction of the fuzzy weight vector adopts the method of combining the analytic hierarchy process and the entropy weight method. The relative importance of each evaluation index is determined through expert evaluation, a pair-wise comparison judgment matrix is constructed and the characteristic vector is calculated to obtain the subjective weight vector. At the same time, the information entropy of each node is calculated based on the historical data of the index, and the smaller the information entropy, the stronger the distinguishing ability of the index, and the greater the corresponding objective weight. The final combination weight is calculated by convex combination of the subjective weight and the objective weight, and the combination coefficient is dynamically determined according to the reliability of expert knowledge and the sufficiency of historical data.

[0097] The establishment of the membership matrix adopts the method of combining piecewise linear membership function and Gaussian membership function. For indexes with clear threshold limits, such as missing rate, proportion of abnormal values, etc., piecewise linear function is used to define the membership degree; for continuously changing indexes, such as transmission delay, signal strength, etc., Gaussian function is used to describe the membership relationship. The parameters of the membership function are determined through statistical analysis of historical data to ensure that the function shape conforms to the actual data distribution characteristics.

[0098] The fuzzy comprehensive evaluation is realized by fuzzy matrix compound operation, and the weighted average operator is used to process the fuzzy relationship to obtain the membership degree vector of each node at different confidence levels. The evaluation result is converted into a confidence value score through normalization processing, and the score range is [0, 1], the higher the score, the higher the node confidence.

[0099] C2: Establish a data node confidence security domain based on control factors;

[0100] Specifically, in C2, based on the node confidence evaluation results obtained in C1 step, the confidence security domain boundary is constructed. The selection of control factors is based on the correlation analysis results of A2 step, focusing on the key indicators that have the greatest impact on anomaly detection performance. The most representative control factors are selected from the multi-dimensional evaluation indexes through feature selection algorithm, usually including data integrity, device health status, communication stability, detection accuracy, etc. core indicators.

[0101] The construction of the security domain adopts the support vector data description method, and the data of the high-confidence nodes with good historical performance and accurate detection are taken as normal samples to solve the minimum hypersphere surrounding the samples by optimization. The center and radius of the hypersphere are determined by the training data, and the area within the hypersphere is defined as the confidence security domain. For a new node or a state-changed existing node, whether the node is within the security domain is determined by calculating the distance of the control factor vector of the node to the center of the security domain.

[0102] Specifically, the security domain boundary judgment formula in C2 is:

[0103] f(x) = ‖x-a‖ 2 -R 2

[0104] In the formula, f(x) is the security domain judgment function of the node x, a is the center of the security domain, and R is the radius of the security domain. When f(x)≤0, the node is within the security domain and has high confidence. The formula determines the confidence and security state of the node by distance measurement.

[0105] The dynamic adjustment mechanism of the security domain boundary combines the early warning results of the B3 step. When it is detected that the nodes near the security domain boundary have abnormal behaviors, the security domain boundary is appropriately contracted; when the nodes within the boundary have long-term stable performance, the security domain range is appropriately expanded. The adjustment range is controlled by the set safety margin to ensure that the security domain is neither too conservative to affect system efficiency nor too loose to reduce safety level.

[0106] The confidence level management is realized based on the distance of the node to the security domain boundary. The closer the node is to the center of the security domain, the higher the confidence level of the node, and the closer the node is to the boundary, the lower the confidence level of the node. The classification results are used for subsequent weight allocation and detection result adjustment. The detection results of high-level nodes obtain higher weights, and the detection results of low-level nodes need additional verification.

[0107] C3: Dynamic confidence evaluation is realized by the weight allocation algorithm based on node confidence.

[0108] Specifically, in C3, based on the confidence evaluation results of C1 and C2 steps, the dynamic allocation and update of node weights are realized. The weight allocation algorithm adopts the Bayesian update framework, taking the prior confidence distribution of the node as the initial weight. With the arrival of new detection data and performance feedback, the posterior probability distribution is recursively updated by the Bayesian formula. The prior distribution is determined based on the security domain analysis results of the C2 step. The nodes within the security domain have higher prior confidence, and the nodes outside the security domain have lower prior confidence.

[0109] Specifically, the Bayesian weight update formula in C3 is:

[0110] P(θ t |Dt ) ∝ P(D t | θ t ) × P(θ t-1 | D t-1 )

[0111] where P(θ t | D t ) is the posterior belief distribution at time t; P(D t | θ t ) is the likelihood function; P(θ t-1 | D t-1 ) is the prior distribution. The formula realizes the dynamic adjustment of node belief through the Bayesian updating mechanism.

[0112] The dynamic updating mechanism combines the forgetting factor, gives the historical data an exponentially decaying weight, and enables the algorithm to quickly adapt to the changes in node state. The value of the forgetting factor is determined according to the balance between the stability requirement and the response speed requirement of the system, and is usually between 0.9 and 0.99. The weight updating formula comprehensively considers the current detection performance, historical performance and forgetting decay.

[0113] The state estimation method adopts the Kalman filter framework, takes the node belief as the system state variable, and takes the accuracy of the detection result as the observation variable. By establishing the state transition equation and the observation equation, the optimal value of the node belief is recursively estimated. The state transition equation describes the time evolution law of the belief, and the observation equation establishes the relationship between the belief and the detection performance. The prediction and update steps of the Kalman filter are alternately performed, the prediction step is based on the system model to predict the belief state at the next time, and the update step is combined with the new observation data to correct the prediction result.

[0114] The application of the belief weight is reflected in the adjustment of the abnormal detection result in step S200. The detection result of the high belief node is directly used, and the detection result of the low belief node needs to be cross-verified with the detection result of the neighbor node. When multiple high belief nodes detect the same anomaly, the confidence of the abnormal alarm is improved; when only low belief nodes detect the anomaly, the alarm priority is reduced and manual confirmation is required.

[0115] In the embodiment, the intelligent analysis and dynamic early warning of electricity management risk are realized in step S400, including the following steps D1-D3:

[0116] D1: Establish a multi-perspective weighted balanced risk assessment index system;

[0117] Specifically, in D1, based on the analysis results of steps S100-S300, a multi-dimensional risk assessment indicator system is constructed. The indicator system is designed from four perspectives: abnormal behavior risk, economic loss risk, system security risk, and social impact risk. Abnormal behavior risk is based on the anomaly detection results of step S200, including indicators such as anomaly probability, anomaly duration, and anomaly severity; economic loss risk analyzes the economic impact of non-technical power losses, including indicators such as lost electricity volume, loss amount, and difficulty of recovery; system security risk considers the impact of abnormal behavior on power grid operation, including indicators such as load impact, power quality impact, and cascading reaction risk; and social impact risk assesses the social consequences of abnormal behavior, including indicators such as user complaints, media attention, and regulatory risks.

[0118] The multi-perspective weighting mechanism is designed based on the importance and urgency of each risk type. Opinions from experts in different fields, including power systems, risk management, and economics, are collected using the Delphi expert survey method to form an expert weight matrix. Simultaneously, statistical analysis of historical loss events is used to calculate the actual loss proportion caused by different risk types, resulting in an objective weight vector. The final weights are determined by a weighted average of the expert weights and the objective weights, with the weight coefficients dynamically adjusted according to the characteristics of the decision-making scenario.

[0119] Balance constraints ensure the coordination of risk indicators from various perspectives, preventing any single indicator from dominating the overall risk assessment result. By setting upper and lower bound constraints on indicator weights, the weight of any single indicator is limited to no more than 40% of the total weight, ensuring the balance of multi-perspective assessments. Simultaneously, correlation analysis between indicators is introduced to identify highly correlated redundant indicators and merge or adjust them, improving the independence and reliability of the indicator system.

[0120] The standardization process employs a piecewise standardization method. Linear standardization is used for indicators with defined thresholds, while normal standardization is used for continuously distributed indicators. The standardization parameters are determined based on the distribution characteristics of historical data and are periodically updated according to changes in the system operating environment.

[0121] D2: Calculation rules for constructing a comprehensive risk index;

[0122] Specifically, in D2, based on the indicator system established in step D1, a calculation framework for the comprehensive risk index is constructed. The calculation framework adopts a hierarchical structure. First, indicators are aggregated within each risk perspective to obtain risk scores within that perspective. Then, weighted fusion is performed between perspectives to obtain the comprehensive risk index.

[0123] Specifically, the formula for calculating the comprehensive risk index in D2 is as follows:

[0124]

[0125] where Risk total is the comprehensive risk index; w i is the weight of the i-th risk perspective; r ij is the standardized risk value of the j-th indicator under the i-th perspective; m i is the number of indicators for the i-th perspective; λ is the time decay coefficient; t is the time distance. This formula calculates the comprehensive risk by geometric mean and weighted fusion, considering the time decay effect.

[0126] The risk aggregation within the perspective uses the geometric mean method to avoid the compensation effect that may be caused by linear weighting. The geometric mean can ensure that when a key indicator is zero, the risk score of this perspective is also zero, reflecting the "short board effect" in risk assessment. For the abnormal behavior risk perspective, the aggregation formula is the geometric mean of each anomaly detection indicator multiplied by the credibility weight coefficient obtained in step S300.

[0127] The inter-perspective comprehensive fusion is based on the perspective weights determined by the analytic hierarchy process, and uses weighted arithmetic mean to calculate the comprehensive risk index. The calculation of the comprehensive risk index also introduces a time decay factor, which gives an exponential decay weight to historical risk events, making the risk assessment more focused on recent abnormal situations. The time decay factor sets different decay rates according to the characteristics of the risk type.

[0128] The dynamic adjustment mechanism of the risk index considers the influence of external environmental factors, including seasonal changes, policy adjustments, market fluctuations, etc. By establishing an environmental factor correction model, the basic risk index is adjusted in context. The correction model is based on regression analysis of historical data and regularly updates parameters according to new data.

[0129] The output range of the comprehensive risk index is standardized to [0, 100], which is convenient for understanding and application. The corresponding relationship between the risk index and the risk level is: 0-25 is low risk, 25-50 is medium risk, 50-75 is high risk, and 75-100 is extremely high risk. Each risk level corresponds to different control strategies and response measures.

[0130] D3: Generate intelligent early warning information based on risk assessment results and dynamically adjust.

[0131] Specifically, in D3, based on the comprehensive risk index calculated in step D2, an intelligent early warning information generation and dynamic adjustment mechanism is constructed. The early warning information generation uses a combination of templating and personalization. The early warning template is pre-set according to the risk level and risk type, including standard content such as risk description, impact analysis, and disposal suggestions. Personalized information is generated based on the specific user's abnormal characteristics and historical situation, including specific manifestations of abnormal behavior, possible cause analysis, and targeted disposal measures.

[0132] Specifically, the early warning priority calculation formula in D3 is:

[0133] Priority = Risk total × Importance user × Urgency factor

[0134] where Priority is the early warning priority score; Risk total is the comprehensive risk index; Importance user is the user importance coefficient; Urgency factor is the urgency factor. The formula considers the risk level, user importance, and handling urgency to determine the early warning priority.

[0135] The early warning priority ranking considers the risk index, user importance, and handling urgency. User importance is evaluated based on electricity capacity, electricity type, social influence, and other factors. Important users' abnormal situations are given higher handling priority. Handling urgency is evaluated according to the development trend and potential consequences of abnormal behavior. Abnormal situations that deteriorate quickly need priority handling.

[0136] The dynamic adjustment mechanism optimizes the early warning strategy based on feedback from early warning handling. By tracking early warning accuracy, handling effectiveness, user satisfaction, and other indicators, the performance of the early warning system is evaluated. For cases with low early warning accuracy, improvements are made by adjusting the abnormal detection threshold, optimizing credibility evaluation parameters, and updating the risk assessment model. For cases with poor handling effectiveness, measures such as improving handling processes, strengthening personnel training, and improving technical means are taken to improve handling capacity.

[0137] Early warning information push adopts a multi-channel hierarchical push strategy, selecting appropriate push channels according to risk level and user type. Low-risk early warning is pushed through internal system messages, medium-risk early warning is pushed through email and SMS, high-risk early warning is pushed through phone and on-site notification, and extremely high-risk early warning starts the emergency response process. Push content is customized according to the recipient's role and authority, with technical details received by operation and maintenance personnel, decision support information received by management personnel, and coordination information received by relevant departments.

[0138] Early warning effect evaluation is achieved through the establishment of a closed-loop feedback mechanism, tracking the handling process and final results of each early warning event, and analyzing the timeliness and accuracy of early warning. Evaluation results are used to continuously optimize early warning algorithms, adjust early warning strategies, and improve handling processes, forming the self-learning and continuous improvement capabilities of the early warning system.

[0139] In summary, in terms of spatio-temporal feature extraction, the use of multi-scale time window design and mutual information calculation can comprehensively capture the use behavior characteristics at different time granularities, the decomposition and separation of the autoregressive integral moving average model can determine the deterministic pattern and random fluctuations, and the frequency domain analysis can reveal the hidden periodicity. In the risk mapping model construction, the combination of bidirectional LSTM and GRU network can fully capture the bidirectional time sequence dependence of use behavior, the multi-scale convolution design can extract the correlation pattern in different spatial ranges, the feature layer fusion can avoid the limitations of single feature, and the local outlier factor detection can identify complex abnormal patterns. In the credibility evaluation system, the combination of analytic hierarchy process and entropy weight method balances subjective judgment and objective analysis, the support vector data description method processes high-dimensional nonlinear credibility evaluation problems, and the Bayesian update mechanism provides a theoretically optimal weight allocation strategy. The abnormal behavior of power users is accurately identified, the credibility is dynamically quantitatively evaluated, and the risk is intelligently analyzed and warned.

[0140] Embodiment 3

[0141] The above is an illustrative scheme of a power user abnormality detection and risk assessment method based on spatio-temporal feature fusion. It should be noted that the technical scheme of the power user abnormality detection and risk assessment system based on spatio-temporal feature fusion is the same as the technical scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion described above. The technical scheme of the power user abnormality detection and risk assessment system based on spatio-temporal feature fusion in this embodiment is not described in detail, and can be referred to the description of the technical scheme of the power user abnormality detection and risk assessment method based on spatio-temporal feature fusion.

[0142] The embodiment also provides a power user abnormality detection and risk assessment system based on spatio-temporal feature fusion, which comprises:

[0143] The data acquisition module acquires multi-source power consumption data of various power users, constructs a spatio-temporal correlation feature extraction model, analyzes the time sequence characteristics and spatial distribution characteristics of the power consumption data through the spatio-temporal correlation feature extraction model, establishes the spatio-temporal coupling relationship of user behavior, and extracts the periodicity pattern;

[0144] The risk mapping module, based on the extracted spatio-temporal coupling characteristics, constructs a multi-dimensional risk mapping model, establishes a nonlinear mapping relationship from feature information to risk assessment results, identifies abnormal use behavior through the nonlinear mapping relationship, and constructs an abnormality detection and warning mechanism;

[0145] The credibility evaluation module establishes a distributed node credibility evaluation system and quantitatively analyzes the credibility of each data node by combining the fuzzy comprehensive evaluation method;

[0146] The risk assessment module realizes intelligent analysis and dynamic early warning of electricity management and control risks based on the anomaly detection result and the credibility assessment.

[0147] The embodiment also provides an electronic device suitable for the case of the power user anomaly detection and risk assessment based on spatio-temporal feature fusion, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the method for realizing the power user anomaly detection and risk assessment based on spatio-temporal feature fusion proposed in the above embodiment.

[0148] The embodiment also provides a storage medium having a computer program stored thereon, and the program is executed by a processor to realize the method for realizing the power user anomaly detection and risk assessment based on spatio-temporal feature fusion proposed in the above embodiment.

[0149] The storage medium proposed in the embodiment and the method for realizing the power user anomaly detection and risk assessment based on spatio-temporal feature fusion proposed in the above embodiment belong to the same inventive concept, and the technical details not described in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.

[0150] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH memory, a hard disk or an optical disk, and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.

[0151] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion, characterized in that: This includes acquiring multi-source electricity consumption data from various types of electricity users, constructing a spatiotemporal correlation feature extraction model, analyzing the temporal characteristics and spatial distribution features of electricity consumption data through the spatiotemporal correlation feature extraction model, establishing the spatiotemporal coupling relationship of user behavior, and extracting periodic patterns. Based on the extracted spatiotemporal coupling characteristics, a multi-dimensional risk mapping model is constructed to establish a nonlinear mapping relationship between feature information and risk assessment results. Through the nonlinear mapping relationship, abnormal electricity consumption behavior is identified, and an abnormal detection and early warning mechanism is constructed. Establish a distributed node credibility assessment system and combine fuzzy comprehensive evaluation method to conduct quantitative analysis of the credibility of each data node; Based on anomaly detection results and credibility assessment, intelligent analysis and dynamic early warning of electricity fee control risks are achieved.

2. The method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion as described in claim 1, characterized in that: The step of analyzing the temporal characteristics and spatial distribution of electricity consumption data through a spatiotemporal correlation feature extraction model and establishing the spatiotemporal coupling relationship of user behavior includes using time series analysis methods to mine the temporal characteristics and periodic models of specific electricity users. By using correlation analysis and cluster mining, we can establish the correlation between abnormal user behavior and the spatiotemporal state of each data node. A spatiotemporal coupled feature matrix is ​​constructed to quantify the mutual influence of user electricity consumption behavior in the time and space dimensions.

3. The method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion as described in claim 2, characterized in that: The construction of the multi-dimensional risk mapping model includes: building a time correlation mining model based on long short-term memory networks and gated recurrent units to learn the temporal dependencies between data features; and building a spatial correlation mining model through convolutional neural networks to mine the spatial distribution characteristics of power data at a specific time. Establish a multi-layer nonlinear mapping function from spatiotemporal characteristics to risk assessment.

4. The method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion as described in claim 3, characterized in that: The method of identifying abnormal electricity consumption behavior through nonlinear mapping includes fusing the time correlation mining model and the spatial correlation mining model at the feature layer to construct a unified anomaly detection network. Set thresholds for identifying abnormal behavior, and label and classify outlier characteristic data; establish a non-technical power loss detection mechanism based on hybrid neural networks.

5. The method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion as described in claim 4, characterized in that: The construction of the anomaly detection and early warning mechanism includes establishing a risk level classification system based on the anomaly detection results; Adjust risk weights based on credibility assessment results; A fuzzy relation matrix is ​​established, and a comprehensive risk assessment is conducted based on the principle of maximum membership.

6. The method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion as described in claim 5, characterized in that: Establishing a distributed node credibility evaluation system includes constructing a comprehensive evaluation model based on fuzzy weight vectors and membership matrices; Establish a data node trustworthiness security domain based on control factors; Dynamic credibility assessment is achieved through a node credibility allocation weight update algorithm.

7. The method for power user anomaly detection and risk assessment based on spatiotemporal feature fusion as described in claim 6, characterized in that: The intelligent analysis and dynamic early warning of electricity cost control risks include establishing a multi-perspective weighted and balanced risk assessment indicator system; Establish calculation rules for the comprehensive risk index; Intelligent early warning information is generated based on the risk assessment results and dynamically adjusted.

8. A power user anomaly detection and risk assessment system based on spatiotemporal feature fusion, based on the power user anomaly detection and risk assessment method based on spatiotemporal feature fusion as described in any one of claims 1 to 7, characterized in that: It also includes a data acquisition module, which acquires multi-source electricity consumption data from various types of electricity users, constructs a spatiotemporal correlation feature extraction model, analyzes the temporal characteristics and spatial distribution characteristics of electricity consumption data through the spatiotemporal correlation feature extraction model, establishes the spatiotemporal coupling relationship of user behavior, and extracts periodic patterns. The risk mapping module, based on the extracted spatiotemporal coupling characteristics, constructs a multi-dimensional risk mapping model, establishes a nonlinear mapping relationship between feature information and risk assessment results, identifies abnormal electricity consumption behavior through the nonlinear mapping relationship, and constructs an abnormal detection and early warning mechanism. The credibility assessment module establishes a distributed node credibility assessment system and combines fuzzy comprehensive evaluation method to perform quantitative analysis of the credibility of each data node. The risk assessment module, based on anomaly detection results and credibility assessment, enables intelligent analysis and dynamic early warning of electricity cost control risks.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the power user anomaly detection and risk assessment method based on spatiotemporal feature fusion as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the power user anomaly detection and risk assessment method based on spatiotemporal feature fusion as described in any one of claims 1 to 7.

Images