A method and device for detecting abnormal data

Abstract

The present application discloses a method and device for detecting abnormal data. The detection method includes: obtaining a power data set, where the power data set includes multiple power data; calculating the support degrees between the power data and generating a support degree matrix; clustering the support degrees in the support degree matrix according to the total support degree of each row of data in the support degree matrix to obtain multiple sub-clusters; comparing the multiple sub-clusters to detect abnormal data and obtaining an abnormal detection result of the power data. In the present application, the total support degree of each row of data in the support degree matrix is used as the center of a sub-cluster, without the need to artificially pre-define the clustering cluster center in advance, nor to determine the threshold and density definition in advance. The present application can adaptively adjust the clustering weight according to the total support degree calculated by the individual model, reduce the requirements for the data structure in the clustering process, so as to be applicable to more different data and improve the data adaptability of the abnormal data detection method.

Description

Technical Field

[0001] This application relates to the field of power grid security, and particularly to a method and device for detecting abnormal data. Background Art

[0002] The power grid power system collects power observation data through a monitoring and data acquisition system for state estimation. However, during the long-term operation of the power grid power system, it may be subject to false data injection attacks, resulting in the tampering of power observation data, thereby causing deviations in the state estimation results of the power system and seriously endangering the actual benefits of the power grid.

[0003] Currently, abnormal data is mainly detected through single physical space security protection technologies or information space anomaly detection technologies such as distance clustering algorithms or density distance clustering algorithms. However, the traditional distance clustering algorithm requires artificial pre-determination of the clustering cluster center, and the traditional density distance clustering algorithm requires prior determination of the threshold and density definition, resulting in too high requirements for the data shape structure in hierarchical clustering. It can be seen that the current abnormal data detection method has the problem of poor data adaptability. Summary of the Invention

[0004] This application provides a method and device for detecting abnormal data, aiming to solve the problem of poor data adaptability existing in the current abnormal data detection method.

[0005] To solve the above technical problems, in the first aspect, an embodiment of this application provides a method for detecting abnormal data, including:

[0006] Obtain a power data set, where the power data set includes a plurality of power data;

[0007] Calculate the support degrees between the power data and generate a support degree matrix;

[0008] Cluster the support degrees in the support degree matrix according to the sum of the support degrees of each row of data in the support degree matrix to obtain a plurality of sub-clusters;

[0009] Compare the plurality of sub-clusters to detect abnormal data and obtain the abnormal detection result of the power data.

[0010] In this embodiment, the association relationship between data is presented by calculating the support degree between the power data and generating a support degree matrix; and according to the total support degree of each row of data in the support degree matrix, the support degrees in the support degree matrix are clustered to obtain multiple sub-clusters, and the multiple sub-clusters are compared to detect abnormal data, so as to obtain the abnormal detection result of the power data. Different from the traditional distance clustering algorithm and the traditional density distance clustering algorithm, in this application, the total support degree of each row of data in the support degree matrix is used as the center of a sub-cluster, without the need to artificially pre-determine the clustering cluster center in advance, nor to determine the threshold and density definition in advance. This application can adaptively adjust the clustering weight according to the total support degree calculated by the individual model, reduce the requirements for the data structure in the clustering process, so as to be applicable to more different data and improve the data adaptability of the abnormal data detection method.

[0011] In one embodiment, the obtaining of the power data set includes:

[0012] Obtain power observation data, where the power observation data includes numerical data and text data;

[0013] Perform numerical normalization on the numerical data and text data to obtain multiple pieces of the power data, and the multiple pieces of the power data form the power data set.

[0014] In this embodiment, the power observation data is uniformly transformed into power data through numerical normalization to standardize the power observation data, so as to facilitate subsequent data operations and improve data operation efficiency.

[0015] In one embodiment, the calculating the support degree between the power data and generating a support degree matrix includes:

[0016] Based on the power data, calculate the Euclidean distance between the power data;

[0017] Based on the Euclidean distance between the power data, use a preset support degree formula to calculate the support degree between the power data;

[0018] Generate the support degree matrix according to the support degrees between all the power data;

[0019] Among them, the support degree formula is:

[0020] Sup=(1-d N (a i , a j )) k , k>0, a i =(x1, x2,..., x i ), a j =(x1, x2,..., xj )

[0021]

[0022] where Sup is the support, a i is the i-th power data, a j is the j-th power data, d N (a i , a j ) is the normalized Euclidean distance between power data a i and power data a j , x i is the i-th data vector in power data a i , x j is the j-th data vector in power data a j .

[0023] In this embodiment, by calculating the Euclidean distance between power data, the similarity between power data is obtained, the support is determined based on the Euclidean distance, and all supports are constructed into a support matrix, so as to obtain the association relationship between power data, and the support matrix with the association relationship of power data can be used for clustering, thereby improving data adaptability.

[0024] In one embodiment, clustering the supports in the support matrix according to the sum of the supports of each row of data in the support matrix to obtain multiple sub-clusters, including:

[0025] Step 1, calculate the sum of the supports of each row of data in the support matrix, and add the sum of the supports to the corresponding row of the support matrix;

[0026] Step 2, determine the maximum sum of the supports among the multiple sums of the supports, and determine the maximum support in each column of data;

[0027] Step 3, take the column data corresponding to the target maximum support as the same sub-cluster to obtain a sub-cluster, where the target maximum support is the maximum support in the same row as the maximum sum of the supports;

[0028] Step 4, delete the column data corresponding to the target maximum support in the support matrix to obtain a new support matrix;

[0029] Repeat steps 1 to 4 iteratively until a preset iteration stop condition is reached to obtain multiple sub-clusters.

[0030] In this embodiment, by calculating the sum of the support degrees of each row of data in the support degree matrix and using the sum of the support degrees as the center point of the sub-cluster for this iteration, and then comparing the maximum support degree in each column of the support degrees with the sum of the support degrees. If the maximum support degree and the sum of the support degrees are in the same row, it indicates that the maximum support degree is near the center point of the sub-cluster. Therefore, all the maximum support degrees near the center point of the sub-cluster in this iteration are used as a sub-cluster, and the iteration process is repeated to obtain multiple sub-clusters. Different from the traditional distance clustering algorithm and the traditional density distance clustering algorithm, there is no need to artificially pre-determine the clustering cluster center in advance, nor to determine the threshold and density definition in advance, which reduces the requirements for the data structure in the clustering process and improves the data adaptability in the clustering process.

[0031] In one embodiment, before clustering the support degrees in the support degree matrix according to the sum of the support degrees of each row of data in the support degree matrix to obtain multiple sub-clusters, it further includes:

[0032] Performing lower triangular numerical processing on the support degree matrix to obtain a support degree matrix that is the reciprocal value of the upper triangle.

[0033] In this embodiment, by performing lower triangular numerical processing on the support degree matrix, it is easier to solve the iteration result of each iteration process during clustering, and the iteration efficiency of the clustering process is improved.

[0034] In a second aspect, an abnormal data detection device provided by an embodiment of the present application includes:

[0035] An acquisition module, configured to acquire a power data set, where the power data set includes multiple power data;

[0036] A calculation module, configured to calculate the support degrees between the power data and generate a support degree matrix;

[0037] A clustering module, configured to cluster the support degrees in the support degree matrix according to the sum of the support degrees of each row of data in the support degree matrix to obtain multiple sub-clusters;

[0038] A detection module, configured to compare multiple sub-clusters to detect abnormal data and obtain an abnormal detection result of the power data.

[0039] In one embodiment, the acquisition module includes:

[0040] An acquisition unit, configured to acquire power observation data, where the power observation data includes numerical data and text data;

[0041] A normalization unit, configured to perform numerical normalization on the numerical data and text data to obtain multiple power data, and the multiple power data form the power data set.

[0042] In one embodiment, the computing module includes:

[0043] A first computing unit, configured to calculate the Euclidean distance between power data based on the power data;

[0044] A second computing unit, configured to calculate the support degree between the power data by using a preset support degree formula based on the Euclidean distance between the power data;

[0045] A generating unit, configured to generate the support degree matrix according to the support degrees between all the power data;

[0046] Wherein, the support degree formula is:

[0047] Sup = (1 - d N (a i , a j )) k , k > 0, a i = (x1, x2,..., x i ), aj = (x1, x2,..., x j );

[0048]

[0049] Where Sup is the support degree, a i is the i-th power data, a j is the j-th power data, d N (a i , a j ) is the normalized Euclidean distance between the power data a i and the power data a j , x i is the i-th data vector in the power data a i , and x j is the j-th data vector in the power data a j .

[0050] In one embodiment, the clustering module includes:

[0051] An iteration unit, configured to iteratively execute a third computing unit, a determination unit, a serving unit, and a deletion unit until a preset iteration stop condition is reached, to obtain a plurality of sub-clusters;

[0052] Wherein, the third computing unit is configured to calculate the sum of the support degrees of each row of data in the support degree matrix, and add the sum of the support degrees to the corresponding row of the support degree matrix;

[0053] The determining unit is configured to determine the maximum sum of supports among the multiple sums of supports, and determine the maximum support in each column of data;

[0054] The acting unit is configured to use the column data corresponding to the target maximum support as the same sub-cluster, to obtain one sub-cluster, where the target maximum support is the maximum support in the same row as the sum of supports;

[0055] The deleting unit is configured to delete the column data corresponding to the target maximum support in the support matrix, to obtain a new support matrix.

[0056] In one embodiment, the detecting device further includes:

[0057] The processing module is configured to perform lower triangular numerical processing on the support matrix, to obtain a support matrix that is the reciprocal value of the upper triangle.

[0058] It should be noted that for the beneficial effects of the second aspect above, please refer to the relevant descriptions of the first aspect above, and will not be elaborated here. Description of the Drawings

[0059] Figure 1 It is a schematic flowchart of a method for detecting abnormal data provided by an embodiment of the present application;

[0060] Figure 2 It is a schematic structural diagram of a device for detecting abnormal data provided by an embodiment of the present application. Detailed Embodiments

[0061] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0062] As recorded in the related background art, currently, mainly single physical space security protection technologies or information space anomaly detection technologies such as distance clustering algorithms or density distance clustering algorithms are used to detect abnormal data. However, the traditional distance clustering algorithm requires artificial pre-determination of the clustering cluster center, and the traditional density distance clustering algorithm requires pre-determination of the threshold and density definition, resulting in too high requirements for the data shape structure in hierarchical clustering and poor data adaptability.

[0063] To this end, the embodiments of the present application provide a method and device for detecting abnormal data. The detection method calculates the support degree between the power data and generates a support degree matrix, thereby presenting the correlation relationship between the data; and according to the total support degree of each row of data in the support degree matrix, clusters the support degrees in the support degree matrix to obtain multiple sub-clusters, compares the multiple sub-clusters, detects abnormal data, and obtains the abnormal detection result of the power data. Different from the traditional distance clustering algorithm and the traditional density distance clustering algorithm, the present application uses the total support degree of each row of data in the support degree matrix as the center of a sub-cluster, without the need to artificially pre-determine the clustering cluster center in advance, nor to determine the threshold and density definition in advance. The present application can adaptively adjust the clustering weight according to the total support degree calculated by the individual model, reduce the requirements for the data structure in the clustering process, so as to be applicable to more different data and improve the data adaptability of the abnormal data detection method.

[0064] See Figure 1 , Figure 1 Fig. shows the implementation flowchart of a method for detecting abnormal data in a network provided by an embodiment of the present application. In the embodiments of the present application, the following method for detecting abnormal data can be applied to computer devices, including but not limited to computer devices such as smart phones, tablet computers, desktop computers, supercomputers, personal digital assistants, physical servers, and cloud servers. The method for detecting abnormal data in the embodiments of the present application includes steps S101 to S104, which are described in detail as follows:

[0065] Step S101, obtain a power data set, where the power data set includes multiple power data.

[0066] In this step, the power data is the operation data collected when the grid device is running, including but not limited to numerical data and text data. Optionally, the numerical data and text data are heterogeneous data, and the data structures of the numerical data and text data can be unified through a standardization operation.

[0067] In one embodiment, obtain power observation data, where the power observation data includes numerical data and text data; perform numerical normalization on the numerical data and text data to obtain multiple pieces of the power data, and the multiple pieces of the power data form the power data set.

[0068] Optionally, for numerical data, through the normalization formula for processing, where dn is the power data obtained after normalizing the numerical data, x is the numerical data, is the mean value of all numerical data of the same type, and δ is the standard deviation.

[0069] Optionally, for text data, through the TF-IDF algorithm Process it, where d m is the power data obtained after normalizing the text-type data, and n ij represents the number of times word i appears in text j, and ∑n ij represents the total number of times all words appear in text j.

[0070] Power data D i = {d1, d2... d n ... d m}, that is, D i includes all d n and all d m . In this embodiment, the power observation data is uniformly transformed into power data through numerical normalization to standardize the power observation data, thereby facilitating subsequent data operations and improving data operation efficiency.

[0071] It can be understood that the normalization process of the power observation data can be executed on the computer device implementing this detection method, or can be executed on other computing devices and then the obtained power data can be transplanted to this computer device.

[0072] Step S102, calculate the support degree between the power data and generate a support degree matrix.

[0073] In this step, the support degree is used to characterize the correlation relationship between the power data. By calculating the similarity between the power data, and then using the similarity to calculate the support degree between the power data, and constructing all the support degrees into a support degree matrix. Optionally, the similarity can be Euclidean distance similarity, cosine similarity, etc.

[0074] In one embodiment, step S102 specifically includes: calculating the Euclidean distance between the power data based on the power data; calculating the support degree between the power data using a preset support degree formula based on the Euclidean distance between the power data; generating the support degree matrix according to the support degree between all the power data; where the support degree formula is:

[0075] Sup(a i , a j ) = (1 - d N (a i , a j )) k , k > 0, a i = (x1, x2,..., x i ), a j = (x1, x2,..., x j );

[0076]

[0077] Where Sup(a i , a j ) is the support degree between a i and a j , a i is the i-th power data, a j is the j-th power data, d N (a i , a j ) is the normalized Euclidean distance between power data a i and power data a j , x i is the i-th data vector in power data a i , x j is the j-th data vector in power data a j .

[0078] Based on the support degrees between all power data, a support degree matrix is generated, as shown in the following example:

[0079]

[0080] In this embodiment, by calculating the Euclidean distance between power data, the similarity between power data is obtained, and the support degree is determined based on the Euclidean distance, and all support degrees are constructed into a support degree matrix, so as to obtain the association relationship between power data, so that the support degree matrix with the association relationship of power data can be used for clustering, thereby improving data adaptability.

[0081] Step S103, cluster the support degrees in the support degree matrix according to the sum of the support degrees of each row of data in the support degree matrix, and obtain multiple sub-clusters.

[0082] In this step, the support degree matrix includes rows and columns. Calculate the sum of all support degrees in each row of data to obtain the total support degree. Take the total support degree as the center point of the sub-cluster in this iteration. Then, compare the maximum support degree in each column of support degrees with the total support degree. If the maximum support degree and the total support degree are in the same row, it means that the maximum support degree is near the center point of the sub-cluster. Therefore, all the maximum support degrees near the center point of the sub-cluster in this iteration are used as a sub-cluster, and the iteration process is repeated to obtain multiple sub-clusters. Different from the traditional distance clustering algorithm and the traditional density distance clustering algorithm, there is no need to artificially pre-determine the clustering cluster center in advance, nor to determine the threshold and density definition in advance, reducing the requirements for the data shape structure in the clustering process and improving the data adaptability in the clustering process.

[0083] In one embodiment, the above step S103 specifically includes:

[0084] Step 1: Calculate the sum of supports for each row of data in the support matrix, and add the sum of supports to the corresponding row of the support matrix;

[0085] Step 2: Determine the maximum sum of supports among multiple sums of supports, and determine the maximum support for each column of data;

[0086] Step 3: Use the column data corresponding to the target maximum support as the same sub-cluster to obtain one sub-cluster, where the target maximum support is the maximum support in the same row as the maximum sum of supports;

[0087] Step 4: Delete the column data corresponding to the target maximum support in the support matrix to obtain a new support matrix;

[0088] Repeat the above steps 1 to 4 iteratively until a preset iteration stop condition is reached to obtain multiple sub-clusters.

[0089] In this embodiment, for the obtained support matrix, add a new row to calculate the sum Sum for each row, as shown below:

[0090]

[0091] Determine the maximum sum of supports among multiple sums of supports, and determine the maximum support for each column of data. For example, the maximum sum of supports is Sum2, the maximum support for the first column is Sup(a2, a1), the maximum support for the second column is Sup(a n , a2), and the maximum support for the nth column is Sup(a1, a n ). Compare the maximum support for each column with the maximum sum of supports, and use all the target maximum supports in the same row as the maximum sum of supports as the same sub-cluster to obtain one sub-cluster. As can be seen from the above, Sup(a2, a1) is in the same row as the maximum sum of supports Sum2, so the column data corresponding to Sup(a2, a1) is used to obtain a new support matrix, as shown below:

[0092]

[0093] Return to step 1 for iteration with this new support matrix until a preset iteration stop condition is reached. The iteration stop condition can be that all data in the support matrix is deleted, or the data clustering is stopped manually.

[0094] Step S104: Compare multiple sub-clusters to detect abnormal data and obtain the abnormal detection result of the power data.

[0095] In this step, by comparing the sub-clusters in the clustering result, abnormal data is picked out, and the device corresponding to the original data is the abnormal device.

[0096] In one embodiment, based on the embodiment shown in Figure 1 before the above step S103, it further includes: performing a lower triangular numerical processing on the support degree matrix to obtain a support degree matrix with upper triangular reciprocal values.

[0097] In this embodiment, by performing lower triangular numerical processing on the support degree matrix, it is easier to solve the iteration result of each iteration process during clustering, and the iteration efficiency of the clustering process is improved.

[0098] In order to execute the abnormal data detection method corresponding to the above method embodiment to achieve the corresponding functions and technical effects. Refer to Figure 2 , Figure 2 shows a structural block diagram of an abnormal data detection device provided by an embodiment of the present application. For the sake of convenience of description, only the parts related to this embodiment are shown. The abnormal data detection device provided by the embodiment of the present application includes:

[0099] An acquisition module 201, configured to acquire a power data set, where the power data set includes a plurality of power data;

[0100] A calculation module 202, configured to calculate the support degree between the power data and generate a support degree matrix;

[0101] A clustering module 203, configured to cluster the support degrees in the support degree matrix according to the sum of the support degrees of each row of data in the support degree matrix to obtain a plurality of sub-clusters;

[0102] A detection module 204, configured to compare a plurality of the sub-clusters to detect abnormal data and obtain an abnormal detection result of the power data.

[0103] In one embodiment, the acquisition module 201 includes:

[0104] An acquisition unit, configured to acquire power observation data, where the power observation data includes numerical data and text data;

[0105] A normalization unit, configured to perform numerical normalization on the numerical data and text data to obtain a plurality of the power data, and the plurality of power data form the power data set.

[0106] In one embodiment, the calculation module 202 includes:

[0107] A first calculation unit, configured to calculate the Euclidean distance between the power data based on the power data;

[0108] A second calculation unit, configured to calculate the support degree between the power data based on the Euclidean distance between the power data by using a preset support degree formula;

[0109] A generation unit, configured to generate the support degree matrix according to the support degrees between all the power data;

[0110] Wherein, the support degree formula is:

[0111] Sup=(1 - d N (a i , a j )) k , k>0, a i =(x1, x2,..., x i ), a j =(x1, x2,..., x j );

[0112]

[0113] Where Sup is the support degree, a i is the i-th power data, a j is the j-th power data, d N (a i , a j ) is the normalized Euclidean distance between the power data a i and the power data a j , x i is the i-th data vector in the power data a i , x j is the j-th data vector in the power data a j .

[0114] In one embodiment, the clustering module 203 includes:

[0115] An iteration unit, configured to iteratively execute a third calculation unit, a determination unit, a serving unit, and a deletion unit until a preset iteration stop condition is reached, and obtain a plurality of sub-clusters;

[0116] Wherein, the third calculation unit is configured to calculate the sum of the support degrees of each row of data in the support degree matrix, and add the sum of the support degrees to the corresponding row of the support degree matrix;

[0117] The determination unit is configured to determine the maximum sum of the support degrees among the plurality of sums of the support degrees, and determine the maximum support degree in each column of data;

[0118] The unit is configured to use the column data corresponding to the target maximum support as the same sub-cluster to obtain a sub-cluster, where the target maximum support is the maximum support in the same row as the sum of the maximum supports;

[0119] The deletion unit is configured to delete the column data corresponding to the target maximum support in the support matrix to obtain a new support matrix.

[0120] In one embodiment, the detection device further includes:

[0121] The processing module is configured to perform lower triangular numerical processing on the support matrix to obtain a support matrix with upper triangular reciprocal values.

[0122] The above abnormal data detection device can implement the abnormal data detection method in the above method embodiment. The optional items in the above method embodiment are also applicable to this embodiment, which will not be elaborated here. The remaining content of the embodiments of the present application can refer to the content of the above method embodiment, which will not be repeated here.

[0123] In each embodiment of the present application, the various functional modules can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0124] If the above functions are implemented in the form of software function modules and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0125] It should be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the said element.

[0126] The specific embodiments described above further elaborate on the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only specific embodiments of the present application and is not used to limit the protection scope of the present application. In particular, it is pointed out that for those skilled in the art, any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application should be included within the protection scope of the present application.

Claims

1. A method for detecting abnormal data, characterized in that, Including: Obtain a power data set, where the power data set includes multiple power data; Calculate the support between the power data and generate a support matrix; Cluster the supports in the support matrix according to the sum of the supports of each row of data in the support matrix to obtain multiple sub-clusters; Among them, the clustering of the supports in the support matrix according to the sum of the supports of each row of data in the support matrix to obtain multiple sub-clusters includes: Step 1, calculate the sum of the supports of each row of data in the support matrix and add the sum of the supports to the corresponding row of the support matrix; Step 2, determine the maximum sum of the supports among the multiple sums of the supports, and determine the maximum support in each column of data; Step 3, use the column data corresponding to the target maximum support as the same sub-cluster to obtain a sub-cluster, where the target maximum support is the maximum support in the same row as the maximum sum of the supports; Step 4, delete the target maximum support in the support matrix to obtain a new support matrix; Repeat the above steps 1 to 4 iteratively until a preset iteration stop condition is reached to obtain multiple sub-clusters; Compare the multiple sub-clusters to detect abnormal data and obtain the abnormal detection result of the power data.

2. The detection method according to claim 1, characterized in that, The obtaining of the power data set includes: Obtain power observation data, where the power observation data includes numerical data and text data; Perform numerical normalization on the numerical data and text data to obtain multiple power data, and the multiple power data form the power data set.

3. The detection method according to claim 1, characterized in that, The calculation of the support between the power data and the generation of the support matrix includes: Based on the power data, calculate the Euclidean distance between the power data; Based on the Euclidean distance between the power data, calculate the support between the power data using a preset support formula; Generate the support matrix according to the supports between all the power data; Among them, the support formula is: Among them, Sup is the support degree, and a i is the i-th power data, and a j is the j-th power data, and d N (a i , a j ) is the normalized Euclidean distance between the power data a i and the power data a j . x i is the i-th data vector in the power data a i , and x j is the j-th data vector in the power data a j .

4. The detection method according to claim 1, wherein, Before clustering the supports in the support matrix according to the sum of the supports of each row of data in the support matrix to obtain multiple sub-clusters, it also includes: Perform lower triangular numerical processing on the support matrix to obtain a support matrix with upper triangular reciprocal values.

5. A detection device for abnormal data, characterized in that, Including: An acquisition module for obtaining a power data set, where the power data set includes multiple power data; A calculation module for calculating the support between the power data and generating a support matrix; The clustering module is used to cluster the supports in the support matrix according to the sum of supports of each row of data in the support matrix, and obtain multiple sub-clusters; wherein, the clustering module includes: an iterative unit, which is used to iteratively execute a third calculation unit, a determination unit, an acting unit, and a deletion unit until a preset iteration stop condition is reached to obtain multiple sub-clusters; the third calculation unit is used to calculate the sum of supports of each row of data in the support matrix and add the sum of supports to the corresponding row of the support matrix; the determination unit is used to determine the maximum sum of supports among the multiple sums of supports, and determine the maximum support in each column of data; the acting unit is used to use the column data corresponding to the target maximum support as the same sub-cluster to obtain a sub-cluster, and the target maximum support is the maximum support in the same row as the maximum sum of supports; the deletion unit is used to delete the column data corresponding to the target maximum support in the support matrix to obtain a new support matrix; The detection module is used to compare multiple sub-clusters, detect abnormal data, and obtain the abnormal detection result of the power data.

6. The detection device according to claim 5, wherein, The acquisition module includes: An acquisition unit, which is used to acquire power observation data, and the power observation data includes numerical data and text data; A normalization unit, which is used to perform numerical normalization on the numerical data and text data to obtain multiple power data, and the multiple power data form the power data set.

7. The detection device according to claim 5, wherein The calculation module includes: A first calculation unit, which is used to calculate the Euclidean distance between power data based on the power data; A second calculation unit, which is used to calculate the support between power data by using a preset support formula based on the Euclidean distance between power data; A generation unit, which is used to generate the support matrix according to the supports between all power data; wherein, the support formula is: where Sup is the support, a i is the i-th power data, a j is the j-th power data, d N (a i , a j ) is the normalized Euclidean distance between the power data a i and the power data a j , x i is the i-th data vector in the power data a i , x j is the j-th data vector in the power data a j .

8. The detection device according to claim 5, characterized in that, The detection device further includes: A processing module, which is used to perform lower triangular numerical processing on the support matrix to obtain a support matrix with upper triangular reciprocal values.

Images