A method, device, mobile terminal and storage medium for detecting abnormal data in a power grid

Abstract

The present invention discloses a method, device, mobile terminal and storage medium for detecting abnormal power grid data provided by an embodiment of the present invention. The method includes: obtaining heterogeneous power data of a power grid to be detected, performing first clustering processing on the heterogeneous power data to obtain M first clustering results, where M is a positive integer greater than 2; after calculating a clustering validity evaluation index based on the M first clustering results, dynamically adjusting the weight of the clustering validity evaluation index to obtain a final weight value; performing second clustering processing on the M first clustering results according to the final weight value to obtain M second clustering results, and then detecting abnormal data of the power grid to be detected according to the M second clustering results. Using the embodiment of the present invention can improve the accuracy of detecting abnormal power grid data.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular, to a method, device, mobile terminal and storage medium for detecting abnormal data in a power grid. Background Art

[0002] The safe operation of the power grid is an important part of the country's energy security and also an important part of ensuring the stable development of the country's industrial and economic lifelines. When predicting potential security threats to the power grid, it is necessary to detect abnormal data. A single physical space security protection technology or information space abnormal data detection technology is no longer sufficient to cope with the cyber-physical hybrid attack behavior of the power grid that spans the cyber-physical space.

[0003] Currently, the types of attacks faced by the power grid are numerous and show an increasing trend. Therefore, in the prior art, abnormal data in the power grid is often clustered to detect abnormal data in the power grid. However, the prior art treats base clusters equally, and the base cluster results with poor clustering effects will reduce the performance of the integrated cluster results, resulting in low accuracy of detecting abnormal data in the power grid.

[0004] In summary, the accuracy of the method for detecting abnormal data in the power grid in the prior art is not high. Summary of the Invention

[0005] Embodiments of the present invention provide a method, device, mobile terminal and storage medium for detecting abnormal data in a power grid, which improves the accuracy of detecting abnormal data in the power grid.

[0006] The first aspect of the embodiments of the present application provides a method for detecting abnormal data in a power grid, including:

[0007] Obtain heterogeneous power data of the power grid to be detected, and perform first clustering processing on the heterogeneous power data to obtain M first clustering results; where M is a positive integer greater than 2;

[0008] After calculating a clustering validity evaluation index based on the M first clustering results, dynamically adjust the initial weight of the clustering validity evaluation index to obtain a final weight value;

[0009] Perform second clustering processing on the M first clustering results according to the final weight value to obtain M second clustering results, and then detect abnormal data in the power grid to be detected according to the M second clustering results.

[0010] In a possible implementation manner of the first aspect, dynamically adjusting the initial weight of the clustering validity evaluation index to obtain a final weight value specifically includes:

[0011] Generate an internal validity matrix according to the clustering validity evaluation index;

[0012] Calculate the initial weights of the clustering validity evaluation index according to the internal validity matrix;

[0013] After performing a weighted average on the initial weights, dynamically adjust the initial weights until the first threshold is satisfied, then stop adjusting and obtain the final weight value.

[0014] In a possible implementation manner of the first aspect, obtain the heterogeneous power data of the power grid to be detected, specifically:

[0015] After obtaining the initial abnormal data of the power grid to be detected, convert the initial abnormal data into numerical data;

[0016] After normalizing the numerical data, generate and obtain the heterogeneous power data of the power grid to be detected.

[0017] In a possible implementation manner of the first aspect, perform a first clustering process on the heterogeneous power data to obtain M first clustering results, specifically:

[0018] Calculate the support degrees between the heterogeneous power data, and calculate the support degree matrix according to the support degrees;

[0019] After calculating the new attribute matrix according to the support degree matrix, perform a first clustering process according to M clustering algorithms and the new attribute matrix to obtain M first clustering results.

[0020] In a possible implementation manner of the first aspect, calculate the new attribute matrix according to the support degree matrix, specifically:

[0021] Calculate the maximum value, minimum value, arithmetic mean, geometric mean, and mode in the support degree matrix, and then perform an integration process according to the maximum value, minimum value, arithmetic mean, geometric mean, and mode to generate the new attribute matrix.

[0022] A second aspect of the embodiments of the present application provides a power grid abnormal data detection device, including: an acquisition module, an adjustment module, and a detection module;

[0023] Among them, the acquisition module is used to obtain the heterogeneous power data of the power grid to be detected, and perform a first clustering process on the heterogeneous power data to obtain M first clustering results; where M is a positive integer greater than 2;

[0024] The adjustment module is used to calculate the clustering validity evaluation index according to the M first clustering results, and then dynamically adjust the weights of the clustering validity evaluation index to obtain the final weight value;

[0025] The detection module is used to perform a second clustering process on the M first clustering results according to the final weight value to obtain M second clustering results, and then perform abnormal data detection on the power grid to be detected according to the M second clustering results.

[0026] In a possible implementation of the second aspect, the initial weights of the clustering validity evaluation index are dynamically adjusted to obtain the final weight values, specifically:

[0027] Generate an internal validity matrix according to the clustering validity evaluation index;

[0028] Calculate the initial weights of the clustering validity evaluation index according to the internal validity matrix;

[0029] After weighted averaging the initial weights, dynamically adjust the initial weights until the first threshold is satisfied, then stop the adjustment and obtain the final weight values.

[0030] In a possible implementation of the second aspect, obtain the heterogeneous power data of the power grid to be detected, specifically:

[0031] After obtaining the initial abnormal data of the power grid to be detected, convert the initial abnormal data into numerical data;

[0032] After normalizing the numerical data, generate and obtain the heterogeneous power data of the power grid to be detected.

[0033] The third aspect of the embodiments of the present application provides a mobile terminal, including a processor and a memory. The memory stores computer-readable program code, and when the processor executes the computer-readable program code, the steps of the above-mentioned power grid abnormal data detection method are implemented.

[0034] The fourth aspect of the embodiments of the present application provides a storage medium, which stores computer-readable program code, and when the computer-readable program code is executed, the steps of the above-mentioned power grid abnormal data detection method are implemented.

[0035] Compared with the prior art, a power grid abnormal data detection method, device, mobile terminal and storage medium provided by the embodiments of the present invention, the method includes: obtaining the heterogeneous power data of the power grid to be detected, performing a first clustering process on the heterogeneous power data to obtain M first clustering results; where M is a positive integer greater than 2; after calculating the clustering validity evaluation index according to the M first clustering results, dynamically adjust the weights of the clustering validity evaluation index to obtain the final weight values; perform a second clustering process on the M first clustering results according to the final weight values to obtain M second clustering results, and then perform abnormal data detection on the power grid to be detected according to the M second clustering results.

[0036] The beneficial effects are as follows: After calculating the clustering validity evaluation index based on the heterogeneous power data of the power grid to be detected in the embodiment of the present invention, the weight of the clustering validity evaluation index is dynamically adjusted to obtain the final weight value. After performing clustering processing according to the final weight value to obtain M final clustering results (i.e., the second clustering results), the power grid to be detected is subjected to abnormal data detection according to the M final clustering results. Since the final clustering results are obtained by considering the final weight value of the clustering validity evaluation index, the clustering validity evaluation index with a higher weight represents better performance of the clustering results, and the high performance of the clustering results ensures the detection accuracy of power grid anomalies. Therefore, the present invention can solve the problem of low accuracy in detecting abnormal data of the power grid caused by equally treating all basic clusters in the prior art, enabling high-performance clustering results to occupy an important component in the overall basic cluster, reducing the influence of low-performance clustering results on the overall basic cluster, so that the detection results are more accurate and objective, and effectively improving the accuracy of detecting abnormal data of the power grid. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 is a schematic flowchart of a method for detecting abnormal data of a power grid provided by an embodiment of the present invention;

[0038] Figure 2 is a schematic structural diagram of a device for detecting abnormal data of a power grid provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0039] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without any creative work shall fall within the protection scope of the present invention.

[0040] Refer to Figure 1 , which is a schematic flowchart of a method for detecting abnormal data of a power grid provided by an embodiment of the present invention, including S101 - S103:

[0041] S101: Obtain the heterogeneous power data of the power grid to be detected, and perform first clustering processing according to the heterogeneous power data to obtain M first clustering results.

[0042] Wherein, M is a positive integer greater than 2.

[0043] In this embodiment, the obtaining of the heterogeneous power data of the power grid to be detected is specifically:

[0044] After obtaining the initial abnormal data of the power grid to be detected, convert the initial abnormal data into numerical data;

[0045] After normalizing the numerical data, generate and obtain the heterogeneous power data of the power grid to be detected.

[0046] Further, the heterogeneous power data of the power grid to be detected can be represented by the following data set N:

[0047]

[0048] Wherein, represents the power grid measurement data, represents the information system measurement data, x i ={x ij |j = 1, 2,..., Z} T is the data vector corresponding to x i , y i ={y ij |j = 1, 2,..., Z} T is the data vector corresponding to y i , n1 + n2 = n.

[0049] Further, d j ∈ N (j = 1, 2,..., Z) represents the data points in the data set N, where d j (x) represents the power grid measurement data part in the data point d j , d j (y) represents the information system measurement data part in the data point d j .

[0050] Then, the distance between the power grid measurement data of different data points d j , d k ∈ N is represented by the following formula:

[0051]

[0052] Then, the distance between the information system measurement data of different data points d j , d k ∈ N is represented by the following formula:

[0053]

[0054] Then, the distance between different data points d j , d k ∈ N is represented by the following formula:

[0055]

[0056] In a specific embodiment, the first clustering process is performed on the heterogeneous power data to obtain M first clustering results, specifically as follows:

[0057] Calculate the support degrees between the heterogeneous power data, and calculate a support degree matrix based on the support degrees;

[0058] After calculating a new attribute matrix based on the support degree matrix, perform a first clustering process according to M clustering algorithms (F1, F2,..., F M ) and the new attribute matrix to obtain the M first clustering results.

[0059] Further, the calculation of the support degree Sup between the heterogeneous power data can be expressed by the following formula:

[0060] sup(d j , d k ) = (1 - d(d j , d k )) k , k = 0.7;

[0061] The support degree matrix A is as follows:

[0062]

[0063] In a specific embodiment, the calculation of the new attribute matrix based on the support degree matrix is specifically as follows:

[0064] Calculate the maximum value, minimum value, arithmetic mean, geometric mean, and mode in the support degree matrix, and perform an integration process according to the maximum value, the minimum value, the arithmetic mean, the geometric mean, and the mode to generate the new attribute matrix. Among them, since the support degree matrix is an N*N-order support degree matrix A, calculating the maximum value, minimum value, arithmetic mean, geometric mean, and mode in the support degree matrix means calculating the maximum value, minimum value, arithmetic mean, geometric mean, and mode in each row of data in the N*N-order support degree matrix A, and constructing a new attribute matrix B by integrating these five types of data. The new attribute matrix B is an N*5-order matrix.

[0065] S102: Calculate a clustering validity evaluation index based on the M first clustering results, and dynamically adjust the weight of the clustering validity evaluation index to obtain a final weight value.

[0066] Among them, the clustering validity evaluation index includes: DBI index (i.e., Davies-Bouldin index), CH index, and DI index.

[0067] The DBI index can be expressed by the following formula:

[0068]

[0069] Among them, P w represents the w-th (w ∈ {1, 2,..., M}) clustering result among the M results of the first type of clustering, and p w is the number of clusters in the clustering result P w in the cluster, represents the average distance between samples within the clustering cluster in the cluster.

[0070] Furthermore, it can be expressed by the following formula:

[0071]

[0072] Among them, represents the number of elements in the clustering cluster in the cluster. Indicates the center point of the cluster in the cluster, represents the average center point of the cluster in the cluster, represents the distance between the center point of the cluster in the cluster and the center point of the cluster in the cluster.

[0073] The CH index can be expressed by the following formula:

[0074]

[0075] Among them, P w represents the w-th (w ∈ {1, 2,..., M}) clustering result among the M results of the first type of clustering, and p w is the number of clusters in the clustering result P w in the cluster, represents the center point of the cluster w in P in the cluster, d j represents a point in the dataset N, Z is the number of data points in the dataset, represents the mean of all data points in the dataset, represents the distance between data points.

[0076] The DI index can be expressed by the following formula:

[0077]

[0078] Among them, the parameters used in the calculation formula of the DI index have been explained in the above content, and the meanings are the same, so they will not be elaborated here.

[0079] In this embodiment, the initial weight of the clustering validity evaluation index is dynamically adjusted to obtain the final weight value, specifically as follows:

[0080] Generate an internal validity matrix according to the clustering validity evaluation index;

[0081] Calculate the initial weight of the clustering validity evaluation index according to the internal validity matrix;

[0082] After performing weighted averaging on the initial weight, dynamically adjust the initial weight until the first threshold is met, then stop the adjustment and obtain the final weight value.

[0083] Furthermore, the internal validity matrix V w can be expressed by the following formula:

[0084]

[0085] where, is the DBI index value in the w-th basic cluster, is the CH index value in the w-th basic cluster, is the DI index value in the w-th basic cluster.

[0086] Furthermore, let where, represents the above three calculation indexes (i.e., DBI index value, CH index value, and DI index value) of the w-th clustering result among the M results of the first type of clustering.

[0087] Then the process of dynamically adjusting the initial weight is as follows:

[0088] First, calculate The index vector corresponding to tp is denoted as Second, calculate the similarity S(V w , T) between the other index vector V w and T, and the calculation formula is as follows:

[0089]

[0090] Let Calculate and let T = V o ;

[0091] Calculate the similarity S(V w , T) between the other index vector V w and T again, and calculate ω w , V O again according to the similarity calculation result;

[0092] Finally, iterate the above process until So far, the first threshold α can be flexibly set according to the actual application. For example, α = 0.2 can be set.

[0093] After the process of dynamically adjusting the initial weights ends, the final weight value is ω * ={ω 1 , ω 2 ,... ω M}.

[0094] S103: Perform second clustering processing on the M first clustering results according to the final weight value. After obtaining the M second clustering results, perform abnormal data detection on the power grid to be detected according to the M second clustering results.

[0095] In this embodiment, the M first clustering results are integrated according to the final weight value to complete the second clustering processing, and the M second clustering results are obtained, realizing effective classification of the heterogeneous power data of the power grid to be detected; abnormal data detection is performed on the power grid to be detected according to the M second clustering results. Since the second clustering result is the clustering result obtained by considering the final weight value of the clustering validity evaluation index, the higher the weight of the clustering validity evaluation index, the better the performance of the clustering result, and the high performance of the clustering result ensures the detection accuracy of the power grid anomaly. Therefore, the present invention can solve the problem of low accuracy of power grid abnormal data detection caused by equally treating all base clusters in the prior art, and effectively improve the accuracy of power grid abnormal data detection.

[0096] To further illustrate the power grid abnormal data detection device, please refer to Figure 2 , Figure 2 which is a schematic structural diagram of a power grid abnormal data detection device provided by an embodiment of the present invention, including: an acquisition module 201, an adjustment module 202, and a detection module 203;

[0097] Among them, the acquisition module 201 is used to acquire the heterogeneous power data of the power grid to be detected, and perform first clustering processing according to the heterogeneous power data to obtain M first clustering results; where M is a positive integer greater than 2;

[0098] The adjustment module 202 is used to calculate the clustering validity evaluation index according to the M first clustering results, and then dynamically adjust the weight of the clustering validity evaluation index to obtain the final weight value;

[0099] The detection module 203 is used to perform second clustering processing on the M first clustering results according to the final weight value, and after obtaining the M second clustering results, perform abnormal data detection on the power grid to be detected according to the M second clustering results.

[0100] In this embodiment, the initial weight of the clustering validity evaluation index is dynamically adjusted to obtain a final weight value, specifically as follows:

[0101] Generate an internal validity matrix according to the clustering validity evaluation index;

[0102] Calculate the initial weight of the clustering validity evaluation index according to the internal validity matrix;

[0103] After performing weighted averaging on the initial weight, dynamically adjust the initial weight until a first threshold is satisfied, then stop the adjustment and obtain the final weight value.

[0104] In this embodiment, the obtaining of the heterogeneous power data of the power grid to be detected is specifically as follows:

[0105] After obtaining the initial abnormal data of the power grid to be detected, convert the initial abnormal data into numerical data;

[0106] After performing normalization processing on the numerical data, generate and obtain the heterogeneous power data of the power grid to be detected.

[0107] A specific embodiment of the present invention provides a mobile terminal, including a processor and a memory. The memory stores computer-readable program code, and when the processor executes the computer-readable program code, the steps of the above-mentioned power grid abnormal data detection method are implemented.

[0108] A specific embodiment of the present invention provides a storage medium that stores computer-readable program code, and when the computer-readable program code is executed, the steps of the above-mentioned power grid abnormal data detection method are implemented.

[0109] In the embodiment of the present invention, first, the obtaining module 201 obtains the heterogeneous power data of the power grid to be detected, and performs first clustering processing according to the heterogeneous power data to obtain M first clustering results; where M is a positive integer greater than 2; then, the adjustment module 202 calculates the clustering validity evaluation index according to the M first clustering results, and dynamically adjusts the weight of the clustering validity evaluation index to obtain a final weight value; finally, the detection module 203 performs second clustering processing on the M first clustering results according to the final weight value to obtain M second clustering results, and then performs abnormal data detection on the power grid to be detected according to the M second clustering results.

[0110] After calculating the clustering validity evaluation index based on the heterogeneous power data of the power grid to be detected in the embodiment of the present invention, the weight of the clustering validity evaluation index is dynamically adjusted to obtain the final weight value. After performing clustering processing according to the final weight value to obtain M final clustering results (i.e., the second clustering results), the abnormal data of the power grid to be detected is detected according to the M final clustering results. Since the final clustering results are obtained by considering the final weight value of the clustering validity evaluation index, the clustering validity evaluation index with a higher weight represents better performance of the clustering results. The high-performance clustering results ensure the detection accuracy of power grid anomalies. Therefore, the present invention can solve the problem of low accuracy in detecting abnormal power grid data caused by equally treating all basic clusters in the prior art, enabling high-performance clustering results to occupy an important component in the overall basic cluster, reducing the influence of low-performance clustering results on the overall basic cluster, so that the detection results are more accurate and objective, and effectively improving the accuracy of detecting abnormal power grid data.

[0111] The above is the preferred embodiment of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements are also regarded as the protection scope of the present invention.

Claims

1. A method for detecting abnormal data in a power grid, characterized in that, Including: Obtain heterogeneous power data of the power grid to be detected, calculate the support degree between the heterogeneous power data, and calculate a support degree matrix based on the support degree; After calculating a new attribute matrix based on the support degree matrix, perform first clustering processing according to M clustering algorithms and the new attribute matrix to obtain M first clustering results; where M is a positive integer greater than 2; After calculating a clustering validity evaluation index based on the M first clustering results, generate an internal validity matrix according to the clustering validity evaluation index; calculate the initial weight of the clustering validity evaluation index according to the internal validity matrix; perform weighted averaging on the initial weight, and dynamically adjust the initial weight until a first threshold is satisfied, then stop adjusting and obtain a final weight value; Perform second clustering processing on the M first clustering results according to the final weight value to obtain M second clustering results, and then perform abnormal data detection on the power grid to be detected according to the M second clustering results.

2. The method for detecting abnormal data of a power grid according to claim 1, wherein The obtaining of the heterogeneous power data of the power grid to be detected is specifically: After obtaining the initial abnormal data of the power grid to be detected, convert the initial abnormal data into numerical data; After normalizing the numerical data, generate and obtain the heterogeneous power data of the power grid to be detected.

3. The method for detecting abnormal data of a power grid according to claim 2, wherein The calculating of the new attribute matrix based on the support degree matrix is specifically: Calculate the maximum value, minimum value, arithmetic mean, geometric mean, and mode in the support degree matrix, and then perform integration processing according to the maximum value, the minimum value, the arithmetic mean, the geometric mean, and the mode to generate the new attribute matrix.

4. An abnormal data detection device for a power grid, characterized in that, Including: An obtaining module, an adjusting module, and a detecting module; Among them, the obtaining module is used to obtain heterogeneous power data of the power grid to be detected, calculate the support degree between the heterogeneous power data, and calculate a support degree matrix based on the support degree; after calculating a new attribute matrix based on the support degree matrix, perform first clustering processing according to M clustering algorithms and the new attribute matrix to obtain M first clustering results; where M is a positive integer greater than 2; The adjusting module is used to calculate a clustering validity evaluation index based on the M first clustering results, generate an internal validity matrix according to the clustering validity evaluation index; calculate the initial weight of the clustering validity evaluation index according to the internal validity matrix; perform weighted averaging on the initial weight, and dynamically adjust the initial weight until a first threshold is satisfied, then stop adjusting and obtain a final weight value; The detecting module is used to perform second clustering processing on the M first clustering results according to the final weight value to obtain M second clustering results, and then perform abnormal data detection on the power grid to be detected according to the M second clustering results.

5. The power grid abnormal data detection device according to claim 4, characterized in that, The obtaining of the heterogeneous power data of the power grid to be detected is specifically: After obtaining the initial abnormal data of the power grid to be detected, convert the initial abnormal data into numerical data; After normalizing the numerical data, generate and obtain the heterogeneous power data of the power grid to be detected.

6. A mobile terminal, characterized in that, It includes a processor and a memory. The memory stores computer-readable program code. When the processor executes the computer-readable program code, it implements the steps of a method for detecting abnormal power grid data described in any one of claims 1 to 3.

7. A storage medium, characterized in that, The storage medium stores computer-readable program code. When the computer-readable program code is executed, it implements the steps of a method for detecting abnormal power grid data described in any one of claims 1 to 3.

Images