An enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement

Abstract

The present invention relates to a method for detecting anomalies in electricity consumption of enterprises based on Isolated forest‑change point enhancement. The method comprises: first, according to the collected daily electricity consumption data of enterprises, performing missing value filling, standardization processing, etc. on the time series data of electricity consumption of enterprises; decomposing the cleaned data to eliminate the periodic pattern of the data; using the residual items after decomposition to make predictions using the LSTM model to obtain the error between the predicted value and the true value; calculating the abnormal score of electricity consumption at each point to obtain the suspected abnormal time point; performing change point detection on the residual items, combining the results of anomaly detection and change point detection to determine whether it is an abnormal time point; based on the detected abnormal time point, locating the data at the time point, and using isolated forest to further detect abnormal enterprises. The change point enhancement algorithm proposed in the present invention reduces the false positive rate of anomaly detection, and after obtaining the abnormal time point, combined with the isolated forest, it can effectively detect abnormal electricity consumption enterprises.

Description

Technical Field

[0001] The present invention belongs to the field of electricity use, and particularly relates to an enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement. Background Technique

[0002] In recent years, with the booming development of the national economy and the continuous improvement of the electricity consumption level of various industries, the monitoring of enterprise electricity consumption anomalies has become one of the key points of supervision and management in our country. In order to save costs, some enterprises have resorted to electricity theft or illegal electricity use, seriously affecting the order of the entire society. Therefore, it is urgent to strengthen the monitoring of enterprise electricity consumption anomalies and assist the regulatory authorities to achieve precise law enforcement against enterprises with abnormal electricity use.

[0003] Enterprise electricity consumption anomaly detection can play a warning role in the illegal electricity use behavior of enterprises, ensure the normal operation of enterprise facilities, and urge enterprises to produce in accordance with laws and regulations. Most of the existing anomaly detection methods are applicable to detecting abnormal electricity consumption of users, but enterprise electricity consumption data shows difficulties such as large data volume, no abnormal enterprise user labels, and complex electricity consumption rules in various industries, bringing challenges to enterprise electricity consumption anomaly detection.

[0004] Therefore, the present invention proposes an enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement, trains the LSTM algorithm based on historical electricity consumption data for anomaly detection, uses an unsupervised algorithm to solve the difficulty of no abnormal labels in enterprise electricity consumption data, and at the same time utilizes the time correlation of electricity consumption data; then introduces change point detection to reduce the false positive rate of anomaly detection and reduce false alarms; finally locates the abnormal time point and introduces enterprise - related dimensions to train the Isolated Forest model to detect abnormal enterprises. Summary of the Invention

[0005] The purpose of the present invention is to provide an enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement, to improve the defects of high false alarm rate, inability to effectively utilize the time dimension, and need for abnormal labels in traditional electricity consumption anomaly detection. For enterprise electricity consumption time - series data, an LSTM model is established for anomaly detection, change point detection is introduced to further screen abnormal points, combined with the Isolated Forest, to determine abnormal electricity - using enterprises and improve the accuracy of electricity consumption anomaly detection.

[0006] To achieve the above - mentioned purpose, the technical solution of the present invention is: an enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement, including the following steps:

[0007] Step 1: Collect the electricity consumption time - series data of the entire industry;

[0008] Step 2: Clean the electricity consumption time - series data;

[0009] Step 3: Smooth the cleaned data first, and then perform trend decomposition to obtain a residual sequence without periodic terms and trend terms, and remove holiday data in the residual sequence;

[0010] Step 4: Use the LSTM model to detect anomalies in the residual sequence and obtain suspected abnormal time points;

[0011] Step 5: Use the WIN algorithm, i.e., the window-based segmentation model, to detect the change point of the residual sequence, obtain the time point where the change point is located, and determine the abnormal time point in combination with the abnormal detection result;

[0012] Step 6: Based on the abnormal time point detected in step 5, further locate the enterprise electricity consumption data at that time point, and use the isolation forest algorithm to detect enterprises with abnormal electricity consumption.

[0013] Specifically, in step 2, the missing values of the enterprise electricity consumption time series data are first filled, and then the enterprises are grouped and each group is standardized, and finally the average daily electricity consumption of the entire industry is obtained. Since the cleaned time series data contains noise data and periodic factors, step 3 first smoothes the data and then decomposes it to obtain the residual sequence. Step 4 uses the LSTM model to predict and fit the residual sequence to obtain the predicted value, and constructs the power consumption anomaly score based on the error between the true value and the predicted value. The calculation formula is as follows:

[0014]

[0015]

[0016] Among them, y t Refers to the actual power consumption at time t, refers to the predicted electricity consumption at time t, s t Represents the abnormal power consumption score at time t, avg i∈t It means taking the mean value of the error at t moments, It is the normalized power consumption anomaly score at time t, T represents the total time length, min(s) represents the minimum value of the power consumption anomaly score at each moment, and max(s) represents the maximum value of the power consumption anomaly score at each moment.

[0017] After obtaining the abnormal scores at each time point, the 95% quantile point of the power consumption abnormal score is set as the threshold, and by comparing the threshold and the power consumption abnormal score, it is determined whether the time point is an abnormal power consumption time point.

[0018] In step 5, a window-based segmentation model is used to detect change points. The detection method is based on a sliding window. The difference between adjacent two windows is detected each time to obtain a difference curve. A peak detection program is used on the difference curve to determine the position of the change point. Then, combining the results of anomaly detection and change point detection, a judgment is made on whether the time point is an anomaly point or a change point. Finally, in step 6, based on the detected abnormal time points, the enterprise electricity consumption data at that time point is further located. The dimensions of the region and company type of the enterprise are introduced and the Isolation Forest model is trained in combination with the electricity consumption data to detect enterprises with abnormal electricity consumption.

[0019] An enterprise electricity consumption anomaly detection method based on Isolated forest-change point enhancement proposed by the present invention determines the abnormal time points of enterprise electricity consumption according to the historical electricity consumption data of enterprises, combines the time series anomaly detection algorithm and the change point detection algorithm, and then further uses the Isolation Forest model to determine the enterprises with abnormal electricity consumption by locating the abnormal time points, in order to strengthen the remote intelligent monitoring of enterprises and reduce the frequency and inspection time of on-site inspections by regulatory authorities.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] 1. In step 2, the enterprise electricity consumption time series data is first grouped and standardized by enterprise, and then the daily electricity consumption mean value of the whole industry is calculated, reducing the electricity consumption difference between enterprises;

[0022] 2. In step 3, the trend decomposition of the electricity consumption time series data is carried out. Considering that the cycle may make the anomaly detection effect of the model unstable, the residual sequence without trend term and cycle term is used for modeling, improving the accuracy of subsequent modeling;

[0023] 3. Considering the correlation between enterprise electricity consumption data and time, the LSTM model is selected to first detect the abnormal time points, and then further determine the abnormal enterprises through the detected abnormal time points, not only effectively utilizing the time dimension, but also solving the difficulty of large amount of enterprise electricity consumption data that cannot be fused and analyzed;

[0024] 4. In step 4, most of the prior arts use the n-sigma criterion to set the threshold. Considering that the distribution of anomaly scores does not conform to the assumption of normal distribution, the 95% quantile point of the anomaly scores is set as the threshold in the present invention;

[0025] 5. The present invention proposes to introduce change point detection and combine the anomaly detection results to further determine the anomaly points. Compared with the prior art, it reduces false alarms to a certain extent and improves the accuracy of anomaly detection;

[0026] 6. Based on the abnormal time points detected in step 5, combined with relevant dimensions such as region and company type, the Isolation Forest is used to determine the abnormal enterprises, which plays an effective role in supervising the electricity consumption safety of enterprises. Brief Description of the Drawings

[0027] Figure 1 This is a flowchart of a method for detecting abnormal electricity consumption of enterprises based on Isolated forest - change point enhancement of the present invention;

[0028] Figure 2 This is a time series diagram of the electricity consumption of enterprises after data cleaning of the present invention;

[0029] Figure 3 This is a smoothed graph of the present invention using the Savitzky - Golay filter;

[0030] Figure 4 This is a decomposition graph of the present invention after using the additive model;

[0031] Figure 5 This is a distribution graph of abnormal scores at each time point obtained by using the LSTM model of the present invention;

[0032] Figure 6 This is a result graph of abnormal points detected by using the LSTM model of the present invention;

[0033] Figure 7 This is a result graph of change points detected by using the WIN algorithm of the present invention. Detailed Description of the Invention

[0034] The following combines the drawings to specifically describe the technical solution of the present invention.

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application and use the electricity consumption dataset of the non - metallic mineral products industry in Fujian Province to clearly and completely describe the technical solutions in the embodiments of the present application. As Figure 1 shown is the detailed process of the present invention.

[0036] Embodiment:

[0037] The present invention provides a method for detecting abnormal electricity consumption of enterprises based on Isolated forest - change point enhancement. The implementation flowchart of the method can be seen in Figure 1 of the explanatory drawings, and mainly includes the following sequential steps:

[0038] Step 1: Collect the electricity consumption time series data of the entire industry; the data includes time stamps, enterprise numbers, regions (each city), company types, and daily electricity load data.

[0039] Step 2: Fill in the missing values in the electricity consumption time series data. Mark the values of electricity consumption that are empty or zero as missing values, calculate the average electricity consumption of each enterprise, and fill in the missing values with the average electricity consumption of each enterprise respectively. After filling in the missing values, standardize the data by enterprise grouping. Since the electricity consumption of each enterprise in the same industry varies greatly, if directly standardized, the data will be affected by extreme values. Calculate the average daily electricity consumption of the standardized data. The main formula is as follows:

[0040]

[0041]

[0042] Among them, x it represents the electricity consumption of the i-th enterprise at the t-th time point, μ i represents the average electricity consumption of the i-th enterprise, σ i represents the standard deviation of the electricity consumption of the i-th enterprise, represents the standardized electricity consumption; y t represents the average daily electricity consumption of the industry at time t, N t represents the total number of enterprises at time t. The time series diagram of the electricity consumption of enterprises after data cleaning is as Figure 2 shown.

[0043] Step 3: First, use the Savitzky-Golay filter to smooth the cleaned data. The Savitzky-Golay filter is a filtering method based on local polynomial least squares fitting in the time domain. Assume that the original time series data is y = {y1, y2,... y t ..., y T}, taking y t as the origin, taking M sample points on both the left and right of yt to construct a window array containing 2M + 1 sample points, and then construct a p-order polynomial to fit the data within the window. The p-order polynomial is as follows:

[0044]

[0045] where -M ≤ n ≤ M, p ≤ 2M + 1; define the loss function as follows:

[0046]

[0047] When the loss function reaches the minimum value, the fitting effect of the original data reaches the best. The fitted value of the smoothed original data can be obtained through a sliding window, which can effectively reduce the noise of the data. The smoothed data is as Figure 3 shown;

[0048] Then, use the additive model to decompose the trend of the smoothed data. The model is expressed as follows:

[0049] Y t = T t + S t + C t + I t , (9)

[0050] where T represents the long - term time trend, S represents the seasonal time trend, C represents the cyclical time trend, and I represents the remaining residual term. The present invention decomposes the smoothed power consumption data into a trend part, a cycle part, and a residual term part, as shown below Figure 4 . For the obtained residual sequence, the holiday data is further removed and then modeled.

[0051] Step 4: Use the LSTM model to predict and fit the residual sequence. The input data is the residual sequence obtained after decomposition, and the predicted value at each moment is output. The LSTM model mainly functions through a gating mechanism, namely the input gate i t , the forget gate f t , and the output gate o t . The principle is as follows:

[0052] First, the output h t-1 of the previous unit and the input vector x t at time t are used as inputs. Through the sigmoid layer, f t is output. The output value of "0" means all past information is forgotten, and the output value of "1" means all past states are remembered. Therefore, the forget gate f t can selectively retain past historical information. The input gate i t determines the retention of the newly input information C t . After splicing the past information and the new information to form the new information C t to be transmitted at the current moment, it acts on C t through the output gate O t to determine which information will be input to the next unit h t . The main formulas of LSTM are as follows:

[0053] f t = σ(W f * [h t-1 , x t + b f )

[0054] i t = σ(W i * [h t-1 , x t + b i )

[0055]

[0056]

[0057] O t = σ(W o * [h t-1 , x t + b o )

[0058] h t = O t * tanh(C t )

[0059] Among them, σ represents the sigmoid activation function, W f , W i , W C , W O represent the propagation weight matrices, and b f , b i , b C , b O represents the bias vector.

[0060] Next, construct the abnormal power consumption score based on the error between the true value and the predicted value. The calculation formula is as follows:

[0061]

[0062]

[0063] Among them, y t refers to the true power consumption at time t, refers to the predicted power consumption at time t, s t represents the abnormal power consumption score at time t, is the normalized abnormal power consumption score at time t, and T represents the total time length;

[0064] The obtained abnormal power consumption score graph is as Figure 5 shown.

[0065] Based on the obtained abnormal scores, set the 95% quantile point of the abnormal power consumption score as the threshold; if the abnormal power consumption score is greater than the threshold, determine this time point as a suspected abnormal point; if the abnormal power consumption score is less than or equal to the threshold, then consider this time point as a normal time point. The abnormal detection result of this algorithm is as Figure 6 shown, and a total of four suspected abnormal time points are detected.

[0066] Step 5: Further use the residual sequence to detect change points. Select the window-based segmentation model, i.e., the WIN algorithm. The detection method is based on a sliding window. Each time, the difference between two adjacent windows is detected to obtain a difference curve. A peak detection program is used on the difference curve to determine the change point position. Suppose the given cost function is c(·). The formula for the difference between two windows is as follows:

[0067] d(y a...t ,y t...b )=c(y a...t )-c(y t...b )(1≤a<t<b≤T)

[0068] Among them, the present invention selects L2 as the cost function, and the formula is as follows:

[0069]

[0070] Among them, y a..b represents the subsequence, represents the empirical mean of the subsequence.

[0071] Combined with the results of anomaly detection and change point detection, it is judged whether the time point is an anomaly point or a change point. The change points obtained by using the WIN algorithm are as Figure 7 shown. A total of 4 change points are detected. Comparing with the anomaly detection results, it can be found that there are no overlapping points. Therefore, it can be determined that the abnormal time points detected in Step 4 are real abnormal points. If there is a situation where the anomaly point coincides with the change point, it is necessary to further determine whether it is an anomaly point.

[0072] Step 6: Based on the abnormal power consumption time points detected in Step 5, further locate the enterprise power consumption data at this time point. Introduce two dimensions of region and company type, and use the isolation forest algorithm for multi-dimensional anomaly detection. Among them, the modeling steps of the isolation forest are divided into two parts: the first part is to train each isolation tree in the isolation forest; the second part is to use the trained isolation trees to calculate the anomaly scores of each sample.

[0073] In the first part, an isolation tree needs to be trained first. The first step is to randomly select ψ sample points from the enterprise power consumption data as sub-samples and put them into the root node of the tree; the second step is to randomly specify a dimension in the enterprise power consumption data, and then randomly select a splitting point p from the sub-sample data of the root node; the third step is to generate a hyperplane with the cutting point p, and then put the data ≤p in the specified dimension into the left child node and the data ≥p into the right child node; finally, repeat the above steps until the child node can no longer be cut or the child node has reached the specified height.

[0074] The second part is to use the trained isolation trees in the first part to calculate the anomaly score for each sample. Assume that m is the number of enterprises at this time node and n is the number of dimensions, then Y m×n represents the specific value of the nth dimension of the mth enterprise. Let Y m×n traverse each isolation tree in the isolation forest and calculate the average path length of each sample point Y m×n in the isolation forest, and calculate the anomaly score through the average path length. The formula is as follows:

[0075]

[0076]

[0077] Among them, E(h(y)) is the average path length of the sample point traversing t iTree trees, and c(n) represents the average path length required to build a binary tree with n samples. When the calculated enterprise anomaly score is greater than the threshold and very close to 1, the enterprise can be determined as an abnormal enterprise; the threshold is determined by selecting the anomaly ratio.

[0078] The above are only the preferred embodiments of the present invention. Generally, the components of the embodiments of the present application described and illustrated here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the present application claimed, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of the present application.

Claims

1. An enterprise electricity consumption anomaly detection method based on Isolated forest-change point enhancement, characterized in that The steps include: Step 1: Collect electricity consumption time series data of the entire industry; Step 2: First fill the missing values of the electricity consumption time series data, then group them by enterprise, standardize each group separately, and finally calculate the average daily electricity consumption of the entire industry; Step 3: Smooth the data after data cleaning in step 2, and then perform trend decomposition to eliminate the periodicity and trend of the data to obtain a residual sequence without periodic terms and trend terms. For the obtained residual sequence, further eliminate holiday data; Step 4: Use the LSTM model to perform prediction fitting on the residual sequence to obtain the predicted value, and calculate the power consumption anomaly score at each time point based on the error between the predicted value and the true value; according to the preset threshold of the quantile point, determine the time point when the power consumption anomaly score exceeds the threshold as the suspected abnormal time point; Step 5: Perform change point detection on the residual sequence, combine the results of anomaly detection and change point detection, judge whether the time point is an anomaly point or a change point, and determine whether it is an abnormal time point; Step 6: Based on the detected abnormal time point, further locate the enterprise electricity consumption data at that time point, and use Isolated forest to detect enterprises with abnormal electricity consumption; In step 4, the 95% quantile point of the power consumption anomaly score is set as the threshold, and by comparing the threshold and the power consumption anomaly score, it is determined whether the time point is a suspected abnormal time point; In step 5, the WIN algorithm is used for change point detection, that is, a window-based segmentation model. The detection method is based on a sliding window. The difference between two adjacent windows is detected each time to obtain a difference curve. The peak detection procedure is used on the difference curve to determine the change point position; In step 5, if a time point is detected as both a change point and an abnormal point, manual review will be used to determine whether the point is an abnormal point. If it is only detected as a change point, the power consumption at the time point is determined to be normal behavior.

2. The enterprise power consumption anomaly detection method based on Isolated forest - change point enhancement according to claim 1, characterized in that, In step 3, the data after data cleaning in step 2 is smoothed using a Savitzky-Golay filter.

3. The enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement according to claim 1, characterized in that, In step 3, the smoothed data is decomposed using an additive model to eliminate the trend and periodic factors of the data.

4. The enterprise power consumption anomaly detection method based on Isolated forest - change point enhancement according to claim 1, characterized in that In step 3, for the obtained residual sequence, the holiday data eliminated are the data during the Spring Festival and the New Year's Day.

5. The enterprise power consumption anomaly detection method based on Isolated forest - change point enhancement according to claim 1, characterized in that, In step 4, the power consumption anomaly score is constructed based on the error between the true value and the predicted value. The calculation formula is as follows: Among them, y t refers to the actual power consumption at time t, refers to the predicted power consumption at time t, s t represents the power consumption anomaly score at time t, avg i∈t indicates taking the average of the errors at t times, is the normalized power consumption anomaly score at time t, min(s) represents the minimum value among the power consumption anomaly scores at each time, and max(s) represents the maximum value among the power consumption anomaly scores at each time.

6. The enterprise electricity consumption anomaly detection method based on Isolated forest - change point enhancement according to claim 1, characterized in that In step 6, Isolated forest is used to introduce the region and company type dimensions of the enterprise and combine them with electricity consumption data to train Isolated forest and detect enterprises with abnormal electricity consumption.

Images