Power data transmission anomaly detection method and system based on federated learning, and medium

Abstract

The application discloses a kind of based on federal learning's electric power data transmission anomaly detection method, system and medium, method includes: in the deployment of federal learning architecture with parameter monitoring module in electric power system edge gateway layer;When edge gateway uploads electric power data, transmission data is used as the parameter set of abnormal information monitoring network in parameter monitoring module, abnormal information identification is carried out to obtain abnormal information in transmission process and is transmitted into buffer area;When the abnormal information monitoring network of parameter monitoring module detects new abnormal information, confirm whether new abnormal information is recorded in buffer area, if not recorded, update buffer area using new abnormal information, and filter this abnormal information;After filtering abnormal information, transmission data is updated using knowledge transfer, to ensure that data transmission is accurate.The application effectively detects and filters abnormal information, accurately prevents data abnormal transmission behavior existing in network, and ensures data transmission security.

Description

Technical Field

[0001] This invention belongs to the technical field of data transmission anomaly detection, specifically relating to a method, system, and medium for power data transmission anomaly detection based on federated learning. Background Technology

[0002] To fully support the operation of a new power system dominated by new energy sources, accelerate the digitalization of the power grid, and adapt to the shift in power grid operation characteristics from planned and centralized to open, shared, and intelligent interaction, distributed architecture will gradually become dominant in the power grid. However, in-depth mining and analysis of power data poses the risk of leaking the privacy information of machine learning participants; therefore, ensuring the privacy of participants during the full utilization of power data for machine learning has become a research topic of great concern. Federated learning architecture is widely used due to its good privacy protection capabilities, but it still has vulnerabilities that are easily attacked and compromised. During data transmission at the edge, abnormal attacks on the data can lead to a decrease in the convergence speed and performance of the federated model. Summary of the Invention

[0003] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a method, system, and medium for detecting abnormal data transmission in power systems based on federated learning. By constructing a parameter monitoring module in the federated learning architecture, the invention effectively detects and filters abnormal information in the data transmission process within the federated learning framework, accurately prevents abnormal data transmission behavior in the network, and ensures data transmission security.

[0004] To achieve the above objectives, the present invention provides a method for detecting anomalies in power data transmission based on federated learning, characterized by comprising the following steps:

[0005] A federated learning architecture with a parameter monitoring module is deployed at the power system edge gateway layer; the parameter monitoring module includes an anomaly information monitoring network and a buffer.

[0006] When the edge gateway uploads power data, it uses the transmitted data as a parameter set for the abnormal information monitoring network in the parameter monitoring module to identify abnormal information during transmission and pass it into the buffer.

[0007] When the parameter monitoring module detects new abnormal information, it checks whether the new abnormal information has been recorded in the buffer. If it has not been recorded, the buffer is updated with the new abnormal information and the abnormal information is filtered out.

[0008] After filtering out abnormal information, knowledge transfer is used to update the transmitted data to ensure accurate data transmission.

[0009] Preferably, the training steps of the parameter monitoring module are as follows:

[0010] The parameter set X of the anomaly information monitoring network is divided into an unlabeled parameter set U and a labeled anomaly parameter set V; the labeled anomaly parameter set V includes the features and labels of each labeled parameter;

[0011] The anomaly detection network is initially trained using the cross-entropy loss function on the labeled anomaly parameter set V to train its classification ability and obtain the category set of the labeled anomaly parameter set.

[0012] Clustering algorithms are used to cluster the category set of the labeled anomaly parameter set. The cluster centers are used as prototypes to construct an N×N prototype matrix, which is initialized with zero, where N is the number of categories in the category set of the labeled anomaly parameter set.

[0013] The prototype matrix and the initially trained anomaly detection network are jointly trained on the labeled parameter set V to obtain the trained parameter detection module.

[0014] Preferably, the anomaly information monitoring network is constructed based on a neural network; the parameter set of the anomaly information monitoring network is represented as X = {X1, ..., X...} i ,…,X m+k The unlabeled parameter set is represented as U = {X1, ..., X}. m The set of marked anomaly parameters is represented as V = {X1, ..., X}. k}, where X i Let m be the number of unlabeled parameters and k be the number of labeled abnormal parameters;

[0015] The cross-entropy loss function is:

[0016]

[0017] Where S is the batch size of the neural network, f i For the features of the i-th labeled anomaly parameter extracted by the anomaly information monitoring network, l i It is the accuracy of identifying the i-th marked abnormal parameter.

[0018] Preferably, the loss function for the joint training is:

[0019] loss p =ω*loss2+loss d

[0020] Where ω represents the weight parameter, and loss2 is used to describe the features of the prototype and the labeled anomaly parameters to be learned, expressed as:

[0021]

[0022] In the formula, f i p is a feature of the i-th labeled anomaly parameter extracted by the anomaly information monitoring network. i The prototype feature of the i-th labeled anomaly parameter;

[0023] loss d The distance-based classification loss, used to improve the classification capability of the parameter monitoring module, is represented as:

[0024]

[0025] Among them, l i It is the recognition accuracy of the i-th labeled anomaly parameter, and D[i,:] represents the i-th row of the distance distribution matrix D;

[0026] The distance distribution matrix D is used to calculate the Euclidean distance between the prototype and the marked anomaly parameter set, and the formula is:

[0027]

[0028] In the formula, i = 1, 2, ..., S, j = 1, 2, ..., N, and ε is a non-zero constant.

[0029] Preferably, the step of identifying abnormal information during transmission and passing it into the buffer specifically involves:

[0030] Input the unlabeled parameter set into the trained parameter monitoring module to obtain the feature set, category set, label set, and prototype matrix distribution matrix of the unlabeled parameter set;

[0031] Use the set of categories of the labeled abnormal parameter set as the set of all correctly classified samples C;

[0032] The threshold is obtained by calculating the average distance distribution based on the distance distribution matrix, and then used to detect anomalies in the unlabeled parameter set. The formula is as follows:

[0033]

[0034] μ i =ρ*η i

[0035] In the formula, η i μ represents the distance threshold for the i-th class in the unlabeled parameter set classification set, with reference to all correctly classified sample sets C. i M represents the confidence level of the i-th class in the unlabeled parameter set classification set. ij C is the maximum confidence score of class i in the unlabeled parameter set on the j-th correctly classified sample set, where |C| is the number of all correctly classified sample sets C. iIt is the number of correctly classified samples in the i-th correctly classified sample set C, and ρ is an empirical parameter; when all confidence values ​​of a certain unlabeled parameter in the unlabeled parameter set are less than μ i If the unmarked parameter is determined to be abnormal, its class is considered an exception class.

[0036] Treating all anomaly classes as a single class, we store this as a prototype in a buffer using the unlabeled anomaly parameters clustered together. This buffer is used in the next round of incremental training to detect anomaly information, thereby further identifying potential different classes. Specifically:

[0037] Suppose that the set of anomalies in the Tth training iteration is U. T Using K-means on U T Clustered into k prototypes {C1, C2, ..., C} k};

[0038] Each prototype is treated as a category, and its corresponding unlabeled parameters are automatically marked, converted into labeled parameters, and added to a buffer to aid in the next round of anomaly detection.

[0039] Preferably, when the anomaly monitoring network of the parameter monitoring module detects new anomaly information, it checks whether the new anomaly information has been recorded in the buffer. If it has not been recorded, the buffer is updated with the new anomaly information, and the anomaly information is filtered out. Specifically:

[0040] Suppose that m new classes are found in the T-th detection and q new classes are found in the (T+1)-th detection, then the update method for buffer B is as follows:

[0041]

[0042]

[0043] In the formula, f u It is a feature of the u-th type in the abnormal information, l u It is the category of type u in the exception information, W T and W T+1 Let T and T+1 represent the weight vectors for the Tth and T+1th iterations, respectively.

[0044] Preferably, when the anomaly monitoring network of the parameter monitoring module detects new anomaly information, the weight parameters are initialized, specifically as follows:

[0045] Let A be the new set of anomaly information detected by the parameter monitoring module. Then, the weight parameters are initialized using the following formula:

[0046]

[0047] Where, ω n ωm These are the weight columns for the nth and mth classes, where N is the number of classes stored in the buffer and M is the number of exception classes.

[0048] Another aspect of the present invention provides a power data transmission anomaly detection system based on federated learning, characterized in that the system includes a deployment module, an identification module, a filtering module and a transmission module;

[0049] The deployment module is used to deploy a federated learning architecture with a parameter monitoring module at the power system edge gateway layer; the parameter monitoring module includes an anomaly information monitoring network and a buffer.

[0050] The identification module is used to identify abnormal information during the transmission process and pass it into the buffer when the edge gateway uploads power data, using the transmitted data as the parameter set of the abnormal information monitoring network in the parameter monitoring module.

[0051] The filtering module is used to confirm whether the new abnormal information has been recorded in the buffer when the abnormal information monitoring network of the parameter monitoring module detects new abnormal information. If it has not been recorded, the buffer is updated with the new abnormal information and the abnormal information is filtered.

[0052] The transmission module is used to filter out abnormal information and then update the transmitted data using knowledge transfer to ensure accurate data transmission.

[0053] The present invention also provides an electronic device, characterized in that the electronic device comprises:

[0054] At least one processor; and,

[0055] A memory communicatively connected to the at least one processor; wherein,

[0056] The memory stores computer program instructions that can be executed by the at least one processor, which enables the at least one processor to perform the above-described federated learning-based power data transmission anomaly detection method.

[0057] In another aspect, the present invention provides a computer-readable storage medium storing a program, characterized in that, when the program is executed by a processor, it implements the above-described federated learning-based power data transmission anomaly detection method.

[0058] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0059] 1. This invention provides a new method for constructing anomaly detection in distributed power data transmission. This method can discover abnormal data in a large number of unlabeled samples after learning from only a small number of labeled samples.

[0060] 2. The abnormal transmission detection method proposed in this invention includes a buffer, which enables the parameter monitoring module to have continuous learning capabilities and greatly improves the average accuracy of abnormal detection. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a flowchart of the power data transmission anomaly detection method based on federated learning in an embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram of the parameter monitoring module in an embodiment of the present invention;

[0064] Figure 3 This is a schematic diagram of the power data transmission anomaly detection system based on federated learning in an embodiment of the present invention;

[0065] Figure 4 This is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Detailed Implementation

[0066] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0067] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0068] like Figure 1 As shown, this embodiment of the power data transmission anomaly detection method based on federated learning includes the following steps:

[0069] Step 1: Deploy a federated learning architecture with a parameter monitoring module at the power system edge gateway layer; the parameter monitoring module includes an anomaly monitoring network and a buffer.

[0070] Each gateway collects local power grid operation data based on its jurisdiction, uploads it to the edge cluster, and performs commands such as switching power grid operation modes and frequency / peak regulation. It has edge computing and cloud-edge collaborative application functions to support dispatching operations and market operations.

[0071] Step 2, as follows Figure 2 As shown, when the edge gateway uploads power data, it uses the transmitted data as the parameter set of the abnormal information monitoring network in the parameter monitoring module to identify abnormal information during the transmission process and pass it into the buffer.

[0072] Specifically, the training steps for the parameter monitoring module are as follows:

[0073] A. The parameter set X of the anomaly monitoring network is divided into an unlabeled parameter set U and a labeled anomaly parameter set V; the features, categories, and labels in the unlabeled parameter set are unknown, while the features and labels in the labeled anomaly parameter set are known; the anomaly monitoring network is constructed based on a neural network, and the parameter set of the anomaly monitoring network is represented as X = {X1, ..., X...} i ,…,X m+k The unlabeled parameter set is represented as U = [X1, ..., X]. m The set of marked exception parameters is represented as V = [X1, ..., X]. k}, used to provide prior knowledge, X i Let m be the number of unlabeled parameters and k be the number of labeled abnormal parameters;

[0074] B. Initially train the anomaly detection network using the cross-entropy loss function on the labeled anomaly parameter set V to improve its classification ability and obtain the category set of the labeled anomaly parameter set; the cross-entropy loss function is:

[0075]

[0076] Where S is the batch size of the neural network, f i For the features of the i-th labeled anomaly parameter extracted by the anomaly information monitoring network, l i It is the accuracy of identifying the i-th marked anomaly parameter;

[0077] C. Use a clustering algorithm to cluster the categories of the labeled anomaly parameter set, and use the cluster centers as prototypes to construct an N×N prototype matrix, which is initialized with zero, where N is the number of categories of the labeled anomaly parameter set; each row of the prototype matrix represents the prototype (or center) of each known category, and the prototypes are selected according to the labels of the labeled anomaly parameter set;

[0078] D. Jointly train the prototype matrix and the initially trained anomaly detection network on the labeled parameter set V to obtain the trained parameter detection module; the loss function for joint training is:

[0079] loss p =ω*loss2+loss d

[0080] Where ω represents the weight parameter, and loss2 is used to describe the features of the prototype and the labeled anomaly parameters to be learned, expressed as:

[0081]

[0082] In the formula, f i p is a feature of the i-th labeled anomaly parameter extracted by the anomaly information monitoring network. i Let be the prototype feature of the i-th labeled anomaly parameter; the prototype feature is measurable data used to describe the prototype; the initial prototype feature can be obtained from the set of labeled anomaly parameters, and is subsequently updated as the transmission parameters increase.

[0083] Since the prototype matrix and the labeled parameter set V are trained jointly, simply using loss2 can easily mislead the prototype by anomalies in the training data. Therefore, a distance-based classification loss is added. d This is used to improve the classification ability of the parameter monitoring module and increase the penalty for misclassification, as shown in the following way:

[0084]

[0085] Among them, l i It is the recognition accuracy of the i-th labeled anomaly parameter, and D[i,:] represents the i-th row of the distance distribution matrix D;

[0086] The distance distribution matrix D is used to calculate the Euclidean distance between the prototype and the set of marked anomaly parameters. The reciprocal of the distance between the marked anomaly parameter and the prototype is taken so that marked anomaly parameters closer to the prototype can obtain a higher probability value. The formula is:

[0087]

[0088] In the formula, i = 1, 2, ..., S, j = 1, 2, ..., N, and ε is a constant to avoid the denominator being zero. In this embodiment, ε = 0.001.

[0089] After obtaining the trained parameter monitoring module, anomaly identification is performed on the unlabeled parameter set. Unlabeled parameters may be anomalous. The trained parameter monitoring module clusters parameters based on previously selected cluster centers. If an unlabeled parameter cannot be assigned to any normal class after clustering, it is considered an anomalous class. The anomalous class is stored in a buffer. In a new round of anomaly detection, if the detected unlabeled parameter belongs to neither a normal class nor a known anomalous class, it is considered a new anomalous class. Specifically:

[0090] Input the unlabeled parameter set into the trained parameter monitoring module to obtain the feature set, category set, label set, and prototype matrix distribution matrix of the unlabeled parameter set;

[0091] Use the set of categories of the labeled abnormal parameter set as the set of all correctly classified samples C;

[0092] The threshold is obtained by calculating the average distance distribution based on the distance distribution matrix, and then used to detect anomalies in the unlabeled parameter set. The formula is as follows:

[0093]

[0094] μ i =ρ*η i

[0095] In the formula, η i μ represents the distance threshold for the i-th class in the unlabeled parameter set classification set, with reference to all correctly classified sample sets C. i M represents the confidence level of the i-th class in the unlabeled parameter set classification set. ij C is the maximum confidence score of class i in the unlabeled parameter set on the j-th correctly classified sample set, where |C| is the number of all correctly classified sample sets C. i It is the number of correctly classified samples in the i-th correctly classified sample set C, and ρ is an empirical parameter; when all confidence values ​​of a certain unlabeled parameter in the unlabeled parameter set are less than μ i If the unmarked parameter is determined to be abnormal, its class is considered an exception class.

[0096] Treating all anomaly classes as a single class, we store this as a prototype in a buffer using the unlabeled anomaly parameters clustered together. This buffer is used in the next round of incremental training to detect anomaly information, thereby further identifying potential different classes. Specifically:

[0097] Suppose that the set of anomalies in the Tth training iteration is U. T Using K-means on U T Clustered into k prototypes {C1, C2, ..., C} k};

[0098] Each prototype is treated as a category, and its corresponding unlabeled parameters are automatically marked, converted into labeled parameters, and added to a buffer to aid in the next round of anomaly detection.

[0099] Step 3: When the anomaly monitoring network of the parameter monitoring module detects new anomaly information, it checks whether the new anomaly information has been recorded in the buffer. If not, it updates the buffer with the new anomaly information and filters it. Specifically:

[0100] Suppose that m new classes are found in the T-th detection and q new classes are found in the (T+1)-th detection, then buffer B will be updated in the following way:

[0101]

[0102]

[0103] In the formula, f u It is a feature of the u-th type in the abnormal information, l u It is a label of class u, W T and W T+1 Let T and T+1 represent the weight vectors for the Tth and T+1th iterations, respectively.

[0104] Simultaneously, an update method is employed that transfers knowledge from the training model to accelerate the training phase. Newly labeled parameters are used to update the network model and are temporarily cached. In each iteration of the incremental training phase, the distance distribution between the prototype and the newly labeled parameters is calculated. Then, mean normalization is applied to obtain the weight distribution. In each incremental training, all unknown classes are treated as a new class, as the buffer settings preserve different classes. Therefore, weight updates consider whether the detection parameters are known or unknown. When the parameter monitoring module detects new anomalies, the weight parameters are initialized, specifically as follows:

[0105] Let A be the new set of anomaly information detected by the parameter monitoring module. Then, the weight parameters are initialized using the following formula:

[0106]

[0107] Where, ω n ω m These are the weight columns for the nth and mth classes, where N is the number of classes stored in the buffer and M is the number of exception classes.

[0108] Step 4: After filtering out abnormal information, use knowledge transfer to update the transmitted data to ensure accurate data transmission.

[0109] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0110] Based on the same idea as the federated learning-based power data transmission anomaly detection method in the above embodiments, this invention also provides a federated learning-based power data transmission anomaly detection system, which can be used to execute the above-described federated learning-based power data transmission anomaly detection method. For ease of explanation, the structural diagram of the federated learning-based power data transmission anomaly detection system embodiment only shows the parts related to the embodiments of this invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and it may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0111] like Figure 3 As shown, another embodiment of the present invention provides a power data transmission anomaly detection system based on federated learning, including a deployment module, an identification module, a filtering module and a transmission module;

[0112] The deployment module is used to deploy a federated learning architecture with a parameter monitoring module at the power system edge gateway layer; the parameter monitoring module includes an anomaly information monitoring network and a buffer.

[0113] The identification module is used to identify abnormal information during the transmission process and pass it into the buffer when the edge gateway uploads power data, using the transmitted data as the parameter set of the abnormal information monitoring network in the parameter monitoring module.

[0114] The filtering module is used to check whether the new abnormal information is recorded in the buffer when the abnormal information monitoring network of the parameter monitoring module detects new abnormal information. If it is not recorded, the buffer is updated with the new abnormal information and the abnormal information is filtered.

[0115] The transmission module filters out abnormal information and then uses knowledge transfer to update the transmitted data, ensuring accurate data transmission.

[0116] It should be noted that the federated learning-based power data transmission anomaly detection system of the present invention corresponds one-to-one with the federated learning-based power data transmission anomaly detection method of the present invention. The technical features and beneficial effects described in the embodiments of the federated learning-based power data transmission anomaly detection method are applicable to the embodiments of the federated learning-based power data transmission anomaly detection system. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0117] Furthermore, in the above embodiments of the federated learning-based power data transmission anomaly detection system, the logical division of each program module is merely illustrative. In practical applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or software implementation convenience. That is, the internal structure of the federated learning-based power data transmission anomaly detection system can be divided into different program modules to complete all or part of the functions described above.

[0118] like Figure 4 As shown, in one embodiment, an electronic device is provided for implementing a federated learning-based method for detecting anomalies in power data transmission. The electronic device may include a first processor, a first memory, and a bus, and may also include a computer program, such as a power data transmission anomaly detection program, stored in the first memory and executable on the first processor.

[0119] The first memory includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the first memory can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the first memory can be an external storage device of the electronic device, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. Furthermore, the first memory can include both internal and external storage units of the electronic device. The first memory can be used not only to store application software and various types of data installed on the electronic device, such as the code of a power data transmission anomaly detection program, but also to temporarily store data that has been output or will be output.

[0120] In some embodiments, the first processor may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory (e.g., power data transmission anomaly detection programs) and calls data stored in the first memory to perform various functions of the electronic device and process data.

[0121] Figure 4 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 4 The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0122] The power data transmission anomaly detection program stored in the first memory of the electronic device is a combination of multiple instructions. When run in the first processor, it can achieve the following:

[0123] A federated learning architecture with a parameter monitoring module is deployed at the power system edge gateway layer; the parameter monitoring module includes an anomaly information monitoring network and a buffer.

[0124] When the edge gateway uploads power data, it uses the transmitted data as the parameter set of the abnormal information monitoring network in the parameter monitoring module to identify abnormal information during transmission and pass it into the buffer.

[0125] When the parameter monitoring module detects new abnormal information, it checks whether the new abnormal information has been recorded in the buffer. If it has not been recorded, the buffer is updated with the new abnormal information and the abnormal information is filtered out.

[0126] After filtering out abnormal information, knowledge transfer is used to update the transmitted data to ensure accurate data transmission.

[0127] Furthermore, if the modules / units integrated in the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0128] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0129] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0130] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for detecting anomalies in power data transmission based on federated learning, characterized in that, Includes the following steps: A federated learning architecture with a parameter monitoring module is deployed at the power system edge gateway layer; the parameter monitoring module includes an anomaly information monitoring network and a buffer. When the edge gateway uploads power data, it uses the transmitted data as a parameter set for the abnormal information monitoring network in the parameter monitoring module to identify abnormal information during transmission and pass it into the buffer. When the parameter monitoring module detects new abnormal information, it checks whether the new abnormal information has been recorded in the buffer. If it has not been recorded, the buffer is updated with the new abnormal information and the abnormal information is filtered out. After filtering out abnormal information, knowledge transfer is used to update the transmitted data to ensure accurate data transmission. The training steps for the parameter monitoring module are as follows: The parameter set X of the anomaly information monitoring network is divided into an unlabeled parameter set U and a labeled anomaly parameter set V; the labeled anomaly parameter set V includes the features and labels of each labeled parameter; The anomaly detection network is initially trained using the cross-entropy loss function on the labeled anomaly parameter set V to train its classification ability and obtain the category set of the labeled anomaly parameter set. Clustering algorithms are used to cluster the category set of the labeled anomaly parameter set. The cluster centers are used as prototypes to construct an N×N prototype matrix, which is initialized with zero, where N is the number of categories in the category set of the labeled anomaly parameter set. The prototype matrix and the initially trained anomaly detection network are jointly trained on the labeled parameter set V to obtain the trained parameter detection module; the loss function for the joint training is: loss p = ω * loss2 + loss d Where ω represents the weight parameter, loss2 is used to describe the features of the prototype and the labeled anomaly parameters to be learned, loss d This represents the distance-based classification loss, used to improve the classification capability of the parameter monitoring module; When the anomaly monitoring network of the parameter monitoring module detects new anomaly information, the weight parameters are initialized, specifically as follows: Let A be the new set of anomaly information detected by the parameter monitoring module. Then, the weight parameters are initialized using the following formula: ， Where, ω n ω m These are the weight columns for the nth and mth classes, where N is the number of classes stored in the buffer and M is the number of exception classes.

2. The power data transmission anomaly detection method based on federated learning according to claim 1, characterized in that, The anomaly monitoring network is constructed based on a neural network; the parameter set of the anomaly monitoring network is represented as X = {X1, …, X}. i , …, X m+k The unlabeled parameter set is represented as U = {X1, …, X}. m The set of marked anomaly parameters is represented as V = {X1, …, X}. k }, where X i Let m be the number of unlabeled parameters and k be the number of labeled abnormal parameters; The cross-entropy loss function is: ， Where S is the batch size of the neural network, f i For the features of the i-th labeled anomaly parameter extracted by the anomaly information monitoring network, l i It is the accuracy of identifying the i-th marked abnormal parameter.

3. The power data transmission anomaly detection method based on federated learning according to claim 1, characterized in that, The loss2 is used to describe the features of the prototype and the labeled anomaly parameters to be learned, and is expressed as: ， In the formula, f i p is a feature of the i-th labeled anomaly parameter extracted by the anomaly information monitoring network. i The prototype feature of the i-th labeled anomaly parameter; loss d The distance-based classification loss, used to improve the classification capability of the parameter monitoring module, is represented as: ， Among them, l i It is the recognition accuracy of the i-th labeled anomaly parameter, and D[i,:] represents the i-th row of the distance distribution matrix D; The distance distribution matrix D is used to calculate the Euclidean distance between the prototype and the marked anomaly parameter set, and the formula is: ， In the formula, i = 1,2,…,S, j = 1,2,…,N, and ε is a non-zero constant.

4. The power data transmission anomaly detection method based on federated learning according to claim 1, characterized in that, The process of identifying and transmitting abnormal information during transmission and then storing it in the buffer specifically involves: Input the unlabeled parameter set into the trained parameter monitoring module to obtain the feature set, category set, label set, and prototype matrix distribution matrix of the unlabeled parameter set; Use the set of categories of the labeled abnormal parameter set as the set of all correctly classified samples C; The threshold is obtained by calculating the average distance distribution based on the distance distribution matrix, and then used to detect anomalies in the unlabeled parameter set. The formula is as follows: ， m i = p * n i , In the formula, η i μ represents the distance threshold for the i-th class in the unlabeled parameter set classification set, with reference to all correctly classified sample sets C. i M represents the confidence level of the i-th class in the unlabeled parameter set classification set. ij C is the maximum confidence score of class i in the unlabeled parameter set on the j-th correctly classified sample set, where |C| is the number of all correctly classified sample sets C. i It is the number of correctly classified samples in the all correctly classified sample sets C, and ρ is an empirical parameter; when all confidence values ​​of a certain unlabeled parameter in the unlabeled parameter set are less than μ i If the unmarked parameter is determined to be abnormal, its class is considered an exception class. Treating all anomaly classes as a single class, we store this as a prototype in a buffer using the unlabeled anomaly parameters clustered together. This buffer is used in the next round of incremental training to detect anomaly information, thereby further identifying potential different classes. Specifically: Assume the first The anomaly set in this training is U. T Using K-means on U T Clustered into k prototypes {C1, C2, …, C k }; Each prototype is treated as a category, and its corresponding unlabeled parameters are automatically marked, converted into labeled parameters, and added to a buffer to aid in the next round of anomaly detection.

5. The power data transmission anomaly detection method based on federated learning according to claim 4, characterized in that, When the parameter monitoring module's anomaly monitoring network detects new anomaly information, it checks whether the new anomaly information has been recorded in the buffer. If not, it updates the buffer with the new anomaly information and filters it. Specifically: Suppose that m new classes are found in the T-th detection and q new classes are found in the (T+1)-th detection, then the update method for buffer B is as follows: ， ， In the formula, f u It is a feature of the u-th type in the abnormal information, l u It is the category of type u in the exception information, W T and W T+1 Let T and T+1 represent the weight vectors for the Tth and T+1th iterations, respectively.

6. A power data transmission anomaly detection system based on federated learning, characterized in that, The system includes a deployment module, an identification module, a filtering module, and a transmission module; The deployment module is used to deploy a federated learning architecture with a parameter monitoring module at the power system edge gateway layer; the parameter monitoring module includes an anomaly information monitoring network and a buffer. The identification module is used to identify abnormal information during the transmission process and pass it into the buffer when the edge gateway uploads power data, using the transmitted data as the parameter set of the abnormal information monitoring network in the parameter monitoring module. The filtering module is used to confirm whether the new abnormal information has been recorded in the buffer when the abnormal information monitoring network of the parameter monitoring module detects new abnormal information. If it has not been recorded, the buffer is updated with the new abnormal information and the abnormal information is filtered. The transmission module is used to filter out abnormal information and then update the transmitted data using knowledge transfer to ensure accurate data transmission. The training steps for the parameter monitoring module are as follows: The parameter set X of the anomaly information monitoring network is divided into an unlabeled parameter set U and a labeled anomaly parameter set V; the labeled anomaly parameter set V includes the features and labels of each labeled parameter; The anomaly detection network is initially trained using the cross-entropy loss function on the labeled anomaly parameter set V to train its classification ability and obtain the category set of the labeled anomaly parameter set. Clustering algorithms are used to cluster the category set of the labeled anomaly parameter set. The cluster centers are used as prototypes to construct an N×N prototype matrix, which is initialized with zero, where N is the number of categories in the category set of the labeled anomaly parameter set. The prototype matrix and the initially trained anomaly detection network are jointly trained on the labeled parameter set V to obtain the trained parameter detection module; the loss function for the joint training is: loss p = ω * loss2 + loss d Where ω represents the weight parameter, loss2 is used to describe the features of the prototype and the labeled anomaly parameters to be learned, loss d This represents the distance-based classification loss, used to improve the classification capability of the parameter monitoring module; When the anomaly monitoring network of the parameter monitoring module detects new anomaly information, the weight parameters are initialized, specifically as follows: Let A be the new set of anomaly information detected by the parameter monitoring module. Then, the weight parameters are initialized using the following formula: ， Where, ω n ω m These are the weight columns for the nth and mth classes, where N is the number of classes stored in the buffer and M is the number of exception classes.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which enables the at least one processor to perform the federated learning-based power data transmission anomaly detection method as described in any one of claims 1-5.

8. A computer-readable storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the power data transmission anomaly detection method based on federated learning as described in any one of claims 1-5.

Images