Method, device and system for identifying, diagnosing and predicting abnormalities of massive data streams in dispatching automation systems

Abstract

The present invention proposes a method, device and system for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system. The method comprises the following steps: a lossless acquisition step, in which the power dispatching data is losslessly acquired and preprocessed to obtain a message information stream; a sample expansion step, in which the message information stream is further preprocessed and WGAN-GP is performed for sample expansion; an AI identification step, in which the expanded samples are input into a two-step detection method composed of a PCA+XGBoost and CNN+LSTM joint algorithm model to improve the problem of low recognition rate of traditional machine learning and an output result step. The method, device and system of the present invention do not require a large amount of manpower, are short in time, do not require a large amount of labeled data, and have high accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of communication network technology, and in particular relates to a method, device and system for identifying, diagnosing and predicting anomalies of massive data streams in a dispatching automation system by integrating a generative adversarial network and multiple machine learning algorithms. Background Art

[0002] With the acceleration of power grid construction and the expansion of scale, various dispatching automation systems have been built one after another, and the business interaction applications between local and county dispatching systems have become more frequent, and the power dispatching data network has come into being. As a result, the amount of power dispatching data has increased exponentially, and the big data era of the power dispatching data network has officially arrived. In order to meet the needs of smart grids, the intelligent dispatching system should have a more comprehensive and accurate data acquisition system, with a powerful intelligent safety warning function, and pay attention to the coordination of system safety and economy in dispatching decisions: in the event of a system failure, it can quickly diagnose the fault and provide fault recovery decisions.

[0003] At present, with the increase in the amount of dispatch information data collection, power dispatch monitoring data has the characteristics of sequential, large, fast and continuous arrival of stream data. In addition, the implicit distribution changes of stream data will also bring about the problem of concept drift. The current anomaly detection methods for dispatch data mainly include simple threshold judgment methods based on a single system and analysis methods based on static offline data. The simple threshold judgment method based on a single system has limitations. On the one hand, the equipment information utilization rate and the accuracy of state evaluation are both low. On the other hand, it is difficult to detect the latent faults and fault categories of the equipment, and the fixed thresholds in the relevant specifications and standards are difficult to combine with the differences in equipment operating conditions. The analysis method based on static offline data has problems such as loose integration with the production operation system, inability to quickly reflect the system operation status and timely detect abnormal phenomena. In recent years, in the field of smart grid anomaly detection, domestic and foreign scholars have actively explored based on pattern matching algorithms and machine learning ideas, and have achieved certain research results. However, the existing power anomaly detection is mainly based on pattern matching algorithms. This method requires a lot of manpower, is time-consuming, and cannot detect unknown anomalies. In the anomaly detection based on machine learning, a large amount of labeled anomaly data is required.

[0004] In recent years, GAN has been widely used as a typical method for realizing artificial intelligence, and has achieved widespread success in the fields of computer vision, image recognition, and natural language processing, allowing people to appreciate its magical ability in dealing with complex problems. GAN consists of two independent deep networks: the generator and the discriminator. The generator accepts a model that obeys p gThe discriminator outputs 1 and 0 to distinguish between real samples and generated samples. During the GAN training process, the generator and discriminator are used to generate and classify samples respectively, and the performance of samples is improved adversarially. By using this method to recognize the minist handwriting dataset, the experimental results prove the potential of this framework.

[0005] eXtreme Gradient Boosting (XGBoost)

[17] is an improved algorithm based on the Gradient Boosting Decision Tree (GBDT)

[18] , which has been improved in terms of computing speed, generalization performance, and scalability. Convolutional Neural Network (CNN) is a feedforward neural network whose artificial neurons can respond to surrounding units within a certain coverage area and has excellent performance in large image processing. Long short-term memory (LSTM) is a special RNN (recurrent neural network), which is a neural network used to process time series data. Compared with general neural networks, it can process data with sequential changes.

[0006] Therefore, it is necessary to design new solutions to solve many problems such as the existing power anomaly detection requires a lot of manpower, is time-consuming, and requires a large amount of labeled anomaly data in machine learning-based anomaly detection. Summary of the invention

[0007] The main purpose of the present invention is to design a method, device and system for identifying, diagnosing and predicting anomalies in massive data streams of a scheduling automation system based on the fusion of a generative adversarial network and multiple machine learning algorithms. The method, device and system do not require a lot of manpower, are time-saving, do not require a large amount of labeled data, and have high accuracy.

[0008] To achieve the above objectives, the present invention provides a method for identifying, diagnosing and predicting anomalies of massive data streams in a dispatching automation system based on a combination of a generative adversarial network and machine learning, comprising the following steps:

[0009] Step 1: Losslessly collect and preprocess the power dispatching data to obtain a message information flow;

[0010] Step 2: further preprocess the message information flow and perform WGAN-GP for sample expansion;

[0011] Step 3: Input the expanded samples into a two-step detection method consisting of a PCA+XGBoost and CNN+LSTM joint algorithm model to improve the low recognition rate of traditional machine learning; and

[0012] Step 4: Output the recognition result.

[0013] A further improvement of the present invention is that in step 1, the power grid data is collected by a constructed data collection system, and the collected massive power data set is losslessly compressed and preliminarily processed into a message information flow containing only a timestamp and 104 messages.

[0014] A further improvement of the present invention is that, in step 2, the message information flow preliminarily processed in step 1 is further cleaned and feature extracted to remove duplicate samples and invalid samples of incomplete data, and the data set is divided into a training set, a validation set and a test set; in view of the problem of less abnormal power data, the WGAN-GP generation algorithm is used to expand the samples of the above preprocessed training set.

[0015] A further improvement of the present invention is that, in step 3, the abnormal data after sample expansion in step 2 is first subjected to XGBoost and CNN+LSTM algorithm models; secondly, for different abnormalities in power data, a two-step detection process is adopted: in the first step, the XGBoost algorithm is selected to reduce the dimension of the data, remove redundant data, select the optimal feature combination of input parameters in the fault detection stage, and train the XGBoost fault detection model to obtain the diagnosis results of large-scale abnormalities; in the second step, the data processed in the first step is input into the joint model of CNN+LSTM for fine-grained analysis to detect small-scale abnormalities.

[0016] A further improvement of the present invention is that, in step 4, the result generated by the AI ​​identification in step 3 is output, and the fault existing in the power system is processed according to the output result.

[0017] A further improvement of the present invention is that step 2 further comprises the following steps:

[0018] Step 2.1, data preprocessing stage: preprocess the captured power anomaly data and perform feature extraction, remove redundant features irrelevant to the category attributes, and divide it into a training set and a validation set, and put the processed feature set in the training set into the established sample database;

[0019] Step 2.2, select the generation algorithm stage: according to the characteristics of different generation adversarial networks, select a suitable generation adversarial network; you can choose any of the following generation algorithms for performance analysis: GAN, WGAN-GP, Time-GAN;

[0020] Step 2.3, adjusting generation algorithm parameters: According to the selected WGAN-GP generation algorithm, in order to ensure the credibility of the generated samples, the effect of the ratio of original samples to generated samples (optimal ratio of generated samples) of the WGAN-GP generation algorithm on the accuracy is tested;

[0021] Step 2.4. According to the requirements of step 2.3, two test methods are designed for the accuracy of the optimal generated sample ratio: the first is to test the accuracy of the generated samples with the model trained with the original samples (original model); the second is to test the original samples with the model trained with the generated samples (generated model); finally, the optimal generated sample ratio of the WGAN-GP algorithm is 1:2.

[0022] A further improvement of the present invention is to design a PCA+XGBoost algorithm model and a CNN+LSTM joint algorithm model according to the characteristics of power abnormal data and establish an identification model library. The specific steps include:

[0023] (1) According to the characteristics of power anomalies, power anomalies are divided into major anomalies and minor anomalies. The major anomalies consider the formation mechanism and characteristic quantities of the dispatching business information flow anomalies, and the minor anomalies consider the timestamp and the related message information before and after.

[0024] (2) According to the characteristics of the power anomaly divided in step (1), a suitable algorithm is selected. For large-class anomalies, the PCA+XGBoost algorithm model is used for detection, and for small-class anomalies, the CNN+LSTM joint algorithm model is used for detection;

[0025] Among them, the specific steps of PCA+XGBoost algorithm training model are:

[0026] a) Load the data set and label the data;

[0027] b) Sort the importance of features based on expert knowledge and PCA algorithm;

[0028] c) Select different feature combinations according to the feature importance ranking and test their impact on the model accuracy;

[0029] d) The best feature combination selected includes IP source address, IP destination address, IP header length, total IP length, source port number, destination port number, ACK confirmation flag, FIN, TCP sequence number, timestamp, 104 message start character, APDU length, transmission reason, type identifier, information object address, information element, etc.;

[0030] e) Set XGBoost training parameters: randomly shuffle data order, test set training set ratio, maximum depth of 6, learning rate of 0.01, given model solving method of gbtree, and select default parameters for other parameters;

[0031] f) Convert the processed data into a vector list and input the vector list into the XGBoost model for training;

[0032] e) Save the trained model to the detector model library;

[0033] Among them, the specific steps of CNN+LSTM joint algorithm training model are:

[0034] a) Convert the original pcap data set into K12txt text format;

[0035] b) Remove useless information in the K12 format: separators, separator lines, and convert the hexadecimal to the decimal required by the training model;

[0036] c) Load the data set, label the data, and randomly shuffle the original data order;

[0037] d) The length of the number list is guaranteed to be consistent by truncating the length and padded, and the Embedding layer converts it into a vector list;

[0038] e) Set the model parameters of CNN and LSTM respectively. First, construct a convolutional neural network. The convolutional neural network is based on one-dimensional CNN, including four convolutional layers, two maximum pooling layers, two fully connected layers, and one softmax layer. The number of neurons in Conv1 and Conv2 is 256, the kernel size is 3, and the all-zero padding step is 1; the number of neurons in Conv3 and Conv4 is 128, the kernel size is 2, and the all-zero padding step is 1; the kernel size of the two maximum pooling layers is 2, and the all-zero padding step is 2; the number of neurons in the two fully connected layers is 128; each pooling layer uses batch normalization, the activation function used in the four convolutional layers is the ReLU function, the training model Adam optimization algorithm is a maximum of 30 epochs, and the learning rate is 0.001; the neural network uses early stopping, that is, if the loss function does not decrease within 5 epochs, the training is terminated; the results of this network are based on 10-fold cross validation;

[0039] f) Two LSTM layers were added to CNN, where the LSTM layer was connected in series with the CNN layer. The parameter settings of the LSTM layer included: the input feature dimension of the first LSTM layer was 256, the number of hidden layer nodes was 64, and the dropout was set to 0.3; the input dimension of the second LSTM layer was 128, and the dropout level was 0.2;

[0040] g) Input the vector list into the CNN convolutional neural network for training;

[0041] h) Save the trained model to the detector model library.

[0042] In order to achieve the above-mentioned purpose of the invention, the present invention also provides a massive data stream anomaly identification, diagnosis and prediction device for a scheduling automation system based on a combination of generative adversarial networks and machine learning, including four modules: a lossless acquisition module, a sample expansion module, an AI identification module and an output result module.

[0043] A further improvement of the present invention is that the lossless acquisition module is used to perform lossless acquisition preprocessing on the power dispatching data to obtain a message information flow; the sample expansion module is used to further preprocess the message information flow and perform sample expansion by WGAN-GP; the AI ​​recognition module is used to input the expanded samples into a two-step detection method composed of a PCA+XGBoost and CNN+LSTM joint algorithm model to improve the problem of low recognition rate of traditional machine learning.

[0044] In order to achieve the above invention objectives, the present invention also provides a massive data stream anomaly identification, diagnosis and prediction system for a scheduling automation system based on a combination of generative adversarial networks and machine learning, which is used to execute the aforementioned method.

[0045] Beneficial effects of the present invention: Based on the characteristics of machine learning algorithms, the present invention first uses the feature importance ranking function of the XGBoost framework to preprocess data and select the most relevant performance indicators that affect the measurement of network status. This algorithm can be used to balance the accuracy of the test set and the complexity of the model. In addition, considering the characteristics of abnormal power grid data, the data processed by XGBoost is further input into the CNN+LSTM joint model for fine-grained analysis, thereby achieving efficient and reliable detection of power grid faults. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The present invention provides a technical framework for abnormal characteristics and fault identification based on massive information flows.

[0047] Figure 2 It is a two-step testing process. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0049] It should be emphasized that in the process of describing the present invention, various formulas and constraints are distinguished by consistent labels, but the use of different labels to mark the same formula and / or constraints is not excluded. The purpose of this setting is to more clearly illustrate the characteristics of the present invention.

[0050] Based on the application scenario of abnormal identification, diagnosis and prediction of massive data streams in power dispatching automation system, the present invention proposes a method for abnormal identification, diagnosis and prediction of massive data streams in dispatching automation system based on the fusion of generative adversarial network and multiple machine learning algorithms, including the following steps:

[0051] (1) Lossless acquisition stage: First, the data stream generated by the power dispatching data network is losslessly acquired throughout the entire process and initially processed into a message information stream. A lossless compression algorithm is then used to reduce the pressure of massive data on hardware devices.

[0052] (2) Sample expansion stage: The message information flow initially processed in the lossless acquisition stage is further processed to obtain a data format suitable for the WGAN-GP generation algorithm, and the original abnormal samples are expanded according to the optimal generation ratio obtained by the test.

[0053] (3) AI identification stage: In view of the characteristics of abnormal data in the power grid, a two-step detection process method is designed. In the first step, the XGBoost algorithm is selected to reduce the dimension of the data, remove redundant data, select the optimal feature combination of the input parameters in the fault detection stage, and divide the final processed data into a training set and a test set, and train the XGBoost fault detection model to obtain the diagnosis results of large-scale abnormalities. The data processed in the first step is then input into the CNN+LSTM joint model for fine-grained analysis to detect small-scale abnormalities. The advantages of CNN's ability to automatically extract features from massive data and LSTM's ability to process time series changes are used to combine the two algorithm models to better handle various abnormalities in the power grid.

[0054] (4) Result output stage: The identification results of the AI ​​identification stage are output, and relevant problems are processed based on the output results.

[0055] The following is combined with Figure 1 , 2 The present invention is described in detail with reference to the accompanying drawings and examples.

[0056] (1) Lossless acquisition stage: First, the data stream generated by the power dispatching data network is losslessly acquired throughout the entire process and initially processed into a message information stream. A lossless compression algorithm is then used to reduce the pressure of massive data on hardware devices.

[0057] In the lossless collection stage, the power grid data is collected through the established data collection system, and the collected massive power data sets are losslessly compressed and initially processed into message information streams containing only timestamps and 104 messages.

[0058] (2) Sample expansion stage: The message information flow initially processed in the lossless acquisition stage is further processed to obtain a data format suitable for the WGAN-GP generation algorithm, and the original abnormal samples are expanded according to the optimal generation ratio obtained by the test.

[0059] In the sample expansion stage, the message information flow that has been preliminarily processed in step (1) is further cleaned and features extracted to remove duplicate samples and invalid samples of incomplete data, and the data set is divided into a training set, a validation set, and a test set. In view of the problem of less power abnormality data, the WGAN-GP generation algorithm is used to expand the sample of the above preprocessed training set. The specific steps for sample expansion using the WGAN-GP generation algorithm are as follows:

[0060] Step 2.1, data preprocessing stage: preprocess the captured power anomaly data and perform feature extraction, remove redundant features irrelevant to category attributes, and divide it into a training set and a validation set, and put the processed feature set in the training set into the established sample database.

[0061] Step 2.2, select the generation algorithm stage: According to the characteristics of different generation adversarial networks, select the appropriate generation adversarial network. We selected several commonly used generation algorithms such as classic GAN, WGAN-GP, and Time-GAN for performance analysis. Considering factors such as time cost, generated sample credibility, and algorithm complexity, we finally adopted the WGAN-GP generation algorithm.

[0062] Step 2.3, adjusting generation algorithm parameters: According to the selected WGAN-GP generation algorithm, in order to ensure the credibility of the generated samples, we tested the impact of the ratio of original samples to generated samples (optimal ratio of generated samples) of the WGAN-GP generation algorithm on the accuracy.

[0063] Step 2.4: According to the requirements of step 2.3, we designed two test methods for the accuracy of the optimal generated sample ratio. The first method is to test the accuracy of the generated samples with the model trained with the original samples (original model); the second method is to test the original samples with the model trained with the generated samples (generated model). Finally, the optimal generated sample ratio of the WGAN-GP algorithm is 1:2.

[0064] (3) AI identification stage: In view of the characteristics of abnormal data in the power grid, a two-step detection process method is designed. In the first step, the XGBoost algorithm is selected to reduce the dimension of the data, remove redundant data, select the optimal feature combination of the input parameters in the fault detection stage, and divide the final processed data into a training set and a test set, and train the XGBoost fault detection model to obtain the diagnosis results of large-scale abnormalities. The data processed in the first step is then input into the CNN+LSTM joint model for fine-grained analysis to detect small-scale abnormalities. The advantages of CNN's ability to automatically extract features from massive data and LSTM's ability to process time series changes are used to combine the two algorithm models to better handle various abnormalities in the power grid.

[0065] In the AI ​​recognition stage, the two-step detection process is as follows:

[0066] Step 3.1: Divide the power anomaly into major anomaly and minor anomaly according to the above power anomaly characteristics. Major anomaly usually considers the formation mechanism and characteristic quantity of the scheduling business information flow anomaly, while minor anomaly needs to consider the timestamp and related message information before and after.

[0067] Step 3.2: The detection model library contains a variety of algorithms, and different algorithms are suitable for different needs. According to the characteristics of power anomalies divided in step 3.1, select the appropriate algorithm. For large-class anomalies, use the PCA+XGBoost algorithm model for detection, and for small-class anomalies, use the CNN+LSTM joint algorithm model for detection.

[0068] Among them, the specific steps of PCA+XGBoost algorithm training model are:

[0069] a) Load the data set and label the data;

[0070] b) Sort the importance of features based on expert knowledge and PCA algorithm;

[0071] c) Select different feature combinations according to the feature importance ranking and test their impact on the model accuracy;

[0072] d) The best feature combination selected includes IP source address, IP destination address, IP header length, total IP length, source port number, destination port number, ACK confirmation flag, FIN, TCP sequence number, timestamp, 104 message start character, APDU length, transmission reason, type identifier, information object address, information element, etc.;

[0073] e) Set XGBoost training parameters: randomly shuffle data order, test set training set ratio, maximum depth of 6, learning rate of 0.01, given model solving method of gbtree, and select default parameters for other parameters;

[0074] f) Convert the processed data into a vector list and input the vector list into the XGBoost model for training;

[0075] e) Save the trained model to the detector model library.

[0076] Among them, the specific steps of CNN+LSTM joint algorithm training model are:

[0077] a) Convert the original pcap data set into K12txt text format;

[0078] b) Remove useless information in the K12 format: separators, separator lines, and convert the hexadecimal to the decimal required by the training model;

[0079] c) Load the data set, label the data, and randomly shuffle the original data order;

[0080] d) The length of the number list is guaranteed to be consistent by truncating the length and padded, and the Embedding layer converts it into a vector list;

[0081] e) Set the model parameters of CNN and LSTM respectively, and first construct a convolutional neural network. The neural network of the present invention is based on a one-dimensional CNN, including four convolutional layers, two maximum pooling layers, two fully connected layers, and a softmax layer. The number of neurons in Conv1 and Conv2 is 256, the kernel size is 3, and the full zero padding step is 1; the number of neurons in Conv3 and Conv4 is 128, the kernel size is 2, and the full zero padding step is 1; the kernel of the two maximum pooling layers is 2, and the full zero padding step is 2; the number of neurons in the two fully connected layers is 128. Each pooling layer uses batch normalization, the activation function used by the four convolutional layers is the ReLU function, the training model Adam optimization algorithm is a maximum of 30 epochs, and the learning rate is 0.001. The neural network uses early stopping, that is, if the training is within 5 epochs and the loss function does not decrease, the training is terminated. The results of this network are based on 10-fold cross validation.

[0082] f) Two LSTM layers were added to CNN, where the LSTM layer was connected in series with the CNN layer. The parameter settings of the LSTM layer included: the input feature dimension of the first LSTM layer was 256, the number of hidden layer nodes was 64, and the dropout was set to 0.3; the input dimension of the second LSTM layer was 128, and the dropout level was 0.2;

[0083] g) Input the vector list into the CNN convolutional neural network for training;

[0084] h) Save the trained model to the detector model library.

[0085] Save the trained model to the classifier model library. The trained CNN model is used as a business type identifier, similar to other machine learning algorithms.

[0086] (4) Result output stage: The identification results of the AI ​​identification stage are output, and relevant problems are processed based on the output results.

[0087] In the result output stage, the result generated by the AI ​​identification in step (3) is output, and the faults existing in the power system are processed according to the output results.

[0088] Regarding the two-step detection method, the following combination Figure 2 Detailed description is shown below.

[0089] Generative Adversarial Networks (GAN) is a deep learning model that produces fairly good outputs through mutual game learning between generative models and discriminative models. The problem of insufficient labeled data of power grid anomalies is solved by expanding the samples of power grid anomaly data through generative adversarial networks, thereby solving the problem that machine learning-based anomaly detection requires a large amount of labeled anomaly data. Secondly, power grid anomalies can be divided into several categories according to the formation mechanism and characteristic quantities of dispatching business information flow anomalies. The major anomalies can be further divided into subcategories according to the specific causes of the anomalies. Therefore, based on the characteristics of power grid anomaly data and the characteristics of machine learning algorithms, we designed a two-step detection method. The structural diagram is shown in the figure. Figure 2 As shown, the details are as follows:

[0090] ① Detection method of abnormal data of large categories of power grid based on XGBoost algorithm: eXtremeGradient Boosting (XGBoost) is an improved algorithm based on Gradient Boosting Decision Tree (GBDT), which has been improved in terms of computing speed, generalization performance and scalability. In each iteration of the original GBDT algorithm during training, a new decision tree model is established in the gradient descent direction of the previous model loss function, and the decision tree is pruned after it is constructed. Unlike the original GBDT, XGBoost adds regularization terms to the loss function during the construction stage of the decision tree. The XGBoost algorithm based on the tree model supports parallel training, can handle tabular data well, and is easy to adjust parameters. It is widely used in various classification tasks. Therefore, for the identification of large-category abnormalities in power, the use of the XGBoost algorithm has a faster and more accurate effect on the classification of large-category abnormalities.

[0091] (② A method for detecting small-category abnormal data in power grids based on the CNN+LSTM joint algorithm: A neural network is composed of a large number of artificial neurons, and different networks are constructed according to different connection methods. Convolutional Neural Network (CNN) is one of them. Neural networks can have simple decision-making and simple judgment capabilities similar to humans, and can achieve high-precision analysis of traffic classification without the need for manual feature extraction. LSTM is a recurrent neural network (RNN), which is suitable for sequence data. Such models have been successfully applied to language recognition, translation tasks, time series prediction, and language modeling. The input of the LSTM model depends not only on the last input, but also on the previous input. In anomaly identification, we regard each flow as a single input and a set of continuous flows as an input sequence suitable for LSTM. Because the timing characteristics of related messages need to be considered in the identification of small-category anomalies in the power grid, we introduced the CNN+LSTM joint algorithm model.

[0092] In the two-step detection process, a CNN model is first trained to use a single flow to predict the first type of abnormal business, and then an LSTM model is used to predict the second type of abnormality in the flow. The input features of each flow are first passed through the CNN model, and then the predicted output is connected with the relative time of the flow (that is, relative to the target flow). It is then input as the first step of the LSTM model, and the same process is repeated for the next K flows. The LSTM then outputs the judgment result of the target flow. This method can solve the problem of complex abnormal types in the power grid.

[0093] The two-step detection anomaly identification method based on the XGBoost and CNN+LSTM joint model is studied, and a two-step detection process is designed according to the characteristics of power grid data. Figure 2 As shown. In the first step, the XGBoost algorithm is selected to reduce the dimension of the data, remove redundant data, select the optimal feature combination of the input parameters in the fault detection stage, divide the final processed data into training sets and test sets, and train the XGBoost fault detection model to obtain the diagnosis results of large-class anomalies. The data processed in the first step is then input into the CNN+LSTM joint model for fine-grained analysis to detect small-class anomalies. CNN can automatically extract features from massive data and LSTM can handle time series changes. The two algorithm models are combined to better handle various anomalies of the power grid. The two-step detection process comprehensively considers the characteristics of power grid data and fully utilizes the advantages of various algorithm models to obtain the best diagnostic results.

[0094] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of generative adversarial networks and machine learning, characterized in that: The following steps are involved: Step 1: Losslessly collect and preprocess the power dispatching data to obtain a message information flow; Step 2: Further preprocess the message information flow and perform WGAN-GP (Wasserstein Generative Adversarial Nets - Gradient Penalty) for sample expansion; Step 3: Input the expanded samples into a two-step detection method consisting of a PCA+XGBoost and CNN+LSTM joint algorithm model; as well as Step 4: Output the recognition result; Among them, in step 3, the specific steps of designing the PCA+XGBoost algorithm model and the CNN+LSTM joint algorithm model according to the characteristics of power abnormal data and establishing the identification model library include: (1) According to the characteristics of power anomalies, power anomalies are divided into major anomalies and minor anomalies. The major anomalies consider the formation mechanism and characteristic quantities of the dispatching business information flow anomalies, and the minor anomalies consider the timestamp and the related message information before and after. (2) According to the characteristics of power anomalies classified in step (1), select a suitable algorithm. For large-scale anomalies, use the PCA+XGBoost algorithm model for detection, and for small-scale anomalies, use the CNN+LSTM joint algorithm model for detection; Among them, the specific steps of PCA+XGBoost algorithm training model are: a) Load the data set and label the data; b) Sort the importance of features based on expert knowledge and PCA algorithm; c) Select different feature combinations according to the feature importance ranking and test their impact on the model accuracy; d) The best feature combination selected includes IP source address, IP destination address, IP header length, total IP length, source port number, destination port number, ACK confirmation flag, FIN, TCP sequence number, timestamp, 104 message start character, APDU length, transmission reason, type identifier, information object address, and information element; e) Set XGBoost training parameters: randomly shuffle data order, test set training set ratio, maximum depth of 6, learning rate of 0.01, given model solving method of gbtree, and select default parameters for other parameters; f) Convert the processed data into a vector list and input the vector list into the XGBoost model for training; e) Save the trained model to the detector model library; Among them, the specific steps of CNN+LSTM joint algorithm training model are: a) Convert the original pcap data set into K12 format; b) Remove useless information in the K12 format: separators, separator lines, and convert the hexadecimal to the decimal required by the training model; c) Load the data set, label the data, and randomly shuffle the original data order; d) The length of the number list is guaranteed to be consistent by truncating the length and padded, and the Embedding layer converts it into a vector list; e) Set the model parameters of CNN and LSTM respectively. First, build a convolutional neural network. The convolutional neural network is based on one-dimensional CNN, including four convolutional layers, two maximum pooling layers, two fully connected layers, and one softmax layer. The number of neurons in Conv1 and Conv2 is 256, the kernel size is 3, and the all-zero padding step is 1; the number of neurons in Conv3 and Conv4 is 128, the kernel size is 2, and the all-zero padding step is 1; the kernel size of the two maximum pooling layers is 2, and the all-zero padding step is 2; the number of neurons in the two fully connected layers is 128; each pooling layer uses batch normalization, the activation function used in the four convolutional layers is the ReLU function, the training model Adam optimization algorithm is a maximum of 30 epochs, and the learning rate is 0.001; the neural network training is terminated if the loss function does not decrease within 5 epochs; the network results are based on 10-fold cross validation; f) Two LSTM layers were added to CNN, where the LSTM layer was connected in series with the CNN layer. The parameter settings of the LSTM layer included: the input feature dimension of the first LSTM layer was 256, the number of hidden layer nodes was 64, and the dropout was set to 0.3; the input dimension of the second LSTM layer was 128, and the dropout level was 0.2; g) Input the vector list into the CNN convolutional neural network for training; h) Save the trained model to the detector model library.

2. The method for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of a generative adversarial network and machine learning according to claim 1 is characterized in that: In step 1, the power grid data is collected through the established data acquisition system, and the collected massive power data set is losslessly compressed and preliminarily processed into a message information flow containing only timestamps and 104 messages.

3. The method for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of a generative adversarial network and machine learning according to claim 2 is characterized in that: In step 2, the message information flow initially processed in step 1 is further cleaned and features extracted to remove duplicate samples and invalid samples of incomplete data, and the data set is divided into training set, validation set and test set. In view of the problem of less abnormal power data, the WGAN-GP generation algorithm is used to expand the samples of the above preprocessed training set.

4. The method for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of a generative adversarial network and machine learning according to claim 3 is characterized in that: In step 3, the abnormal data after sample expansion in step 2 is first subjected to the XGBoost and CNN+LSTM algorithm models; secondly, a two-step detection process is adopted for different abnormalities in power data: in the first step, the XGBoost algorithm is selected to reduce the dimension of the data, remove redundant data, select the optimal feature combination of input parameters in the fault detection stage, and train the XGBoost fault detection model to obtain the diagnosis results of large-scale abnormalities; in the second step, the data processed in the first step is input into the CNN+LSTM joint model for fine-grained analysis to detect small-scale abnormalities.

5. The method for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of a generative adversarial network and machine learning according to claim 4 is characterized in that: In step 4, the result generated by the AI ​​identification in step 3 is output, and the fault in the power system is processed according to the output result.

6. The method for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of a generative adversarial network and machine learning according to claim 3 is characterized in that: Step 2 further comprises the following steps: Step 2.1, data preprocessing stage: preprocess the captured power anomaly data and perform feature extraction, remove redundant features irrelevant to the category attributes, and divide it into a training set and a validation set, and put the processed feature set in the training set into the established sample database; Step 2.2, select the generation algorithm stage: according to the characteristics of different generation adversarial networks, select a suitable generation adversarial network; you can choose any of the following generation algorithms for performance analysis: GAN, WGAN-GP, Time-GAN; Step 2.3, adjusting generation algorithm parameters: According to the selected WGAN-GP generation algorithm, in order to ensure the credibility of the generated samples, the influence of the ratio of the original samples and the optimal generated samples of the WGAN-GP generation algorithm on the accuracy is tested; Step 2.

4. According to the requirements of step 2.3, two test methods are designed for the accuracy of the optimal generated sample ratio: the first is to test the accuracy of the generated samples with the original model trained with the original samples; the second is to test the original samples with the generated model trained with the generated samples; finally, the optimal generated sample ratio of the WGAN-GP algorithm is 1:

2.

7. A device for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of generative adversarial networks and machine learning, used to implement the method described in any one of claims 1 to 6, characterized in that: The method comprises four modules: a lossless acquisition module, a sample expansion module, an AI recognition module and an output result module. The lossless acquisition module is used to perform lossless acquisition preprocessing on the power dispatching data to obtain a message information flow, thereby implementing the method of step 1; the sample expansion module is used to further preprocess the message information flow and perform sample expansion by WGAN-GP, thereby implementing the method of step 2; the AI ​​recognition module is used to input the expanded samples into a two-step detection method composed of a PCA+XGBoost and CNN+LSTM joint algorithm model, thereby implementing the method of step 3.

8. A system for identifying, diagnosing and predicting abnormalities of massive data streams in a dispatching automation system based on a combination of generative adversarial networks and machine learning, characterized in that: Used to execute the method according to any one of claims 1 to 6.

Images