An automatic detection method for unknown anomalies in power grid data stream

Abstract

The present invention relates to the technical field of communication networks, and in particular to an automated detection method for unknown anomalies in power grid data streams. A lossless acquisition module obtains original messages generated by a power dispatching data network through a tshark network packet interception tool and stores them respectively according to message types. Message data passes through a sample expansion module to determine whether the number of messages reaches a threshold of an input AI recognition module. Sample expansion is performed on message types whose number does not reach the threshold through a time series adversarial generation network. An AI recognition and result output module uses an unsupervised clustering algorithm DBSCAN to learn characteristic patterns of power grid data streams. Power detection personnel inspect equipment that outputs abnormal messages to determine whether it is necessary to update DBSCAN algorithm parameters. Finally, the abnormal message results identified help power maintenance personnel to promptly discover abnormal equipment and quickly discover and classify abnormal messages, thereby expanding abnormal data sets.

Description

Technical Field

[0001] The present invention relates to the field of communication network technology, and in particular to an automatic detection method for unknown anomalies in power grid data streams, which is based on the fusion of Time-GAN and unsupervised clustering. Background Art

[0002] As the scale of intelligent development of power dispatching networks continues to expand, the devices in various power dispatching networks will generate massive data flows. The interaction between various systems in different prefecture-level cities and county-level cities has become more frequent, and the power dispatching data network has emerged. In order to meet the needs of smart grids, the intelligent dispatching system should have a more comprehensive and accurate data collection system, and be able to collect and classify the abnormalities of power equipment, and quickly locate the faulty power equipment.

[0003] Unsupervised learning is a learning method that learns patterns in raw data without the help of labels. Unlike supervised learning, which artificially specifies labels to define data categories based on prior knowledge, unsupervised learning can discover the inherent laws or structures contained in the data. In recent years, domestic and foreign scholars have achieved some research results in the application of clustering algorithms to identify anomalies in network traffic in power systems. Some researchers use the Canopy-K-means algorithm to cluster traffic data in key power business systems to identify attack traffic and business traffic. Other researchers have applied fuzzy clustering methods to achieve the fusion of multiple expert diagnosis results in the process of power system fault diagnosis, achieving faster fault diagnosis results. At the same time, hierarchical clustering, k-means, DBSCAN and other methods are used to improve the detection rate of wireless network intrusion detection methods, reduce false positive rates, and improve the overall performance of intrusion detection systems.

[0004] DBSCAN is a representative density-based unsupervised clustering algorithm. It clusters samples by type according to the density of the sample space and separates sample points that do not belong to the density area. It is widely used in anomaly detection of network flows. Its working principle is: for each sample, the algorithm calculates how many adjacent samples there are within a small distance ε from it, and this area is called the ε neighborhood of the sample. If a sample contains at least μ samples in its ε neighborhood, the instance is considered a core instance, and each core instance is considered to belong to the density area.

[0005] In recent years, GAN has been widely used as a typical method for realizing artificial intelligence, and has achieved widespread success in the fields of computer vision, image recognition and natural language processing, allowing people to appreciate its magical ability in dealing with complex problems. WGAN was proposed by Arjovsky et al. The difference from the classic GAN algorithm is that it overcomes the defects of JS metric discontinuity and gradient unavailability in some places. The Time-GAN generation method proposed by JinsungYoon et al. is specially designed for generating real time series. This generation method not only introduces unsupervised adversarial loss of real data and generated data, but also introduces step-by-step supervised loss of original data as supervision. Secondly, this method introduces an embedding network to provide a reversible mapping between feature space and latent space, so as to reduce the dimension of adversarial learning space. Finally, the supervision loss is minimized by jointly training the embedding network and the generator network, so that the latent space not only helps to improve parameter efficiency, but also helps the generator learn time relationships. Summary of the invention

[0006] In order to solve the problem that there are a large number of unknown anomalies in the existing power grid, and the supervised learning method that requires a labeled data set cannot be used for detection, and at the same time solve the problem of rapid discovery of power grid faults and rapid location of faulty equipment. The present invention proposes an automatic detection method for unknown anomalies in power grid data streams based on the fusion of Time-GAN and unsupervised clustering. It helps power maintenance personnel to discover unknown anomalies that were not previously collected and archived, expands the anomaly database (the database can be used for supervised learning), and can quickly locate faulty equipment, which is convenient for staff to repair in time. The present invention first uses the Time-GAN generation model to expand the data set with a small number of samples, so that it can meet the quantitative requirements of DBSCAN anomaly identification as soon as possible, and will not cause the real-time performance of anomaly detection to decrease due to the inability to collect enough data for too long; at the same time, the DBSCAN algorithm is used to identify anomalies in the power dispatching data stream, and the data that cannot be clustered into any cluster is marked as abnormal sample points, thereby realizing the detection of unknown anomalies in the power dispatching network.

[0007] The specific technical solution adopted by the present invention is as follows:

[0008] An automatic detection method for unknown anomalies in power grid data streams is proposed. The method is based on the fusion of Time-GAN and unsupervised clustering and includes the following stages:

[0009] (1) Lossless collection and classification stage: First, the data stream generated by the power dispatching data network is losslessly collected through the tshark network tool and preliminarily processed into message information streams, and a lossless compression algorithm is used to reduce the storage requirements of massive data on the equipment. At the same time, the messages are classified into three categories according to type: telemetry, remote control, and remote communication, in order to improve the performance of the DBSCAN algorithm clustering used in the AI ​​identification stage.

[0010] (2) Sparse sample expansion stage: Periodically check whether the number of each type of message reaches the threshold, and send the message data that reaches the threshold to the next stage for AI recognition. For message types that have not reached the threshold for a long time, normalization and other processing are performed to obtain a data format suitable for the Time-GAN generation algorithm, and the original message samples are expanded according to the optimal generation ratio obtained by the test so that the number of messages reaches the requirement that can be sent to the AI ​​recognition stage.

[0011] (3) AI identification and result output stage: In view of the frequent occurrence of unknown faults in the power dispatching system, an abnormal message detection method based on the DBSCAN clustering algorithm is designed to timely discover abnormal messages and quickly locate faulty equipment. First, the neighborhood radius parameter of the DBSCAN algorithm is determined by the elbow point method, and the minimum sample size parameter of the DBSCAN algorithm is determined by the number of features of the input sample. Then, the data processed in the sparse sample expansion stage is input into the DBSCAN algorithm, and the data set is clustered. Samples that cannot be classified into any cluster are regarded as abnormal samples, marked and output.

[0012] (4) Parameter update phase: Check the abnormal messages marked in the AI ​​identification phase and locate the power equipment that sent the message to detect whether it has a fault. If a correct alarm occurs, maintenance personnel can perform troubleshooting. If multiple false alarms occur, the neighborhood radius parameter will be re-determined using the elbow point method and the DBSCAN algorithm will be adjusted.

[0013] Specific steps:

[0014] Step S1, the data stream generated by the electric power dispatching data network is losslessly collected through the tshark network tool and preliminarily processed into a message information stream, and compressed using a lossless compression algorithm, and then the processed messages are classified according to the message type and stored.

[0015] Step S2: Periodically check the messages processed in step S1 to determine whether the number of messages of each type reaches the threshold, and send the message data that reaches the threshold to the next stage for AI recognition. In order to solve the problem that the number of certain types of messages is small and AI abnormal recognition cannot be performed, for message types that have not reached the threshold for a long time, the Time-GAN generative adversarial network model is used to expand the samples so that the number of messages reaches the requirement that can be sent to the AI ​​recognition stage.

[0016] Step S3: First, determine the neighborhood radius parameter of the DBSCAN algorithm by the elbow point method, and determine the minimum sample size parameter of the DBSCAN algorithm by the number of features of the input sample. Then input the data set processed in step S2 into the DBSCAN algorithm, cluster the data set, and regard samples that cannot be classified into any cluster as abnormal samples, mark them, and output them.

[0017] Step S4: Check the abnormal message marked in step S3, locate the power equipment that sent the message, and detect whether it has a fault. If a correct alarm occurs, the maintenance personnel can troubleshoot the fault, archive and classify the abnormality, and expand the abnormal message database. If multiple false alarms occur, the neighborhood radius parameter will be re-determined through the elbow point method and the DBSCAN algorithm will be adjusted.

[0018] As a further preferred embodiment, step S2 performs sample expansion through Time-GAN, and the specific steps are as follows:

[0019] (1) Message classification stage: Messages are classified into three categories: telemetry, remote control, and remote communication. According to the survey, the data messages of the power dispatching network are divided into the above three categories, and the data distribution of the same type of messages is relatively consistent. Therefore, classifying the messages in advance can improve the performance of the DBSCAN algorithm clustering used in this method. If the messages are not classified and different types of messages are directly mixed and input into the algorithm, abnormal messages will be hidden.

[0020] (2) Data preprocessing stage: The captured power anomaly data is preprocessed and feature extracted to remove redundant features that are not related to the category attributes. The data is divided into a training set and a validation set, and the processed feature set in the training set is placed in the established sample database.

[0021] (3) Generation algorithm selection stage: The Time-GAN method is selected because it is specially designed for generating real time series. First, this generation method not only introduces unsupervised adversarial losses for real data and generated data, but also introduces step-by-step supervised losses for original data as supervision. Second, this method introduces an embedding network to provide a reversible mapping between feature space and latent space, thereby reducing the dimensionality of the adversarial learning space. Finally, the supervised loss is minimized by jointly training the embedding network and the generator network. In this way, the latent space not only helps to improve parameter efficiency, but also helps the generator learn temporal relationships.

[0022] (4) Adjusting generation algorithm parameters: Based on the selected Time-GAN generation algorithm, in order to ensure the credibility of the generated samples, we tested the impact of the ratio of original samples to generated samples (optimal generation sample ratio) of the Time-GAN generation algorithm on the accuracy.

[0023] (5) Algorithm deployment stage: Time-GAN is used to expand a small number of power dispatching network samples, and finally the message data that can "deceive" the discriminator is obtained, thus achieving the purpose of expanding the samples.

[0024] As a further preferred embodiment, in step S3, according to the characteristics of the power grid data, the DBSCAN unsupervised clustering algorithm is used to identify unknown abnormal messages, and the specific steps are as follows:

[0025] (1) Data preprocessing stage: According to the data sent by the sparse sample expansion module, the data is filled and truncated, and the corresponding feature fields are extracted according to the feature values ​​selected in advance.

[0026] (2) Algorithm selection stage: In order to solve the problem of missing abnormal types in the power dispatching network and the inability to locate faulty equipment in time. Therefore, an unsupervised learning algorithm that does not require pre-labeling is adopted. This type of algorithm can well mark abnormal sample points that are out of all clusters. If a supervised learning algorithm is used, the input data must be labeled in advance, which results in this type of algorithm only being able to discover abnormal types that have been defined in advance. Commonly used unsupervised clustering algorithms include the k-means algorithm and the DBSCAN algorithm. The k-means algorithm has a poor effect when the sample space is irregular, and the parameter of the number of clusters needs to be determined in advance. It is not suitable for power dispatching network data streams with unknown cluster numbers. The DBSCAN clustering algorithm does not need to determine the number of clusters in advance, and it also has a good effect on irregular sample spaces. Therefore, the DBSCAN algorithm is used for AI abnormality identification.

[0027] (3) Algorithm parameter determination stage: The first algorithm parameters to be determined are the neighborhood radius ε and the minimum number of points μ within the domain radius to become a core object. The minimum number of points μ is determined by empirical methods and is usually twice the number of selected features. The minimum number of points μ in the present invention is determined to be 14. The commonly used method to determine the neighborhood radius ε is the elbow point method. After the messages are classified, 18,000 samples are selected to draw a k-distance graph. The neighborhood radius ε of the three types of messages are determined to be 2.5, 6.5, and 6.5, respectively.

[0028] (4) Result output and parameter update stage: Input the parameters into the model, and use the DBSCAN algorithm to perform AI anomaly identification on the data set to obtain marked abnormal messages. The messages are stored and reported to the power maintenance personnel. The power maintenance personnel inspect the abnormal messages marked in the AI ​​identification stage, locate the power equipment that sent the message, and detect whether it has a fault. If a correct alarm occurs, the maintenance personnel can perform troubleshooting, archive and classify the anomalies, and expand the abnormal message database. If false alarms occur multiple times, the neighborhood radius parameters will be re-determined through the elbow point method, and the DBSCAN algorithm will be adjusted.

[0029] Beneficial effects of the present invention: The present invention proposes a method for detecting unknown anomalies in power grid data streams based on the fusion of Time-GAN and unsupervised clustering. The method not only solves the problem that there are a large number of unknown anomalies in the existing power grid, and it is impossible to use a supervised learning method that requires a labeled data set for detection, but also solves the problem of rapid discovery of power grid faults and rapid location of faulty equipment. The present invention adopts a combination of Time-GAN and DBSCAN unsupervised algorithms, including four modules: lossless acquisition and classification, sparse sample expansion, AI identification and result output, and parameter update. The operation process of the system is as follows: the lossless acquisition module obtains the original message generated by the power dispatching data network through the tshark network packet interception tool and stores them separately according to the message type. The message data passes through the sample expansion module, firstly judging whether the number of messages reaches the threshold of the input AI identification module, and the message type whose number does not reach the threshold is sampled by Time-GAN. The AI ​​identification and result output module uses DBSCAN to learn the feature pattern of the power grid data stream, and regards the samples that deviate from the conventional features as abnormal samples and outputs them. In the parameter update module, power inspection personnel inspect the equipment that outputs abnormal messages and determine whether the DBSCAN algorithm parameters need to be updated. The final identification of abnormal message results helps power inspection personnel to promptly discover abnormal equipment and quickly discover and classify abnormal messages, laying a good foundation for the safe and stable operation of the power network. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a technical framework diagram of an embodiment of the present invention.

[0031] Figure 2 is the k-distance map in the embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to deepen the understanding of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. The embodiments are only used to explain the present invention and do not limit the protection scope of the present invention.

[0033] Example: Figure 1 As shown, a method for automatic detection of unknown anomalies in power grid data streams specifically includes the following stages:

[0034] (1) Lossless collection and classification stage: First, the data stream generated by the power dispatching data network is losslessly collected through the tshark network tool and preliminarily processed into message information streams, and a lossless compression algorithm is used to reduce the storage requirements of massive data on the equipment. At the same time, the messages are classified into three categories according to type: telemetry, remote control, and remote communication, in order to improve the performance of the DBSCAN algorithm clustering used in the AI ​​identification stage;

[0035] (2) Sparse sample expansion stage: Periodically check whether the number of messages of each type reaches the threshold, and send the message data that reaches the threshold to the next stage for AI recognition. For message types that have not reached the threshold for a long time, normalization and other processing are performed to obtain a data format suitable for the Time-GAN generation algorithm, and the original message samples are expanded according to the optimal generation ratio obtained by the test so that the number of messages reaches the requirement that can be sent to the AI ​​recognition stage;

[0036] (3) AI identification and result output stage: In view of the frequent occurrence of unknown faults in the power dispatching system, an abnormal message detection method based on the DBSCAN clustering algorithm is designed to detect abnormal messages in a timely manner and quickly locate the faulty equipment. First, the neighborhood radius parameter of the DBSCAN algorithm is determined by the elbow point method, and the minimum sample size parameter of the DBSCAN algorithm is determined by the number of features of the input sample. Then, the data processed in the sparse sample expansion stage is input into the DBSCAN algorithm, and the data set is clustered. Samples that cannot be classified into any cluster are regarded as abnormal samples, marked and output;

[0037] (4) Parameter update phase: Check the abnormal messages marked in the AI ​​identification phase and locate the power equipment that sent the message to detect whether it has a fault. If a correct alarm occurs, maintenance personnel can perform troubleshooting. If multiple false alarms occur, the neighborhood radius parameter will be re-determined using the elbow point method and the DBSCAN algorithm will be adjusted.

[0038] Specific steps:

[0039] Step S1, the data stream generated by the power dispatching data network is losslessly collected through the tshark network tool and preliminarily processed into a message information stream, and compressed using a lossless compression algorithm, and then the processed messages are classified according to the message type and stored;

[0040] Step S2: Periodically check the messages processed in step S1 to determine whether the number of messages of each type has reached the threshold, and send the message data that has reached the threshold to the next stage for AI identification. In order to solve the problem that the number of certain types of messages is small and AI anomaly identification cannot be performed, for message types that have not reached the threshold for a long time, the Time-GAN generative adversarial network model is used to expand the samples so that the number of messages reaches the requirement that can be sent to the AI ​​identification stage;

[0041] The Time-GAN sample generation process in step S2 is as follows:

[0042] (1) Message classification stage: Messages are classified into three categories: telemetry, remote control, and remote communication. According to the survey, the data messages of the power dispatching network are divided into the above three categories, and the data distribution of the same type of messages is relatively consistent. Therefore, classifying the messages in advance can improve the performance of the DBSCAN algorithm clustering used in this method. If the messages are not classified and different types of messages are directly mixed and input into the algorithm, abnormal messages will be hidden.

[0043] (2) Data preprocessing stage: The captured power anomaly data is preprocessed and feature extracted to remove redundant features that are not related to the category attributes. The data is divided into a training set and a validation set, and the processed feature set in the training set is placed in the established sample database.

[0044] (3) Generation algorithm selection stage: The Time-GAN method is selected because it is specially designed for generating real time series. First, this generation method not only introduces unsupervised adversarial losses for real data and generated data, but also introduces step-by-step supervised losses for original data as supervision. Second, this method introduces an embedding network to provide a reversible mapping between feature space and latent space, thereby reducing the dimensionality of the adversarial learning space. Finally, the supervised loss is minimized by jointly training the embedding network and the generator network. In this way, the latent space not only helps to improve parameter efficiency, but also helps the generator learn temporal relationships.

[0045] (4) Adjusting generation algorithm parameters: Based on the selected Time-GAN generation algorithm, in order to ensure the credibility of the generated samples, we tested the impact of the ratio of original samples to generated samples (optimal generation sample ratio) of the Time-GAN generation algorithm on the accuracy.

[0046] (5) Algorithm deployment stage: Time-GAN is used to expand a small number of power dispatching network samples, and finally obtains message data that can "deceive" the discriminator, achieving the purpose of expanding the sample;

[0047] Step S3, first determine the neighborhood radius parameter of the DBSCAN algorithm by the elbow point method, determine the minimum sample size parameter of the DBSCAN algorithm by the number of features of the input sample, then input the data set processed in step S2 into the DBSCAN algorithm, cluster the data set, and regard the samples that cannot be classified into any cluster as abnormal samples, mark them and output them;

[0048] The specific steps of determining the DBSCAN algorithm parameters and selecting the algorithm in step S3 are as follows:

[0049] (1) Data preprocessing stage: According to the data sent by the sparse sample expansion module, the data is filled and truncated, and the corresponding feature fields are extracted according to the feature values ​​selected in advance.

[0050] (2) Algorithm selection stage: In order to solve the problem of missing abnormal types in the power dispatching network and the inability to locate faulty equipment in a timely manner. Therefore, an unsupervised learning algorithm that does not require pre-labeling is adopted. This type of algorithm can well mark abnormal sample points that are out of all clusters. If a supervised learning algorithm is used, the input data must be labeled in advance, which results in this type of algorithm only being able to discover abnormal types that have been defined in advance. Commonly used unsupervised clustering algorithms include the k-means algorithm and the DBSCAN algorithm. The k-means algorithm has poor results when the sample space is irregular, and the parameter of the number of clusters needs to be determined in advance. It is not suitable for power dispatching network data streams with unknown number of clusters. The DBSCAN clustering algorithm does not need to determine the number of clusters in advance, and it also has good results for irregular sample spaces. Therefore, the DBSCAN algorithm is used for AI anomaly identification.

[0051] (3) Algorithm parameter determination stage: The first algorithm parameters to be determined are the neighborhood radius ε and the minimum number of points μ within the domain radius that must be a core object. The minimum number of points μ is determined empirically and is usually twice the number of features selected. The minimum number of points μ in the present invention is determined to be 14. The neighborhood radius ε is commonly determined by the elbow point method. After classifying the messages, 18,000 samples are selected to draw a k-distance graph (such as Figure 2 As shown), the neighborhood radius ε of the three types of messages are determined to be 2.5, 6.5, and 6.5 respectively.

[0052] (4) Result output and parameter update stage: Input the parameters into the model, and use the DBSCAN algorithm to perform AI anomaly identification on the data set to obtain marked abnormal messages. The messages are stored and reported to the power maintenance personnel. The power maintenance personnel inspect the abnormal messages marked in the AI ​​identification stage, locate the power equipment that sent the message, and detect whether it has a fault. If a correct alarm occurs, the maintenance personnel can perform troubleshooting, archive and classify the anomalies, and expand the abnormal message database. If false alarms occur multiple times, the neighborhood radius parameters will be re-determined through the elbow point method, and the DBSCAN algorithm will be adjusted;

[0053] Step S4: Check the abnormal message marked in step S3, locate the power equipment that sent the message, and detect whether it has a fault. If a correct alarm occurs, the maintenance personnel can troubleshoot the fault, archive and classify the abnormality, and expand the abnormal message database. If multiple false alarms occur, the neighborhood radius parameter will be re-determined through the elbow point method to adjust the DBSCAN algorithm.

[0054] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A method for automatic detection of unknown anomalies in power grid data streams, characterized in that: The following steps are involved: Step S1, the data stream generated by the power dispatching data network is losslessly collected through the tshark network tool and preliminarily processed into a message information stream, and compressed using a lossless compression algorithm, and then the processed messages are classified according to the message type and stored; Step S2: Periodically detect the messages processed in step S1 to determine whether the number of messages of each type reaches the threshold. The message data that reaches the threshold is sent to the next stage for AI recognition. In view of the problem that the number of certain types of messages is small and AI abnormal recognition cannot be performed, for the message types that have not reached the threshold for a long time, the Time-GAN generative adversarial network model is used to expand the samples so that the number of messages reaches the requirement that can be sent to the AI ​​recognition stage. Step S3, first determine the neighborhood radius parameter of the DBSCAN algorithm by the elbow point method, determine the minimum sample size parameter of the DBSCAN algorithm by the number of features of the input sample, then input the data set processed in step S2 into the DBSCAN algorithm, cluster the data set, and regard the samples that cannot be classified into any cluster as abnormal samples, mark them and output them; Step S4, check the abnormal message marked in step S3, locate the power equipment that sent the message, and detect whether it has a fault. If a correct alarm occurs, the maintenance personnel will conduct troubleshooting, archive and classify the abnormalities, and expand the abnormal message database. If false alarms occur multiple times, the neighborhood radius parameter will be re-determined through the elbow point method and the DBSCAN algorithm will be adjusted.

2. The method for automatic detection of unknown anomalies in power grid data flow according to claim 1 is characterized in that: The Time-GAN sample generation process of step S2 includes: a message classification stage, a data preprocessing stage, a generation algorithm selection stage, a generation algorithm parameter adjustment stage and an algorithm deployment stage.

3. The method for automatic detection of unknown anomalies in power grid data flow according to claim 2, characterized in that: In the message classification stage, the messages are classified into three categories according to their types: telemetry, remote control, and remote communication.

4. The method for automatic detection of unknown anomalies in power grid data flow according to claim 2, characterized in that: In the data preprocessing stage, the captured power anomaly data is preprocessed and feature extracted to remove redundant features irrelevant to the category attributes, and the data is divided into a training set and a validation set, and the processed feature set in the training set is placed in the established sample database.

5. The method for automatic detection of unknown anomalies in power grid data flow according to any one of claims 2 to 4, characterized in that: The specific process of determining the DBSCAN algorithm parameters and selecting the algorithm in step S3 is as follows: (1) Data preprocessing process: According to the data sent by the sparse sample expansion module, the data is filled and truncated, and the corresponding feature fields are extracted according to the feature values ​​selected in advance; (2) Algorithm selection process: an unsupervised learning algorithm that does not require prior labeling is adopted, and the unsupervised clustering algorithm is the DBSCAN algorithm; (3) Algorithm parameter determination process: The first algorithm parameters that need to be determined are the neighborhood radius ε and the minimum number of points μ within the domain radius to become a core object. The minimum number of points μ is twice the number of selected features. (4) Result output and parameter update process: The parameters are input into the model, and the data set is subjected to AI anomaly identification by the DBSCAN algorithm to obtain marked abnormal messages. The messages are stored and reported to the power maintenance personnel. The power maintenance personnel inspect the abnormal messages marked in the AI ​​identification stage, locate the power equipment that sent the message, and detect whether it has a fault. If a correct alarm occurs, the maintenance personnel conduct troubleshooting, archive and classify the anomalies, and expand the abnormal message database. If false alarms occur multiple times, the neighborhood radius parameters will be re-determined through the elbow point method, and the DBSCAN algorithm will be adjusted.

Images