A rule-based and evaluation feedback optimized timing forensics method and system

Abstract

The application discloses a kind of timing forensics method and system based on rule and evaluation feedback optimization, wherein the method comprises: obtaining preprocessed historical electricity stealing forensics data, the historical electricity stealing forensics data is classified according to electricity stealing category, and the electricity stealing forensics data sample subset of each category is established;Respectively, the electricity stealing forensics data sample subset of each category is calculated to support evidence link, and the evidence sample set based on rule item is obtained;Respectively, the evidence sample set of each category is extracted to rule, and the differentiated electricity stealing forensics timing rule is obtained;Respectively, the fitting degree of the electricity stealing forensics timing rule of each category and the electricity stealing forensics data sample subset is evaluated, and based on the evaluation result, the electricity stealing forensics timing rule of each category is determined.

Description

Technical Field

[0001] This invention relates to the field of smart electricity technology, and more specifically, to a time-series forensics method and system based on rule and evaluation feedback optimization. Background Technology

[0002] In the process of conducting electricity inspections, discovering suspected electricity theft and obtaining corresponding evidence of electricity theft are two stages of anti-electricity theft work. Discovering suspected electricity theft is only the first step, the so-called prerequisite. Only after discovering suspected electricity theft can on-site investigation of electricity use be carried out as a cause. Anti-electricity theft evidence collection is the second step in anti-electricity theft work, and it is also an essential step in investigating and handling electricity theft cases. The current principle of judicial work is to base decisions on facts and support them with evidence. If effective evidence of electricity theft is not collected, once legal proceedings begin, the facts of the incident will have already become a thing of the past. Therefore, in order to ensure that corresponding anti-electricity theft evidence is provided comprehensively, objectively, and fairly during the litigation process, it is necessary to ensure that the evidence obtained from on-site investigations of electricity theft clearly and comprehensively reflects the entire process of the on-site inspection and restores the facts of electricity theft at the scene. However, facing increasingly complex and diverse electricity theft incidents, anti-theft evidence collection must ensure the validity of the evidence, the continuity of the investigation, and a reasonable timeline. Anti-theft evidence collection should reflect the characteristics of electricity theft, obvious signs, and the correlation between equipment and lines. There should be continuity and temporal sequence between each evidence collection stage. If the type of electricity theft requires data from a remote information acquisition system, the collected data must be stored chronologically to form an evidence chain together with on-site verification. Therefore, increased interaction makes tracing a series of different events exceptionally complex, necessitating the formation of an effective temporal evidence chain. In actual, complex operating environments, electricity theft evidence collection often involves noisy conditions or external shocks, interfering with the on-site personnel's evidence collection process or leading to omissions, resulting in insufficient fidelity in the captured evidence of the electricity theft.

[0003] Therefore, a technology is needed to enable time-series forensics techniques that are optimized based on rules and evaluation feedback. Summary of the Invention

[0004] The present invention provides a time-series forensics method based on rule and evaluation feedback optimization, and a system for executing the above-mentioned forensics method, so as to solve the problem of how to perform time-series forensics based on rule and evaluation feedback optimization.

[0005] To address the aforementioned problems, this invention provides a time-series forensics method based on rule and evaluation feedback optimization, the method comprising:

[0006] Acquire preprocessed historical electricity theft evidence data, classify the historical electricity theft evidence data according to the electricity theft category, and establish a sample subset of electricity theft evidence data for each category;

[0007] For each category of electricity theft evidence data sample subset, the support degree of the evidence collection process is calculated to obtain the evidence collection sample set based on rule items;

[0008] Rules are extracted from the evidence sample set for each category to obtain differentiated time-series rules for electricity theft evidence collection;

[0009] The fitting degree of each category of electricity theft evidence collection timing rule is evaluated with the subset of electricity theft evidence collection data samples. Based on the evaluation results, the electricity theft evidence collection timing rule for each category is determined.

[0010] Preferably, the step of calculating the evidence collection support for each category of electricity theft evidence collection data sample subset to generate an evidence collection sample set based on rule terms includes:

[0011] For each category of electricity theft evidence data sample subset, the support of the evidence collection process is calculated. When the calculated temporal correlation support is greater than the minimum support threshold, the minimum correlation temporal series is generated.

[0012] Based on the minimum correlation time series, the time series correlation confidence is calculated. When the time series correlation confidence is greater than the minimum confidence threshold, a subsequence pair with preceding and following conditional correlation is generated to obtain the strong time series correlation link.

[0013] Connect the strong time-series associated links that meet the connection conditions to generate a connected strong time-series associated link, and replace the strong time-series associated link before the connection with the connected strong time-series associated link.

[0014] The strongly temporally related links after connection and the strongly temporally related links that do not meet the connection conditions are used as the temporal rules for evidence collection.

[0015] Based on the aforementioned time-series rules, time-series sorting is performed to generate evidence collection sample sets for each category.

[0016] Preferably, the step of extracting rules from the evidence sample set for each category to obtain differentiated electricity theft evidence timing rules includes:

[0017] S31: Count the number of each time rule in the evidence collection sample set for each category. In the same time sequence, the time rule type is not unique. Filter the time rules with the largest and second largest number of statistics, and connect the time rules with the largest and second largest number of statistics based on the time sequence to generate multiple candidate evidence collection time sequence rules. Count the number of samples covered by the multiple candidate evidence collection time sequence rules, extract the actual evidence collection sample with the largest coverage as the evidence collection time sequence rule, and remove the samples covered by the evidence collection time sequence rule from the evidence collection sample set of the corresponding electricity theft category.

[0018] S32: Repeat step S31 for the remaining evidence samples until there are no remaining samples in the evidence sample set, generate multiple evidence collection time sequence rules, and output the evidence collection time sequence rule set.

[0019] S33: Calculate the proximity of any two time rules in the evidence collection time sequence rule set, obtain multiple proximity values, and sort the proximity values.

[0020] S34: Extract the two closest time rules in the proximity ranking, merge the time rules that can be merged, and for time rules that do not meet the generalization operation, extract the jump condition of the first different rule item after the merged rule item based on the time sequence position; repeat steps S33 and S34 until a rule based on the jump condition is generated, which serves as the evidence collection rule for one of the categories of electricity theft.

[0021] S35: Repeat steps S3 and S34 to traverse all categories of electricity theft and directly obtain the set of evidence collection rules based on the category of electricity theft;

[0022] S36: Based on the evidence collection rules set for electricity theft categories, repeat steps S34 and S35 until an electricity theft evidence collection timing rule based on jump conditions is generated, which is then output as a differentiated electricity theft evidence collection timing rule.

[0023] Preferably, the step of evaluating the fit between the timing rules for electricity theft evidence collection of each category and the subset of electricity theft evidence collection data samples based on evaluation indicators, and determining the timing rules for electricity theft evidence collection of each category based on the evaluation results, includes:

[0024] The fitting degree of each category of the electricity theft evidence collection time sequence rule is evaluated with the electricity theft evidence collection data sample subset to obtain an index value; the smaller the index value, the more effective the electricity theft evidence collection time sequence rule is; therefore, the larger the index value, the greater the difference in the electricity theft evidence collection time sequence rule.

[0025] Preferably, the method further includes adjusting the parameters for calculating the support level in the evidence collection process when the index value is higher than a preset fitting threshold.

[0026] This invention provides a system for executing the aforementioned time-series forensics method based on rule and evaluation feedback optimization. The system includes: a system-side suspected electricity theft identification module, a time-series forensics rule module, a video acquisition module, an audio acquisition module, a BeiDou timing and positioning module, an encapsulation module, an forensics fixation module, and a storage module, wherein:

[0027] The system-side suspected electricity theft identification module connects the power system side and the evidence collection timing rule module. It is used to receive the suspected electricity theft type identified by the power system side and send the suspected electricity theft type to the evidence collection timing rule module.

[0028] The evidence collection timing rule module is connected to the suspected electricity theft identification module, the video acquisition module, and the audio acquisition module on the system side. It is used to extract a subset of electricity theft evidence collection timing rules for the corresponding type of suspected electricity theft based on the electricity theft evidence collection timing rules, and input the evidence collection timing into the video acquisition module and the audio module based on the jump conditions of the subset of electricity theft evidence collection timing rules.

[0029] The video acquisition module is used to acquire video data from the scene based on a subset of the electricity theft evidence collection time sequence rules, and send the video data to the encapsulation module.

[0030] The audio acquisition module is used to acquire audio data at the scene based on a subset of the electricity theft evidence collection time sequence rules, and to send the audio data to the encapsulation module.

[0031] The Beidou timing and positioning module is used to synchronize the system time and collect the positioning information of the evidence collection location, and send the timing signal and positioning signal to the evidence collection and fixing module.

[0032] The encapsulation module is used to process the received video data and audio data, and send the processed video data and audio data to the evidence collection and fixing module;

[0033] The evidence collection and fixing module is used to integrate the received video data and audio data, add evidence collection time and evidence collection location based on the timing signal and the positioning signal, generate evidence collection rule jump conditions based on evidence collection timing prompts, video data and audio data, obtain execution rules through the subset of electricity theft evidence collection timing rules, and feed the execution rules back to the evidence collection timing rule module. Until the evidence collection is completed, the obtained timing evidence is sent to the storage module.

[0034] The storage module is used to store the time-series forensic evidence.

[0035] Preferably, the video acquisition module includes: a camera circuit, a video encoding circuit, a DSP processor, and a random access memory circuit, used to acquire video data from the scene based on a subset of the electricity theft evidence collection timing rules; wherein, the camera circuit is connected to the video encoding circuit, and the video encoding circuit is connected to the DSP processor.

[0036] Preferably, the audio acquisition module includes: a microphone (MIC), a voice chip circuit, and a random access memory circuit, used to acquire audio data from the scene based on a subset of the electricity theft evidence collection timing rules; wherein, the voice chip circuit includes a filtering circuit, an AGC circuit, an ADC circuit, and an encoding processing circuit.

[0037] Preferably, the BeiDou timing and positioning module includes: a BeiDou navigation and timing module, a BeiDou positioning module, and a communication module, which receives BeiDou satellite timing signals and positioning signals in real time based on the BeiDou satellite positioning system.

[0038] In another aspect, the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program for performing the above-described rule-based and evaluation feedback-optimized temporal forensics.

[0039] Based on another aspect of the present invention, the present invention provides a computer program including computer-readable code, characterized in that, when the computer-readable code is run on a device, the processor in the device performs the aforementioned rule-based and evaluation feedback-optimized timing forensics.

[0040] This invention provides a time-series evidence collection method based on rule and evaluation feedback optimization, and a system for executing the method. The method includes: acquiring preprocessed historical electricity theft evidence collection data; classifying the historical electricity theft evidence collection data according to electricity theft categories; establishing a subset of electricity theft evidence collection data samples for each category; calculating the evidence collection support degree for each category of electricity theft evidence collection data sample subset to obtain an evidence collection sample set based on rule items; extracting rules from each category of evidence collection sample set to obtain differentiated electricity theft evidence collection time-series rules; evaluating the fit between each category of electricity theft evidence collection time-series rules and the electricity theft evidence collection data sample subset; and determining the electricity theft evidence collection time-series rules for each category based on the evaluation results. This invention, by establishing effective evidence collection time-series rules before evidence collection, enables evidence to be captured based on time-series prompts during on-site recording, ensuring standardized evidence collection and effectively improving the efficiency of on-site personnel in collecting evidence. The present invention proposes a time-series evidence collection method and apparatus based on rule and evaluation feedback optimization. By formulating standardized evidence collection process rules and an evaluation feedback optimization mechanism, the evidence collection operation process is further optimized, the effectiveness of evidence collection rules is continuously improved, the efficiency of anti-theft and illegal investigation evidence collection is increased, and the burden on front-line staff is reduced. Attached Figure Description

[0041] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0042] Figure 1 This is a flowchart of a time-series forensics method based on rule and evaluation feedback optimization according to a preferred embodiment of the present invention;

[0043] Figure 2 The above is a flowchart of the overall process of a time-series forensics method based on rule and evaluation feedback optimization according to a preferred embodiment of the present invention.

[0044] Figure 3This is a flowchart of a preferred embodiment of the present invention for screening strongly correlated evidence based on support and confidence.

[0045] Figure 4 A flowchart illustrating the construction of differentiated electricity theft evidence collection timing rules according to a preferred embodiment of the present invention;

[0046] Figure 5 This is an example diagram of the differentiated electricity theft evidence collection timing rules according to a preferred embodiment of the present invention;

[0047] Figure 6 This is a structural diagram of the built-in modules of a Beidou-based anti-electricity theft service recorder according to a preferred embodiment of the present invention; and

[0048] Figure 7 The present invention provides a six-view diagram of a service recorder based on an anti-electricity theft device according to a preferred embodiment. Detailed Implementation

[0049] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0050] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0051] Figure 1 This is a flowchart of a time-series evidence collection method based on rule and evaluation feedback optimization according to a preferred embodiment of the present invention. The present invention addresses suspected electricity theft incidents determined by the power system side by establishing standardized evidence collection process rules, further optimizing the evidence collection process, and proposing a time-series evidence collection method and apparatus based on rule and evaluation feedback optimization. This constructs a rule-based, reusable evidence collection workflow, improves the anti-theft and illegal activity investigation system, avoids evidence collection failures caused by on-site environmental interference and human operator unfamiliarity, improves the work quality and efficiency of on-site evidence collection personnel, and provides support for electricity theft evidence collection work for power supply companies.

[0052] like Figure 1 As shown, this invention provides a time-series forensics method based on rule and evaluation feedback optimization, the method comprising:

[0053] Step 101: Obtain preprocessed historical electricity theft evidence data, classify the historical electricity theft evidence data according to the electricity theft category, and establish a sample subset of electricity theft evidence data for each category;

[0054] This invention extracts historical electricity theft evidence data from the power system, including electricity theft sample attribute information and evidence collection process log information.

[0055] This invention performs data preprocessing on the acquired sample data, including forensic data representation and data normalization, to obtain a normalized forensic sample set. Based on the type of electricity theft, such as undervoltage theft, undercurrent theft, and phase-shifting theft, the electricity theft samples are divided into forensic sample subsets of different electricity theft categories.

[0056] Step 102: Calculate the evidence collection support for each category of electricity theft evidence collection data sample subset to obtain the evidence collection sample set based on rule items;

[0057] Preferably, the evidence collection support degree is calculated for each category of electricity theft evidence collection data sample subset to generate an evidence collection sample set based on rule terms, including:

[0058] For each category of electricity theft evidence data sample subset, the support of the evidence collection process is calculated. When the calculated temporal correlation support is greater than the minimum support threshold, the minimum correlation temporal series is generated.

[0059] Based on the minimum correlation time series, the time series correlation confidence is calculated. When the time series correlation confidence is greater than the minimum confidence threshold, a subsequence pair with preceding and following conditional correlation is generated to obtain the strong time series correlation link.

[0060] Connect the strong time-series associated links that meet the connection conditions to generate a connected strong time-series associated link, and replace the strong time-series associated link before the connection with the connected strong time-series associated link.

[0061] The strongly temporally related links after connection and the strongly temporally related links that do not meet the connection conditions are used as the temporal rules for evidence collection.

[0062] Based on time-series rules, the samples are sorted by time to generate evidence collection sets for each category.

[0063] This invention calculates the support of each evidence collection step for each subset of evidence collection samples of each type of electricity theft. If the temporal correlation support is greater than the minimum support threshold, a minimum correlation temporal sequence is generated. Based on the minimum correlation temporal sequence, the temporal correlation confidence is calculated. If the confidence is greater than the minimum confidence threshold, a subset of sequences with preceding and following conditional correlations is generated, i.e., a strong temporal correlation step. Connectable strong temporal correlation steps are connected to generate a new strong temporal correlation step to replace the two strong temporal correlation steps before the connection. The strong temporal correlation steps and the remaining evidence collection steps that do not meet the requirements for generating strong temporal correlation steps are all used as evidence collection temporal rule items to generate a set of evidence collection temporal rule items for each type of electricity theft, covering the original evidence collection sample evidence collection steps, forming a rule-based evidence collection sample set for different types of electricity theft.

[0064] In the above steps of this invention, for each subset of evidence samples of each type of electricity theft, the support of the evidence collection process is calculated. If the temporal correlation support is greater than the minimum support threshold, a minimum correlation temporal sequence is generated. Based on the minimum correlation temporal sequence, the temporal correlation confidence is calculated. If the confidence is greater than the minimum confidence threshold, a subset of sequences with preceding and following conditional correlations is generated, i.e., a strong temporal correlation link. Connectable strong temporal correlation links are connected to generate a new strong temporal correlation link to replace the two strong temporal correlation links before the connection. The strong temporal correlation links and the remaining evidence collection links that do not meet the requirements for generating strong temporal correlation links are all used as evidence collection temporal rule items to generate a set of evidence collection temporal rule items for each type of electricity theft, covering the original evidence collection sample links, forming a rule-based evidence collection sample set for different types of electricity theft. The general generation process is as follows:

[0065] This invention, in similar electricity theft evidence samples, focuses on the evidence collection process p within the same sample. i and evidence collection process p i+1 The simultaneous occurrence of these sequences is defined as the candidate minimum correlation sequence.

[0066] This invention calculates the support of each candidate minimum association time series, sets a minimum support threshold based on historical data, and if the support of a candidate minimum association time series exceeds the minimum support threshold, it is taken as the minimum association time series. After traversing all candidate minimum association time series, the minimum association time series set is obtained.

[0067] This invention is based on the minimum associated time series set, calculates the confidence level of the occurrence of the minimum associated time series, sets a minimum confidence level threshold, and generates subsequence pairs with preceding and following conditional associations, i.e. strong time series association links, after traversing all minimum associated time series, obtains a set of strong time series association links.

[0068] This invention connects connectable strong temporal correlation links to generate a new strong temporal correlation link to replace two strong temporal correlation links before the connection, thereby generating a new set of strong temporal correlation links.

[0069] This invention covers the original evidence collection steps that satisfy the strong temporal correlation links obtained in the above steps in the subset of evidence collection samples of this type of electricity theft, and uses them as rule items. The remaining evidence collection steps that did not generate strong temporal correlation links and the remaining evidence collection steps that did not generate minimum correlation time sequence are also used as rule items and sorted according to time to form a set of evidence collection samples based on rule items for different types of electricity theft.

[0070] Step 103: Extract rules from the evidence sample set for each category to obtain differentiated time-series rules for electricity theft evidence collection;

[0071] Preferably, rules are extracted from the evidence sample set for each category to obtain differentiated electricity theft evidence timing rules, including:

[0072] S31: Count the number of each time rule in the evidence collection sample set for each category. In the same time sequence, the time rule type is not unique. Filter the time rules with the largest and second largest number of statistics, and connect the time rules with the largest and second largest number of statistics based on the time sequence to generate multiple candidate evidence collection time sequence rules. Count the number of samples covered by the multiple candidate evidence collection time sequence rules, extract the actual evidence collection samples with the largest number of coverage as the evidence collection time sequence rule, and remove the samples covered by the evidence collection time sequence rule from the evidence collection sample set of the corresponding electricity theft category.

[0073] S32: Repeat step S31 for the remaining evidence samples until there are no remaining samples in the evidence sample set, generate multiple evidence collection time sequence rules, and output the evidence collection time sequence rule set.

[0074] S33: Calculate the proximity of any two time rules in the evidence collection time sequence rule set, obtain multiple proximity values, and sort the proximity values.

[0075] S34: Extract the two closest time rules in the proximity ranking, merge the time rules that can be merged, and for time rules that do not meet the generalization operation, extract the jump condition of the first different rule item after the merged rule item based on the time sequence position; repeat steps S33 and S34 until a rule based on the jump condition is generated, which serves as the evidence collection rule for one of the categories of electricity theft.

[0076] S35: Repeat steps S3 and S34 to traverse all categories of electricity theft and directly obtain the set of evidence collection rules based on the category of electricity theft;

[0077] S36: Based on the evidence collection rule set for electricity theft categories, repeat steps S34 and S35 until an electricity theft evidence collection timing rule based on jump conditions is generated, which is then output as a differentiated electricity theft evidence collection timing rule.

[0078] This invention extracts rules for different categories of electricity theft. Specifically, it obtains evidence collection sample sets based on rule items for different categories of electricity theft generated in the above steps, extracts rules using sequential coverage, calculates and sorts the proximity between pairs of rules, performs rule generalization operation on the nearest rules using Least General Generalization (LGG), and extracts rule jump conditions to improve the time-series rules for small-sample evidence collection. The above process is repeated until differentiated time-series rules for electricity theft evidence collection are formed.

[0079] This invention extracts rules for different categories of electricity theft. Specifically, it obtains evidence sample sets based on rule items for different categories of electricity theft generated in the above steps, extracts rules using sequential coverage, calculates and sorts the proximity between pairs of rules, performs Least General Generalization (LGG) on the nearest rules, and extracts rule transition conditions to improve the time-series rules for small-sample evidence collection. This process is repeated until differentiated time-series rules for electricity theft evidence collection are formed. The general generation process is as follows:

[0080] 1. For different categories of electricity theft, obtain the rule-based evidence collection sample sets for different categories of electricity theft generated in the above steps, and perform initialization definition;

[0081] 2. Sequential coverage is used for rule extraction. Based on the evidence sample set of rule items included in the electricity theft category, the number of each rule item in the evidence sample set is counted. In the same sequence, if the rule item type is not unique, the rule items with the largest and second largest number of counts are selected. The rule items with the largest and second largest number of counts are connected according to the sequence to generate v candidate evidence rules. The actual number of evidence samples covered by each rule is counted. The sample with the largest number of covers is extracted as the evidence sequence rule. The samples covered by the evidence sequence rule are removed from the evidence sample set of the electricity theft category.

[0082] 3. Repeat step 2 for the remaining evidence collection sample set until there are no remaining samples in the sample set, generating a total of k rules r, and outputting the evidence collection time sequence rule set;

[0083] 4. For each rule in the evidence collection sequence rule set, calculate the similarity between any two rules, and obtain a total of [number missing] rules. Calculate the similarity scores and sort them by similarity.

[0084] 5. Extract the two rules with the closest proximity, and use LGG to generalize the two rules. That is, merge the rule items that can be merged, and extract the jump condition of the first different rule item after the merged rule item based on the time position. Repeat steps 4 and 5 of the above process until a rule based on the jump condition is generated as a rule for evidence collection of a certain type of electricity theft.

[0085] 6. Repeat steps 4 and 5 in a loop, traversing all categories of electricity theft, until a set of evidence collection rules based on the category of electricity theft is obtained;

[0086] 7. Based on the evidence collection rules set for electricity theft categories, repeat steps 4 and 5 until an electricity theft evidence collection rule based on jump conditions is generated, which is then output as a differentiated electricity theft evidence collection timing rule.

[0087] Step 104: Evaluate the fit between the timing rules for electricity theft evidence collection for each category and the subset of electricity theft evidence collection data samples. Based on the evaluation results, determine the timing rules for electricity theft evidence collection for each category.

[0088] Preferably, based on evaluation metrics, the goodness-of-fit of the timing rules for electricity theft evidence collection for each category is assessed with a subset of electricity theft evidence collection data samples. Based on the evaluation results, the timing rules for electricity theft evidence collection for each category are determined, including:

[0089] The fit between the timing rules for electricity theft evidence collection in each category and the subset of electricity theft evidence collection data samples was evaluated to obtain an index value. The smaller the index value, the more effective the timing rules for electricity theft evidence collection are; conversely, the larger the index value, the greater the difference in timing rules for electricity theft evidence collection.

[0090] Preferably, it also includes adjusting the parameters for calculating the support level in the evidence collection process when the index value is higher than a preset fitting threshold.

[0091] This invention uses the Distance Metric (DM) evaluation index to assess the fit between the differentiated electricity theft evidence collection timing rules and the actual evidence collection sample sequences. The smaller the index value, the more effective the established evidence collection rules are, indicating that the timing rules are consistent with the actual evidence collection timing operations. Conversely, the larger the value, the greater the difference between the timing rules and the actual evidence collection operations.

[0092] In this invention, if the evaluation index DM is higher than the set fitting threshold, the support calculation of the above evidence collection stage is returned for feedback parameter adjustment. If it is lower than the set fitting threshold, the parameters are fixed and differentiated electricity theft evidence collection timing rules are output to assist on-site electricity theft investigation personnel in collecting on-site evidence.

[0093] This invention imports differentiated electricity theft evidence collection timing rules into the evidence collection timing rule module and evidence collection fixation module of the on-site evidence collection equipment to standardize the on-site evidence collection process. Based on the electricity theft evidence samples obtained from on-site anti-theft evidence collection work, the electricity theft evidence sample library is continuously enriched, the evidence collection timing rules are continuously iterated and optimized, and the effectiveness of electricity theft evidence collection is improved.

[0094] The present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program being used to execute the above-described time-series forensics method based on rule and evaluation feedback optimization.

[0095] The present invention provides a computer program, including computer-readable code, characterized in that, when the computer-readable code is run on a device, the processor in the device executes the aforementioned timing forensics method based on rule and evaluation feedback optimization.

[0096] Figure 6 This is a structural diagram of the built-in modules of a BeiDou-based anti-electricity theft service recorder according to a preferred embodiment of the present invention. Figure 6 As shown, the present invention provides a system for executing a time-series forensics method based on rules and evaluation feedback optimization. The system includes: a system-side suspected electricity theft identification module, an forensics time-series rule module, a video acquisition module, an audio acquisition module, a Beidou timing and positioning module, an encapsulation module, an forensics fixation module, and a storage module.

[0097] This invention provides a time-series evidence collection device based on rule and evaluation feedback optimization, relying on anti-theft and illegal electricity collection equipment. It includes a system-side suspected electricity theft identification module, an evidence collection time-series rule module, a video acquisition module, an audio acquisition module, a BeiDou positioning module, an encapsulation module, an evidence collection and fixation module, and a storage module. When executing differentiated electricity theft evidence collection time-series rules, the time-series evidence collection device performs the following steps:

[0098] The system-side suspected electricity theft identification module connects the power system side and the evidence collection timing rule module. It is used to receive the suspected electricity theft types identified by the power system side and send the suspected electricity theft types to the evidence collection timing rule module.

[0099] The system-side suspected electricity theft identification module in this invention connects the power system side and the evidence collection timing rule module. The system-side suspected electricity theft identification module receives the suspected electricity theft type identified by the power system side and transmits it to the evidence collection timing rule module.

[0100] The evidence collection timing rule module connects the suspected electricity theft identification module, video acquisition module, and audio acquisition module on the system side. It is used to extract the corresponding electricity theft evidence collection timing rule subset based on the suspected electricity theft type and the electricity theft evidence collection timing rule, and input the evidence collection timing into the video acquisition module and audio module based on the jump conditions of the electricity theft evidence collection timing rule subset.

[0101] The evidence collection timing rule module of this invention connects the suspected electricity theft identification module, video acquisition module, and audio acquisition module on the system side. The evidence collection timing rule module extracts a subset of the suspected electricity theft evidence collection timing rules from the differentiated electricity theft evidence collection timing rules stored in its internal storage according to the suspected electricity theft type, and inputs the evidence collection timing into the video acquisition module and audio acquisition module based on the rule jump conditions to guide them to carry out on-site timing evidence collection.

[0102] The video acquisition module is used to acquire video data from the scene based on a subset of the time sequence rules for electricity theft evidence collection, and then send the video data to the encapsulation module.

[0103] Preferably, the video acquisition module includes: a camera circuit, a video encoding circuit, a DSP processor, and a random access memory circuit, used to acquire video data from the scene based on a subset of the electricity theft evidence collection timing rules; wherein, the camera circuit is connected to the video encoding circuit, and the video encoding circuit is connected to the DSP processor.

[0104] The video acquisition module of the present invention includes a camera circuit, a video encoding circuit, a DSP processor and a random access memory circuit, used to acquire video data at the scene based on evidence collection timing prompts, process the acquired video data and store it in the random access memory circuit, and transmit the on-site evidence collection video to the encapsulation module.

[0105] The camera circuit is connected to the video encoding circuit, and the video encoding circuit, infrared sensor, random access memory circuit, and automatic recording control circuit are all connected to the DSP processor.

[0106] The audio acquisition module is used to collect audio data from the scene based on a subset of the electricity theft evidence collection time sequence rules, and then sends the audio data to the encapsulation module.

[0107] Preferably, the audio acquisition module includes: a microphone (MIC), a voice chip circuit, and a random access memory circuit, used to acquire audio data from the scene based on a subset of the electricity theft evidence collection timing rules; wherein, the voice chip circuit includes a filtering circuit, an AGC circuit, an ADC circuit, and an encoding processing circuit.

[0108] The audio acquisition module of the present invention comprises a microphone (MIC), a voice chip circuit, and a random access memory circuit. It is used to acquire audio data at the scene based on the evidence collection timing prompts, process the acquired audio data and store it in the random access memory circuit, and transmit the on-site evidence collection audio to the encapsulation module.

[0109] The voice chip circuit includes a filtering circuit, an AGC circuit, an ADC circuit, and an encoding processing circuit.

[0110] The Beidou timing and positioning module is used to synchronize the system time and collect the positioning information of the evidence collection location, and send the timing signal and positioning signal to the evidence collection and fixing module.

[0111] Preferably, the BeiDou timing and positioning module includes: a BeiDou navigation and timing module, a BeiDou positioning module, and a communication module, which receives BeiDou satellite timing signals and positioning signals in real time based on the BeiDou satellite positioning system.

[0112] The Beidou timing and positioning module of the present invention includes a Beidou navigation and timing module, a Beidou positioning module and a communication module. Relying on the Beidou satellite positioning system, it receives Beidou satellite timing and positioning signals in real time and transmits them to the evidence collection and fixing module for on-site evidence collection timing and positioning marking.

[0113] Among them, the Beidou navigation and timing module receives Beidou satellite signals in real time and uses Beidou timing signals to synchronize the device's time; the Beidou positioning module is used to collect evidence collection location information; and the communication module transmits data with the Beidou satellite in real time.

[0114] The encapsulation module is used to process the received video and audio data and send the processed video and audio data to the evidence collection and fixation module.

[0115] The encapsulation module of this invention is used to receive audio and video data from the video acquisition module and the audio acquisition module, correct, remove redundant data and compress the audio and video data to obtain clear, noise-free and distortion-free audio and video data, and then integrate and encode the audio and video data to unify the data format and type before transmitting it to the evidence collection and fixing module.

[0116] The evidence collection and fixation module is used to integrate the received video and audio data, add evidence collection time and location based on timing and positioning signals, generate evidence collection rule jump conditions based on evidence collection timing prompts, video data, and audio data, obtain execution rules through a subset of electricity theft evidence collection timing rules, and feed the execution rules back to the evidence collection timing rule module. Until the evidence collection is completed, the obtained timing evidence is sent to the storage module.

[0117] The evidence collection and fixing module of this invention receives audio and video data transmitted by the encapsulation module, integrates Beidou positioning signals, adds evidence collection time, evidence collection location, and evidence collector's personal information to the evidence collection audio and video, and generates evidence collection rule jump conditions based on the current evidence collection sequence prompt, audio and video data, and evidence collector's personal information. It filters evidence collection execution rules from a subset of electricity theft evidence collection sequence rules and feeds them back to the evidence collection sequence rule module. After the evidence collection is completed, the acquired time-series evidence is formed into an electricity theft evidence chain and transmitted to the storage module.

[0118] The storage module is used to store time-series forensic evidence.

[0119] The storage module of this invention is used to store a chain of evidence of electricity theft.

[0120] Since the effectiveness of traditional anti-theft and illegal evidence collection relies on the experience and skills of the evidence collectors, it is easy for invalid evidence to be obtained due to subjective reasons of the personnel. This invention adopts a method that combines rules and evaluation feedback, and formulates matching and differentiated electricity theft evidence collection timing rules for different types of electricity theft. It standardizes the operation behavior of evidence collectors, improves the work quality of evidence collectors and the effectiveness of electricity theft evidence collection, and greatly reduces the burden on front-line staff.

[0121] This invention addresses the issue of strong and weak temporal links in the electricity theft evidence collection process. First, it employs a bottom-up approach, combining support and confidence scores to construct rule items with strong temporal correlations. Then, it uses sequential coverage and minimum generalization to obtain evidence collection rules. For small sample evidence collection cases, it extracts rule transition conditions, thereby generating differentiated temporal rules for electricity theft evidence collection. This approach considers both general and special operational aspects of the evidence collection process, making the evidence collection work more concrete and standardized. It can handle various types and scenarios of electricity theft on-site evidence collection, providing effective evidence collection guidance.

[0122] This invention addresses the problems of rampant electricity theft in smart electricity environments and the need for regular optimization of evidence collection standards. By establishing an iterative optimization mechanism for evidence collection rules, this invention continuously optimizes the rules based on the constantly accumulated evidence collection sample data, forming a dynamically adjusted model, thereby further improving the applicability of the evidence collection timing rules.

[0123] This invention provides a time-series evidence collection method and system based on rule-based and evaluation feedback optimization. The purpose of this invention is to address the problem that the effectiveness of traditional electricity theft evidence collection relies heavily on the experience and skills of the investigators, and is easily rendered ineffective due to subjective factors. This invention employs a method combining rules and evaluation feedback. It formulates matching time-series rules for specific types of electricity theft, calculates the relationships between time-series rules using support and confidence, and generates strongly time-series related rule items. Then, it further refines the evidence collection rules based on sequential coverage and generalization operations. Furthermore, this invention establishes a reasonable and effective evaluation method for iterative optimization of the evidence collection time-series rules, further improving their applicability. This invention standardizes the operational behavior of investigators, improves their work quality and the effectiveness of electricity theft evidence collection, and significantly reduces the burden on frontline staff.

[0124] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments:

[0125] refer to Figure 2 This is a specific implementation process of the time-series forensics method based on rule and evaluation feedback optimization of the present invention, and the steps include the following:

[0126] A. Extract historical electricity theft evidence data from the power system, including electricity theft sample attribute information and evidence collection process log information, etc.

[0127] We obtained over 2,000 evidence samples of electricity theft from a certain region between June and December 2020 from the power system. We also obtained subsequent validity information for these evidence samples. An example of the evidence data is shown below:

[0128]

[0129] B. Perform data preprocessing on the above data, including forensic data representation and data normalization, to obtain a normalized forensic sample set, represented as {P1, P2, ..., P...}. N}, where P is the number of electricity theft evidence samples, N is the number of evidence samples, and P={p1,p2,...,p step},p i Let represent the i-th evidence collection step in the evidence collection sample, where i represents the i-th evidence collection time sequence mark based on the time sorting of the evidence collection steps, 1≤i≤step; according to the type of electricity theft, such as undervoltage theft, undercurrent theft, phase shifting theft, etc., the electricity theft samples are divided into evidence collection sample subsets of different electricity theft categories.

[0130] C. For each subset of evidence samples in each category of electricity theft, calculate the support of each evidence collection step. If the temporal correlation support is greater than the minimum support threshold, generate a minimum correlation temporal sequence. Based on the minimum correlation temporal sequence, calculate the temporal correlation confidence. If the confidence is greater than the minimum confidence threshold, generate a pair of subsequences with preceding and following conditional correlations, i.e., strong temporal correlation steps. Connect the connectable strong temporal correlation steps to generate a new strong temporal correlation step to replace the two strong temporal correlation steps before the connection. Use the strong temporal correlation steps and the remaining evidence collection steps that do not meet the requirements for generating strong temporal correlation steps as evidence collection temporal rule items to generate a set of evidence collection temporal rule items for each category of electricity theft, and cover the evidence collection steps of the original evidence samples to form evidence collection sample sets based on rule items for different categories of electricity theft.

[0131] C1. In similar electricity theft evidence samples, within the same sample, the evidence collection stage p i and evidence collection process p i+1 Simultaneous occurrence is defined as a candidate minimum association sequence.

[0132]

[0133] in, In the i-th evidence collection stage p i After that, proceed with p. i+1 Step-by-step operation;

[0134] C2. Calculate the support of each candidate minimum association time series. Set a minimum support threshold η based on expert experience. If the support exceeds the minimum support threshold... Then, as the minimum associated time series, after traversing all candidate minimum associated time series, the minimum associated time series set is obtained;

[0135] Minimum Association Temporal Support Candidate minimum association time series The probability of it appearing on the entire candidate minimum association time series set. The calculation formula is as follows:

[0136]

[0137] in, express The ratio of the number of occurrences to the total number of candidate minimum association time series, i∈[1,2,…,step-1], where step-1 is the total number of candidate minimum association time series;

[0138] C3. Based on the minimum association time series set, calculate the confidence level of the occurrence of the minimum association time series, and set a minimum confidence threshold ζ. If the confidence level of the occurrence of the minimum association time series is greater than the set minimum confidence threshold Confidence(p i →p i+1 If ) > ζ, then a pair of subsequences with preceding and following conditions is generated, which is a strongly temporally related link. After traversing all the smallest related temporal sequences, the set of strongly temporally related links is obtained.

[0139] Minimal association time series confidence (p i →p i+1 Let represent the probability that after the i-th minimum association time sequence occurs, the (i+1)-th minimum association time sequence follows. The calculation formula is as follows:

[0140]

[0141] Wherein, Con(p) i ) represents the evidence collection stage p in the minimal correlation time series set. i The probability of occurrence Representation rules The probability of it appearing in the minimum associated time series set;

[0142] C4. Connect the connectable strong temporal correlation links to generate a new strong temporal correlation link. Replace the two strong temporal correlation links before the connection to generate a new set of strong temporal correlation links.

[0143] In the set of strongly temporally correlated links obtained, if Confidence(p i →p i+1 ) and Confidence(pi+1 →p i+2 The Confidence(p) obtained after merging the shared evidence collection items of both exists simultaneously. i →p i+1 →p i+2 If the sample data can cover all evidence samples of this type of electricity theft, then a new strongly temporally correlated link, Confidence(p), is generated. i →p i+1 →p i+2 This generates a new strongly temporally correlated link to replace the two strongly temporally correlated links that existed before the connection.

[0144] C5. The strong temporal correlation links obtained in step C4 are used to cover the original evidence collection links that satisfy the strong temporal correlation links in the subset of evidence collection samples for this type of electricity theft, and are used as rule items. The remaining evidence collection links that did not generate strong temporal correlation links in step C3 and the remaining evidence collection links that did not generate minimum correlation temporal links in step C2 are also used as rule items, and are sorted according to time to form a set of evidence collection samples based on rule items for different types of electricity theft.

[0145] Rule extraction is performed for different categories of electricity theft. Specifically, the evidence collection sample sets based on rule items for different categories of electricity theft generated in step C are obtained. Sequential coverage is used to extract rules, and the proximity between pairs of rules is calculated and sorted. Least General Generalization (LGG) is used to generalize the nearest rules and extract the rule jump conditions to improve the time sequence rules for small sample evidence collection. The above process is repeated until differentiated time sequence rules for electricity theft evidence collection are formed.

[0146] D1. For different categories of electricity theft, obtain the rule-based evidence collection sample set C for different categories of electricity theft generated in step C, defined as C = {c 1 ,c 2 ,…,c H}, Among them, c h This represents the evidence samples based on rule terms for electricity theft category h, where h∈[1,H], H is the number of electricity theft categories, q represents the rule term, and n is the number of evidence samples c. h The number of rule items included;

[0147] D2. Rule extraction is performed using sequential coverage. Based on the evidence sample set containing rule items in the category of electricity theft h, the number of each rule item in the evidence sample set is counted. In the same sequence, if the rule item type is not unique, the rule items with the largest and second largest number of counts are selected. Based on the sequence, the rule items with the largest and second largest number of counts are connected to generate v candidate evidence rules. The actual number of evidence samples covered by each rule is counted. The sample with the largest number of covers is extracted as the evidence sequence rule. The samples covered by this evidence sequence rule are removed from the evidence sample set of the category of electricity theft h.

[0148] D3. Repeat step D2 for the remaining evidence collection sample set until there are no remaining samples in the sample set, generating a total of k rules r, and outputting the evidence collection time sequence rule set;

[0149] D4. For each rule in the evidence collection sequence rule set, calculate the closeness H between any two rules, using the following formula:

[0150]

[0151] Where 0≤H(A,B)≤1, H(A,B) represents the similarity between rule A and rule B. The larger the value, the more similar the two rules are. |A∩B| represents the number of common rule items contained in rule A and rule B. |A∪B| represents the total number of rule items contained in rule A and rule B.

[0152] Total acquisition Calculate the similarity scores and sort them by similarity.

[0153] D5. Extract the two rules with the closest proximity, and use LGG to generalize the two rules. That is, merge the rule items that can be merged, and extract the jump condition of the first different rule item after the merged rule item based on the temporal position.

[0154] For rules r1 and r2, rule items with the same evidence collection operation are directly merged, denoted as LGG(q,q) = q. For rule items that cannot be directly merged, based on expert experience, it is determined whether there is functional equivalence or temporal adjustment among the remaining evidence collection items of rules r1 and r2. If so, after name unification / temporal adjustment, the identical rule items are merged. If not, the jump condition of the first different rule item after the merged rule item is determined based on the temporal position, and subsequent rule items enter different rule paths until they are merged with the next merged rule item, thus merging rules r1 and r2 into a single rule r based on the jump condition. 1,2 Remove rules r1 and r2 from the evidence collection sequence rule set in step D4, and add rule r. 1,2 ;

[0155] Repeat steps D4 and D5 as described above until a rule based on jump conditions is generated as an evidence collection rule for a certain type of electricity theft.

[0156] D6. Repeat steps D4 and D5 in a loop, traversing all categories of electricity theft, until a set of evidence collection rules based on the category of electricity theft is obtained;

[0157] D7. Based on the evidence collection rules set for electricity theft categories, repeat steps D4 and D5 until an electricity theft evidence collection rule based on jump conditions is generated, which is output as a differentiated electricity theft evidence collection timing rule.

[0158] Introducing the evaluation index DM,

[0159]

[0160] in, This represents the evidence sample formed based on differentiated electricity theft evidence collection timing rules, with each evidence collection step represented by a timing code; P true The actual evidence samples are represented by time-series codes. The fitting degree between the differentiated electricity theft evidence collection time-series rules and the actual evidence sample sequences is evaluated. The smaller the index value, the more effective the established evidence collection rules are, indicating that the time-series rules are consistent with the actual evidence collection time-series operations. Conversely, the larger the value, the greater the difference between the time-series rules and the actual evidence collection operations.

[0161] If the evaluation index DM is higher than the set fitting threshold, return to step C for feedback parameter adjustment; if it is lower than the set fitting threshold, fix the parameters and output differentiated electricity theft evidence collection timing rules to assist on-site electricity theft investigation personnel in collecting on-site evidence.

[0162] Differentiated electricity theft evidence collection timing rules are imported into the evidence collection timing rule module and evidence collection fixation module of the on-site evidence collection equipment to standardize the on-site evidence collection process. Based on the electricity theft evidence collection samples obtained from on-site anti-theft evidence collection work, the electricity theft evidence collection sample library is continuously enriched, and the evidence collection timing rules are continuously iterated and optimized to improve the effectiveness of electricity theft evidence collection.

[0163] During the on-site evidence collection phase of electricity theft, after the on-site staff obtains the corresponding evidence collection sequence rules based on the electricity theft category fed back from the system, the anti-electricity theft service recorder prompts the evidence collectors for the next step and precautions based on the evidence collection sequence rules. Evidence that meets the rule requirements is saved, and the next evidence collection step is indicated; for necessary evidence that was not captured, the on-site staff are notified of the key evidence collection steps that should be performed, and prompted to perform the operation again, thereby assisting the on-site evidence collectors in carrying out standardized and effective evidence collection and verification work.

[0164] This invention is validated through a simulated electricity theft scene environment. Multiple evidence-gathering personnel were selected to conduct simulated evidence collection at different types of electricity theft sites. The experimental setup was optimized using the controlled variable method to eliminate other influencing factors. The Effective Rate (ER) was used to evaluate the experimental results. The Effective Rate refers to the proportion of valid evidence samples out of the total sample, calculated as follows:

[0165]

[0166] S e S represents the number of valid evidence samples. n This indicates the total number of evidence samples collected.

[0167] Table 1. Results of Simulated Electricity Theft On-Site Tests and Verifications

[0168]

[0169] Table 1 shows some of the test and verification results. It can be seen that, with the assistance of differentiated electricity theft evidence collection timing rules, staff members 80001 and 80002 simulated six evidence collections at three electricity theft sites. These included three evidence collections using human experience and three evidence collections assisted by the evidence collection timing rules. The experimental data shows that when evidence collection was done using human experience, the evidence collection timing was significantly different from the evidence collection rules. However, with the assistance of the evidence collection timing rules, both staff members improved the speed of evidence collection while ensuring the standardization of evidence collection, greatly reducing the workload of frontline staff.

[0170] This invention provides a time-series evidence collection device based on rule and evaluation feedback optimization, relying on anti-theft and illegal electricity collection equipment. It includes a system-side suspected electricity theft identification module, an evidence collection time-series rule module, a video acquisition module, an audio acquisition module, a BeiDou positioning module, an encapsulation module, an evidence collection and fixation module, and a storage module. When executing differentiated electricity theft evidence collection time-series rules, the time-series evidence collection device performs the following steps:

[0171] The system-side suspected electricity theft identification module connects the power system side and the evidence collection timing rule module. The system-side suspected electricity theft identification module receives the suspected electricity theft type identified by the power system side and transmits it to the evidence collection timing rule module.

[0172] The evidence collection timing rule module connects the suspected electricity theft identification module, video acquisition module, and audio acquisition module on the system side. The evidence collection timing rule module extracts a subset of the suspected electricity theft evidence collection timing rules from the differentiated electricity theft evidence collection timing rules stored in its internal storage according to the suspected electricity theft type, and inputs the evidence collection timing into the video acquisition module and audio acquisition module based on the rule jump conditions to guide them to carry out on-site timing evidence collection.

[0173] The video acquisition module includes a camera circuit, a video encoding circuit, a DSP processor, and a random access memory circuit. It is used to acquire video data at the scene based on the evidence collection timing prompts, process the acquired video data and store it in the random access memory circuit, and transmit the on-site evidence collection video to the encapsulation module.

[0174] The camera circuit is connected to the video encoding circuit, and the video encoding circuit, infrared sensor, random access memory circuit, and automatic recording control circuit are all connected to the DSP processor.

[0175] The audio acquisition module consists of a microphone (MIC), a voice chip circuit, and a random access memory (RAM) circuit. It is used to collect audio data from the scene based on the evidence collection timing prompts, process the collected audio data, and store it in the RAM circuit. The on-site evidence collection audio is then transmitted to the encapsulation module.

[0176] The voice chip circuit includes a filtering circuit, an AGC circuit, an ADC circuit, and an encoding processing circuit.

[0177] The BeiDou module includes a BeiDou navigation and timing module, a BeiDou positioning module, and a communication module. Relying on the BeiDou satellite positioning system, it receives BeiDou satellite timing and positioning signals in real time and transmits them to the evidence collection and fixing module for on-site evidence collection timing and positioning marking.

[0178] Among them, the Beidou navigation and timing module receives Beidou satellite signals in real time and uses Beidou timing signals to synchronize the device's time; the Beidou positioning module is used to collect evidence collection location information; and the communication module transmits data with the Beidou satellite in real time.

[0179] The encapsulation module is used to receive audio and video data from the video acquisition module and the audio acquisition module, correct the audio and video data, remove redundant data and compress the data to obtain clear, noise-free and distortion-free audio and video data, and then integrate and encode the audio and video data to unify the data format and type before transmitting it to the evidence collection and fixing module.

[0180] The evidence collection and fixation module receives audio and video data transmitted from the encapsulation module, integrates BeiDou positioning signals, adds evidence collection time, evidence collection location, and personal information entered by the evidence collector to the evidence collection audio and video, and generates evidence collection rule jump conditions based on the current evidence collection sequence prompts, audio and video data, and personal information entered by the evidence collector. It selects evidence collection execution rules from a subset of electricity theft evidence collection sequence rules and feeds them back to the evidence collection sequence rule module. After the evidence collection is completed, the acquired time-series evidence is formed into an electricity theft evidence chain and transmitted to the storage module.

[0181] Storage module, used to store evidence of electricity theft.

[0182] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0183] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0184] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0185] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0186] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0187] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0188] The invention has been described with reference to a few embodiments. However, as will be known to those skilled in the art, and as defined in the appended claims, other embodiments besides those disclosed above fall equivalently within the scope of the invention.

[0189] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless otherwise expressly defined herein. All references to “a / / the [device, component, etc.]” ​​are openly interpreted as at least one instance of the device, component, etc., unless otherwise expressly stated. The steps of any method disclosed herein are not necessarily to be performed in the exact order disclosed, unless explicitly stated otherwise.

Claims

1. A temporal forensics method based on rule and evaluation feedback optimization, the method comprising: Obtain preprocessed historical electricity theft evidence data, classify the historical electricity theft evidence data according to the electricity theft category, and establish a sample subset of electricity theft evidence data for each category; the historical electricity theft evidence data includes electricity theft sample attribute information and evidence collection process log information; For each category of electricity theft evidence data sample subset, the support degree of the evidence collection process is calculated to obtain the evidence collection sample set based on rule terms, including: For each category of electricity theft evidence data sample subset, the evidence collection process support is calculated. When the calculated temporal correlation support is greater than the minimum support threshold, the minimum correlation temporal series is generated. Based on the minimum correlation time series, the time series correlation confidence is calculated. When the time series correlation confidence is greater than the minimum confidence threshold, a subsequence pair with preceding and following conditional correlation is generated to obtain the strong time series correlation link. Connect the strong time-series associated links that meet the connection conditions to generate a connected strong time-series associated link, and replace the strong time-series associated link before the connection with the connected strong time-series associated link. The strongly temporally related links after connection and the strongly temporally related links that do not meet the connection conditions are used as the temporal rules for evidence collection. Based on the aforementioned time sequence rules, time sorting is performed to generate evidence collection sample sets for each category. Rules were extracted from the evidence sample set for each category to obtain differentiated time-series rules for electricity theft evidence collection, including: S31: Count the number of each time rule in the evidence collection sample set for each category. In the same time sequence, the time rule type is not unique. Filter the time rules with the largest and second largest number of statistics, and connect the time rules with the largest and second largest number of statistics based on the time sequence to generate multiple candidate evidence collection time sequence rules. Count the number of samples covered by the multiple candidate evidence collection time sequence rules, extract the actual evidence collection sample with the largest coverage as the evidence collection time sequence rule, and remove the samples covered by the evidence collection time sequence rule from the evidence collection sample set of the corresponding electricity theft category. S32: Repeat step S31 for the remaining evidence samples until there are no remaining samples in the evidence sample set, generate multiple evidence collection time sequence rules, and output the evidence collection time sequence rule set. S33: Calculate the proximity of any two time rules in the evidence collection time sequence rule set, obtain multiple proximity values, and sort the proximity values. S34: Extract the two closest time rules in the proximity ranking, merge the time rules that can be merged, and for time rules that do not meet the generalization operation, extract the jump condition of the first different rule item after the merged rule item based on the time sequence position; repeat steps S33 and S34 until a rule based on the jump condition is generated, which serves as the evidence collection rule for one of the categories of electricity theft. S35: Repeat steps S3 and S34 to traverse all categories of electricity theft and directly obtain the set of evidence collection rules based on the category of electricity theft; S36: Based on the evidence collection rule set for electricity theft categories, repeat steps S34 and S35 until an electricity theft evidence collection timing rule based on jump conditions is generated as a differentiated electricity theft evidence collection timing rule output. The fitting degree of each category of electricity theft evidence collection timing rule is evaluated with the subset of electricity theft evidence collection data samples. Based on the evaluation results, the electricity theft evidence collection timing rule for each category is determined.

2. The method according to claim 1, wherein the evaluation index DM is introduced. （5） in, This represents the evidence sample formed based on the differentiated electricity theft evidence collection timing rules, with each evidence collection step represented by a timing code. The data represents the actual evidence samples, and the evidence collection process is represented by time sequence coding. The fitting degree between the differentiated electricity theft evidence collection time sequence rules and the actual evidence sample sequence is evaluated. The smaller the index value, the more effective the established evidence collection rules are, indicating that the time sequence rules are consistent with the actual evidence collection time sequence operation. Conversely, the larger the value, the greater the difference between the time sequence rules and the actual evidence collection operation.

3. The method according to claim 2 further includes adjusting the parameters for calculating the support of the evidence collection process when the index value is higher than a preset fitting threshold.

4. A system for performing the timing forensics method of claim 1, the system comprising: The system includes a suspected electricity theft identification module, an evidence collection timing rule module, a video acquisition module, an audio acquisition module, a BeiDou timing and positioning module, an encapsulation module, an evidence collection and fixation module, and a storage module, among which: The system-side suspected electricity theft identification module connects the power system side and the evidence collection timing rule module. It is used to receive the suspected electricity theft type identified by the power system side and send the suspected electricity theft type to the evidence collection timing rule module. The evidence collection timing rule module is connected to the suspected electricity theft identification module, the video acquisition module, and the audio acquisition module on the system side. It is used to extract a subset of electricity theft evidence collection timing rules for the corresponding type of suspected electricity theft based on the electricity theft evidence collection timing rules, and input the evidence collection timing into the video acquisition module and the audio acquisition module based on the jump conditions of the subset of electricity theft evidence collection timing rules. The video acquisition module is used to acquire video data from the scene based on a subset of the electricity theft evidence collection time sequence rules, and send the video data to the encapsulation module. The audio acquisition module is used to acquire audio data at the scene based on a subset of the electricity theft evidence collection time sequence rules, and to send the audio data to the encapsulation module. The Beidou timing and positioning module is used to synchronize the system time and collect the positioning information of the evidence collection location, and send the timing signal and positioning signal to the evidence collection and fixing module. The encapsulation module is used to process the received video data and audio data, and send the processed video data and audio data to the evidence collection and fixing module; The evidence collection and fixing module is used to integrate the received video data and audio data, add evidence collection time and evidence collection location based on the timing signal and the positioning signal, generate evidence collection rule jump conditions based on evidence collection timing prompts, video data and audio data, obtain execution rules through the subset of electricity theft evidence collection timing rules, and feed the execution rules back to the evidence collection timing rule module. Until the evidence collection is completed, the obtained timing evidence is sent to the storage module. The storage module is used to store the time-series forensic evidence.

5. The system according to claim 4, wherein the video acquisition module comprises: The system comprises a camera circuit, a video encoding circuit, a DSP processor, and a random access memory circuit, used to collect video data from the scene based on a subset of the timing rules for electricity theft evidence collection; wherein, the camera circuit is connected to the video encoding circuit, and the video encoding circuit is connected to the DSP processor.

6. The system according to claim 4, wherein the audio acquisition module comprises: The microphone (MIC), voice chip circuit, and random access memory circuit are used to collect audio data from the scene based on a subset of the timing rules for electricity theft evidence collection. The voice chip circuit includes a filtering circuit, an AGC circuit, an ADC circuit, and an encoding processing circuit.

7. The system according to claim 4, wherein the BeiDou timing and positioning module comprises: The BeiDou navigation and timing module, BeiDou positioning module, and communication module are based on the BeiDou satellite positioning system and receive BeiDou satellite timing and positioning signals in real time.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program for performing the method of any one of claims 1-5.

9. A computer program comprising computer-readable code, characterized in that, When the computer-readable code is run on the device, the processor in the device performs the method for implementing any one of claims 1-3.

Images