A power stealing identification method based on a multi-layer integrated model
The electricity theft identification method based on a multi-layer ensemble model utilizes data standardization and combined clustering models, along with an isolated forest model, to identify electricity theft users. This solves the problems of poor interpretability and low accuracy in electricity theft detection models, achieving efficient electricity theft user identification.
Patent Information
- Application Number
- CN202310793232.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-30
- Publication Date
- 2026-02-27
- Estimated Expiration
- 2043-06-30
AI Technical Summary
Existing electricity theft detection models have poor interpretability, making it difficult to effectively identify electricity theft users. Furthermore, there is a lack of methods to determine the priority of investigating electricity theft users, which makes it difficult to effectively combat electricity theft.
A method for identifying electricity theft based on a multi-layer ensemble model is adopted. This method identifies suspected electricity theft users by standardizing data, constructing user load characteristics, and combining clustering and isolated forest models.
It improved the accuracy of identifying electricity theft users, narrowed the detection range of suspected electricity theft users, and enhanced the efficiency of identifying electricity theft behavior.
Smart Images
Figure CN116933182B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to a kind of for electricity theft monitoring prevention field based on multi-layer integrated model electricity theft identification method. BACKGROUND
[0002] Early, traditional electricity charge mode is artificial hand copy meter, physical labor is strong and insufficient quantity of foreign personnel, electricity theft investigation problem is also borne by foreign personnel, and the number of electricity inspection personnel is difficult to meet demand;Second, due to the traditional power management thought concept is deeply rooted, power supply enterprise does not pay enough attention to electricity theft behavior, resulting in electricity inspection and low intensity of cracking down on electricity theft behavior, which encourages electricity theft behavior.With the rapid development of science and technology, high-tech means is widely used by electricity theft personnel, with the intelligentization and technological development of electricity theft technology, more and more high-tech content electricity theft methods, such as wireless remote control, wired remote control, etc.This kind of electricity theft means is often very hidden, traditional electricity inspection method can not detect, and the comprehensive quality of electricity inspection personnel is low, which is difficult to meet the modernization demand of electricity inspection and anti-electricity theft work.
[0003] With the rise of big data, machine learning and artificial intelligence, electricity theft identification method using machine learning has attracted widespread attention of scholars at home and abroad.Electricity theft detection model based on machine learning is generally a black box model, that is, only the original data needs to be input after training the model, and the prediction result can be obtained, and the disadvantage is that the model has poor interpretability and cannot provide reliable basis for actual investigation.In addition, current electricity theft detection research pays more attention to how to identify a few electricity theft users in normal user cluster, and there is little research on the determination method of electricity theft user investigation priority, which is difficult to ensure the economic benefit of actual investigation. SUMMARY
[0004] The purpose of the present application is to overcome the shortcomings of the prior art, provide an electricity theft identification method based on multi-layer integrated model, which can improve the identification accuracy of electricity theft behavior and electricity theft user.
[0005] One technical solution to achieve the above purpose is: an electricity theft identification method based on multi-layer integrated model, comprising the following steps:
[0006] S1, in order to avoid the influence of data range of different fields on the screening result of feature index, data standardization processing is adopted, and each data in the original data set is transformed into the range of [0, 1];
[0007] S2, constructing user load characteristic quantity;
[0008] S3, constructing user clustering model based on combination clustering;
[0009] S4, based on the constructed multiple class users, a group of users is constructed for each class user; determine the abnormal situation of the input data sample point, and obtain the electricity stealing suspect user group.
[0010] Further, the user load characteristic quantity in S2 includes:
[0011] a. Load rate
[0012]
[0013] Wherein, P av is the average load of a day, P max is the maximum load of a day, and the load rate reflects the load change of the whole day.
[0014] b. Highest utilization hour rate
[0015]
[0016] Wherein, P sum is the total load of each day, and the highest hour utilization rate reflects the utilization efficiency in time.
[0017] c. Daily peak valley difference rate
[0018]
[0019] Wherein, P min is the minimum load of each day, and the daily peak valley difference rate reflects the peak regulation capacity of the power grid.
[0020] d. Peak period load rate
[0021]
[0022] Wherein, p av.peak is the average load of the peak period, and p av is the average load of each day.
[0023] e. Flat period load rate
[0024]
[0025] Wherein, p av.sh is the average load of the flat period.
[0026] f. Valley period load rate
[0027]
[0028] Wherein, p av.val is the average load of the valley period.
[0029] Further, the specific steps of S3 include:
[0030] S31, determine the number of clusters K by elbow method, and determine the clustering effect by sum of squared error formula
[0031]
[0032] Wherein, C i is the i-th cluster, p is a sample point in C i , mi is the centroid of C i , that is, the mean of all samples in C i , SSE is the clustering error of all samples, which represents the clustering effect; as the number of clusters K increases, the sample division will be more refined, and the aggregation degree of each cluster will gradually increase, so the sum of squared error SSE will naturally gradually decrease; and when K is less than the true cluster number, the increase of K will greatly increase the aggregation degree of each cluster, so the decrease amplitude of SSE will be large, and when K reaches the true cluster number, the return of the aggregation degree obtained by increasing K will quickly become small, so the decrease amplitude of SSE will sharply decrease, and then gradually tend to be flat with the continuous increase of K value, so that the relationship diagram of SSE and K is an elbow shape, and the K value corresponding to the elbow is the true cluster number of the data;
[0033] S32, divide the data into K clusters by using hierarchical clustering model;
[0034] S33, calculate the sum of distances between each sample point and other points in each cluster respectively, select the point with the smallest sum of distances as the cluster center of this cluster, and further determine the K cluster centers;
[0035] S34, call K-medoids clustering algorithm for iteration until all cluster centers no longer change, the clustering is completed, and the user group division is completed.
[0036] Further, the specific steps of S4 are:
[0037] S41, for the load characteristic data set, randomly select n points as a sub-sample data set, and distribute them to the root node of the isolated tree;
[0038] S42, randomly select a dimension from the 6 features in the sub-sample set, and then randomly generate a value between the minimum value and the maximum value of the selected feature of the current node data as a cutting point p;
[0039] S43, construct a hyperplane based on the selected feature dimension and cutting point p to divide the current data into two parts of subspaces; divide the data with feature values less than p in the specified feature dimension to the left child node of the current node, and divide the data greater than or equal to p to the right child node of the current node;
[0040] S44, recursively performing steps S42, S43 for each sub-node, constantly constructing new sub-nodes, until each data point is completely isolated or the node has reached the maximum limited depth;
[0041] Iterating the above steps to build a large number of isolated trees, forming multiple isolated forests. For each sample point x, the results of all isolated trees are integrated to calculate the anomaly score, so as to judge the abnormality of the sample point.
[0042] Further, the expression of the anomaly score is:
[0043]
[0044] Where h(x) represents the average path length of sample point x obtained by integrating all isolated trees, c(n) is the average path length of the tree, and n is the number of sample points in the data set.
[0045] The present application has the advantages compared with the prior art:
[0046] The present application proposes a power stealing detection method through abnormal power consumption state recognition, which can reduce the detection range of suspected power stealing users. By analyzing user load data information to establish comprehensive load information feature indicators, and combining the idea of integration, the K-medoids algorithm is improved, multi-level integration is used for clustering, and finally isolated forest models are constructed for each class to identify power stealing abnormal users in each class. The specific effect of the present application is as follows.
[0047] (1) The improved K-medoids clustering algorithm needs to randomly select the initial clustering center, the combination clustering model is designed, the K-medoids clustering and hierarchical clustering are combined, the randomness of the K-medoids clustering algorithm is reduced, and the improved combination clustering model is used for clustering analysis of user load feature data, so as to divide the users into different user groups.
[0048] (2) The users in each user group after clustering have certain similarity, and the users with no similarity are more easily identified. By using this characteristic, isolated forest models are constructed for each user group to identify power stealing abnormal users in each class, which can improve the accuracy of power stealing identification. BRIEF DESCRIPTION OF DRAWINGS
[0049] Figure 1 The figure is a power stealing identification flowchart of the power stealing identification method based on a multi-layer integrated model of the present application.
[0050] Figure 2 The figure is an elbow method best cluster number schematic diagram of the present application. DETAILED DESCRIPTION
[0051] In order to better understand the technical solutions of the present application, the following will be described in detail through specific examples:
[0052] Please refer to Figure 1 The present application is a power stealing identification method based on a multi-layer integrated model, comprising the following steps:
[0053] S1, in order to avoid the influence of data range of different fields on the screening results of feature indicators, data standardization processing is adopted to transform each data in the original data set to the range of [0, 1]. The model of data transformation is:
[0054]
[0055] S2, constructing user load characteristic quantity, comprising:
[0056] a. Load rate
[0057]
[0058] Among them, P av is the average load of a day, P max is the maximum load of a day, and the load rate reflects the load change of the whole day;
[0059] b. Highest utilization hour rate
[0060]
[0061] Among them, P sum is the total load of each day, and the highest hour utilization rate reflects the utilization efficiency in time.
[0062] c. Daily peak valley difference rate
[0063]
[0064] Among them, P min is the minimum load of each day, and the daily peak valley difference rate reflects the peak regulation capacity of the power grid;
[0065] d. Peak period load rate
[0066]
[0067] Among them, p av.peak is the average load of the peak period, and p av is the average load of each day;
[0068] e. Flat period load rate
[0069]
[0070] Among them, pav.sh is the average load of the valley period;
[0071] f. valley load rate
[0072]
[0073] wherein, p av.val is the average load of the valley period.
[0074] S3, a user clustering model based on combined clustering is constructed. The K-medoids clustering algorithm needs to randomly select an initial cluster center. In order to improve the shortcomings of the K-medoids algorithm, the application combines the advantages of the hierarchical clustering model and proposes an AggK-medoids combined clustering model. The method first uses the elbow method to obtain the optimal clustering number K, then uses the hierarchical clustering model to divide the data samples into K different classes. The sum of the distances of each sample point in each cluster from other points is calculated, and the point with the smallest sum of distances is selected as the cluster center of this cluster. Then the K-medoids clustering algorithm is called for iteration until all cluster centers no longer change, and the clustering is completed. The execution process is:
[0075] Input: user load feature data set
[0076] Output: K clustering results.
[0077] The specific steps include:
[0078] S31, the elbow method is used to determine the clustering number K, and the error sum of squares formula is used to judge the good and bad of the clustering effect, and the error sum of squares formula is
[0079]
[0080] wherein, C i is the i-th cluster, p is the sample point in C i , mi is the centroid of C i , that is, the mean of all samples in C i , and SSE is the clustering error of all samples, which represents the good and bad of the clustering effect; as the clustering number K increases, the sample division will be more refined, and the aggregation degree of each cluster will gradually increase, so the error sum of squares SSE will naturally gradually decrease; and when K is less than the true clustering number, since the increase of K will greatly increase the aggregation degree of each cluster, the decrease amplitude of SSE will be large, and when K reaches the true clustering number, the return of the aggregation degree obtained by increasing K will quickly become small, so the decrease amplitude of SSE will sharply decrease, and then gradually tend to be flat with the continuous increase of K, so that the relationship diagram of SSE and K is an elbow shape, and the K value corresponding to the elbow is the true clustering number of the data.
[0081] Figure 2 is an example diagram of elbow method for selecting cluster center, the horizontal coordinate K is the optimal cluster number, and the vertical coordinate SSE is the sum of squared error. As shown in Figure 2 , the elbow corresponds to the K value of 4 (the highest curvature), so the optimal cluster number for clustering of this data set should be 3.
[0082] S32, the data is divided into K clusters by using the hierarchical clustering model;
[0083] S33, the sum of distances of each sample point in each cluster to other points is calculated respectively, and the point with the smallest sum of distances is selected as the cluster center of the cluster, and then the K cluster centers are determined;
[0084] S34, the K-medoids clustering algorithm is called for iteration until all cluster centers no longer change, the clustering is completed, and the user group division is completed.
[0085] S4, after clustering analysis, multiple class group users are formed, and then an isolation forest model is constructed for each class group user to identify suspicious users. Since each class group user has certain similarity in the class, the electricity stealing abnormal user is more likely to be isolated at this time, thereby improving the accuracy of identification. The construction of isolation forest is similar to random forest, that is, a part of data is randomly sampled to construct a tree, and difference between different trees is ensured.
[0086] The specific steps are as follows:
[0087] S41, for the load feature data set, n points are randomly selected as a sub-sample data set, and the sub-sample data set is distributed to the root node of the isolation tree;
[0088] S42, one dimension is randomly selected from the 6 features in the sub-sample set, and then a value is randomly generated between the minimum value and the maximum value of the selected feature of the current node data as a cutting point p;
[0089] S43, based on the selected feature dimension and the cutting point p, an hyperplane is constructed to divide the current data into two part subspaces; the data with feature value less than p in the specified feature dimension is divided into the left child node of the current node, and the data greater than or equal to p is divided into the right child node of the current node;
[0090] S44, steps S42 and S43 are recursively executed for each sub-node to continuously construct new sub-nodes until each data point is completely isolated or the node has reached the maximum limited depth;
[0091] The above steps are iterated to construct a large number of isolation trees to form multiple isolation forests. For each sample point x, the abnormal score is calculated by comprehensively considering the results of all isolation trees, so as to judge the abnormality of the sample point.
[0092] The expression of the abnormal score is:
[0093]
[0094] Wherein, h(x) represents the average path length of the sample point x obtained by integrating all isolated trees, c(n) is the average path length of the tree, and n is the number of sample points in the data set.
[0095] The application discloses a power stealing identification method based on a multi-layer integrated model, and the model is designed by using the integrated idea, the algorithm is improved in view of the shortcomings of the K-medoids algorithm, and a hierarchical clustering model is combined to divide users into different user groups, then an isolated forest model is constructed for users in each class group to identify power stealing abnormal users.
[0096] (1) According to the load performance of the peak-valley period, user load power consumption characteristics are constructed, including load rate, highest utilization hour rate, daily peak-valley difference rate, peak period load rate, flat period load rate, and valley period load rate, to form a load characteristic index system.
[0097] (2) The division clustering model and the hierarchical clustering model are combined to form a combined clustering model, user load characteristic data are clustered, and users are divided into different categories, thereby laying a foundation for identification of power stealing abnormal users.
[0098] (3) An isolated forest model is constructed for each type of user to identify power stealing abnormal suspicious users.
[0099] Those skilled in the art in this technical field should realize that the above embodiments are only used to illustrate the application, and are not used as a limitation on the application, and as long as the above described embodiments are changed and modified within the essential spirit of the application, the changes and modifications will fall within the scope of the claims of the application.
Claims
1. A method for identifying electricity theft based on a multi-layer ensemble model, characterized in that, Includes the following steps: S1. In order to avoid the impact of the data range of different fields on the screening results of feature indicators, data standardization is adopted to transform each data in the original dataset into the range of [0,1]. S2, construct user load characteristics; S3, Construct a user grouping model based on combinatorial clustering; S4: Based on the constructed user groups, an encouragement forest model is built for each user group; abnormal scores of input data sample points are judged to obtain the user groups suspected of electricity theft. The specific steps of S3 include: S31. The elbow method is used to determine the number of clusters K, and the quality of clustering is judged by the sum of squared errors formula, which is: Among them, C i It is the i-th cluster, and p is C i The sample points in the C are mi, which are C i The center of mass, i.e., C i The sum of squared errors (SSE) is the mean of all samples in the dataset, representing the quality of clustering. As the number of clusters K increases, the sample partitioning becomes more refined, and the aggregation degree of each cluster gradually increases, so the SSE naturally decreases. Furthermore, when K is less than the true number of clusters, increasing K will significantly increase the aggregation degree of each cluster, so the decrease in SSE will be substantial. However, when K reaches the true number of clusters, the aggregation degree gain from further increasing K will rapidly decrease, so the decrease in SSE will drop sharply. Then, as the value of K continues to increase, it tends to level off, making the relationship between SSE and K resemble the shape of an elbow, and the K value corresponding to this elbow is the true number of clusters in the data. S32 uses a hierarchical clustering model to divide the data into K clusters; S33, calculate the sum of distances between each sample point in each cluster and other points, select the point with the smallest sum of distances as the cluster center of this cluster, and then determine K cluster centers; S34, call the K-medoids clustering algorithm to iterate until all cluster centers no longer change, the clustering is complete, and the user group is divided.
2. The electricity theft identification method based on a multi-layer ensemble model according to claim 1, characterized in that, User load characteristics in S2 include: a. Load factor Among them, P av P represents the average daily load. max The load factor represents the maximum load of a day and reflects the load variation throughout the day. b. Peak utilization hours Among them, P sum The peak hourly utilization rate reflects the efficiency of time utilization, representing the total daily load. c. Daily peak-valley difference rate Among them, P min The daily peak-to-valley difference rate reflects the power grid's peak-shaving capacity, representing the minimum daily load. d. Peak load factor Where, p av.peak p represents the average load during peak periods. av Average daily workload; e. Off-peak load factor Where, p av.sh The average load during the off-season; f. Off-peak load rate Where, p av.val This represents the average load during the trough period.
3. The electricity theft identification method based on a multi-layer ensemble model according to claim 1, characterized in that, The specific steps of S4 are as follows: S41, For the load feature dataset, randomly select n points as subsample datasets and assign them to the root node of the isolated tree; S42, randomly select one dimension from the 6 features in the subsample set, and then randomly generate a value between the minimum and maximum values of the selected feature in the current node data as the cut point p; S43, construct a hyperplane based on the selected feature dimension and the cut point p, and divide the current data into two subspaces; assign data with feature values less than p under the current specified feature dimension to the left child node of the current node, and assign data with values greater than or equal to p to the right child node of the current node; S44, recursively execute steps S42 and S43 for each child node, continuously constructing new child nodes until each data point is completely isolated or the node has reached its maximum depth. The above steps are iterated to construct a large number of isolated trees, forming multiple isolated forests. For each sample point x, the anomaly score is calculated by combining the results of all isolated trees, thereby determining the anomaly of the sample point.
4. The electricity theft identification method based on a multi-layer ensemble model according to claim 1, characterized in that, The expression for anomaly scores is: Where h(x) represents the average path length of sample point x obtained by combining all isolated trees, c(n) is the average path length of the tree, and n is the number of sample points in the dataset.