Mini-batch-kmeans algorithm-based charging pile fault automatic detection method and system

Abstract

The application provides a kind of Mini-Batch-Kmeans algorithm-based charging pile fault automatic detection method and system, relating to power equipment anomaly detection technical field.The method comprises: collecting charging pile terminal equipment traffic raw message data, extracting key information from it to form detection vector;Utilize Mini-Batch-Kmeans clustering algorithm to establish normal traffic model;Online acquisition of each time period traffic data, and it is structured into detection vector, compared with normal traffic model, normal traffic vector will be included in model to optimize model performance, abnormal traffic will trigger alarm mechanism, and generate detailed abnormal report and report distributed charging pile operation monitoring platform;When the system detects fault behavior, take corresponding blocking measures according to the nature of the threat.The technical scheme provided by the application can save manpower and computing power cost, expand the function of integrated terminal, and further consolidate the security line of the power grid.

Description

Technical Field

[0001] This invention relates to the field of power equipment anomaly detection technology, and in particular to an automated method and system for detecting charging pile faults based on the Mini-Batch-Kmeans algorithm. Background Technology

[0002] Against the backdrop of continuous development in the electricity market and driven by technological innovation, the massive influx of IoT terminals into new power systems has brought a huge data deluge to the power grid, placing higher demands on distribution terminal anomaly detection technology. Traditional operation and maintenance methods face numerous challenges in monitoring, fault detection, alarm response, and fault handling, mainly manifested in reliance on human experience, low efficiency, inaccurate problem localization, and high labor costs. Particularly for terminal equipment such as charging piles, the lack of effective automated detection methods for potential fault behaviors poses a threat to the safe operation of the power grid.

[0003] Therefore, there is an urgent need for an efficient automated fault detection mechanism for charging piles, capable of real-time monitoring of the large data streams generated by IoT terminals in the new power system, identifying and warning of potential risks, and ensuring the safe and stable operation of the power system. The Mini-Batch-Kmeans algorithm, due to its superior performance in anomaly detection, has become an ideal choice for solving this problem. This algorithm can quickly identify anomalies, provide decision-making suggestions, overcome the limitations of traditional operation and maintenance, realize intelligent network cloud service analysis and optimization, and significantly improve operation and maintenance efficiency. Summary of the Invention

[0004] Purpose of the invention: This invention proposes an automated method for detecting charging pile faults, and further proposes an apparatus for implementing the above-mentioned automated method for detecting charging pile faults, so as to solve the above-mentioned problems existing in the prior art.

[0005] As a first aspect of the present invention, an automated fault detection method for charging piles based on the Mini-Batch-Kmeans algorithm is proposed, comprising the following steps:

[0006] Step 1: Collect raw traffic data of charging pile terminal equipment, clean the raw traffic data of charging pile terminal equipment and remove data with random deviation greater than preset value, construct a dataset, and construct a normal detection vector based on the dataset.

[0007] Step 2: Add the normal traffic data clusters generated by the Mini-Batch-Kmeans algorithm from the normal detection vectors to the normal traffic data model;

[0008] Step 3: Detect the traffic data collected in each time period online. First, construct the current period detection vector from the detected traffic data. Then, compare and analyze the current period detection vector with the normal traffic data model.

[0009] If the comparison result is normal, the current period detection vector is added to the normal traffic data model; otherwise, the current period detection vector is considered abnormal, a traffic data anomaly report is generated, and an alarm is sent.

[0010] Step 4: Analyze the traffic data within the period corresponding to the current period detection vector, find the corresponding fault behavior, and perform different blocking based on different fault behaviors.

[0011] In a further embodiment of the first aspect, step 1 specifically includes:

[0012] Step 1.1: Collect raw traffic data of charging pile terminal devices according to different business types. The raw traffic data of charging pile terminal devices is collected by smart meters and transmitted to the converged terminal by Modbus TCP protocol.

[0013] Step 1.2: Use 80% of the data collected by the charging pile terminal equipment as the training set and 20% as the test set;

[0014] Step 1.3: Based on the traffic data packets between the converged terminal and the smart meter, extract the number of source / destination IP addresses, source / destination ports, and TCP flags for each data packet per unit time, and construct a three-dimensional detection vector as the normal detection vector.

[0015] In a further embodiment of the first aspect, the three-dimensional detection vector described in step 1.3 is considered as a fixed-length vector containing key statistical features of network traffic per unit time. The expression for the three-dimensional detection vector is as follows:

[0016] Drtection Vector = (IP features Port features Data registers )

[0017] In the formula, IP features It is a two-dimensional vector containing the number of source IPs and destination IPs. features =(N srcIP N dstIP Port features It is a two-dimensional vector containing the number of source ports and destination ports. features =(N srcPort N dstPort Data registersIt is a multidimensional array containing data at different destination register addresses, Data registers =(D address1 D address2 ,...,D addressn ).

[0018] In a further embodiment of the first aspect, step 2 specifically includes:

[0019] Step 2.1: Let the training set be X = {x1, x2, ..., x...} n}, where x i It is a feature vector;

[0020] X = {x1, x2, ..., x} n}={Data register1 Data register2 Data registern}

[0021] In the formula, Data registern This represents the nth multidimensional array, which contains data at different destination register addresses;

[0022] Step 2.2: Determine the number of clusters K according to the fault detection business needs, and select K samples from the training set X as initial cluster centers. Based on the selected center points, denoted as C = {μ1, μ2, ..., μ...} n}, where μ j This represents the j-th cluster center;

[0023] Step 2.3: Perform mini-batch sampling iterations, randomly sampling a mini-batch of data B from the training set X. t ,Right now Where t represents the current iteration number;

[0024] Step 2.4, for small batch data B t Each sample x in i Calculate the distance between a node and all its cluster centers, and assign it to the nearest cluster center. Define the assignment function a(x) i ) represents sample x i Assigned cluster center index;

[0025] Step 2.5, based on small batch data B t For each cluster, calculate the new cluster center as the mean of all samples within that cluster; then update the mean smoothly using the following formula:

[0026]

[0027] In the formula, In the t-th iteration, the mini-batch B represents... t The set of all samples assigned to class j in the middle. This indicates the number of samples in the set.

[0028] Step 2.6: Repeat steps 2.3 to 2.5 until the stopping condition is met. The stopping condition includes reaching the preset maximum number of iterations T or the change in cluster centers being less than a certain threshold.

[0029] In a further embodiment of the first aspect, the definition of the allocation function a(x) in step 2.4 i The expression for ) is as follows:

[0030]

[0031] In the formula, ||·|| represents the Euclidean distance; x i This represents a small batch of data B. t Each sample in; μ j Let j represent the j-th cluster center.

[0032] In a further embodiment of the first aspect, step 3 specifically includes:

[0033] Step 3.1: Collect network traffic data in real time for each time period online, and construct a three-dimensional detection vector to be detected by extracting key features such as the number of source / destination IP addresses, the number of source / destination ports, and the number of TCP flag bits.

[0034] Step 3.2: Perform a detailed comparison and analysis between the three-dimensional detection vector to be detected and the pre-established normal flow model.

[0035] If the comparison results indicate that the traffic is normal, the vector will be included in the normal traffic model to enrich its dataset.

[0036] If an anomaly is detected, a traffic anomaly report will be automatically generated and sent to the distributed charging pile operation monitoring platform, and a safety alarm will be sent in a timely manner so that appropriate measures can be taken.

[0037] In a further embodiment of the first aspect, step 4 involves different blocking actions based on different fault behaviors, including:

[0038] In response to the fault behavior of a single charging pile device, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the device's data upload behavior and shut down the device's command issuance.

[0039] In response to the fault behavior of a batch of charging pile equipment, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the data upload behavior of the equipment and issue a restart command for the equipment;

[0040] In response to persistent batch failures, the distributed charging pile operation monitoring platform interacts with the fusion terminal to block the data upload behavior of the devices and temporarily suspend the use of charging pile devices in the area.

[0041] As a second aspect of the present invention, an automated fault detection system for charging piles is proposed, which is used to perform the automated fault detection method for charging piles as described in the first aspect and its further embodiments.

[0042] Specifically, the automated fault detection system for charging piles includes a converged terminal for connecting charging piles; multiple charging piles within a predetermined area connect to the same converged terminal, and multiple converged terminals within multiple areas connect to a distributed charging pile operation monitoring platform via a network layer. The distributed charging pile operation monitoring platform is responsible for training and distributing the normal traffic model, storing anomaly reports, and interacting with the converged terminals to issue control commands. The converged terminal acts as middleware, executing the detection work of the trained normal traffic model, reporting anomaly reports, issuing control commands, and performing data preprocessing. Detection and early warning are completed in the converged terminal; the distributed charging pile operation monitoring platform is responsible for decision-making and model training.

[0043] As a third aspect of the invention, a computer-readable storage medium is provided, storing a computer program that causes a computer to perform operations of the automated charging pile fault detection method based on the Mini-Batch-Kmeans algorithm disclosed in the first aspect and its further embodiments.

[0044] Compared with the prior art, the present invention can achieve the following beneficial effects:

[0045] (1) This invention utilizes network data packets between charging piles and converged terminals to accurately extract features through intelligent means, constructing a highly targeted detection vector. This process fully considers the differences in business types, ensuring the accuracy and applicability of the model construction. Combined with the small-batch data processing strategy of the Mini-Batch-Kmeans algorithm, it not only significantly improves the efficiency of processing large-scale datasets, but also ensures that the model can flexibly adapt to various dynamic changes in data, effectively reducing computing power consumption, which is crucial for the operation and maintenance of large-scale IoT terminals.

[0046] (2) The Mini-Batch-Kmeans algorithm model can quickly distinguish between normal and abnormal traffic patterns through cluster analysis, enabling real-time fault identification. This process is not only fast but also highly accurate, providing the operation and maintenance team with decision-making support quickly. It solves the problems of slow fault handling and inaccurate fault location in traditional methods, effectively reduces the false alarm rate, avoids potential risks caused by delays due to manual intervention, and greatly improves fault response speed and processing efficiency.

[0047] (3) This invention significantly reduces reliance on human resources and alleviates labor costs through an automated detection mechanism, while also reducing maintenance risks caused by human error. Furthermore, it expands the functionality of the converged terminal, enabling it to provide fault warnings and preliminary handling capabilities, which is unparalleled by traditional maintenance models. The system can automatically execute operations such as issuing commands to shut down or restart equipment, performing preliminary fault handling, reducing the burden on maintenance personnel, and improving the overall level of maintenance.

[0048] In summary, this invention addresses network data packets between converged terminals and charging pile terminal devices. By accurately constructing traffic detection vectors and combining them with an improved Mini-Batch-Kmeans clustering algorithm, a normal traffic model was successfully established in a distributed charging pile operation monitoring platform and distributed to the converged terminals for detection. This model can effectively identify potential fault behaviors of charging pile devices and issue timely warnings to ensure the safe and stable operation of the power grid. Compared with traditional detection methods, this method not only saves manpower and computing power costs but also expands the functionality of the converged terminals. Furthermore, this invention cleverly combines accumulated historical data to simulate more realistic attack patterns and defense strategies, making the power grid interaction closer to real-world application scenarios. This not only compensates for the complexity limitations of traditional technologies but also further strengthens the power grid's security defenses. Attached Figure Description

[0049] Figure 1 This is an architecture diagram of the automated fault detection system for charging piles in an embodiment of the present invention.

[0050] Figure 2 This is a flowchart of the automated fault detection method for charging piles in an embodiment of the present invention.

[0051] Figure 3 This is a schematic diagram of the Mini-Batch-Kmeans algorithm in an embodiment of the present invention. Detailed Implementation

[0052] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0053] Example of using a fusion terminal as the detection carrier:

[0054] like Figure 1This is an architecture diagram of the automated charging pile fault detection system of the present invention. The automated charging pile fault detection method, medium, and system specifically include a distributed charging pile operation monitoring platform, a converged terminal, and charging pile terminals. The distributed charging pile operation monitoring platform is mainly responsible for training and distributing the normal traffic model, storing abnormal reports, and interacting with the converged terminal to issue control commands. The converged terminal, as middleware, not only carries out the detection work of the trained normal traffic model but also has functions such as reporting abnormal reports, issuing control commands, and data preprocessing. Detection and early warning work is completed in the converged terminal, while the distributed charging pile operation monitoring platform is responsible for decision-making and model training.

[0055] like Figure 2 This is a flowchart of the automated fault detection method for charging piles based on the Mini-Batch-Kmeans algorithm of the present invention. The automated fault detection method, medium, and system for charging piles specifically include the following steps:

[0056] Step 1: Collect raw power grid flow data, clean the raw power grid data and remove data with large random biases, construct a test training set and a dataset, and construct a detection vector. The interaction between the charging pile equipment and the converged terminal adopts wireless transmission. The interaction protocol is Modbus TCP as an example. A three-dimensional detection vector is constructed based on the data packets between the converged terminal and the charging pile equipment to realize data feature processing. Specifically, it includes the following sub-steps:

[0057] Step 1.1: Collect raw traffic data of charging pile terminal devices according to different business types. The raw traffic data of charging pile terminal devices is collected by smart meters and transmitted to the converged terminal by Modbus TCP protocol.

[0058] Step 1.2: 80% of the data collected from the charging pile terminal equipment is used as the training set, and 20% is used as the test set.

[0059] Step 1.3: Based on the traffic data packets between the converged terminal and the smart meter, extract the number of source / destination IP addresses, the number of source / destination ports, and the target register data for each data packet per unit time, and construct a three-dimensional detection vector.

[0060] Furthermore, the 3D detection vector constructed in step 1.3 can be represented as:

[0061] Drtection Vector = (IP features Port features Data registers )

[0062] Among them, IP features It is a two-dimensional vector containing the number of source IPs and destination IPs: IP features =(NsrcIP N dstIP Port features It is also a two-dimensional vector containing the number of source ports and destination ports: Port features =(N srcPort N dstPort Data registers It is a multidimensional array containing data at different destination register addresses: Data registers =(D address1 D address2 ,...,D addressn Ultimately, the three-dimensional detection vector can be viewed as a fixed-length vector containing key statistical features of network traffic per unit time.

[0063] Step 2: After constructing the detection vector, a detection vector containing the network data packet characteristics between the fusion terminal and the charging pile equipment can be obtained. A normal traffic model is then established using the Mini-Batch-Kmeans clustering algorithm. The normal traffic clusters generated by the Mini-Batch-Kmeans clustering algorithm from the normal detection vector are added to the normal traffic model. Figure 3 This is a schematic diagram of the algorithm principle of the automated fault detection method, medium, and system for charging piles based on the Mini-Batch-Kmeans algorithm of the present invention, which specifically includes the following sub-steps:

[0064] Step 2.1: Let the training set be X = {x1, x2, ..., x...} n}, where x i It is a feature vector.

[0065] X = {x1, x2, ..., x} n}={Data register1 Data register2 Data registern};

[0066] Step 2.2: Determine the number of clusters K based on the fault detection business needs. Select K samples from the dataset as initial cluster centers. These cluster centers can be randomly selected data points or determined through a heuristic method. Based on the selected centers, denoted as C = {μ1, μ2, ..., μ...} n}where μ j This represents the j-th cluster center;

[0067] Step 2.3: Perform mini-batch sampling iterations, randomly selecting a mini-batch of data B from dataset X. t (where t represents the current iteration number), that is

[0068] Step 2.4, for small batch B t Each sample x in i Calculate the distance between a node and all its cluster centers, and assign it to the nearest cluster center. Define the assignment function a(x) i ) represents sample x i The assigned cluster center index, i.e.

[0069]

[0070] Here, ||·|| represents Euclidean distance;

[0071] Step 2.5: Update Cluster Centers: Based on the samples assigned to each cluster within the mini-batch, calculate new cluster centers as the mean of all samples within that cluster. However, direct mean values ​​may fluctuate significantly due to the choice of mini-batch size; therefore, in practice, strategies such as momentum analysis or weighted averaging are typically used for smoothing updates. A simplified update formula is provided (without considering smoothing strategies).

[0072]

[0073] in In the t-th iteration, the mini-batch B represents... t The set of all samples assigned to class j in the middle. Indicates the number of samples in the set;

[0074] Step 2.6: Repeat steps 2.3-2.5 until the stopping condition is met, reaching the preset maximum number of iterations T or the change in cluster centers is less than a certain threshold;

[0075] After the algorithm is completed, the obtained cluster centers are μ1, μ2, ..., μ n This describes the behavioral patterns of normal traffic. These cluster centers can be used as part of a model to evaluate whether new traffic data conforms to the established normal patterns. By calculating the distances between the features of new traffic data and each cluster center, potential faulty traffic can be identified.

[0076] Step 3: Detect the traffic data collected in each time period online. First, construct a detection vector from the detected data. Then, perform a detailed comparison and in-depth analysis of the detection vector with a pre-built normal traffic model. If the analysis results show that the detection vector matches the characteristics of the normal traffic model, it indicates that the traffic behavior is not abnormal. At this point, the detection vector is integrated into the normal traffic model to continuously optimize and update the model, making it more closely reflect actual network traffic patterns. Conversely, if the comparison results reveal a significant deviation between the detection vector and the normal traffic model, the system will mark it as abnormal traffic. Subsequently, the system will automatically generate a traffic anomaly report, recording the specific characteristics and behavioral patterns of the abnormal traffic, and triggering a timely security alert so that the network security team can respond quickly and take measures to prevent potential security threats. Through this series of meticulous processes, this technical solution not only improves the accuracy of abnormal traffic detection but also enhances the response capability to network security threats. Specifically, it includes the following sub-steps:

[0077] Step 3.1: Collect network traffic data in real time for each time period online, and construct a three-dimensional detection vector to be detected by extracting key features such as the number of source / destination IP addresses, the number of source / destination ports, and the number of TCP flags.

[0078] Step 3.2: Perform a detailed comparison and analysis between the detection vector and the pre-established normal traffic model. If the comparison result shows that the traffic is normal, the vector is included in the normal traffic model to enrich its dataset. Otherwise, if an anomaly is detected, an abnormal traffic report is automatically generated and reported to the distributed charging pile operation monitoring platform, and a safety alarm is sent in a timely manner so that corresponding measures can be taken.

[0079] Step 4: Based on the detection and analysis of the above fault behaviors, for the fault behavior of a single charging pile device, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the device's data upload behavior and issue device shutdown commands, etc.; for the fault behavior of a batch of charging pile devices, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the device's data upload behavior and issue device restart commands; for continuous batch fault behaviors, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the device's data upload behavior and temporarily ban the use of charging pile devices in the area.

[0080] This invention targets network data packets between converged terminals and charging pile terminal equipment. By accurately constructing traffic detection vectors and combining them with an improved Mini-Batch-Kmeans clustering algorithm, a normal traffic model is successfully established in a distributed charging pile operation monitoring platform and distributed to the converged terminals for detection. This model can effectively identify potential fault behaviors of charging pile equipment and issue timely warnings to ensure the safe and stable operation of the power grid. Compared with traditional detection methods, this method not only saves manpower and computing power costs but also expands the functionality of the converged terminals. In addition, this invention cleverly combines accumulated historical data to simulate more realistic attack patterns and defense strategies, making the power grid interaction closer to real-world application scenarios. This not only compensates for the shortcomings of traditional technologies in terms of complexity but also further strengthens the power grid's security defenses.

[0081] In one embodiment of the present invention, a computer-readable storage medium is also disclosed, wherein a computer program is encoded. This program is designed to enable a computer to execute an automated fault detection method for charging piles based on the Mini-Batch-Kmeans algorithm.

[0082] In one technical solution of the present invention, an electronic device is also disclosed. This device is equipped with a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the computer program, it can realize an automated fault detection method for charging piles based on the Mini-Batch-Kmeans algorithm.

[0083] In the disclosed embodiments of the present invention, the computer storage medium may take the form of a tangible medium for storing programs for use by or in conjunction with an instruction execution system, apparatus, or device. These media include not only electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, but also any combination of these media. More specific examples include, but are not limited to, wire-based electrical connections, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), optical fibers, CD-ROMs, optical storage devices, magnetic storage devices, or suitable combinations of these storage media.

[0084] Those skilled in the art will recognize that, based on the units and algorithm steps described in conjunction with the embodiments disclosed in this application, the implementation of this invention is not limited to a specific implementation method, and can be electronic hardware, computer software, or a combination of both. The specific implementation method will depend on the needs and design constraints of a particular application. Those skilled in the art can choose different methods to implement the functions described in this invention according to the needs of each specific application, and such selection should not be considered as exceeding the scope of protection of this invention.

[0085] As described above, although the invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the invention itself. Various changes in form and detail may be made without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A Mini-Batch-Kmeans algorithm-based charging pile fault automatic detection method, characterized in that, Includes the following steps: Step 1: Collect raw traffic data from charging pile terminal devices, clean the raw traffic data by removing data with random deviations greater than a preset value, construct a dataset, and construct a normal detection vector based on this dataset; specifically including: Step 1.1: Collect raw traffic data of charging pile terminal devices according to different business types. The raw traffic data of charging pile terminal devices is collected by smart meters and transmitted to the converged terminal by Modbus TCP protocol. Step 1.2: Use 80% of the data collected by the charging pile terminal equipment as the training set and 20% as the test set; Step 1.3: Based on the traffic data packets between the converged terminal and the smart meter, extract the number of source / destination IP addresses, source / destination ports, and TCP flags for each data packet per unit time, and construct a three-dimensional detection vector as the normal detection vector. The three-dimensional detection vector is considered a fixed-length vector containing key statistical features of network traffic per unit time. The expression for the three-dimensional detection vector is as follows: In the formula, It is a two-dimensional vector containing the number of source IPs and destination IPs. ; It is a two-dimensional vector containing the number of source ports and destination ports. ; It is a multidimensional array containing data at different destination register addresses. ; Step 2: Add the normal traffic data clusters generated by the Mini-Batch-Kmeans algorithm from the normal detection vectors to the normal traffic data model; specifically including: Step 2.1, Let the training set be... ,in It is a feature vector; In the formula, This represents the nth multidimensional array, which contains data at different destination register addresses; Step 2.2: Determine the number of clusters based on the needs of fault detection services. From the training set X Selected from Each sample is used as the initial cluster center, and based on the selected center points, they are denoted as... ,in Indicates the first Cluster centers; Step 2.3: Perform mini-batch sampling iterations from the training set. X Randomly select a small batch of data ,Right now ,in Indicates the current iteration number; Step 2.4, for small batches of data Each sample in Calculate the distance between a node and all its cluster centers, and assign it to the nearest cluster center. Define the assignment function. Indicates sample Assigned cluster center index; Step 2.5: Based on small batch data The samples assigned to each cluster are used to calculate the new cluster center as the mean of all samples in that cluster; Step 2.6: Repeat steps 2.3 to 2.5 until the stopping condition is met, including reaching the preset maximum number of iterations. Or the change in cluster centers is less than a certain threshold; Step 3: Detect the traffic data collected in each time period online. First, construct the current period detection vector from the detected traffic data. Then, compare and analyze the current period detection vector with the normal traffic data model. If the comparison result is normal, the current period detection vector is added to the normal traffic data model; otherwise, the current period detection vector is considered abnormal, a traffic data anomaly report is generated, and an alarm is sent. Step 4: Analyze the traffic data within the period corresponding to the current period detection vector, find the corresponding fault behavior, and perform different blocking based on different fault behaviors.

2. The automated fault detection method for charging piles according to claim 1, characterized in that, The allocation function is defined in step 2.

4. The expression is as follows: In the formula, Represents Euclidean distance; Indicates small batch data Each sample in the; Indicates the first Cluster centers.

3. The automated fault detection method for charging piles according to claim 1, characterized in that, Step 2.5 further includes: smoothly updating the mean using the following formula: In the formula, Indicates the first Small batches in rounds of iteration The middle was assigned to the first The set of all samples of the class This indicates the number of samples in the set.

4. The automated fault detection method for charging piles according to claim 1, characterized in that, Step 3 specifically includes: Step 3.1: Collect network traffic data in real time for each time period online, and construct a three-dimensional detection vector to be detected by extracting key features such as the number of source / destination IP addresses, the number of source / destination ports, and the number of TCP flag bits. Step 3.2: Perform a detailed comparison and analysis between the three-dimensional detection vector to be detected and the pre-established normal flow model. If the comparison results indicate that the traffic is normal, the vector will be included in the normal traffic model to enrich its dataset. If an anomaly is detected, a traffic anomaly report will be automatically generated and sent to the distributed charging pile operation monitoring platform, and a safety alarm will be sent in a timely manner so that appropriate measures can be taken.

5. The automated fault detection method for charging piles according to claim 1, characterized in that, Step 4 involves different blocking methods based on different fault behaviors, including: In response to the fault behavior of a single charging pile device, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the device's data upload behavior and shut down the device's command issuance. In response to the fault behavior of a batch of charging pile equipment, the distributed charging pile operation monitoring platform interacts with the converged terminal to block the data upload behavior of the equipment and issue a restart command for the equipment; In response to persistent batch failures, the distributed charging pile operation monitoring platform interacts with the fusion terminal to block the data upload behavior of the devices and temporarily suspend the use of charging pile devices in the area.

6. An automated fault detection system for charging piles, used to execute the automated fault detection method for charging piles as described in any one of claims 1 to 5, characterized in that, Includes a converged terminal for accessing charging piles; multiple charging piles within a predetermined area are connected to the same converged terminal, and multiple converged terminals in multiple areas are connected to a distributed charging pile operation monitoring platform through the network layer; The distributed charging pile operation monitoring platform is responsible for training and distributing the normal traffic model, saving abnormal reports, and interacting with the fusion terminal to issue control commands. The fusion terminal acts as middleware, performing the detection work of the trained normal traffic model, and reporting anomalies, issuing control commands, and preprocessing data. Detection and early warning are performed in the integrated terminal; the distributed charging pile operation monitoring platform is responsible for decision-making and model training.

7. A computer-readable storage medium storing a computer program that causes a computer to perform operations of the automated fault detection method for charging piles based on the Mini-Batch-Kmeans algorithm as described in any one of claims 1 to 5.

Images