A device anomaly detection method based on power consumption monitoring time series data

Abstract

The present invention discloses a device anomaly detection method based on power consumption monitoring time series data, comprising the following steps: data collection; feature extraction; data clustering; anomaly detection and device monitoring; parameter adjustment; and device anomaly detection system deployment. In the case of a large collection sample for a specific type of equipment, the present invention automatically determines device instances with higher anomaly risks through historical data analysis, and then iterates the analysis model through manual feedback, ultimately achieving accurate identification of device anomalies.

Description

Technical Field

[0001] The present invention relates to the technical field of electrical digital data processing, and in particular to a method for detecting device anomalies based on electricity consumption monitoring time series data. Background Art

[0002] Equipment anomaly analysis is a common binary classification requirement. There are several ways to perform equipment anomaly analysis based on the collected equipment status time series data. However, these methods all have some defects:

[0003] 1. Model-based method: Use hidden Markov models or Kalman filtering to simulate time series data with a specific model, and detect anomalies based on the deviation between the predicted value and the observed value based on the model. Due to the complexity and diversity of actual business scenarios, it is difficult to have a universal model that can effectively match various conditions, and the prediction effect is not ideal;

[0004] 2. Supervised deep machine learning: In recent years, a large number of deep learning solutions have been used in time series analysis and processing. Instead of trying to directly perform seasonal time series trend analysis on time series data, LSTM (Long Short-Term Memory Network), GRU (Gated Recurrent Unit), Transformer and other solutions are used to try to directly use deep neural networks to identify and extract patterns in time series data, and then perform anomaly detection through the extracted features. However, this type of solution requires a large amount of labeled data, and different training data needs to be prepared for different types of equipment. The training process is complicated and requires a lot of computing resources. The training results are highly sensitive to data preprocessing methods, model structures, training parameters, etc., and it is difficult to obtain stable and reliable results. This method requires a large amount of equipment monitoring data collection and labeling, and the working modes of different equipment also need to prepare training data in a targeted manner, which consumes a lot of manpower and material resources, and the adaptability of the resulting model is not wide;

[0005] 3. Some unsupervised machine learning solutions: Currently, the k-Means clustering algorithm, density-based spatial clustering (DBSCAN) method, autoencoders and other technologies are commonly used to fit the collected device status data, and then use the fitted model for anomaly detection. This type of algorithm only needs to set certain algorithm parameters and does not require a large amount of manually labeled data. However, in order to achieve better reasoning results, it is necessary to carefully design the data construction method and select appropriate algorithm parameters (such as spatial distance function, number of clusters, k-distance (k neighbor distance), minimum number of cluster points, etc.). Summary of the invention

[0006] In response to the above problems, the present invention provides a device anomaly detection method based on electricity consumption monitoring time series data. When there is a large collection sample for a specific type of equipment, the device instances with higher abnormal risks are automatically judged through historical data analysis, and the analysis model is iterated through manual feedback to finally achieve accurate identification of device anomalies.

[0007] In order to achieve the purpose of the present invention, the following scheme is adopted:

[0008] A device anomaly detection method based on power consumption monitoring time series data comprises the following steps:

[0009] S100: Data collection: collect model information for each device, collect at least one attribute value a and a time series value s at a predetermined interval t, and then clean and normalize the collected data to obtain multi-dimensional time series data p collected each time;

[0010] S200: Feature extraction, including:

[0011] S201: Divide the data collected in S100 into n coarse segmented data records;

[0012] S202: dividing the n coarse segmented data into b fine segmented data records respectively;

[0013] S203: In all the subdivided segment data records, m aggregation algorithms are used to aggregate the multidimensional time series data p in each subdivided segment data record into m dimensional values ​​z, so that a vector Z is generated for each coarse segment time. , 1≤i≤n;

[0014] S300: Data clustering, using the HDBSCAN algorithm to calculate the distance between points of all vectors Z, and clustering these vectors Z into multiple clusters C;

[0015] S400: Anomaly detection and equipment monitoring, including:

[0016] S410: Anomaly detection model training, including:

[0017] S411: Data is collected from the device for a duration of T using the method of S100 to obtain an initial data set D = (q1, q2, ⋯, q f );

[0018] S412: Processing the initial data set D into an initial vector set by the method of S200;

[0019] S413: Generate a clustering tree model M1 from the initial vector set in the manner of S300;

[0020] S414: Calculate the abnormality score A1(Z) of each vector Z in the initial vector set by using the GLOSH algorithm. i ) and the abnormal clustering score A2(Z i ), 0≤A1(Z i )≤1,0≤A2(Z i )≤1;

[0021] S415: If A1(Z i )≥thresh or A2(Z i )≥thresh, then identify Z i is the abnormal point, thresh is the preset abnormal threshold;

[0022] S420: After the initial training is completed, the mode switches to real-time monitoring mode;

[0023] S500: adjusting the parameters in S100 to S400 by receiving feedback from the user;

[0024] S600: Setting up a device anomaly detection system, and deploying the methods described in S100 to S500 to the device anomaly detection system.

[0025] Furthermore, the multi-dimensional time series data p includes a normalized time series value s' and at least one normalized attribute value a'.

[0026] Further, S201 is:

[0027] The data collected in S100 are roughly segmented according to the rough segmentation time t', t<t' and t' is divisible by t, to obtain n roughly segmented data records.

[0028] Further, S202 is:

[0029] In the n coarse segmented data, the subdivisions are performed according to the subdivision time t", t<t”<t' and t' is divisible by t", t” is divisible by t, and b subdivision data records are obtained in the n coarse segmented data records, b=t' / t".

[0030] Further, in S203, m=3, and the aggregation algorithms include: average value, maximum value, and standard deviation.

[0031] Furthermore, in the HDBSCAN algorithm parameters, the Euclidean distance is used. Or cosine similarity cos(x,y)=|x|*|y| / (x*y), where x and y are two different vectors Z.

[0032] Furthermore, S300 includes:

[0033] S310: Calculate the distance information core of the kth nearest neighbor of each vector Zk (Z i )=distance(Z i ,Z i The kth nearest neighbor of ), 1≤i≤n, k is a preset integer value between 5 and 10;

[0034] S320: Calculate the mutual reachability distance mrd(x,y)=max(core k (x),core k (y),distance(x,y)), where x and y are two different vectors Z, and the mutual reachability matrix MRD is obtained;

[0035] S330: Through the mutual reachability matrix MRD x,y Generate MST using PRIM algorithm;

[0036] S340: Arrange the MST in ascending order of edge distances, traverse each edge, and create a cluster C containing two leaf nodes or a cluster C containing two sub-clusters C' where the two endpoints are located for each existing edge. The node of this cluster C records the distance mrd(lchild,rchild) between its two child nodes, where lchild(C) and rchild(C) are the left and right child nodes of C respectively, and the number of vectors Z contained in all child nodes is recorded to obtain an original hierarchical clustering tree. The closer the sub-clusters C' are to the root node, the larger the distance between them, and the closer the sub-clusters C' are to the leaf nodes, the smaller the distance between them.

[0037] S350: compressing the original hierarchical clustering tree, deleting sub-clusters C' whose sizes are smaller than the minimum size mcs, and obtaining a compressed hierarchical clustering tree;

[0038] S360: Starting from the root node of the compressed hierarchical clustering tree, define λ=1 / mrd(lchild(C),rchild(C)) for each cluster C represented by each node;

[0039] S370: Recursively peel off the child nodes from the root node of the compressed hierarchical clustering tree until the leaf node. If the number of vectors Z in the child node is less than the minimum size mcs, the current child node is directly discarded and the life of the current cluster C is bound to another child node. If the number of vectors Z in the child node is greater than or equal to the minimum size mcs, the current child node is split into two new clusters C, the cluster C represented by the node dies, and the new node is recorded as λ birth , when the node dies, it is recorded as λ death , if the node is split into two new clusters immediately after peeling, then its λ birth =λ death , otherwise birth <λdeath ;

[0040] S380: Update the stability index stability(C)=λ of each cluster C on the compressed hierarchical clustering tree death (w)-λ birth (w), w is all direct child nodes contained in C on the compressed hierarchical clustering tree.

[0041] Further, in S411, t<T, and T is divisible by t, f=T / t.

[0042] Furthermore, S500 includes:

[0043] S501: Obtain a test vector set G through S100 and S200;

[0044] S502: Set multiple parameter groups θ, θ including some or all of the parameters in the predetermined time t, the rough segmentation time t', the fine segmentation time t", the m value, the aggregation algorithm, the k value, the minimum size mcs, the custom distance e, and the preset clustering number Y. i The anomaly detection model of S410 is trained on the test vector set G respectively, and the anomaly detection model M2 is obtained respectively. i ;

[0045] S503: Through each abnormality detection model M2(G, θ i ) Perform anomaly detection on each data in the test vector set G and obtain the evaluation value h i =M2 i (y i ),∀y i ∈G;

[0046] S504: receiving feedback of partial data from the user i =M2 i (y i ), y i ∈G, get the feedback data set G f ={(y i ,h i ,v i ),∀y i ∈G)};

[0047] S505: Set the data points in the test vector set G as abnormal as positive, and the data points as normal as negative, set the case of correctly detecting anomalies as TP, the case of falsely detecting anomalies as FP, the case of correctly detecting normal as TN, and the case of falsely detecting normal as FN, calculate the precision J=TP / (TP+FP) and the recall rate R=TP / (TP+FN), and define the evaluation standard indicator F=2*(J*R) / (J+R);

[0048] S506: Optimizing a new batch of parameter groups θ with the goal of improving the value of F through the Bayesian optimization method;

[0049] S507: Repeat S502 to S506 using a new batch of parameter groups θ in S506 until the evaluation standard index F does not improve in a predetermined number of consecutive repetitions.

[0050] The beneficial effects of this technical solution are:

[0051] 1. In the device anomaly detection method, the attributes and time series of the device are formed into multi-dimensional time series data, and the original attribute data and each pre-processed attribute are merged into a vector containing time and space dimensions. By capturing the correlation features in each vector, the correlation between different original attribute values ​​and the distribution characteristics of different sampling values ​​in time are identified, and then the working status of the device is classified.

[0052] 2. Use the HDBSCAN method to perform unsupervised clustering on the high-dimensional data points obtained in the data collection and processing stages. Only certain relevant parameters are given to obtain the clustering results of the data. Then, points that do not belong to any cluster, or points that are in the same cluster as the cluster designated as abnormal after initial training, are determined as abnormal points. It is not clear whether the equipment is abnormal, only the abnormal data status is marked. The training parameters are initially empirical data based on the analysis target characteristics, and are iteratively updated with the steps of anomaly detection and equipment evaluation.

[0053] 3. With real-time analysis capabilities, after training is completed, the system will use the trained model to detect anomalies on new data points. Data points that are evaluated as outliers by the model or belong to clusters explicitly marked as abnormal data points will be regarded as abnormal data points, and the current situation will be regarded as abnormal status. At the same time, the proportion of abnormal status handled by the corresponding device in the recent period will be updated as the abnormal index of the device.

[0054] 4. It has the ability to adaptively adjust algorithm parameters. Users can choose to process and train the original monitoring data set with multiple sets of different data preprocessing and clustering algorithm parameter sets. The parameters in the preprocessing stage do not participate in automatic adjustment. The parameters are selected to obtain multiple sets of training data sets, and multiple anomaly detection models are used to determine whether each data point is abnormal based on these different models. At the same time, manual judgment can be made on the results of some system calibration. Each data point on a training data set, the parameters in clustering and anomaly processing, and the evaluation results of the models they are mapped to, and the user evaluation results form a feedback iterative training set. The deviation between user evaluation and system evaluation is regarded as a misjudgment, and other evaluation records are regarded as correct evaluations. Optimize the evaluation standard indicators. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A brief flowchart of a method summarized according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the present application clearer, the implementation methods of the present application are described in detail below, but the embodiments described in this application are only part of the embodiments of the present application, rather than all the embodiments.

[0057] The device anomaly detection method based on power consumption monitoring time series data is implemented in the following steps:

[0058] S100: Data collection: collect model information for each device respectively, and collect at least one attribute value a and a time series value s at a predetermined interval t. The attribute value a includes current, voltage, temperature, etc. The time series value s is the current time. Then, the collected data is cleaned and normalized. The normalization process uses MinMax normalization (minimum-maximum normalization) or Z-Score (normalization standard score normalization) to obtain multi-dimensional time series data p collected each time. Each multi-dimensional time series data p includes a normalized time series value s' and at least one normalized attribute value a'. In addition, when collecting data, the model information of each device can also be collected first, and the same device can also collect data through multiple sensors or monitoring points;

[0059] S200: Feature extraction, including:

[0060] S201: The data collected in S100 is roughly segmented according to the rough segmentation time t', t<t' and t' is divisible by t, to obtain n rough segmentation data records. Specifically, multiple time periods that may potentially reflect the working status mode of the equipment are selected according to the business scenario to monitor the industrial and civil electrical equipment;

[0061] S202: among the n coarse segmented data, segment according to the segment time t", t<t"<t' and t' is divisible by t", t" is divisible by t, and b segment data records are obtained from the n coarse segmented data records, b=t' / t", specifically, the coarse segment time t' and the segment time t" can be tested and selected multiple times to balance the performance and evaluation effect;

[0062] S203: In all the subdivided segment data records, m aggregation algorithms are used to aggregate the multidimensional time series data p in each subdivided segment data record into m dimensional values ​​z, so that a vector Z is generated for each coarse segment time. , 1≤i≤n, specifically, m=3, the aggregation algorithms include: average, maximum, standard deviation;

[0063] S300: Data clustering, using the HDBSCAN (hierarchical density clustering) algorithm to calculate the distance between all vectors Z. In the HDBSCAN algorithm parameters, the Euclidean distance is used. Or cosine similarity cos(x,y)=|x|*|y| / (x*y), where x and y are two different vectors Z, S300 includes:

[0064] S310: Calculate the distance information core of the kth nearest neighbor of each vector Z k (Z i )=distance(Z i ,Z i kth nearest neighbor), 1≤i≤n, k is a preset integer value between 5 and 10. In this embodiment, the calculation of this step is performed by the LSH (local sensitive hashing) algorithm;

[0065] S320: Calculate the mutual reachability distance mrd(x,y)=max(core k (x),core k (y), distance(x,y)), where x and y are two different vectors Z, and the mutually reachable matrix MRD is obtained. Then, the distance between a vector Z and a cluster C is defined as distance(Z,C)=min({mrd(Z,y)|y∈C}), and the distance between two clusters C is defined as distance(C1,C2)=min({mrd(x,y)|x∈C1,y∈C2});

[0066] S330: Through the mutual reachability matrix MRD x,y Use PRIM algorithm to generate MST (Minimum Spanning Tree).

[0067] S340: Arrange the MST in ascending order of edge distances, traverse each edge, and create a cluster C containing two leaf nodes or a cluster C containing two sub-clusters C' where the two endpoints are located for each existing edge. The node of this cluster C records the distance mrd(lchild,rchild) between its two child nodes, where lchild(C) and rchild(C) are the left and right child nodes of C respectively, and the number of vectors Z contained in all child nodes is recorded to obtain an original hierarchical clustering tree. The closer the sub-clusters C' are to the root node, the larger the distance between them, and the closer the sub-clusters C' are to the leaf nodes, the smaller the distance between them.

[0068] S350: compressing the original hierarchical clustering tree, deleting sub-clusters C' whose sizes are smaller than the minimum size mcs, and obtaining a compressed hierarchical clustering tree;

[0069] S360: Starting from the root node of the compressed hierarchical clustering tree, define λ=1 / mrd(lchild(C),rchild(C)) for each cluster C represented by each node;

[0070] S370: Recursively peel off the child nodes from the root node of the compressed hierarchical clustering tree until the leaf node. If the number of vectors Z in the child node is less than the minimum size mcs, the current child node is directly discarded and the life of the current cluster C is bound to another child node. If the number of vectors Z in the child node is greater than or equal to the minimum size mcs, the current child node is split into two new clusters C, the cluster C represented by the node dies, and the new node is recorded as λ birth , when the node dies, it is recorded as λ death , if the node is split into two new clusters immediately after peeling, then its λ birth =λ death , otherwise birth <λ death ;

[0071] S380: Update the stability index stability(C)=λ of each cluster C on the compressed hierarchical clustering tree death (w)-λ birth (w), w is all direct child nodes contained in C on the compressed hierarchical clustering tree;

[0072] Specifically, in S300, starting from the node of the root cluster C, the cluster C with the highest stability index stability(C) is always decomposed, and the decomposed sub-cluster C' is added to the selected cluster C, and the decomposed cluster C is removed from the selected cluster set until the distance mrd(lchild,rchild) between the left and right sub-clusters C' of cluster C is less than the custom distance e or the number of clusters C reaches the preset number of clusters Y, at which time the selected clusters retained are the obtained clustering results;

[0073] S400: Anomaly detection and equipment monitoring, including:

[0074] S410: Anomaly detection model training, including:

[0075] S411: Collect data from the device for a duration of T using the method of S100, where t < T and T is divisible by t, and obtain an initial data set D = (q1, q2, ⋯, q f ), f = T / t;

[0076] S412: Processing the initial data set D into an initial vector set by the method of S200;

[0077] S413: Generate a clustering tree model M1 from the initial vector set in the manner of S300;

[0078] S414: Calculate the abnormality score A1(Z) of each vector Z in the initial vector set by using the GLOSH (global local spherical harmonics) algorithm i ) and the abnormal clustering score A2(Z i ), 0≤A1(Z i )≤1,0≤A2(Z i )≤1;

[0079] S415: If A1(Z i )≥thresh or A2(Z i )≥thresh, then identify Z i is the abnormal point, thresh is the preset abnormal threshold;

[0080] S420: After the initial training is completed, the real-time monitoring mode is switched to. Specifically, feature extraction is performed on the real-time collected device data. Each new initial vector set is detected in the same way as S410. According to the device's rough segmentation algorithm described above, the proportion of data points determined to be abnormal in a certain period of time in the total samples is used as the comprehensive abnormality index of the device for analysis by other business capabilities.

[0081] S500: adjusting parameters by receiving feedback from users, and automatically training and correcting algorithm parameters in clustering and anomaly detection based on user feedback data, including:

[0082] S501: Obtain a test vector set G through S100 and S200;

[0083] S502: Set multiple parameter groups θ, θ including some or all of the parameters in the predetermined time t, the rough segmentation time t', the fine segmentation time t", the m value, the aggregation algorithm, the k value, the minimum size mcs, the custom distance e, and the preset clustering number Y. i The anomaly detection model of S410 is trained on the test vector set G respectively, and the anomaly detection model M2 is obtained respectively. i ;

[0084] S503: Through each abnormality detection model M2(G, θ i ) Perform anomaly detection on each data in the test vector set G and obtain the evaluation value hi=M2 i (y i ),∀y i ∈G;

[0085] S504: receiving feedback of partial data from the user i =M2i (y i ), y i ∈G, get the feedback data set G f ={(y i ,h i ,v i ),∀y i ∈G)};

[0086] S505: Set the abnormal data points in the test vector set G as positive (Positive), and the normal data points as negative (Negative), define TP (True Positive, correctly detected as abnormal), FP (False Positive, falsely detected as abnormal), TN (True Negative, correctly detected as normal), FN (False Negative, falsely detected as normal), and for the points that are not judged, they are regarded as TP or TN, calculate the precision J=TP / (TP+FP) and the recall rate R=TP / (TP+FN), and define the evaluation standard indicator F=2*(J*R) / (J+R);

[0087] S506: Optimizing a new batch of parameter groups θ with the goal of improving the value of F through the Bayesian optimization method;

[0088] S507: Repeat S502 to S506 using a new batch of parameter groups θ in S506 until the evaluation standard index F does not improve in a predetermined number of consecutive repetitions, or the iteration is stopped after the number of iterations reaches a certain number, and it is considered that the optimal parameters under the current data and scenario have been reached. During the iteration process, the user does not need to make a second judgment on the result;

[0089] S600: Set up an equipment anomaly detection system and deploy the methods described in S100~S500 to the equipment anomaly detection system. Specifically, after the user selects a reasonable time segment and parameters, the system undergoes the above model training and parameter adaptive adjustment to obtain a clustering model and anomaly judgment parameters. After being deployed in the system, the monitoring data can be monitored and analyzed to monitor and report on the working status of the equipment. The system periodically obtains new data sets from real-time monitoring data. If the user has real-time feedback on the judgment results, new user feedback can also be generated. The periodic application of the aforementioned model training and parameter adjustment methods can maintain the consistency of the model with the actual observation data and ensure the effectiveness of the analysis.

[0090] The above are only some of the embodiments listed in this application and are not intended to limit this application.

Claims

1. A device anomaly detection method based on power consumption monitoring time series data, characterized in that: The following steps are involved: S100: Data collection: collect model information for each device, collect at least one attribute value a and a time series value s at a predetermined interval t, and then clean and normalize the collected data to obtain multi-dimensional time series data p collected each time; S200: Feature extraction, including: S201: performing coarse segmentation on the data collected in S100 according to the coarse segmentation time t', t<t' and t' is divisible by t, to obtain n coarse segmentation data records; S202: in the n coarse segmented data, segment each according to the segmentation time t", t<t”<t' and t' is divisible by t", t” is divisible by t, and b segmented data records are obtained in the n coarse segmented data records, b=t' / t". S203: In all the subdivided segment data records, m aggregation algorithms are used to aggregate the multidimensional time series data p in each subdivided segment data record into m dimensional values ​​z, so that a vector Z is generated for each coarse segment time. , 1≤i≤n; S300: data clustering, using the HDBSCAN algorithm to calculate the distance between points of all vectors Z, and clustering these vectors Z into multiple clusters C; S400: Anomaly detection and equipment monitoring, including: S410: Anomaly detection model training, including: S411: Data is collected from the device for a duration of T using the method of S100 to obtain an initial data set D = (q1, q2, ⋯, q f ); S412: Processing the initial data set D into an initial vector set by the method of S200; S413: Generate a clustering tree model M1 from the initial vector set in the manner of S300; S414: Calculate the abnormality score A1(Z) of each vector Z in the initial vector set by using the GLOSH algorithm. i ) and the abnormal clustering score A2(Z i ), 0≤A1(Z i )≤1,0≤A2(Z i )≤1; S415: If A1(Z i )≥thresh or A2(Z i )≥thresh, then identify Z i is the abnormal point, thresh is the preset abnormal threshold; S420: After the initial training is completed, the mode switches to real-time monitoring mode; S500: By receiving feedback from the user, adjusting the parameters in S100 to S400, including: S501: Obtain a test vector set G through S100 and S200; S502: Set multiple parameter groups θ, θ including some or all of the parameters in the predetermined time t, the rough segmentation time t', the fine segmentation time t", the m value, the aggregation algorithm, the k value, the minimum size mcs, the custom distance e, and the preset clustering number Y. i The anomaly detection model of S410 is trained on the test vector set G respectively, and the anomaly detection model M2 is obtained respectively. i ; S503: Through each abnormality detection model M2(G, θ i ) Perform anomaly detection on each data in the test vector set G and obtain the evaluation value h i =M2 i (y i ),∀y i ∈G; S504: receiving feedback of partial data from the user i =M2 i (y i ), y i ∈G, get the feedback data set G f ={(y i ,h i ,v i ),∀y i ∈G)}; S505: Set the data points in the test vector set G as abnormal as positive, and the data points as normal as negative, set the case of correctly detecting anomalies as TP, the case of falsely detecting anomalies as FP, the case of correctly detecting normal as TN, and the case of falsely detecting normal as FN, calculate the precision J=TP / (TP+FP) and the recall rate R=TP / (TP+FN), and define the evaluation standard indicator F=2*(J*R) / (J+R); S506: Optimizing a new batch of parameter groups θ with the goal of improving the value of F through the Bayesian optimization method; S507: Repeat S502 to S506 using a new batch of parameter groups θ in S506 until the evaluation standard index F does not improve in a predetermined number of consecutive repetitions; S600: Setting up a device anomaly detection system, and deploying the methods described in S100 to S500 to the device anomaly detection system.

2. The device anomaly detection method based on power consumption monitoring time series data according to claim 1 is characterized in that: The multidimensional time series data p includes a normalized time series value s' and at least one normalized attribute value a'.

3. The device anomaly detection method based on power consumption monitoring time series data according to claim 1 is characterized in that: In S203, m=3, and the aggregation algorithms include: average, maximum, and standard deviation.

4. The device anomaly detection method based on power consumption monitoring time series data according to claim 1 is characterized in that: In the HDBSCAN algorithm parameters, Euclidean distance is used Or cosine similarity cos(x,y)=|x|*|y| / (x*y), where x and y are two different vectors Z.

5. The device anomaly detection method based on power consumption monitoring time series data according to claim 1 is characterized in that: S300 includes: S310: Calculate the distance information core of the kth nearest neighbor of each vector Z k (Zi) = distance (Zi, the kth nearest neighbor of Zi), 1≤i≤n, k is a preset integer value between 5 and 10; S320: Calculate the mutual reachability distance mrd(x,y)=max(core k (x),core k (y),distance(x,y)), where x and y are two different vectors Z, and the mutual reachability matrix MRD is obtained; S330: Through the mutual reachability matrix MRD x,y Generate MST using PRIM algorithm; S340: Arrange the MST in ascending order of edge distances, traverse each edge, and create a cluster C containing two leaf nodes or a cluster C containing two sub-clusters C' where the two endpoints are located for each existing edge. The node of this cluster C records the distance mrd(lchild,rchild) between its two child nodes, where lchild(C) and rchild(C) are the left and right child nodes of C respectively, and the number of vectors Z contained in all child nodes is recorded to obtain an original hierarchical clustering tree. The closer the sub-clusters C' are to the root node, the larger the distance between them, and the closer the sub-clusters C' are to the leaf nodes, the smaller the distance between them. S350: compressing the original hierarchical clustering tree, deleting sub-clusters C' whose sizes are smaller than the minimum size mcs, and obtaining a compressed hierarchical clustering tree; S360: Starting from the root node of the compressed hierarchical clustering tree, define λ=1 / mrd(lchild(C),rchild(C)) for each cluster C represented by each node; S370: Recursively peel off the child nodes from the root node of the compressed hierarchical clustering tree until the leaf node. If the number of vectors Z in the child node is less than the minimum size mcs, the current child node is directly discarded and the life of the current cluster C is bound to another child node. If the number of vectors Z in the child node is greater than or equal to the minimum size mcs, the current child node is split into two new clusters C, the cluster C represented by the node dies, and the new node is recorded as λ birth , when the node dies, it is recorded as λ death , if the node is split into two new clusters immediately after peeling, then its λ birth =λ death , otherwise birth <λ death ; S380: Update the stability index stability(C)=λ of each cluster C on the compressed hierarchical clustering tree death (w)-λ birth (w), w is all direct child nodes contained in C on the compressed hierarchical clustering tree.

6. The device anomaly detection method based on power consumption monitoring time series data according to claim 1 is characterized in that: In S411, t<T, and T is divisible by t, f=T / t.

Images