A Deep Learning-Based Abnormal Detection Method for Power Grid Data Streams

Abstract

The present invention belongs to the technical field of data detection, and specifically relates to an abnormal detection method for power grid data streams based on deep learning, including: constructing an LSTM-NN model, and performing abnormal detection on the power grid data stream after processing by the LSTM-NN model. The present invention proposes a metric called sequence inconsistency distance, which can be obtained through parallel computing, thereby significantly reducing the detection time and making an important guarantee for the stability and security of the power grid.

Description

Technical Field

[0001] The present invention belongs to the technical field of data detection, and particularly relates to a method for detecting anomalies in power grid data streams based on deep learning. Background Art

[0002] With the continuous construction of power system facilities, the scale of the power grid is constantly expanding, the number of various terminal devices and data acquisitions is increasing day by day, the data volume is huge and the complexity is increasing, resulting in an increasing probability of abnormal situations in the power grid. If abnormal situations cannot be detected and processed immediately, it may reduce performance and lead to high maintenance costs. Therefore, practical methods for identifying anomalies within a limited time to avoid serious losses are more important than ever. In this context, anomaly detection has increasingly attracted the attention of power-related departments. Equipment with abnormal behaviors in the power grid may cause serious consequences to the entire power grid system. For example, abnormal traffic may lead to problems such as equipment overload, power grid instability, and even short circuits, which may further cause power outages, equipment damage, and even safety accidents. Therefore, monitoring and timely handling of abnormal behaviors in the power grid are very important for ensuring the safety and stability of the power grid.

[0003] In the actual operation of the power grid, edge nodes can obtain sensory inputs from other terminal devices to evaluate their behaviors and operating states. For example, device monitoring and predictive maintenance using sensors and monitoring devices, where data from sensors and monitoring devices are used to monitor device states and predict risks. In such scenarios, the collected data is usually time series data, which can be used to detect abnormal behaviors of devices in real time.

[0004] However, due to the following reasons, accurately identifying anomalies in advance is challenging. First, according to its inherent characteristics, time series data may be periodic, seasonal, or irregular, and highly correlated. Therefore, it is impossible to assume that data points are independent and identically distributed. Second, in most real-world scenarios, the task of labeling such a large amount of data is actually infeasible. This requires designing appropriate anomaly detection methods that do not require labeled data. Finally, the detection process should be able to run in real time to trigger an alarm in a timely manner. Summary of the Invention

[0005] To solve the above technical problems, the present invention provides a method for detecting anomalies in power grid data streams based on deep learning, including: constructing an LSTM-NN model, and performing anomaly detection after processing the power grid data stream through the LSTM-NN model;

[0006] The LSTM-NN model includes: an input layer and a hidden layer;

[0007] Performing anomaly detection after processing the power grid data stream through the LSTM-NN model includes:

[0008] S1: Collect power grid data within a time period, remove incorrect values and missing values from the collected time series data to obtain processed data;

[0009] The incorrect values are some obvious values far beyond the possible range or values that do not meet the standards;

[0010] S2: Input the processed data into the input layer of the LSTM-NN model to extract the seasonal features of the data;

[0011] S3: Input the processed data and seasonal features into the hidden layer of the LSTM-NN model for multi-source prediction;

[0012] S4: Calculate the anomaly probability AP of the data sequence after multi-source prediction to distinguish normal data from abnormal data.

[0013] Advantages of the present invention:

[0014] 1. The present invention designs a multi-source prediction model that combines LSTM and feature decomposition methods to accurately capture the seasonal features of given time series data.

[0015] 2. To estimate the probability of anomalies in the arriving target sequence, the present invention proposes a metric called sequence inconsistency distance, which can be obtained through parallel computing, thus significantly reducing the detection time and providing an important guarantee for the stability and security of the power grid. Description of the Drawings

[0016] Figure 1 It is a schematic flow framework diagram of a method for detecting anomalies in power grid data streams based on deep learning according to the present invention;

[0017] Figure 2 It is an LSTM structure diagram of a method for detecting anomalies in power grid data streams based on deep learning according to the present invention;

[0018] Figure 3 It is an LSTM network structure diagram of a method for detecting anomalies in power grid data streams based on deep learning according to the present invention. Detailed Embodiments

[0019] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0020] The present invention proposes a method for detecting anomalies in power grid data streams based on deep learning. As shown in Figure 1, the present invention uses data preprocessed by STL decomposition, takes the data and the decomposed seasonal features as the input of the LSTM network, predicts the data at the next time point using the data at a certain time point, thereby obtaining multiple sequence sets, and then calculates the sequence inconsistency distance (SID) to obtain the anomaly probability (AP) of the data, so as to achieve the purpose of anomaly detection.

[0021] Specific steps:

[0022] S1: The data preprocessing module converts the time series data into an appropriate form required by the neural network. First, errors in the data (such as missing values, outliers) are cleared and normalization is performed. Then, the present invention uses the STL (Seasonal and Trend decomposition using Loess) decomposition method to further process the data. STL can decompose a time series data into three parts: trend, season, and residual, and uses LOESS (locally estimated scatterplot smoothing) to extract the smoothed estimates of the three components. The present invention decomposes the seasonal features of the data and uses them as additional inputs to the LSTM for model training.

[0023] S2: Use the processed data for model stacking and training. The input layer of the LSTM-NN model is responsible for receiving the processed data and the seasonal features decomposed by the STL decomposition method. In the hidden layer, the LSTM network is used for outlier detection, and a stacked LSTM network is composed of two layers of LSTM units to avoid gradient explosion or gradient disappearance. At the same time, using a stacked LSTM network can improve the performance of the model in learning complex features. The LSTM model has inherent defects in learning complex seasonal patterns in given multi-season time series data. To solve this problem, the method proposed by the present invention explicitly regards the seasonal features of the input data as the input of the LSTM model through feature decomposition. Extracting and using seasonal features can not only help the LSTM model learn complex seasonal patterns, but also improve the training efficiency and shorten the training time.

[0024] For the LSTM unit, it controls the input, storage, and output of data by introducing a set of gate mechanisms, as Figure 2 shown. The LSTM gate unit receives the output of the LSTM internal unit at the previous time step and the input of the sample at the current time step. However, if the previous layer of the LSTM unit layer is not the input layer, each of its gate units receives both the output of the LSTM internal unit at the current time step of its previous layer and the output of the LSTM internal unit at the previous time step.

[0025] When predicting the data at the next time point, the model needs to use the data at the previous time point as a reference and define the length of this time period as the time step. The input structure of the LSTM model is generally composed of a three-dimensional array: [samples, time step length, features]. The present invention proposes a sliding regression method to construct the input of the LSTM model. That is, for the original time series S = {r1, r2,..., r i ,..., r N}, where N is the length of the time series, r i represents the data at the i-th time point, and the present invention regards it as an n-dimensional vector, where n represents the number of features. Given a sliding window T (set as the time step length), perform sliding regression on the original time series to construct sequence samples as {r1, r2,..., r i ,..., r T}, {r2, r3,..., r i+1 ,..., r T+1}, ······, {r N-T+1 , r N-T+2 ,..., r N-T+i+1 ,..., r N}, where {r1, r2,..., r i ,..., r T} is denoted as the sequence sample that is, the input of the first sample. In this way, the data of the previous T time points can be used to predict the data of the next time point.

[0026] S3: The anomaly detection module designed by the present invention depends on the calculation of two key metrics, namely the sequence inconsistency distance (SID) and the anomaly probability (AP), which will be described below.

[0027] 1. SID metric:

[0028] In the present invention, the following formula is used to calculate the distance between two sequences:

[0029]

[0030] where, RD(r i , r j ) represents the sequence distance of the recorded data at the i-th and j-th moments, r i and r j respectively represent the power grid data recorded at the i-th and j-th moments, n represents the total number of data, r i (1) represents the first item of data recorded at the i-th moment, and RD(r i , r j ) represents the sequence distance of the recorded data at the i-th and j-th moments.

[0031] Meanwhile, the i-th sample sequence can be expressed as:

[0032]

[0033] where T is the time step of the LSTM sliding window.

[0034] To obtain a unified scale for measuring the distance between two sequences, the sequence distance metric should be independent of the sequence length. Therefore, the present invention calculates the distance between the actual recorded value sequence and the predicted recorded value sequence through the weighted sequence distance (WSD):

[0035]

[0036] where represents the weighted distance between sequences and , represents the true value of the sequence, represents the predicted value of the sequence, T represents the time period, m represents a moment within the period T, represents the distance between the true value and the predicted value of the recorded data at the i-m+1 moment, r i-m+1 , respectively represent the actual value and the predicted value at the moment t = i + m - 1, e (T-m) represents the time decay weight. In the definition of the WSD function, the time decay weight e (T-m) is associated with the data at the moment t = i + m - 1 to assign a higher level of reference to the newer data.

[0037] To quantify the deviation between the actual value and the estimated value, the present invention designs a method for calculating the sequence inconsistency distance, and the calculation method is given by the following formula:

[0038]

[0039] where SID(i) represents the sequence inconsistency distance at the i-th moment, L represents the prediction range, k represents the k-th prediction sequence, P(i-k) represents the probability that the record sequence i-k is normal, represents the weighted distance between sequences and , represents the true value of the sequence, represents the predicted value of the sequence.

[0040] Calculating the sequence inconsistency distance can reduce the impact of abnormal records in historical data by weighting the predictions. For example, when setting L = 3, SID(4) at the target 4 can be calculated. As Figure 3As shown, once the actual data r1 arrives, the model predicts the next three data r2, r3, and r4. Similarly, once the record r2 arrives, the model predicts r3, r4, and r5. Similarly, once r3 arrives, the model predicts r4, r5, and r6. A three-step process is performed to calculate the SID(4) of target 4. First, calculate the WSD between the actual sequence up to target 4 and the matching predicted sequence, that is and the distance between, the distance between and and, as well as and and then normalize it by . Subsequently, obtain the SID as the normalized weighted sum of the WSD.

[0041] 2. Abnormality probability:

[0042] Given that the range of the SID metric is application-specific, the objective of the present invention is to map the value of the SID of target i (i) to its abnormality probability AP(i) as follows:

[0043]

[0044] where AP(i) represents the abnormality probability, φ(·) represents the logistic mapping function, C represents the logistic growth rate, C = 1 / σ 2 , σ represents the variance target of the SID of partial targets, SID(i) represents the sequence inconsistency distance at time i, and μ represents the mean of the SID of partial targets. Suitable values for C and μ can be obtained using an iterative algorithm. Over time, the probability of the target becomes more accurate.

[0045] The present invention calculates μ and C based on the mean and standard deviation of the previous SID respectively until the algorithm converges to stable values of μ and C. Mapping the SID to the AP can not only better distinguish normal data from abnormal data, but also enhance the adaptability of the AP value, making it not limited to a specific application. Finally, in order to assign a greater weight to normal records in the calculation of the SID, the present invention substitutes P(i - k) = (1 - AP(i - k)) into Equation (4). Therefore, Equation (4) can be rewritten as follows:

[0046]

[0047] The present invention inputs data over a period of time into the LSTM network to obtain multiple sequence sets, and then calculates the sequence inconsistency distance (SID) to obtain the abnormality probability (AP) of the data, thereby achieving the purpose of anomaly detection.

[0048] Although embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting anomalies in power grid data streams based on deep learning, characterized in that, Including: Construct an LSTM-NN model, and perform anomaly detection after processing the power grid data stream through the LSTM-NN model; The LSTM-NN model includes an input layer and a hidden layer; Performing anomaly detection after processing the power grid data stream through the LSTM-NN model includes: S1: Collect power grid data within a time period, and remove incorrect values and missing values from the collected time series data to obtain processed data; The incorrect values are some values that are obviously far beyond the possible range or do not meet the standards; S2: Input the processed data into the input layer of the LSTM-NN model to extract the seasonal characteristics of the data; S3: Input the processed data and seasonal characteristics into the hidden layer of the LSTM-NN model for multi-source prediction; S4: Calculate the anomaly probability AP of the data sequence after multi-source prediction to distinguish normal data from abnormal data; Calculating the anomaly probability AP of the data sequence after multi-source prediction includes: S41: Calculate the sequence distance of the data sequence after multi-source prediction; S42: Calculate the weighted sequence distance according to the sequence distance; S43: Calculate the sequence inconsistency distance according to the weighted sequence distance; S44: Calculate the anomaly probability AP according to the sequence inconsistency distance; Calculating the sequence distance of the data sequence after multi-source prediction includes: where, RD(r i , r j ) represents the sequence distance of the recorded data at the i-th and j-th moments, r i and r j respectively represent the power grid data recorded at the i-th and j-th moments, n represents the total number of data, represents the l-th data recorded at the i-th moment; Calculating the weighted sequence distance according to the sequence distance includes: Among them, represents the weighted distance between and ; represents the true value of the sequence, represents the predicted value of the sequence, T represents the time period, m represents a moment within the period T, represents the distance between the true value and the predicted value of the recorded data at the i - m + 1 moment, r i-m+1 , respectively represent the actual value and the predicted value at the moment t = i - m + 1, e (T-m) represents the time decay weight;​​ Calculating the sequence inconsistency distance according to the weighted sequence distance includes: Among them, SID(i) represents the sequence inconsistency distance at time i, L represents the prediction range, k represents the k-th prediction sequence, and P(i - k) represents the probability that the recorded sequence i - k is normal. Represents the sequence And The weighted distance between Represents the true value of the k-th prediction sequence, Represents the predicted value of the k-th prediction sequence; Calculating the anomaly probability AP according to the sequence inconsistency distance includes: Among them, AP(i) represents the anomaly probability, φ(·) represents the logical mapping function, C represents the logical growth rate, C = 1 / σ 2 , σ represents the variance target of the SID of some targets, and μ represents the SID mean of some targets.

2. The method for abnormal detection of power grid data stream based on deep learning according to claim 1, characterized in that The input layer uses the STL decomposition method to extract the seasonal characteristics of the data.

3. A method for abnormal detection of power grid data stream based on deep learning according to claim 2, characterized in that, The STL decomposition method includes: Decompose a time series data into three parts: trend, season, and residual, and decompose the seasonal characteristics of the data.

4. A method for detecting anomalies in power grid data streams based on deep learning according to claim 1, characterized in that, The hidden layer uses two layers of LSTM units stacked.

5. A method for detecting anomalies in power grid data streams based on deep learning according to claim 1, characterized in that Inputting the seasonal characteristics into the hidden layer of the LSTM-NN model for multi-source prediction includes: The hidden layer uses two layers of LSTM units stacked to avoid gradient explosion or gradient disappearance and improve the model's ability to learn complex features; Use the input layer to receive the processed data and the seasonal characteristics extracted by the STL decomposition method, and form a record by combining the processed data and its corresponding seasonal characteristics. Each record contains the data within a period of time and the relevant seasonal characteristics; During prediction, provide the last few time points of the known time record sequence, generate a prediction in combination with the corresponding seasonal characteristics, that is, the data of the next time point, add the generated data of the next time point to the new time record sequence, and use it as the input of the LSTM-NN model for further predicting the data of the next time point; repeat this process, that is, iteratively predict to generate new data points, and a new time record sequence can be generated.

Images