Electricity business service risk prevention and control method and system based on time series analysis

Abstract

The present application provides a method and system for preventing and controlling the risk of electric power business services based on time series analysis, which relates to the technical field of big data mining and analysis. The method includes: obtaining a user electric power service data group corresponding to a preset historical time period; determining at least one complaint risk clustering cluster based on user complaint feature clustering analysis; determining the user operation time series data corresponding to each user information according to each complaint risk clustering cluster; screening at least one group of related operation time series data groups according to the operation similarity of the key operation features between different user operation time series data; calculating the minimum time series feature distance based on the dynamic time warping algorithm; screening the abnormal mode time series data set according to the minimum time series feature distance, and determining the target risk prevention and control strategy according to the abnormal mode time series data set. Thus, a personalized prevention and control strategy is formulated according to the time series features of the user operation data to improve the satisfaction of the electric power business service.

Description

Technical Field

[0001] The present application relates to the technical field of big data mining and analysis, and in particular to a method and system for preventing and controlling risks in power business services based on time series analysis. Background Art

[0002] Electricity business services play a key role in modern society, involving multiple aspects such as electricity supply, metering, bill generation, payment, customer service, etc. The quality and efficiency of these services directly affect the operating results of power companies and user satisfaction.

[0003] With the development of society and economic progress, electricity, as an important infrastructure, has an increasing impact on the national economy and social life. The quality of electricity business services is directly related to the user's electricity experience and satisfaction. However, in the process of electricity business services, users complain frequently and for various reasons, often involving multiple aspects, which not only affects the user's electricity experience, but may also cause greater social problems.

[0004] At present, the complaint handling methods adopted by most power operation service companies are still at the passive response stage, lacking the ability to actively predict and prevent, and usually relying on manual processing, which is inefficient and prone to missing important information. In addition, the amount of user data of power companies is huge, and traditional mining and analysis methods are difficult to conduct effective data analysis, and cannot provide valuable or targeted service optimization reference information for the optimization of power business services.

[0005] In response to the above problems, the industry has not yet proposed a better technical solution. Summary of the invention

[0006] The present application provides a method, system, storage medium, computer program product and electronic device for risk prevention and control of power business services based on time series analysis, which are used to at least solve the defects that complaint handling of power business services remains in the passive response stage and that traditional data mining and analysis methods cannot provide targeted service optimization reference information.

[0007] In the first aspect, an embodiment of the present application provides a method for preventing and controlling the risks of electricity business services based on time series analysis, including: obtaining a user electricity service data group corresponding to an adjacent preset historical time period; the user electricity service data group includes multiple user information and corresponding user operation data, and the user operation data includes user complaint records, electricity consumption records, bill payment records and power supply failure records; extracting user complaint features corresponding to the user complaint records in each of the user operation data, and performing cluster analysis on each of the user operation data based on the user complaint features to determine at least one complaint risk clustering cluster; the user complaint features include complaint frequency, complaint type and complaint time; combining the user electricity operation data in each of the complaint risk clustering clusters in chronological order to determine The user operation time series data corresponding to each user information; according to the operation similarity of the corresponding key operation characteristics between different user operation time series data, at least one group of related operation time series data groups is screened; the key operation characteristics include the fluctuation amplitude of user electricity consumption, bill payment behavior characteristics and power supply failure frequency; for each group of the related operation time series data groups, the minimum time series characteristic distance of each user operation time series data in the related operation time series data group with respect to the time series change characteristics is calculated based on the dynamic time warping algorithm; the time series change characteristics include the time series fluctuation amplitude characteristics, the time series delay response characteristics and the time series change rate characteristics; according to the minimum time series characteristic distance, the abnormal pattern time series data set is screened from each related operation time series data group, and the target risk prevention and control strategy is determined according to the abnormal pattern time series data set.

[0008] In the second aspect, an embodiment of the present application provides an electricity business service risk prevention and control system based on time series analysis, including: a data acquisition unit, used to acquire a user electricity service data group corresponding to a preset adjacent historical time period; the user electricity service data group includes multiple user information and corresponding user operation data, and the user operation data includes user complaint records, electricity consumption records, bill payment records and power supply failure records; a complaint feature analysis unit, used to extract user complaint features corresponding to user complaint records in each of the user operation data, and perform cluster analysis on each of the user operation data based on the user complaint features to determine at least one complaint risk cluster cluster; the user complaint features include complaint frequency, complaint type and complaint time; a time series data combination unit, used to combine the user electricity operation data in each of the complaint risk cluster clusters in chronological order to determine the corresponding User operation time series data of each user information; an operation feature analysis unit, used to screen at least one group of related operation time series data groups according to the operation similarity of corresponding key operation features between different user operation time series data; the key operation features include the fluctuation amplitude of user electricity consumption, bill payment behavior features and power supply failure frequency; a time series change analysis unit, used to calculate the minimum time series feature distance of each user operation time series data in the related operation time series data group with respect to the time series change feature based on the dynamic time warping algorithm for each group of the related operation time series data groups; the time series change feature includes the time series fluctuation amplitude feature, the time series delay response feature and the time series change rate feature; a prevention and control strategy determination unit, used to screen the abnormal pattern time series data set from each related operation time series data group according to the minimum time series feature distance, and determine the target risk prevention and control strategy according to the abnormal pattern time series data set.

[0009] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of the method for risk prevention and control of electricity business services based on timing analysis of any embodiment of the present application.

[0010] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program is stored, characterized in that when the program is executed by a processor, the steps of the method for risk prevention and control of electricity business services based on timing analysis of any embodiment of the present application are implemented.

[0011] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the method for risk prevention and control of electricity business services based on timing analysis of any embodiment of the present application.

[0012] The power business service risk prevention and control method based on time series analysis provided by this application can produce at least the following technical effects:

[0013] (1) By clustering and analyzing user operation time series data, power service companies can identify abnormal time series patterns in the operation process and calculate the minimum time series feature distance through the dynamic time warping algorithm. They can accurately identify abnormal data that deviates greatly from normal operation data and formulate target risk prevention and control strategies for these abnormal data, rather than relying solely on user complaint feedback. Through data mining and analysis, they can predict possible service problems in advance and take proactive measures, thereby more effectively dispatching resources and optimizing response strategies, reducing the frequency of user complaints.

[0014] (2) Traditional user data analysis methods are often difficult to cope with massive data. Through this technical solution, we first use user complaint features for cluster analysis to identify the clustering of user operation data for different complaint modes, and then use key operation features for similarity-based screening analysis to obtain abnormal operation behaviors under complaint modes. Through the mining and analysis of multi-dimensional local business features, we can effectively capture the abnormal operation behaviors of power operation service providers under different complaint modes. Furthermore, by analyzing the macroscopic time series change characteristics through the dynamic time warping algorithm, we can more accurately match user data groups with similar time series change characteristics, greatly improving the accuracy of identifying abnormal operation behavior patterns related to complaints, ensuring the pertinence and effectiveness of risk prevention and control strategies, and optimizing service complaints to a large extent.

[0015] Through this technical solution, cluster analysis and dynamic time warping algorithms are used, and the minimum time series feature distance is calculated to accurately screen out user power service data related to specific risk patterns from massive data. Personalized prevention and control strategies can be formulated based on the time series characteristics of user operation data. Power operation service companies can better meet user needs and thus improve overall user satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 A flowchart showing an example of a method for preventing and controlling risks in power business services based on time series analysis according to an embodiment of the present application is shown;

[0018] Figure 2 An operation flow chart of an example of screening an abnormal pattern time series data set according to a minimum time series feature distance according to an embodiment of the present application is shown;

[0019] Figure 3 A schematic diagram of the structural connection of an example of a pattern risk assessment model according to an embodiment of the present application is shown;

[0020] Figure 4 An operation flow chart of an example of determining complaint risk clusters based on user complaint features according to an embodiment of the present application is shown;

[0021] Figure 5 An operation flow chart showing an example of filtering and correlating operation time series data groups according to key operation characteristics according to an embodiment of the present application;

[0022] Figure 6 An operation flow chart of an example of determining an associated operation time series data group based on an enhanced Louvain community detection algorithm according to an embodiment of the present application is shown;

[0023] Figure 7 A structural block diagram of an example of a power business service risk prevention and control system based on time series analysis according to an embodiment of the present application is shown;

[0024] Figure 8 It is a schematic structural diagram of an embodiment of an electronic device of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0027] Figure 1 A flowchart of an example of a method for preventing and controlling risks in power business services based on time series analysis according to an embodiment of the present application is shown.

[0028] Regarding the executor of the method of the embodiment of the present application, it can be any controller or processor with computing or processing capabilities. Through timing analysis, cluster analysis and dynamic time warping algorithm, it effectively improves the risk prevention and control capabilities of electricity business services, data analysis efficiency, initiative and accuracy in handling user complaints, and provides a scientific basis for service optimization, thereby significantly improving user experience and satisfaction.

[0029] In some examples, it can be a complaint risk prevention and control platform, and can be integrated and configured in an electronic device or terminal through software, hardware, or a combination of software and hardware, and the type of terminal or electronic device can be diverse, such as mobile phones, tablet computers, or desktop computers, etc.

[0030] like Figure 1 As shown, in step S110, a user power service data group corresponding to an adjacent preset historical time period is obtained, and the user power service data group includes a plurality of user information and corresponding user operation data.

[0031] Here, the length of the preset historical time period can be defined according to test verification or the needs of the power business service enterprise. For example, the time range of the past month or the first quarter can be selected. Then, the complaint risk prevention and control platform extracts the user power service log within the time period from the database, including each user's basic information (such as user ID, geographic location, etc.) and its corresponding user operation data. The user operation data mainly includes four aspects: user complaint records, electricity consumption records, bill payment records, and power supply failure records. In addition, in order to ensure the integrity and accuracy of the data, data preprocessing methods such as missing value processing and outlier detection can also be used to ensure data quality. In this way, a user power service data group with wide coverage and reasonable time span is obtained, which ensures that the basic data for subsequent analysis has breadth and depth, and provides data support for the comprehensive analysis of abnormal complaint behavior patterns.

[0032] In step S120, user complaint features corresponding to user complaint records in each user operation data are extracted, and cluster analysis is performed on each user operation data based on the user complaint features to determine at least one complaint risk cluster.

[0033] In some embodiments, user complaint features are extracted from the complaint records of each user, and their main features include: complaint frequency (for example, the number of complaints in different time spans), complaint type (such as power outages, billing errors, or customer service quality, etc.), and complaint time (which is used to indicate the specific date and time of the complaint). After the feature extraction is completed, the complaint data of all users are clustered and analyzed by using various unrestricted clustering algorithms, such as the K-means algorithm and the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm, so as to divide the user operation data into different complaint risk patterns, that is, the users in each complaint risk cluster have similar complaint features, such as high-frequency complaint users, users who complain in a specific time period, etc., to identify potential user groups with high complaint risks.

[0034] In step S130, the user power operation data in each complaint risk cluster is combined in chronological order to determine the user operation time series data corresponding to each user information.

[0035] In some embodiments, the user power operation data in each complaint risk cluster is combined according to the time sequence and user information to generate user operation time series data corresponding to each user information. Specifically, for the same complaint risk pattern, the timestamp is matched with various records in the user operation data and arranged in time sequence to form a complete time series data chain to reflect the user's operation behavior dynamics over a period of time. In this way, the user operation time series data covers the temporal continuity and correlation of the user operation data in the complaint risk pattern, and can capture the temporal evolution pattern of user behavior.

[0036] In step S140, at least one group of related operation time series data is screened according to the operation similarities of the corresponding key operation features between different user operation time series data.

[0037] In some embodiments, the associated operation time series data group is screened based on the similarity between the operation time series data of different users in terms of key operation characteristics, and the key operation characteristics include the fluctuation range of user power consumption, bill payment behavior characteristics (such as payment time, payment method, etc.), and power supply failure frequency, etc. Exemplarily, a group of user time series data groups with high similarity in operation characteristics can be screened out by calculating the similarity between these characteristics (such as using cosine similarity, Euclidean distance, etc.), thereby forming an associated operation time series data group. Therefore, in each complaint risk model, identifying user groups with similar operation behaviors is conducive to personalized analysis and management.

[0038] In step S150, for each group of associated operation time series data groups, the minimum time series feature distance of each user operation time series data pair in the associated operation time series data group with respect to the time series change feature is calculated based on the dynamic time warping algorithm.

[0039] In some embodiments, for each group of related operational time series data, the system uses a dynamic time warping (DTW) algorithm to calculate the minimum time series feature distance between each group of time series data, and the time series features include time series fluctuation amplitude features, time series delay response features, and time series change rate features. More specifically, the DTW algorithm can effectively align time series data of different durations, calculate the minimum time series feature distance, and compare the calculated minimum time series feature distance with a preset distance threshold to accurately identify abnormal user behaviors in the time series, and more sensitively capture subtle abnormal changes, thereby reducing false positives and false negatives.

[0040] Specifically, the time series fluctuation amplitude feature can be obtained by analyzing the fluctuation amplitude of data such as user electricity consumption and payment behavior to reflect the stability and volatility of user behavior, and help identify those behavioral patterns that fluctuate greatly within a specific time period. The time series delayed response feature refers to the response speed of user behavior to a specific event or change in conditions. In electricity business services, users may show delayed reactions to certain external events (such as rising electricity prices and policy changes), which helps to identify the user's adaptability to external changes. The time series change rate feature can be obtained by analyzing the rate of change of electricity consumption or payment amount. For example, if a user suddenly increases or decreases electricity consumption within a certain period of time, it may reflect the activation or deactivation of equipment, or a major adjustment in user behavior, thereby revealing mutation points in user behavior.

[0041] In step S160, an abnormal pattern time series data set is screened from each associated operation time series data group according to the minimum time series feature distance, and a target risk prevention and control strategy is determined according to the abnormal pattern time series data set.

[0042] Here, the abnormal pattern time series data set is screened out from the associated operation time series data group according to the minimum time series feature distance. The data set contains the user operation time series data that is significantly different from other user behaviors or has potential risks. Then, according to these abnormal patterns and combined with the risk prevention and control strategy library of the power company, the corresponding target risk prevention and control strategy is determined. The target risk prevention and control strategy can be early warning mechanism optimization, regular service inspection, customer service process optimization or adjustment of resource scheduling plan, etc., to minimize potential user complaints in power business services.

[0043] Figure 2An operational flow chart of an example of screening an abnormal pattern time series data set according to a minimum time series feature distance according to an embodiment of the present application is shown.

[0044] like Figure 2 As shown, in step S210, each calculated minimum time series feature distance is compared with a preset distance threshold.

[0045] It should be noted that in the power service scenario, abnormal user behavior often manifests as slight changes in time series. By calculating the minimum time series feature distance and comparing it with the threshold, these anomalies can be accurately identified to avoid abnormal behavior being discovered only when it develops into a major problem, thereby greatly improving the timeliness of prevention and control.

[0046] In step S220, abnormal user operation time series data pairs are determined according to the user operation time series data pairs corresponding to each first minimum time series feature distance, and the first minimum time series feature distance is the minimum time series feature distance that is less than the distance threshold.

[0047] Here, user operation time series data pairs with close time series feature distances are screened through the minimum time series feature distance, so that the system can accurately aggregate user data with user behavior patterns with potential risks.

[0048] In step S230, an abnormal pattern time series data set is constructed according to each abnormal user operation time series data pair. The abnormal pattern time series data set includes multiple abnormal pattern time series subsets, and each abnormal pattern time series subset has a corresponding abnormal pattern.

[0049] In some implementations, all identified abnormal user operation time series data pairs are integrated to construct a data set containing multiple abnormal patterns. In addition, the classification of abnormal patterns can also be based on specific features (e.g., time series fluctuation amplitude features, time series delay response features, etc.), and an abnormal pattern label can be assigned to each subset, achieving systematic intelligent analysis and management of different types of abnormal behavior patterns, significantly improving the efficiency and accuracy of abnormal detection and analysis.

[0050] Regarding the details of using the abnormal pattern time series data set to determine the target risk prevention and control strategy, in some embodiments, for each abnormal pattern, the abnormal pattern time series subset corresponding to the abnormal pattern is input into the pattern risk assessment model to determine the corresponding abnormal pattern risk level. Then, according to each abnormal pattern risk level, the target risk prevention and control strategy is determined. Therefore, by applying machine learning technology, complex time series data processing and risk management are carried out in the power business service scenario, and the time series abnormal pattern corresponding to each subset is studied, so as to deeply understand the characteristics and manifestations of different abnormal behavior patterns, which can effectively improve the high matching degree of risk prevention and control strategies.

[0051] In some examples of the embodiments of the present application, the pattern risk assessment model adopts a hybrid neural network (HNN).

[0052] Figure 3 A schematic diagram of the structural connection of an example of a pattern risk assessment model according to an embodiment of the present application is shown.

[0053] like Figure 3 As shown, the pattern risk assessment model 300 includes an input layer 310, a convolutional layer 320, a multi-head attention layer 330, a gated recurrent unit layer 340 and an output layer 350.

[0054] The input layer 310 is used to perform data preprocessing on the abnormal pattern time series subset to obtain corresponding standardized input features.

[0055] In some embodiments, the input abnormal pattern time series subset is standardized and normalized to ensure that the data is on the same scale to facilitate unified processing in subsequent model layers.

[0056] The convolution layer 320 is used to extract the local pattern convolution features corresponding to the standardized input features.

[0057] Specifically, the local time series features in the input data are extracted through the convolution layer, and the local patterns in the features are captured, such as the sudden increase in electricity consumption or the abnormal payment behavior. Exemplarily, by applying a one-dimensional convolution kernel to each time series feature channel for convolution, local features are extracted, and multiple feature maps are generated after the convolution operation to reflect the local features of the input data, and nonlinear factors can be introduced using the ReLU activation function.

[0058] Here, by convolving the standardized input features through the convolutional layer, the model can efficiently extract local pattern features in the input data. The convolutional layer is particularly good at identifying short-term drastic changes in abnormal patterns, such as sudden increases in electricity consumption or abnormal jumps in payment behavior. In this way, the model can capture local time series features that may indicate risks.

[0059] The multi-head attention layer 330 is used to perform weighted attention calculation on the local pattern convolution features focusing on key timing points to obtain corresponding attention features.

[0060] Here, by using a multi-head self-attention mechanism, the attention weight of each feature map is calculated, and each attention head works in parallel to focus on different parts of the feature, and obtains the corresponding attention feature through weighted fusion.

[0061] Through this embodiment, the multi-head attention layer performs weighted operations on the extracted local pattern convolution features, which can automatically identify and focus on the most critical timing points for risk prediction. Through the attention mechanism, the model can effectively amplify the impact of these key points and ensure that the key features in the abnormal pattern are fully paid attention to and processed.

[0062] It should be noted that abnormal patterns in electricity business services often involve multiple complex temporal features, which may have subtle correlations and dependencies. Through the combination of convolutional layers and multi-head attention layers, the model can process local features and global key points at the same time, thereby achieving accurate recognition of abnormal patterns.

[0063] The gated recurrent unit layer 340 is used to capture the temporal dependency of the attention features to obtain the corresponding timing dependency features.

[0064] Here, GRU (Gated Recurrent Unit) is used to process attention features, capture temporal dependencies, and retain important timing information. Specifically, GRU can contain update gates, reset gates, memory gates, and output gates. The update gate controls the degree of retention of the previous moment's information at the current moment, allowing the model to memorize long-term temporal dependencies. The reset gate controls the degree of influence of the previous moment's information on the current moment, allowing the model to flexibly handle long-term and short-term dependencies. The memory gate is used to calculate the candidate hidden state at the current moment based on the current input and the information at the previous moment. The output gate is combined with the output of the update gate to obtain the final hidden state at the current moment and pass it to the fully connected layer.

[0065] Through this embodiment, the GRU layer can effectively process and capture the time dependencies in the input features through its gating mechanism, so that the model can not only focus on the key features of the current moment, but also combine the data of the previous and next moments to conduct a comprehensive evaluation and retain the long-term and short-term dependency information, so that the model can better predict future risk trends.

[0066] The output layer 350 is used to perform activation function transformation processing on the time-dependent features to output the corresponding abnormal mode risk level.

[0067] In some embodiments, high-dimensional features are mapped to low-dimensional space, integrated, and nonlinearly transformed using the ReLU activation function to output the final abnormal pattern risk level. In this way, through the activation function transformation processing of the output layer, the model can convert complex time-dependent features into clear risk level outputs.

[0068] Through the embodiments of the present application, the convolutional layer, multi-head attention layer and GRU layer are efficiently combined, so that the model still maintains a high computational efficiency when processing complex time series data. In particular, the lightweight design of the GRU layer relative to the LSTM layer further improves the real-time performance of the model, allowing the model to respond quickly in the actual operating environment and achieve real-time risk level assessment.

[0069] Through the combination of convolutional layers, multi-head attention layers, and GRU layers, the model shows strong adaptability in dealing with diverse abnormal patterns. Whether it is a short-term abnormality caused by sudden events or a trend risk formed by long-term accumulation, the model can accurately capture and evaluate it. The hybrid architecture design also improves the generalization ability of the model, which can significantly improve the ability to identify abnormal patterns and risk assessment in power business services, enabling it to perform well in different power service scenarios.

[0070] Further, in the implementation details of determining the target risk prevention and control strategy based on the root abnormal pattern risk level, in some examples of the embodiments of the present application, each abnormal pattern risk level can be matched based on the risk prevention and control strategy rule base to determine the corresponding target risk prevention and control strategy. Here, the risk prevention and control strategy rule base pre-stores multiple calibrated abnormal pattern levels and corresponding risk prevention and control strategies. In addition, the rule base should be continuously updated based on historical data and expert experience. Further, conditional logic can be applied to generate strategies, such as "if the risk level is high risk and the abnormal pattern involves key equipment, emergency response measures are triggered immediately". In addition, for different risk levels, the prevention and control strategy needs to respond at different levels, and the multi-level response mechanism includes two parts: automated response and manual intervention. Therefore, for low-risk and medium-risk anomalies, the system can automatically execute predetermined prevention and control measures, such as automatically adjusting load distribution, sending reminder notifications, etc. For high-risk anomalies, the system will trigger a manual intervention process, such as dispatching technicians for on-site inspections or remote operations.

[0071] In the process of implementing this application, the model risk assessment model was further optimized to achieve more significant results in the power business service scenario.

[0072] In some examples of the embodiments of the present application, the convolution layer uses a multi-scale deep convolution layer to extract local pattern convolution features of different time windows through a multi-scale convolution kernel. Thus, through the multi-scale convolution layer, it is possible to extract local pattern features at different time scales.

[0073] Accordingly, the multi-head attention layer adopts an adaptive multi-head attention layer and is used to perform the following operations:

[0074] Use multiple attention heads to process the multi-scale local pattern convolution features of the input in parallel, and focus on processing the local pattern convolution features of the corresponding scales respectively:

[0075]

[0076] O i =A i V i , formula (3)

[0077] In the formula, Q i (j),K i (j),V i (j) represent the query matrix, key matrix and value matrix of the i-th attention head corresponding to scale j, respectively. are the query weight matrix, key weight matrix and value weight matrix of the i-th attention head, X(j) represents the local pattern convolution feature of scale j corresponding to the multi-scale local pattern convolution feature; softmax(·) is the Softmax function, A i (j) represents the attention score of the i-th attention head corresponding to scale j; i Represents the output feature representation of the i-th attention head.

[0078] Here, for each attention head, the input feature X is linearly transformed to obtain the query, key, and value matrices. Then, the dot product between the query and the key is calculated and scaled to obtain the attention score matrix. In turn, the value matrix is ​​weighted using the attention score to obtain the output O of each head. i .

[0079] According to the attention score distribution determined by each attention head, the output weights of each attention head are dynamically adjusted:

[0080]

[0081] In the formula, γ i represents the adaptive weight of the i-th attention head, N is the total number of scales, and H is the total number of attention heads.

[0082] Here, in the adaptive multi-head attention layer, the weight of each attention head is dynamically adjusted through a mechanism based on attention distribution, so that the model can adaptively focus on the most important timing points and features in different scenarios. Therefore, by calculating the sum of the attention scores of each attention head at all timing points, and taking its ratio relative to the total attention score of all attention heads as the weight γ i In this way, the more important an attention head is overall, the larger its corresponding weight will be.

[0083] The outputs of each attention head are weighted and fused according to the adaptive weights to generate a comprehensive attention feature:

[0084]

[0085] In the formula, O fused Represents the final generated attention feature.

[0086] Here, the adaptively adjusted weight γ is used i For each head output O i The outputs of each attention head after weight adjustment are weighted and averaged to achieve multi-scale information fusion, ensuring that information at different time scales is effectively retained, so that the outputs of multi-scale attention heads retain their respective advantages after fusion.

[0087] It should be noted that ordinary multi-head attention layers usually use fixed weights or average weights to process multiple attention heads, and cannot be dynamically adjusted according to the specific circumstances of the input data. As a result, when processing complex and changeable time series data, the role of different attention heads may not be fully utilized, resulting in weaker ability to identify abnormal behaviors.

[0088] Through the adaptive weight adjustment mechanism based on attention distribution in this embodiment, the weight of each attention head can be dynamically adjusted according to its importance in the current input data, ensuring that the model can spontaneously focus on the most critical timing points in different scenarios, and can perform adaptive optimization for specific abnormal events (such as short-term emergencies or long-term trend changes) without human intervention, thereby improving the model's ability to respond to various complex timing patterns.

[0089] Figure 4 An operational flowchart of an example of determining complaint risk clusters based on user complaint features according to an embodiment of the present application is shown.

[0090] In some examples of the embodiments of the present application, based on the user complaint characteristics, the enhanced DBSCAN density clustering algorithm is used to perform cluster analysis on each user operation data. More specifically, Figure 4 As shown, in step S410, the weight of each user complaint feature is initialized according to the feature importance.

[0091] First, the weights of user complaint features are initialized. Different weights are dynamically assigned according to the importance of features such as user complaint frequency, complaint type, and complaint time.

[0092]

[0093] In the formula, w q is the weight of the qth feature, X qis the data set of the qth feature, M is the total number of features, Var(X q ) is the variance of the qth feature.

[0094] Here, the variance of each complaint feature is normalized and the feature weight is assigned. The larger the variance, the more obvious the feature changes in the data set and the greater its importance to clustering.

[0095] In step S420, based on the dynamic adjustment mechanism of feature weights, the clustering radius corresponding to each user complaint feature is determined.

[0096] Specifically, different clustering radii are set for different user complaint features. By introducing a dynamic adjustment mechanism based on feature weights, clustering can better adapt to the data distribution of various features:

[0097]

[0098] In the formula, ∈ q represents the clustering radius of the qth feature, ∈0 is the basic radius value; α is the adjustment coefficient, which determines the sensitivity of the feature weight to the radius adjustment; max(w) represents the weight value of the feature with the largest weight among all features.

[0099] By introducing the denominator max(w), each feature weight is standardized so that the ratio in the formula Being between 0 and 1 ensures that the weights of different features are properly normalized when calculating the dynamic radius, thereby avoiding excessive influence of a feature weight that is too large or too small on the clustering result. In addition, by adjusting the value of α, the role of feature weights in clustering can be balanced. For example, in some scenarios, if you want the clustering radii of different features to differ greatly, you can choose a larger α value; otherwise, you can choose a smaller α value.

[0100] Through this embodiment, based on the differentiated importance of different complaint features and using a dynamic radius adjustment mechanism, the importance of different features can be clustered more flexibly, making the clustering results more accurate.

[0101] In step S430, core data points are identified based on whether the number of neighbor points of each data point within the corresponding clustering radius reaches a minimum neighborhood point number threshold.

[0102] Here, the conditions of the core points of each data point are classified by clustering radius.

[0103] core(x p )=|{x q ∣dist(x p ,x q )≤∈q}|≥MinPts, Formula (8)

[0104] In the formula, x p and x q Represents any two data points, dist(x p ,x q ) is the distance measure between two data points, MinPts represents the minimum neighborhood point threshold; core(x p ) represents the data point x p Conditions as core data points.

[0105] Therefore, the core points are screened based on the dynamic radius adjustment mechanism, so that clustering can better reflect the influence of feature weights. Through the dynamic radius adjustment mechanism, the algorithm can more flexibly identify abnormal patterns and noise points when processing high-dimensional and sparse data in power service scenarios, thereby improving the sensitivity of anomaly detection.

[0106] In step S440, for each core data point, the core data point and all data points within the corresponding clustering radius are classified into the same cluster, and the core data point is further expanded for each unlabeled data point until a complete complaint risk cluster is formed.

[0107] In the embodiment of the present application, through the dynamic radius adjustment and feature weight allocation mechanism, high-risk clusters in user complaint data can be more accurately identified, and can be more adaptable to processing high-dimensional and heterogeneous data in power service scenarios. In addition, through the dynamic radius adjustment mechanism, cluster analysis can be effectively performed under different data distributions, so that the algorithm can more sensitively detect sparse abnormal patterns. For example, for abnormal complaint behaviors of a small number of users in a specific time period, the algorithm can capture these abnormal points by dynamically reducing the cluster radius, instead of ignoring them as noise points.

[0108] Figure 5 An operational flow chart of an example of obtaining a group of associated operation time series data based on key operation characteristics according to an embodiment of the present application is shown.

[0109] like Figure 5 As shown, in step S510, a graph structure is constructed based on the time series data of each user operation.

[0110] Here, the graph structure includes multiple graph nodes and edge connections. Each user operation time series data has a unique corresponding graph node. The node characteristics of each graph node are defined by the key operation characteristics in the corresponding user operation time series data; the edge weight of the edge connection is defined by the operation similarity of the key operation characteristics corresponding to the connected graph node.

[0111] Regarding the calculation details of edge weights, in some implementations, the calculation can be performed in combination with the similarity of electricity consumption fluctuation amplitude, the similarity of bill payment behavior characteristics, and the similarity of power supply failure frequency. Regarding the similarity of electricity consumption fluctuation amplitude, the standard deviation of electricity consumption of each user in a specific time period can be calculated, and the Euclidean distance or cosine similarity can be used to measure the similarity of electricity consumption fluctuations between different users. Regarding the similarity of bill payment behavior characteristics, the timeliness of the user's bill payment, the number of overdue times, etc. can be counted, and the Mahalanobis distance or cosine similarity can be used to calculate the similarity of payment behavior between different users. Regarding the similarity of power supply failure frequency, the number of power supply failures experienced by the user in a specific time period can be calculated, and the Euclidean distance or Jaccard similarity can be used to measure the similarity of failure frequencies between users. Furthermore, based on the above similarity calculation results, the weighted sum of the similarities of each feature is used as the edge weight between nodes.

[0112] In step S520, at least one graph node community is identified from the graph structure based on a graph community detection algorithm, and corresponding associated operation time series data groups are determined according to each graph node community.

[0113] Here, through the constructed user operation graph, the graph analysis method of the community detection algorithm is used to identify the interconnected node groups in the graph. The community detection algorithm can use the Louvain algorithm, the Girvan-Newman algorithm, etc. to discover dense subgraphs (communities). In the community detection process, all user nodes are regarded as independent communities, and the modularity is gradually optimized by merging adjacent communities until the modularity no longer increases. For each detected community, the user operation time series data is extracted, and these data are combined together to form a group of related operation time series data.

[0114] It should be noted that the Louvain algorithm is a community detection algorithm based on modularity optimization. It maximizes the modularity of the graph by iteratively merging nodes and optimizing the community structure, thereby identifying dense communities in the graph. The Louvain algorithm can detect community structures at different levels and realize multi-level community structures. The Girvan-Newman algorithm discovers communities by gradually removing edges, which is suitable for revealing hierarchical structures in graphs. Compared with the Girvan-Newman algorithm, the Louvain algorithm has higher computational efficiency and can respond faster to dynamically changing user data needs, making it suitable for large-scale graph data analysis in practical applications.

[0115] In some examples of the embodiments of the present application, the graph community detection algorithm adopts an enhanced Louvain community detection algorithm.

[0116] Figure 6An operational flow chart of an example of determining associated operation time series data groups based on an enhanced Louvain community detection algorithm according to an embodiment of the present application is shown.

[0117] like Figure 6 As shown, in step S610, each graph node in the graph structure is initialized as an independent initial community.

[0118] In step S620, the modularity optimization operation is iteratively performed for each time period until the global modularity cannot be further improved, so as to obtain the initial communities after division.

[0119] It should be noted that in the electricity business service scenario, the user's electricity consumption behavior, bill payment habits, and the frequency of power failures will change over time. Therefore, static community detection methods are difficult to capture these dynamic changes, resulting in the community division results being unable to effectively reflect the temporal nature of user behavior. In order to improve the accuracy and practicality of community detection, in this embodiment, the time dimension is incorporated into the graph structure, and a community detection algorithm that adapts to dynamic changes in time is designed.

[0120] In some implementations, the user's operational data is divided into multiple parts according to time periods, a graph is constructed in each time period, and community detection is performed. For example, the data can be divided into quarterly, monthly, or weekly units, so that each time period corresponds to an independent graph. For the graph in each time period, the enhanced Louvain algorithm is applied to perform community detection to obtain preliminary community division results for each time period.

[0121] Here, the modularity optimization operation is as follows: for each graph node, the graph node is temporarily transferred to the neighbor community corresponding to the neighbor node, and the global modularity of the graph structure is updated according to the edge weights between different communities; if the global modularity remains or decreases, the temporary transfer is canceled; if the global modularity increases, the graph node is permanently moved to the neighbor community.

[0122] In this embodiment, a multi-stage modularity optimization is implemented. In the first stage, for each node, it is temporarily moved to the community where the neighboring node is located, and the change in modularity is calculated. If the modularity increases, the node is permanently moved to the community, and this process is performed for all nodes until the modularity cannot be further improved. In the second stage, each community obtained in the first stage is regarded as a new node, and the edge weights between communities are recalculated. Repeat the operations of the first stage to further optimize the modularity. Repeat the above two stages until the modularity no longer increases significantly. The final community division is the user group with a high operational similarity.

[0123] In step S630, the initial communities whose corresponding similarities in the cross-time periods exceed a preset community similarity threshold are merged to obtain a cross-time period fusion community.

[0124] Through this embodiment, communities that persist or gradually form in different time periods are identified, and these communities are merged to form dynamic communities across time, which helps to identify long-term stable user groups and their behavior patterns.

[0125] In step S640, corresponding associated operation time series data groups are determined according to the graph nodes under each cross-time period fusion community.

[0126] Here, by merging the initial communities with high similarity in different time periods to form a cross-time period fusion community, the community structure can adapt to the long-term trend changes of user behavior, ensuring that the community division is not only applicable to the current period but also maintains long-term stability and continuity.

[0127] By using the time-dynamic community detection method provided by the embodiment of the present application, the communities detected in different time periods are compared to find similar community structures, and similarity metrics (such as Jaccard similarity) are used to measure the similarity between communities. Then, the communities with higher similarity across time periods are merged to form communities across time periods, and the merged communities can reflect the long-term trends and changes in user behavior. Therefore, by introducing time-dynamic characteristics, the Louvain algorithm can more accurately reflect the temporal changes in user behavior during the community detection process. Using time-dynamic community detection, long-term changes and short-term fluctuations in user behavior can be identified, and the sensitivity to changes in user behavior is also enhanced.

[0128] In some examples of the embodiments of the present application, the calculation function for global modularity adopts a time-weighted modularity function. The time weighting factor is introduced into the modularity calculation, so that recent data has a greater weight in community detection, thereby more accurately reflecting the current user behavior pattern.

[0129] More specifically, the time-weighted modularity function is expressed as follows:

[0130]

[0131] In the formula, Q t is the modularity at time t in history, A uv (t) is the edge weight between graph node u and graph node v at time t; k u (t) and k v (t) is the degree of u and v at time t, m t is the sum of the edge weights of all edge connections in the graph structure at time t; δ(c u (t),cv (t)) is the indicator function. When u and v belong to the same community, δ(c u (t),c v (t)) = 1, otherwise 0; is the time weighting factor, where β is the time decay factor and t0 is the current time.

[0132] Here, the time decay factor β can be set according to business needs to ensure that the modularity calculation pays more attention to recent data. It is used to adjust the influence of data from different time periods in the modularity calculation. As time t gets farther away from the current time t0, this factor will gradually decrease, which means that the influence of more distant historical data on the current community division will gradually decrease. In the power business service, this factor makes the algorithm pay more attention to recent user behavior instead of over-relying on past data. Indicator function δ(c u (t),c v (t)) is used to determine whether two nodes are in the same community. If the behavior patterns of two users in a certain period of time are very similar, the community detection algorithm will classify them into the same community, and the indicator function returns 1 in this case.

[0133] Through the embodiment of the present application, a time weighting factor is used so that recent behavior data has a greater influence on community division, thereby ensuring that the detection results can reflect the current user behavior dynamics more timely. In addition, the time-weighted modularity function can not only highlight the importance of recent data, but also identify long-term stable user groups by merging communities in different time periods. The behavior patterns of these groups are relatively consistent and persist in multiple time periods, representing the typical behavior patterns of users, which helps to formulate more accurate service strategies, such as electricity optimization suggestions or payment flexibility plans for different groups.

[0134] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of actions combined, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application. In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0135] Figure 7 A structural block diagram of an example of an electric power business service risk prevention and control system based on time series analysis according to an embodiment of the present application is shown.

[0136] like Figure 7 As shown, the power business service risk prevention and control system 700 based on time series analysis includes a data acquisition unit 710, a complaint feature analysis unit 720, a time series data combination unit 730, an operation feature analysis unit 740, a time series change analysis unit 750 and a prevention and control strategy determination unit 760.

[0137] The data acquisition unit 710 is used to acquire a user power service data group corresponding to a preset adjacent historical time period; the user power service data group includes multiple user information and corresponding user operation data, and the user operation data includes user complaint records, power consumption records, bill payment records and power supply failure records.

[0138] The complaint feature analysis unit 720 is used to extract the user complaint features corresponding to the user complaint records in each of the user operation data, and perform cluster analysis on each of the user operation data based on the user complaint features to determine at least one complaint risk clustering cluster; the user complaint features include complaint frequency, complaint type and complaint time.

[0139] The time series data combination unit 730 is used to combine the user power operation data in each of the complaint risk clusters in chronological order to determine the user operation time series data corresponding to each user information.

[0140] The operation characteristic analysis unit 740 is used to screen at least one group of related operation time series data according to the operation similarity of the corresponding key operation characteristics between different user operation time series data; the key operation characteristics include the fluctuation amplitude of user power consumption, bill payment behavior characteristics and power supply failure frequency.

[0141] The timing change analysis unit 750 is used to calculate the minimum timing feature distance of each user operation timing data pair in the associated operation timing data group regarding the timing change feature based on the dynamic time warping algorithm for each group of the associated operation timing data group; the timing change feature includes the timing fluctuation amplitude feature, the timing delay response feature and the timing change rate feature.

[0142] The prevention and control strategy determination unit 760 is used to filter the abnormal pattern time series data set from each associated operation time series data group according to the minimum time series feature distance, and determine the target risk prevention and control strategy according to the abnormal pattern time series data set.

[0143] In some embodiments, an embodiment of the present application provides a non-volatile computer-readable storage medium, in which one or more programs including execution instructions are stored, and the execution instructions can be read and executed by an electronic device (including but not limited to a computer, a server, or a network device, etc.) to execute the steps of any of the above-mentioned methods for risk prevention and control of electricity business services based on timing analysis in the present application.

[0144] In some embodiments, the embodiments of the present application also provide a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes any step of the above-mentioned electricity business service risk prevention and control method based on timing analysis.

[0145] In some embodiments, the embodiments of the present application also provide an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the steps of the electricity business service risk prevention and control method based on timing analysis.

[0146] Figure 8 is a hardware structure diagram of an electronic device for executing a method for preventing and controlling electric power business service risks based on time series analysis provided by another embodiment of the present application, such as Figure 8 As shown, the device includes:

[0147] One or more processors 810 and memory 820, Figure 8 A processor 810 is taken as an example.

[0148] The device for executing the method for preventing and controlling the risk of electric power business services based on time series analysis may further include: an input device 830 and an output device 840 .

[0149] The processor 810, the memory 820, the input device 830 and the output device 840 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0150] The memory 820, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the method for risk prevention and control of electric power business services based on time series analysis in the embodiment of the present application. The processor 810 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 820, that is, the method for risk prevention and control of electric power business services based on time series analysis in the above method embodiment is realized.

[0151] The memory 820 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 820 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 820 may optionally include a memory remotely arranged relative to the processor 810, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0152] The input device 830 may receive input digital or character information and generate signals related to user settings and function control of the electronic device. The output device 840 may include a display device such as a display screen.

[0153] The one or more modules are stored in the memory 820, and when executed by the one or more processors 810, the power business service risk prevention and control method based on timing analysis in any of the above method embodiments is executed.

[0154] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0155] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to:

[0156] (1) Mobile communication equipment: This type of equipment is characterized by having mobile communication functions and its main purpose is to provide voice and data communications. This type of terminal includes: smart phones, multimedia phones, functional phones, and low-end phones.

[0157] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, etc.

[0158] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players, handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0159] (4) Other onboard electronic devices with data interaction functions, such as on-board devices installed in vehicles.

[0160] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for preventing and controlling risks in power business services based on time series analysis, comprising: Acquire a user power service data group corresponding to an adjacent preset historical time period; The user power service data group includes multiple user information and corresponding user operation data, and the user operation data includes user complaint records, power consumption records, bill payment records and power supply failure records; Extracting user complaint features corresponding to user complaint records in each of the user operation data, and performing cluster analysis on each of the user operation data based on the user complaint features to determine at least one complaint risk cluster; the user complaint features include complaint frequency, complaint type and complaint time; Combining the user power operation data in each of the complaint risk clusters in chronological order to determine the user operation time series data corresponding to each user information; According to the operational similarity of the corresponding key operational characteristics between different user operational time series data, at least one group of related operational time series data is selected; the key operational characteristics include the fluctuation amplitude of user power consumption, bill payment behavior characteristics and power supply failure frequency; For each group of the associated operation time series data groups, the minimum time series feature distance of each user operation time series data pair in the associated operation time series data group with respect to the time series change feature is calculated based on a dynamic time warping algorithm; the time series change feature includes a time series fluctuation amplitude feature, a time series delay response feature, and a time series change rate feature; Screening an abnormal pattern time series data set from each associated operation time series data group according to the minimum time series feature distance, and determining a target risk prevention and control strategy according to the abnormal pattern time series data set; Wherein, determining the target risk prevention and control strategy according to the abnormal pattern time series data set includes: For each of the abnormal patterns, inputting the abnormal pattern time sequence subset corresponding to the abnormal pattern into the pattern risk assessment model to determine the corresponding abnormal pattern risk level; Determine the target risk prevention and control strategy according to the risk level of each abnormal mode; The pattern risk assessment model adopts a hybrid neural network, and the pattern risk assessment model comprises an input layer, a convolutional layer, a multi-head attention layer, a gated recurrent unit layer and an output layer; The input layer is used to perform data preprocessing on the abnormal pattern time series subset to obtain corresponding standardized input features; The convolution layer is used to extract the local pattern convolution feature corresponding to the standardized input feature; The multi-head attention layer is used to perform attention weighted calculation on the local pattern convolutional features focusing on key timing points to obtain corresponding attention features; The gated recurrent unit layer is used to capture the temporal dependency of the attention features to obtain corresponding temporal dependency features; The output layer is used to perform activation function transformation processing on the time-series dependent features to output the corresponding abnormal mode risk level; The convolution layer adopts a multi-scale deep convolution layer, which is used to extract local pattern convolution features of different time windows through multi-scale convolution kernels; The multi-head attention layer uses an adaptive multi-head attention layer to perform the following operations: Use multiple attention heads to process the multi-scale local pattern convolution features of the input in parallel, and focus on processing the local pattern convolution features of the corresponding scales respectively: Q i (j)=X(j)W i Q ,K i (j)=X(j)W i K ,V i (j)=X(j)W i V About i =A i In i In the formula, Q i (j),K i (j),V i (j) represent the query matrix, key matrix and value matrix of the i-th attention head corresponding to scale j, respectively, W i Q ,W i K ,W i V are the query weight matrix, key weight matrix and value weight matrix of the i-th attention head, X(j) represents the local pattern convolution feature of scale j corresponding to the multi-scale local pattern convolution feature; softmax(·) is the Softmax function, A i (j) represents the attention score of the i-th attention head corresponding to scale j; i represents the output feature representation of the i-th attention head; According to the attention score distribution determined by each attention head, the output weights of each attention head are dynamically adjusted: In the formula, γ i represents the adaptive weight of the i-th attention head, N is the total number of scales, and H is the total number of attention heads; The outputs of each attention head are weighted and fused according to the adaptive weights to generate a comprehensive attention feature: In the formula, O fused Represents the final generated attention feature.

2. The method according to claim 1, wherein: The step of screening abnormal pattern time series data sets from each associated operation time series data group according to the minimum time series feature distance includes: Compare each calculated minimum time series feature distance with a preset distance threshold; Determine an abnormal user operation time series data pair according to the user operation time series data pairs corresponding to each first minimum time series feature distance; the first minimum time series feature distance is a minimum time series feature distance that is less than the distance threshold; According to each of the abnormal user operation time series data pairs, an abnormal pattern time series data set is constructed; the abnormal pattern time series data set includes multiple abnormal pattern time series subsets, and each of the abnormal pattern time series subsets has a corresponding abnormal pattern.

3. The method according to claim 1, wherein: Determining a target risk prevention and control strategy according to each of the abnormal mode risk levels includes: Based on the risk prevention and control strategy rule base, each abnormal pattern risk level is matched to determine the corresponding target risk prevention and control strategy; the risk prevention and control strategy rule base pre-stores a plurality of calibrated abnormal pattern levels and corresponding risk prevention and control strategies.

4. The method according to claim 1, wherein: The cluster analysis of each of the user operation data based on the user complaint characteristics to determine at least one complaint risk cluster includes: Based on the user complaint characteristics, an enhanced density clustering algorithm is used to perform cluster analysis on each user operation data, including the following operations: Initialize the weights of each user complaint feature according to feature importance: In the formula, w q is the weight of the qth feature, X q is the data set of the qth feature, M is the total number of features, Var(X q ) is the variance of the qth feature; Based on the dynamic adjustment mechanism of feature weights, the clustering radius corresponding to each user complaint feature is determined: In the formula, ∈ q represents the clustering radius of the qth feature, ∈0 is the basic radius value; α is the adjustment coefficient, which determines the sensitivity of the feature weight to the radius adjustment; max(w) represents the weight value of the feature with the largest weight among all features; The core data points are identified based on whether the number of neighboring points of each data point within the corresponding clustering radius reaches the minimum neighborhood point threshold: core(x p )=|{x q ∣dist(x p ,x q )≤∈ q }|≥MinPts In the formula, x p and x q Represents any two data points, dist(x p ,x q ) is the distance measure between two data points, MinPts represents the minimum neighborhood point threshold; core(x p ) represents the data point x p Conditions as core data points; For each core data point, the core data point and all data points within the corresponding clustering radius are classified into the same cluster, and the core data point is further expanded for each unlabeled data point until a complete complaint risk cluster is formed.

5. The method according to claim 1, wherein: The step of screening at least one group of related operation time series data according to the operation similarities of the key operation features corresponding to different user operation time series data includes: A graph structure is constructed based on each of the user operation time series data; the graph structure includes a plurality of graph nodes and edge connections, each of the user operation time series data has a unique corresponding graph node, and the node feature of each of the graph nodes is defined by the key operation feature in the corresponding user operation time series data; the edge weight of the edge connection is defined by the operation similarity of the key operation feature corresponding to the connected graph node; At least one graph node community is identified from the graph structure based on a graph community detection algorithm, and corresponding associated operation time series data groups are determined according to each of the graph node communities.

6. The method according to claim 5, wherein: The graph community detection algorithm adopts the enhanced Louvain community detection algorithm. The method of identifying at least one graph node community from the graph structure based on the graph community detection algorithm and determining corresponding associated operation time series data groups according to each of the graph node communities includes: Initialize each graph node in the graph structure as an independent initial community; Modularity optimization is performed iteratively for each time period until the global modularity cannot be further improved, so as to obtain the initial communities after division. The modularity optimization operation is as follows: For each graph node, the graph node is temporarily transferred to the neighbor community corresponding to the neighbor node, and the global modularity of the graph structure is updated according to the edge weights between different communities; if the global modularity remains or decreases, the temporary transfer is canceled; if the global modularity increases, the graph node is permanently moved to the neighbor community; The initial communities whose corresponding similarities in the cross-time periods exceed the preset community similarity threshold are merged to obtain the cross-time period fusion community; According to the graph nodes under each of the cross-time period fusion communities, corresponding associated operation time series data groups are determined respectively.

7. The method according to claim 6, wherein: The calculation function for the global modularity adopts a time-weighted modularity function; The time-weighted modularity function is expressed by the following formula: In the formula, Q t is the modularity at time t in history, A uv (t) is the edge weight between graph node u and graph node v at time t; k u (t) and k v (t) is the degree of u and v at time t, m t is the sum of the edge weights of all edge connections in the graph structure at time t; δ(c u (t),c v (t)) is the indicator function. When u and v belong to the same community, δ(c u (t),c v (t)) = 1, otherwise 0; is the time weighting factor, where β is the time decay factor and t0 is the current time.

8. A power business service risk prevention and control system based on time series analysis, used to implement the method as described in any one of claims 1 to 7; The system includes: A data acquisition unit, used to acquire a user power service data group corresponding to a preset adjacent historical time period; the user power service data group includes multiple user information and corresponding user operation data, and the user operation data includes user complaint records, power consumption records, bill payment records, and power supply failure records; A complaint feature analysis unit, used to extract user complaint features corresponding to user complaint records in each of the user operation data, and perform cluster analysis on each of the user operation data based on the user complaint features to determine at least one complaint risk cluster; the user complaint features include complaint frequency, complaint type and complaint time; A time series data combining unit, used for combining the user power operation data in each of the complaint risk clusters in chronological order to determine the user operation time series data corresponding to each user information; An operation characteristic analysis unit, used to select at least one group of related operation time series data according to the operation similarity of the corresponding key operation characteristics between different user operation time series data; the key operation characteristics include the fluctuation amplitude of user power consumption, bill payment behavior characteristics and power supply failure frequency; A time series change analysis unit, for calculating, for each group of the associated operation time series data groups, the minimum time series characteristic distance of each user operation time series data pair in the associated operation time series data group with respect to the time series change characteristic based on a dynamic time warping algorithm; the time series change characteristic comprises a time series fluctuation amplitude characteristic, a time series delay response characteristic and a time series change rate characteristic; A prevention and control strategy determination unit is used to screen an abnormal pattern time series data set from each associated operation time series data group according to the minimum time series feature distance, and determine a target risk prevention and control strategy according to the abnormal pattern time series data set.

Images