Characteristic and time correlation-based energy storage power station acquisition anomaly detection method

Abstract

The invention provides a characteristic and time correlation-based energy storage power station acquisition anomaly detection method, which comprises the following steps of: (1) firstly, counting and preprocessing multi-path acquired flow information, and carrying out data standardization processing; (2) carrying out feature extraction on the information in the step (1) by using one-dimensional convolution, calculating feature correlation, calculating time correlation, and obtaining internal correlation features of the multi-path acquisition information; (3) splicing the output matrix, the feature correlation matrix and the time correlation matrix of the one-dimensional convolutional layer in the step (2), inputting the spliced matrix into a GRU layer, and carrying out network feature integration; (4) respectively inputting the output of the GRU layer into an LSTM prediction model and a VAE reconstruction model for data generation; and (5) carrying out anomaly discrimination through an anomaly detection discrimination module. The invention provides an energy storage power station acquisition anomaly detection method based on feature and time correlation, which combines a feature and time correlation extraction technology and detects and recognizes anomaly based on a predicted and reconstructed model.

Description

Technical Field

[0001] The present invention belongs to the technical field of abnormality detection of communication data collection, and in particular relates to an abnormality detection method for energy storage power station collection based on features and time correlation. Background Art

[0002] Energy storage power stations are composed of independent energy storage units, each of which includes an energy storage management system and a converter system. A common 200MW / 400MWh electrochemical energy storage power station will have about 80-100 energy storage units, and the collection involved will be as many as 200-300 communication links. At present, the analysis and detection of collection anomalies is often simply identified through empirical information, without combining data to calculate feature dependency and time dependency, resulting in insufficient anomaly recognition rate, single applicable scenario, and poor recognition accuracy. Therefore, this patent proposes a multivariate time series anomaly detection method that combines features and time dependencies, calculates feature correlation and time correlation, comprehensively captures the connection between data, and combines prediction-based models and reconstruction-based models, comprehensively utilizes prediction models and reconstruction models in deep learning technology, and improves the accuracy and robustness of anomaly detection by optimizing the joint objective function. Summary of the invention

[0003] The present invention provides a method for detecting anomalies in energy storage power station data acquisition based on features and time correlation, which combines feature extraction and time correlation extraction technologies, and detects and identifies anomalies through prediction-based and reconstruction-based models.

[0004] The present invention is specifically a method for detecting abnormality in energy storage power station acquisition based on features and time correlation, and the method for detecting abnormality in energy storage power station acquisition includes the following steps:

[0005] Step (1): First, statistics and preprocessing of multi-channel collected traffic information are performed, and data normalization is performed;

[0006] Step (2): Use one-dimensional convolution to extract features from the information in step (1), calculate feature correlation, calculate time correlation, and obtain intrinsic correlation features of multi-channel collected information;

[0007] Step (3): concatenate the output matrix of the one-dimensional convolutional layer in step (2), the feature correlation matrix, and the time correlation matrix, and input them into the GRU layer for network feature integration;

[0008] Step (4): Input the output of the GRU layer into the LSTM prediction model and the VAE reconstruction model for data generation;

[0009] Step (5): Perform abnormality identification through the abnormality detection and identification module.

[0010] The specific method of feature extraction in step (2) is:

[0011] One-dimensional convolution is used to extract high-level features from each time series input; through the convolution operation, local patterns and features in the time series can be captured, effectively reducing noise and redundant information.

[0012] The output of the convolutional layer is subjected to feature correlation extraction and time correlation extraction. Feature correlation extraction is mainly to capture the relationship between different features, while time correlation extraction is to capture the change pattern of the same feature at different time points.

[0013] The specific method for calculating the feature correlation is as follows:

[0014] Suppose there is a set of multivariate time series data with a total of n timestamps (m 1 , m 2 , ..., m n ), where m i is the data of the i-th timestamp, which is a k-dimensional vector; each timestamp has k different features, and the features are recorded as (f 1 , f 2 , ..., f k ), where f i is the data of the i-th feature at each timestamp, which is an n-dimensional vector;

[0015] For a feature, based on the data of the feature at all timestamps, it is regarded as an n-dimensional vector and the relationship between the features is calculated:

[0016]

[0017] Among them, σ(·) represents the Sigmoid activation function, h i，feature is the calculated correlation between the i-th feature and the remaining features, and is related to f j The dimensions are the same; α ij is the attention score of the j-th feature to the i-th feature, representing the correlation between them, and is calculated as follows:

[0018]

[0019] in, is the concatenation operation of two features, w is a learnable parameter, LeakyReLU(·) is a nonlinear activation function, and finally each h i，feature After transposition, it is also concatenated into an n*k feature correlation matrix H feature .

[0020] The specific method for calculating the time correlation of n*k is as follows:

[0021] There are k multivariate time series data with characteristic sequences (l 1 , l 2 ,…,l k ), where l i is the data of the ith feature, which is an n-dimensional vector; each feature has n timestamps, recorded as (t 1 , t 2 ,…,t n ), where t i is the data of each feature at the i-th timestamp, which is a k-dimensional vector;

[0022] Similarly, calculate the correlation between time features:

[0023]

[0024] Where σ(·) represents the Sigmoid activation function, h i，time is the calculated correlation between the i-th time and the other timestamps, and is related to t j The dimensions are the same; β ij is the attention score of the jth time to the ith time, indicating the temporal correlation, and is calculated as follows:

[0025]

[0026] in, is the concatenation operation of two features, w is a learnable parameter, and LeakyReLU(·) is a nonlinear activation function.

[0027] Each h i，time Splice into an n*k time correlation matrix H time ;

[0028] In step (3), the output matrix of the one-dimensional convolutional layer in step (2), the feature correlation matrix, and the time correlation matrix are concatenated and input into the GRU layer to perform network feature integration. The specific method is:

[0029] The output matrix from the one-dimensional convolutional layer, the feature correlation matrix H feature and the time correlation matrix H time concatenate them and input them into a Gated Recurrent Unit (GRU) layer with a hidden dimension of d1; the GRU layer is used to capture sequential patterns in time series;

[0030] The specific GRU network is: for the concatenated input x t , construct a reset gate and an update gate, where the reset gate determines the new input information x t and the previous memory information h t-1The update gate selects the hidden information h that is passed to memory and forgetfulness. t .

[0031] In step (4), the specific method of inputting the output of the GRU layer into the LSTM prediction model and the VAE reconstruction model to generate data is:

[0032] The output of the GRU layer is input into the LSTM prediction model and the VAE reconstruction model respectively. The prediction model selects the classic long short-term memory network (Long Short-term Memory, LSTM), and the reconstruction model selects the variational auto encoder (Variational Auto Encoder, VAE) network to train and learn the model. By combining prediction and reconstruction, the robustness and accuracy of anomaly detection are improved. When training the model, a joint optimization method is adopted, and the loss function is defined as the sum of two optimization objectives, namely:

[0033] LOSS=Loss predict +Loss reconstruction

[0034] Among them, Loss predict The RMSE is used to calculate the difference between the predicted value and the true value. reconstruction As the loss function of the reconstruction-based model, the reconstruction model adopts a variational autoencoder, which provides a probabilistic way to describe the observations in the latent space, aiming to learn the marginal distribution of data on the latent representation. By treating the values ​​of the time series as variables, the VAE reconstruction model can capture the data distribution of the entire time series.

[0035] The specific method of performing abnormality identification by the abnormality detection and identification module in step (5) is as follows:

[0036] (51) Result reasoning:

[0037] For the joint optimization goal, there are also two inference results for each timestamp. One is the predicted value calculated by the prediction-based model. The other is the reconstruction probability obtained by the reconstruction-based model The final inference score balances their advantages to maximize the overall effect of anomaly detection. Each feature calculates an inference score, and the sum of all features is taken as the final inference score, recorded as the anomaly score:

[0038]

[0039] in is the square error between the predicted value and the true value, 1-p iis the probability of encountering anomalies in feature i according to the reconstruction model, k is the total number of features, and γ is a hyperparameter that combines the prediction error and the reconstruction probability. The value of γ is determined by grid search on the validation set.

[0040] (52)Optimal threshold selection:

[0041] Use the brute force search method to determine the optimal threshold for the anomaly score. By searching different thresholds on the validation set, the threshold that maximizes the F1-score is selected as the optimal threshold to ensure that normal and abnormal data can be accurately distinguished in practical applications.

[0042] in,

[0043] Precision is the accuracy rate and Recall is the recall rate.

[0044] (53) Anomaly Detection:

[0045] Anomaly detection is performed based on the calculated anomaly score and the optimal threshold. When the anomaly score of a timestamp exceeds the optimal threshold, the timestamp is marked as anomaly, otherwise it is marked as normal. In this way, anomaly detection of multivariate time series can be achieved.

[0046] Compared with the prior art, the beneficial effects are as follows: the energy storage power station acquisition anomaly detection method comprehensively utilizes the prediction model and reconstruction model in deep learning technology, and improves the accuracy and robustness of anomaly detection by optimizing the joint objective function. The specific effects are as follows:

[0047] 1) High-precision anomaly detection:

[0048] The present invention effectively captures local patterns, feature correlations, and temporal correlations in time series data by combining one-dimensional convolutional layers, feature and temporal correlation layers, and GRU layers. Experimental results show that the average anomaly detection F1-Score on the field simulation dataset reaches 0.93, which is better than other existing methods.

[0049] 2) Enhanced robustness:

[0050] By fusing prediction-based and reconstruction-based models, the present invention improves the robustness to the randomness and noise of time series data. The prediction model can accurately predict the value of future timestamps, while the reconstruction model effectively captures the data distribution through variational autoencoders, enhancing the stability of the system.

[0051] 3) Broad application prospects:

[0052] This method is not only applicable to anomaly detection in multi-channel acquisition scenarios of energy storage power stations, but can also be extended to other fields, such as financial risk monitoring, network security detection and health monitoring. By adjusting the model structure and parameters, the needs of different application scenarios can be met. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to the present invention;

[0054] Figure 2 This is a diagram showing the results of an embodiment of the energy storage power station acquisition anomaly detection method using the present invention. DETAILED DESCRIPTION

[0055] The following is a detailed description of a specific implementation of a method for detecting abnormal energy storage power station data acquisition based on features and time correlation according to the present invention in conjunction with the accompanying drawings.

[0056] like Figure 1 As shown, the energy storage power station acquisition anomaly detection method of the present invention comprises the following steps:

[0057] Step (1): First, statistics and preprocessing of multi-channel collected traffic information are performed, and data normalization is performed;

[0058] Step (2): Use one-dimensional convolution to extract features from the information in step (1), calculate feature correlation, calculate time correlation, and obtain intrinsic correlation features of multi-channel collected information;

[0059] Step (3): concatenate the output matrix of the one-dimensional convolutional layer in step (2), the feature correlation matrix, and the time correlation matrix, and input them into the GRU layer for network feature integration;

[0060] Step (4): Input the output of the GRU layer into the LSTM prediction model and the VAE reconstruction model for data generation;

[0061] Step (5): Perform abnormality identification through the abnormality detection and identification module.

[0062] The specific method of feature extraction in step (2) is:

[0063] One-dimensional convolution is used to extract high-level features from each time series input; through the convolution operation, local patterns and features in the time series can be captured, effectively reducing noise and redundant information.

[0064] The output of the convolutional layer is subjected to feature correlation extraction and time correlation extraction. Feature correlation extraction is mainly to capture the relationship between different features, while time correlation extraction is to capture the change pattern of the same feature at different time points.

[0065] The specific method for calculating the feature correlation is as follows:

[0066] Suppose there is a set of multivariate time series data with a total of n timestamps (m 1 , m 2 , ..., m n ), where m i is the data of the i-th timestamp, which is a k-dimensional vector; each timestamp has k different features, and the features are recorded as (f 1 , f 2 , ..., f k ), where f i is the data of the i-th feature at each timestamp, which is an n-dimensional vector;

[0067] For a feature, based on the data of the feature at all timestamps, it is regarded as an n-dimensional vector and the relationship between the features is calculated:

[0068]

[0069] Where σ(·) represents the Sigmoid activation function, h i，feature is the calculated correlation between the i-th feature and the remaining features, and is related to f j The dimensions are the same; α ij is the attention score of the j-th feature to the i-th feature, representing the correlation between them, and is calculated as follows:

[0070]

[0071] in, is the concatenation operation of two features, w is a learnable parameter, LeakyReLU(·) is a nonlinear activation function, and finally each h i，feature After transposition, it is also concatenated into an n*k feature correlation matrix H feature .

[0072] The specific method for calculating the time correlation of n*k is as follows:

[0073] There are k multivariate time series data with characteristic sequences (l 1 , l 2 ,…,l k ), where l i is the data of the ith feature, which is an n-dimensional vector; each feature has n timestamps, recorded as (t 1 , t 2 ,…,t n ), where t i is the data of each feature at the i-th timestamp, which is a k-dimensional vector;

[0074] Similarly, calculate the correlation between time features:

[0075]

[0076] Where σ(·) represents the Sigmoid activation function, h i，time is the calculated correlation between the i-th time and the other timestamps, and is related to t j The dimensions are the same; β ij is the attention score of the jth time to the ith time, indicating the temporal correlation, and is calculated as follows:

[0077]

[0078] in, is the concatenation operation of two features, w is a learnable parameter, and LeakyReLU(·) is a nonlinear activation function.

[0079] Each h i，time Splice into an n*k time correlation matrix H time ;

[0080] In step (3), the output matrix, feature correlation matrix, and time correlation matrix of the one-dimensional convolutional layer in step (2) are concatenated and input into the GRU layer. The specific method for network feature integration is:

[0081] The output matrix from the one-dimensional convolutional layer, the feature correlation matrix H feature and the time correlation matrix H time concatenate them and input them into a Gated Recurrent Unit (GRU) layer with a hidden dimension of d1; the GRU layer is used to capture sequential patterns in time series;

[0082] The specific GRU network is: for the concatenated input x t , construct a reset gate and an update gate, where the reset gate determines the new input information x t and the previous memory information h t-1 The update gate selects the hidden information h that is passed to memory and forgetfulness. t .

[0083] In step (4), the specific method of inputting the output of the GRU layer into the LSTM prediction model and the VAE reconstruction model to generate data is:

[0084] The output of the GRU layer is input into the LSTM prediction model and the VAE reconstruction model respectively. The prediction model selects the classic long short-term memory network (Long Short-term Memory, LSTM), and the reconstruction model selects the variational auto encoder (Variational Auto Encoder, VAE) network to train and learn the model. By combining prediction and reconstruction, the robustness and accuracy of anomaly detection are improved. When training the model, a joint optimization method is adopted, and the loss function is defined as the sum of two optimization objectives, namely:

[0085] LOSS=Loss predict +Loss reconstruction

[0086] Among them, Loss predict The RMSE is used to calculate the difference between the predicted value and the true value. reconstruction As the loss function of the reconstruction-based model, the reconstruction model adopts a variational autoencoder, which provides a probabilistic way to describe observations in the latent space, aiming to learn the marginal distribution of data on the latent representation. By treating the values ​​of the time series as variables, the VAE reconstruction model is able to capture the data distribution of the entire time series.

[0087] The specific method of performing abnormality identification by the abnormality detection and identification module in step (5) is as follows:

[0088] (51) Result reasoning:

[0089] For the joint optimization goal, there are also two inference results for each timestamp. One is the predicted value calculated by the prediction-based model. The other is the reconstruction probability obtained by the reconstruction-based model The final inference score balances their advantages to maximize the overall effect of anomaly detection. Each feature calculates an inference score, and the sum of all features is taken as the final inference score, recorded as the anomaly score:

[0090]

[0091] in is the square error between the predicted value and the true value, 1-p i is the probability of encountering anomalies in feature i according to the reconstruction model, k is the total number of features, and γ is a hyperparameter that combines the prediction error and the reconstruction probability. The value of γ is determined by grid search on the validation set.

[0092] (52)Optimal threshold selection:

[0093] Use the brute force search method to determine the optimal threshold for the anomaly score. By searching different thresholds on the validation set, the threshold that maximizes the F1-score is selected as the optimal threshold to ensure that normal and abnormal data can be accurately distinguished in practical applications.

[0094] in,

[0095] Precision is the accuracy rate and Recall is the recall rate.

[0096] (53) Anomaly Detection:

[0097] Anomaly detection is performed based on the calculated anomaly score and the optimal threshold. When the anomaly score of a timestamp exceeds the optimal threshold, the timestamp is marked as anomaly, otherwise it is marked as normal. In this way, anomaly detection of multivariate time series can be achieved.

[0098] like Figure 2 As shown in the figure, they represent the actual fault value and the discrimination value given by the prediction network and the reconstruction network respectively, and the dotted shadow part is the abnormal acquisition interval.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit the present invention. A person skilled in the art should understand that the specific implementation of the present invention can be modified or replaced by equivalents, but these modifications or changes are within the scope of protection of the pending claims.

Claims

1. A method for detecting abnormal data collection in an energy storage power station based on features and time correlation, characterized in that: The energy storage power station acquisition anomaly detection method comprises the following steps: Step (1): Perform statistics and preprocessing of traffic information collected from multiple channels, and perform data normalization processing; Step (2): Use one-dimensional convolution to extract features from the information in step (1), calculate feature correlation, calculate time correlation, and obtain intrinsic correlation features of multi-channel collected information; Step (3): concatenate the output matrix of the one-dimensional convolutional layer in step (2), the feature correlation matrix, and the time correlation matrix, and input them into the GRU layer for network feature integration; Step (4): Input the output of the GRU layer into the LSTM prediction model and the VAE reconstruction model for data generation; Step (5): Perform abnormality identification through the abnormality detection and identification module.

2. The method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to claim 1 is characterized in that: The specific method of feature extraction in step (2) is: use one-dimensional convolution to extract high-level features from each time series input; through the convolution operation, the local patterns and features in the time series are captured, effectively reducing noise and redundant information.

3. The method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to claim 2 is characterized in that: The specific method for calculating the feature correlation in step (2) is as follows: Assume that there is a set of multivariate time series data with n timestamps (m1, m2, ..., m n ), where m i is the data of the i-th timestamp, which is a k-dimensional vector; each timestamp has k different features, and the features are recorded as (f1, f2, ..., f k ), where f i is the data of the i-th feature at each timestamp, which is an n-dimensional vector; For a feature, based on the data of the feature at all timestamps, it is regarded as an n-dimensional vector and the relationship between the features is calculated: Among them, σ(·) represents the Sigmoid activation function, h i，feature is the calculated correlation between the i-th feature and the remaining features, and is related to f j The dimensions are the same; α ij is the attention score of the j-th feature to the i-th feature, representing the correlation between them, and is calculated as follows: in, is the concatenation operation of two features, w is a learnable parameter, Leaky ReLU(·) is a nonlinear activation function, and finally each h i，feature After transposition, it is also concatenated into an n*k feature correlation matrix H feature .

4. The method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to claim 3 is characterized in that: The specific method for calculating the time correlation of n*k in step (2) is as follows: Multivariate time series data with k feature sequences (l1,l2,···,l k ), where l i is the data of the ith feature, which is an n-dimensional vector; each feature has n timestamps, recorded as (t1, t2, ···, t n ), where t i is the data of each feature at the i-th timestamp, which is a k-dimensional vector; Compute the correlation between temporal features: Among them, σ(·) represents the Sigmoid activation function, h i,time is the calculated correlation between the i-th time and the other timestamps, and is related to t j The dimensions are the same; β ij is the attention score of the jth time to the ith time, indicating the temporal correlation, and is calculated as follows: in, is the concatenation operation of two features, w is a learnable parameter, and LeakyReLU(·) is a nonlinear activation function; Each h i,time Splice into an n*k time correlation matrix H time .

5. The method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to claim 4 is characterized in that: In step (3), the output matrix of the one-dimensional convolutional layer in step (2), the feature correlation matrix, and the time correlation matrix are concatenated and input into the GRU layer. The specific method for network feature integration is: The output matrix from the one-dimensional convolutional layer, the feature correlation matrix H feature and the time correlation matrix H time concatenate them and input them into a Gated Recurrent Unit (GRU) layer with a hidden dimension of d1; the GRU layer is used to capture sequential patterns in time series; The specific GRU network is: for the concatenated input x t , construct a reset gate and an update gate, where the reset gate determines the new input information x t and the previous memory information h t-1 The update gate selects the hidden information h that is passed to memory and forgetfulness. t .

6. The method for detecting abnormality of energy storage power station data acquisition based on features and time correlation according to claim 5 is characterized in that: In step (4), the specific method of inputting the output of the GRU layer into the LSTM prediction model and the VAE reconstruction model to generate data is: The output of the GRU layer is input into the LSTM prediction model and the VAE reconstruction model respectively to train the model, thereby improving the robustness and accuracy of anomaly detection by combining prediction and reconstruction; When training the model, a joint optimization method is used, and the loss function is defined as the sum of two optimization objectives, namely: LOSS=Loss predict +Loss reconstruction Among them, Loss predict The loss function of the model based on prediction uses RMSE to calculate the difference between the predicted value and the true value; Loss reconstruction The reconstruction model adopts a variational autoencoder, which provides a probabilistic way to describe the observations in the latent space, aiming to learn the marginal distribution of data on the latent representation; by treating the values ​​of the time series as variables, the VAE reconstruction model can capture the data distribution of the entire time series.

7. The method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to claim 6 is characterized in that: The specific method of performing anomaly discrimination by the anomaly detection and discrimination module in step (5) is: performing anomaly detection based on the calculated anomaly score and the optimal threshold. When the anomaly score of a timestamp exceeds the optimal threshold, the timestamp is marked as abnormal, otherwise it is marked as normal.

8. The method for detecting abnormality of energy storage power station acquisition based on features and time correlation according to claim 7 is characterized in that: The calculation method of the anomaly score is: For the joint optimization goal, there are also two inference results for each timestamp: one is the predicted value calculated by the prediction-based model The other is the reconstruction probability obtained by the reconstruction-based model An inference score is calculated for each feature, and the sum of all features is taken as the final inference score, denoted as the anomaly score: in is the square error between the predicted value and the true value, 1-p i is the probability of encountering anomalies in feature i according to the reconstruction model, k is the total number of features, and γ is a hyperparameter that combines the prediction error and the reconstruction probability. The value of γ is determined by grid search on the validation set.

9. A method for detecting abnormal data collection in an energy storage power station based on features and time correlation according to claim 8, characterized in that: The optimal threshold is calculated as follows: Use brute force search to determine the optimal threshold of the anomaly score; by searching different thresholds on the validation set, select the threshold that maximizes the F1-score as the optimal threshold to ensure that normal and abnormal data can be accurately distinguished in practical applications; in, Precision is the accuracy rate and Recall is the recall rate.

Images