Abnormity detection and response system and method for intelligent electric power heterogeneous data fusion

Abstract

The invention belongs to the technical field of artificial intelligence, and particularly relates to an anomaly detection and response system and method for intelligent power heterogeneous data fusion, and the system comprises a historical data and preprocessing module which is used for collecting and preprocessing the historical data of a power grid; the multi-source data feature engineering module is used for carrying out training and anomaly prediction on the data at a certain time interval; the heterogeneous graph network construction module is used for connecting all types of nodes according to the task nodes to construct a heterogeneous graph network; and the heterogeneous graph neural network module is used for performing propagation learning on the heterogeneous graph under the sliding window time by using a heterogeneous graph attention network. According to the method, the abnormal conditions of the power system can be classified quickly and accurately, and corresponding response measures are triggered according to the classification result. The real-time performance and the high accuracy are combined, so that the safety and the stability of the power system can be effectively guaranteed, and the economic loss and the potential safety hazard caused by abnormity are reduced.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an abnormality detection and response system and method for intelligent power heterogeneous data fusion. Background Art

[0002] In the power grid system, there are many heterogeneous data, including system operation data, power grid equipment operation status and monitoring data. These data are designed for specific needs and record different network information. When the power grid is subject to advanced persistent threats, it is difficult to find problems by analyzing logs alone due to the latent and persistent nature of the attacks. By integrating heterogeneous data and using as much data as possible, security threats in the power grid can be discovered as early as possible, so that countermeasures can be taken.

[0003] At present, power anomaly detection technology mainly includes traditional statistical methods, rule-based methods, and machine learning and deep learning-based methods. Anomaly detection based on traditional statistical methods uses data analysis and probability theory tools in statistics to model and analyze power system operation data to identify abnormal patterns. Its advantages are solid theoretical foundation, easy to understand and implement, but it has certain limitations when dealing with complex and changeable power system data, especially when dealing with high-dimensional, nonlinear and multimodal data, the detection effect is not good. Rule-based methods rely on expert knowledge and experience to formulate a series of rules and thresholds to determine whether the power system is abnormal. Its advantages are simple implementation and applicable to some specific and well-structured abnormal situations. However, its disadvantage is that the formulation of rules depends on the subjective judgment of experts, it is difficult to cover all possible abnormal situations, and it shows obvious limitations when facing complex and dynamically changing power systems. With the development of artificial intelligence technology, more and more studies are trying to use machine learning and deep learning technology for power system anomaly detection. This method automatically extracts features and builds models by learning a large amount of historical data to achieve abnormal situation identification. Its advantages are the ability to process complex, high-dimensional and nonlinear power system data and high detection accuracy, but it also has problems such as long model training time and high requirements on data quality.

[0004] Although the existing power anomaly detection technology has made progress to a certain extent, there are still some problems and challenges. The data sources of the power system are diverse, including load data, equipment status data, environmental data, etc. These data have different formats and characteristics. How to effectively fuse the data has become a major problem. The anomaly detection of the power system needs to be real-time in order to detect and handle abnormal situations in a timely manner. Traditional methods often find it difficult to meet real-time requirements when processing large-scale data and complex calculations. The anomaly detection of the power system needs to be highly accurate to avoid missed reports and false alarms. The detection accuracy of existing methods still needs to be improved when facing complex power systems.

[0005] In view of the above problems, an intelligent power heterogeneous data fusion anomaly detection and response system and method are invented. The system uses advanced data fusion technology to effectively integrate heterogeneous data from different sources and build a unified data model, thereby improving data utilization efficiency and information integrity. Combining machine learning and deep learning technology, a high-precision anomaly detection model is established through training of a large amount of historical data, effectively improving the accuracy and reliability of detection. Through time segment detection, the frequency of real-time detection can be reduced while processing real-time data in a timely manner. Summary of the invention

[0006] In view of the above-mentioned and / or existing problems in the anomaly detection and response system and method for heterogeneous data fusion of existing intelligent power, the present invention is proposed.

[0007] Therefore, the purpose of the present invention is to provide an abnormal detection and response system and method for intelligent power heterogeneous data fusion, which can solve the above-mentioned existing problems.

[0008] To solve the above technical problems, according to one aspect of the present invention, the present invention provides the following technical solutions:

[0009] Intelligent power heterogeneous data fusion anomaly detection and response system, which includes:

[0010] A historical data and preprocessing module is used to collect and preprocess the historical data of the power grid;

[0011] Multi-source data feature engineering module, used for training and anomaly prediction of data at certain time intervals;

[0012] A heterogeneous graph network construction module is used to connect all types of nodes according to task nodes to build a heterogeneous graph network;

[0013] Heterogeneous graph neural network module, used to propagate learning on heterogeneous graphs under sliding window time using heterogeneous graph attention network;

[0014] A historical information embedding and fusion module is used to embed and fuse historical information;

[0015] The historical label optimization model is used to detect new data partition windows;

[0016] The abnormal alarm module is used to trigger corresponding alarms and responses according to the abnormal categories predicted by the model;

[0017] The historical data and preprocessing module is connected to the multi-source data feature engineering module, the multi-source data feature engineering module is connected to the heterogeneous graph network construction module, the heterogeneous graph network construction module is connected to the heterogeneous graph neural network module, the heterogeneous graph neural network module is connected to the historical information embedding and fusion module, the historical information embedding and fusion module is connected to the historical label optimization model, and the historical label optimization model is connected to the abnormal alarm module.

[0018] As a preferred solution of the intelligent power heterogeneous data fusion anomaly detection and response system of the present invention, the historical data and preprocessing module includes:

[0019] A multi-source data module is used to collect data from multiple sources of the power system;

[0020] Data preprocessing module, used to clean, normalize and denoise data to ensure data quality;

[0021] The multiple source data module is connected to the data preprocessing module, and the data preprocessing module is connected to the multi-source data feature engineering module.

[0022] The anomaly detection and response method of intelligent power heterogeneous data fusion includes the following specific steps:

[0023] S1: Collect historical data of power grid and preprocess;

[0024] S2: Multi-source data feature engineering;

[0025] S3: Building a heterogeneous graph network;

[0026] S4: Heterogeneous Graph Neural Networks;

[0027] S5: historical information embedding and fusion;

[0028] S6: Optimize the model through historical labels and detect new data partition windows;

[0029] S7: Experts formulate anomaly alert rules to trigger corresponding alerts and responses based on the anomaly categories predicted by the model.

[0030] As a preferred solution of the abnormal detection and response method for intelligent power heterogeneous data fusion described in the present invention, the specific steps of S1 are as follows:

[0031] S11: Collect data from various sources of the power system, including system operation data, load data, and equipment life cycle data;

[0032] S12: Preprocess the data by cleaning, normalizing, and denoising the data to ensure data quality. Use simple statistical methods such as mean, median, and mode to fill in missing values. Normalize numerical features to make all features have the same scale through minimum-maximum normalization. Use wavelet transform to decompose and reconstruct signals for sequence data to remove noise.

[0033] The wavelet transform process for denoising is as follows:

[0034] S121: For a signal f(t), select a wavelet function to transform the signal to obtain coefficients W(a, b);

[0035] S122: Threshold processing is performed on the wavelet coefficients W(a, b), and the hard threshold method is used to remove noise, and the coefficients less than the threshold λ are set to zero to obtain the processed wavelet coefficients W new (a, b);

[0036] S123: Use the processed coefficient W new (a, b) The denoised signal is reconstructed by performing inverse wavelet transform through the wavelet function.

[0037] As a preferred solution of the abnormal detection and response method for intelligent power heterogeneous data fusion described in the present invention, the specific steps of S2 are as follows:

[0038] S21: training and anomaly prediction of data at a certain time interval;

[0039] S22: Use the sliding window method to capture the data in each time period, perform different feature engineering processes for different data types in each time period, and mark the normal or abnormal status category of each time period;

[0040] S23: For the log file in time period t: download a large-scale language model suitable for text feature extraction to the local environment, and call the local large model API interface to extract the log text feature vector x t1 ;

[0041] S24: For sequence data: record its continuous values, normalize them, and construct a feature vector x t2 ;

[0042] S25: For device features: Use feature engineering to mine potential rules and key information, and concatenate and normalize the numerical features to obtain the feature vector x t3 ;

[0043] S26: Construct label Y for each time period t, according to the event records in the historical data, the data of each time period is labeled; if a known abnormal event occurs in a certain time period, it is marked as abnormal, and if no known abnormality occurs, it is marked as normal.

[0044] As a preferred solution of the abnormal detection and response method for intelligent power heterogeneous data fusion described in the present invention, the specific steps of S3 are as follows:

[0045] S31: Construct a feature vector X containing multiple features for each time period t t =[x t1 ,x t2 ,x t3 ] and assign it an abnormal label Y t ;

[0046] S32: Log text nodes, sequence data nodes and device information nodes are set according to the heterogeneous graphs of different types of nodes constructed under different types of sliding window time, and all types of nodes are connected according to the task nodes to build a heterogeneous graph network, and the initial features of the nodes are initialized to X t =[x t1 ,x t2 ,x t3 ]feature.

[0047] As a preferred solution of the abnormal detection and response method for intelligent power heterogeneous data fusion described in the present invention, the specific steps of S4 are as follows:

[0048] S41: Use heterogeneous graph attention network to propagate learning on heterogeneous graphs under sliding window time, and use deep learning torch framework to generate initial embedding x of task nodes t4 , and captures the information of different types of nodes and adjacent nodes through a double-layer attention mechanism. For the v node at time t, the type-level attention mechanism is as follows:

[0049]

[0050] Among them, x tv and x tτ They represent the v-node and τ-node type embeddings at time t respectively; x tτ Represented as x tτ =Σ υ' A υυ' x υ' , that is, the sum of the embeddings of all neighbors of node v under type τ; μ τ represents the attention vector learnable by a neural network of type τ; Indicates μ τTranspose; || represents vector concatenation; σ represents an activation function; Represents all node category types;

[0051] S42: In order to capture the attention mechanism of different nodes under the corresponding node category, the node-level attention mechanism under the corresponding type τ' is as follows:

[0052] b υυ' =σ(v T α τ' [x tυ ||x tυ' ])

[0053]

[0054] υ' represents the neighbors of node type τ'; v represents the learnable attention vector; β υυ' Represents the value after normalizing the attention weight;

[0055] S43: A dual-layer attention mechanism that integrates type-level and node-level attention into heterogeneous graph convolution:

[0056]

[0057] in, Represents the attention weight matrix, whose element in row v and column v' is β υυ' ;node Represents the neighboring nodes through the dual attention mechanism factor and different types of τ Its feature information and transformation matrix Multiply by ;σ represents an activation function;

[0058] S44: After multiple rounds of iterations, the final task node T t We will get an updated embedding vector Among them, L is the number of neural network layers, and its embedding vector contains information from different types of nodes and adjacent nodes, which is used to represent features in different time periods.

[0059] As a preferred solution of the anomaly detection and response method of intelligent power heterogeneous data fusion described in the present invention, the specific steps of S5 are as follows: different task node features are learned for different sliding times Use the Transformer model to capture the overall information of the sequence and optimize the embedding of task nodes, so that the task nodes not only focus on local information, but also on the overall time series information;

[0060] The global attention formula of its Transformer model is as follows:

[0061]

[0062] Q=EW Q ,K=EW K ,V=EW V

[0063] Where E is the The characteristic matrix of Q , W K and W V are all trainable weight parameters; d represents the dimension of a single hyperedge vector of E; the Transformer model globally updates the task node representation X through the attention scores between all time periods task .

[0064] As a preferred solution of the abnormal detection and response method for intelligent power heterogeneous data fusion described in the present invention, the specific steps of S6 are as follows:

[0065] S61: Obtain task node representation X through S4 and S5 task , in order to perform anomaly detection, the task node representation is sent to the softmax layer as follows:

[0066] Z = softmax(X task )

[0067] S62: In order to reduce the overfitting problem of the model, L2 regularization and cross entropy training model are used during the training process, as follows:

[0068]

[0069] Among them, η||Θ||2 represents L2 regularization; C is the number of categories; Y ij It represents the true probability that the sample in the i-th time period belongs to category j; Z ij is the probability that the model predicts that the i-th sample belongs to category j;

[0070] S63: After the same preprocessing, the trained model is loaded into the data of the new time period to perform abnormal category prediction.

[0071] As a preferred solution of the anomaly detection and response method for intelligent power heterogeneous data fusion described in the present invention, the anomaly categories in S7 include slight anomalies, medium anomalies and severe anomalies.

[0072] Compared with existing technologies:

[0073] 1. The present invention performs well in data fusion, using heterogeneous graph construction technology to effectively integrate heterogeneous data from different sources. This not only improves the efficiency of data utilization, but also captures more hidden information, thereby improving the accuracy and comprehensiveness of anomaly detection.

[0074] 2. The present invention adopts a heterogeneous graph attention network, and by introducing an attention mechanism, the model can dynamically pay attention to the importance of different nodes and edges in the graph. This mechanism can process complex power system data more finely and improve the accuracy and robustness of feature extraction.

[0075] 3. The present invention combines the powerful sequence modeling capabilities of the Transformer model. Since the Transformer model has advantages in processing time series data and contextual information, it can better capture the time series characteristics and correlation relationships in the power system data, thereby further enhancing the effect of anomaly detection.

[0076] 4. The present invention can quickly and accurately classify abnormal conditions in the power system and trigger corresponding response measures based on the classification results. This combination of real-time performance and high accuracy enables the present invention to effectively ensure the safety and stability of the power system and reduce economic losses and safety hazards caused by abnormalities. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 It is a schematic diagram of the process of the present invention;

[0078] Figure 2 This is a schematic diagram of the connection between the log text node, sequence data node, device information node and task node of the present invention;

[0079] Figure 3 This is a schematic diagram of the historical label optimization model of the present invention;

[0080] Figure 4 This is a schematic diagram of the prediction state of the historical label optimization model of the present invention. DETAILED DESCRIPTION

[0081] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0082] The present invention provides an abnormal detection and response system for intelligent power heterogeneous data fusion, please refer to Figure 1-Figure 4 ;

[0083] It includes: historical data and preprocessing module, which is used to collect and preprocess the historical data of the power grid; multi-source data feature engineering module, which is used to train and predict anomalies of data at a certain time interval; heterogeneous graph network construction module, which is used to connect all types of nodes according to task nodes to build a heterogeneous graph network; heterogeneous graph neural network module, which is used to use heterogeneous graph attention network to propagate and learn heterogeneous graphs under sliding window time; historical information embedding and fusion module, which is used to embed and fuse historical information; historical label optimization model, which is used to detect new data partition windows; abnormal alarm module, which is used to trigger corresponding alarms and responses for abnormal categories predicted by the model;

[0084] The historical data and preprocessing module is connected to the multi-source data feature engineering module, the multi-source data feature engineering module is connected to the heterogeneous graph network construction module, the heterogeneous graph network construction module is connected to the heterogeneous graph neural network module, the heterogeneous graph neural network module is connected to the historical information embedding and fusion module, the historical information embedding and fusion module is connected to the historical label optimization model, and the historical label optimization model is connected to the abnormal alarm module.

[0085] The historical data and preprocessing module includes: a multi-source data module for collecting data from multiple sources of the power system; a data preprocessing module for cleaning, normalizing, and denoising the data to ensure data quality;

[0086] The multiple source data module is connected to the data preprocessing module, and the data preprocessing module is connected to the multi-source data feature engineering module.

[0087] The anomaly detection and response method of intelligent power heterogeneous data fusion includes the following specific steps:

[0088] S1: Collect historical data of power grid and preprocess;

[0089] Among them: The specific steps of S1 are as follows:

[0090] S11: Collect data from multiple sources of the power system, including system operation data, load data, and equipment life cycle data; System operation data: Obtain real-time and historical operation status data of power grid equipment, which may include parameters such as voltage, current, and power; Load data: Record the changes in power consumption and load over time in the power grid, which helps to understand the power demand pattern in different time periods; Equipment life cycle data: Record the entire life cycle information of power grid equipment from installation to retirement, including equipment model, installation date, maintenance records, and replacement time, etc. Its log data: There are firewall logs, intrusion detection system logs, and logs generated by business systems, etc.;

[0091] S12: Preprocess the data by cleaning, normalizing, and denoising the data to ensure data quality. Use simple statistical methods such as mean, median, and mode to fill in missing values. Normalize numerical features to make all features have the same scale through minimum-maximum normalization. Use wavelet transform to decompose and reconstruct signals for sequence data to remove noise.

[0092] The wavelet transform denoising process is as follows:

[0093] S121: For a signal f(t), a wavelet function (such as Daubechies function) is selected to transform the signal to obtain coefficients W(a, b);

[0094] S122: Threshold processing is performed on the wavelet coefficients W(a, b), and the hard threshold method is used to remove noise, and the coefficients less than the threshold λ are set to zero to obtain the processed wavelet coefficients W new (a, b);

[0095] S123: Use the processed coefficient W new (a, b) Perform inverse wavelet transform through wavelet function to reconstruct the denoised signal;

[0096] S2: Multi-source data feature engineering;

[0097] Among them: The specific steps of S2 are as follows:

[0098] S21: training and anomaly prediction of data at a certain time interval;

[0099] S22: Use the sliding window method to capture the data in each time period, perform different feature engineering processes for different data types in each time period, and mark the normal or abnormal status category of each time period;

[0100] S23: For the log file in time period t: download a large-scale language model suitable for text feature extraction (such as LLaMA 3) to the local environment, and call the local large model API interface to extract the log text feature vector x t1 ;

[0101] S24: For sequence data (such as power consumption data, load data): record its continuous values, normalize them, and construct a feature vector x t2 ;

[0102] S25: For equipment features: Use feature engineering to mine potential rules and key information (such as computing equipment usage time, maintenance interval, failure frequency, etc.), and concatenate and normalize the numerical features to obtain the feature vector x t3 ;

[0103] S26: Construct label Y for each time period t , according to the event records in the historical data (such as equipment failure records, abnormal power consumption reports, etc.), the data of each time period is labeled; if a known abnormal event occurs in a certain time period, it is marked as abnormal, and if no known abnormality occurs, it is marked as normal;

[0104] S3: Building a heterogeneous graph network;

[0105] Among them: The specific steps of S3 are as follows:

[0106] S31: Construct a feature vector X containing multiple features for each time period t t =[x t1 ,x t2 ,x t3 ] and assign it an abnormal label Y t ;

[0107] S32: Log text nodes, sequence data nodes and device information nodes are set according to the heterogeneous graphs of different types of nodes constructed under different types of sliding window time, and all types of nodes are connected according to the task nodes to build a heterogeneous graph network, and the initial features of the nodes are initialized to X t =[x t1 ,x t2 ,x t3 ] features; heterogeneous graphs represent networks with different types of nodes and relationship graphs. In addition, log text nodes (Log Text Nodes, L): represent text features extracted from log files; sequence data nodes (Sequence Data Nodes, S): represent time series data, such as power consumption data and load data; equipment information nodes (Equipment Info Nodes, E): represent characteristic information of equipment, such as usage time, maintenance interval, etc.; task nodes (Task Nodes, T): are used to connect the other three types of nodes and represent the comprehensive features within a specific time period; in addition, nodes of different colors represent the heterogeneity of nodes, and edges of different colors represent the heterogeneity of relationships between nodes;

[0108] S4: Heterogeneous Graph Neural Networks;

[0109] Among them: The specific steps of S4 are as follows:

[0110] S41: Use heterogeneous graph attention network to propagate learning on heterogeneous graphs under sliding window time, and use deep learning torch framework to generate initial embedding x of task nodes t4 , and captures the information of different types of nodes and adjacent nodes through a double-layer attention mechanism. For the v node at time t, the type-level attention mechanism is as follows:

[0111]

[0112] Among them, x tv and x tτ They represent the v-node and τ-node type embeddings at time t respectively; x tτ Represented as x tτ =Σ υ' A υυ' x υ' , that is, the sum of the embeddings of all neighbors of node v under type τ; μ τ represents the attention vector learnable by a neural network of type τ; Indicates μ τ Transpose; || represents vector concatenation; σ represents an activation function (such as LeakyReLU activation function); Represents all node category types;

[0113] S42: In order to capture the attention mechanism of different nodes under the corresponding node category, the node-level attention mechanism under the corresponding type τ' is as follows:

[0114] b υυ' =σ(v T α τ' [x tv ||x tυ' ])

[0115]

[0116] υ' represents the neighbors of node type τ'; v represents the learnable attention vector; β υυ' Represents the value after normalizing the attention weight;

[0117] S43: A dual-layer attention mechanism that integrates type-level and node-level attention into heterogeneous graph convolution:

[0118]

[0119] in, Represents the attention weight matrix, whose element in row v and column v' is β υυ' ;node Represents the neighboring nodes through the dual attention mechanism factor and different types of τ Its feature information and transformation matrix Multiply by ;σ represents an activation function;

[0120] S44: After multiple rounds of iterations, the final task node T t We will get an updated embedding vector Where L is the number of neural network layers, and its embedding vector contains information from different types of nodes and adjacent nodes, which is used to represent features in different time periods;

[0121] S5: historical information embedding and fusion;

[0122] Among them: The specific steps of S5 are as follows: Learn different task node features for different sliding times Use the Transformer model to capture the overall information of the sequence and optimize the embedding of task nodes, so that the task nodes not only focus on local information, but also on the overall time series information;

[0123] The global attention formula of its Transformer model is as follows:

[0124]

[0125] Q=EW Q ,K=EW K ,V=EW V

[0126] Where E is the The characteristic matrix of Q , W K and W V are all trainable weight parameters; d represents the dimension of a single hyperedge vector of E; the Transformer model globally updates the task node representation X through the attention scores between all time periods task ;

[0127] S6: Optimize the model through historical labels and detect new data partition windows;

[0128] Among them: The specific steps of S6 are as follows:

[0129] S61: Obtain task node representation X through S4 and S5 task , in order to perform anomaly detection, the task node representation is sent to the softmax layer as follows:

[0130] Z = softmax(X task )

[0131] S62: In order to reduce the overfitting problem of the model, L2 regularization and cross entropy training model are used during the training process, as follows:

[0132]

[0133] Among them, η||Θ||2 represents L2 regularization; C is the number of categories; Y ij It represents the true probability that the sample in the i-th time period belongs to category j; Zij is the probability that the model predicts that the i-th sample belongs to category j;

[0134] S63: After the same preprocessing, the trained model is loaded into the data of the new time period to perform abnormal category prediction;

[0135] S7: Experts formulate anomaly alarm rules to trigger corresponding alarms and responses based on the anomaly categories predicted by the model;

[0136] Among them: the abnormality categories in S7 include minor abnormalities, moderate abnormalities and severe abnormalities; minor abnormalities: send an alarm to the monitoring center and recommend inspection; moderate abnormalities: trigger automatic scheduling and adjust power load distribution; severe abnormalities: emergency alarm, trigger equipment protection mechanism, and notify maintenance personnel to check immediately.

[0137] Based on the above, the present invention proposes an innovative solution, namely, an anomaly detection and response system and method for intelligent power heterogeneous data fusion, which aims to solve the problems of data heterogeneity, lack of accuracy and real-time performance in power data anomaly detection. The present invention collects real-time data of the power system from multiple sources, including load data, equipment status data and environmental data. The collected real-time data is processed in segments to generate a heterogeneous graph. A heterogeneous graph is a graph structure built based on different types of data, which is used to represent the relationship and interaction between various data sources. Task node features are extracted by training a heterogeneous graph attention network. The attention mechanism can effectively focus on the importance of different nodes and edges in the graph, and improve the accuracy and robustness of feature extraction. On this basis, the extracted task node features are further processed in combination with the Transformer model. The Transformer model, with its powerful sequence modeling capability, can better capture the time series and context information in the data and enhance the effect of anomaly detection. Finally, the system classifies the task node features as abnormalities and triggers the corresponding response mechanism according to the classification results. In this way, real-time and accurate detection and response to abnormal situations in the power system can be achieved, and the safety and stability of the power system can be improved.

[0138] Although the present invention has been described above with reference to the embodiments, various modifications may be made thereto and parts thereof may be replaced by equivalents without departing from the scope of the present invention. In particular, as long as there is no structural conflict, the various features in the embodiments disclosed in the present invention may be used in combination with each other in any manner, and the fact that these combinations are not exhaustively described in this specification is only for the sake of omitting space and saving resources. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. Intelligent power heterogeneous data fusion anomaly detection and response system, characterized by: include: A historical data and preprocessing module is used to collect and preprocess the historical data of the power grid; Multi-source data feature engineering module, used for training and anomaly prediction of data at certain time intervals; Construct a heterogeneous graph network module, which is used to connect all types of nodes according to task nodes to build a heterogeneous graph network; Heterogeneous graph neural network module, used to propagate learning on heterogeneous graphs under sliding window time using heterogeneous graph attention network; A historical information embedding and fusion module is used to embed and fuse historical information; The historical label optimization model is used to detect new data partition windows; The abnormal alarm module is used to trigger corresponding alarms and responses according to the abnormal categories predicted by the model; The historical data and preprocessing module is connected to the multi-source data feature engineering module, the multi-source data feature engineering module is connected to the heterogeneous graph network construction module, the heterogeneous graph network construction module is connected to the heterogeneous graph neural network module, the heterogeneous graph neural network module is connected to the historical information embedding and fusion module, the historical information embedding and fusion module is connected to the historical label optimization model, and the historical label optimization model is connected to the abnormal alarm module.

2. The intelligent power heterogeneous data fusion anomaly detection and response system according to claim 1 is characterized in that: The historical data and preprocessing module include: A multi-source data module is used to collect data from multiple sources of the power system; Data preprocessing module, used to clean, normalize and denoise data to ensure data quality; The multiple source data module is connected to the data preprocessing module, and the data preprocessing module is connected to the multi-source data feature engineering module.

3. Anomaly detection and response method for intelligent power heterogeneous data fusion, characterized in that: The specific steps are as follows: S1: Collect historical data of power grid and preprocess; S2: Multi-source data feature engineering; S3: Building a heterogeneous graph network; S4: Heterogeneous Graph Neural Networks; S5: historical information embedding and fusion; S6: Optimize the model through historical labels and detect new data partition windows; S7: Experts formulate anomaly alert rules to trigger corresponding alerts and responses based on the anomaly categories predicted by the model.

4. The abnormality detection and response method for intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The specific steps of S1 are as follows: S11: Collect data from various sources of the power system, including system operation data, load data, and equipment life cycle data; S12: Preprocess the data by cleaning, normalizing, and denoising the data to ensure data quality. Use simple statistical methods such as mean, median, and mode to fill in missing values. Normalize numerical features to make all features have the same scale through minimum-maximum normalization. Use wavelet transform to decompose and reconstruct signals for sequence data to remove noise. The wavelet transform process for denoising is as follows: S121: For a signal f(t), select a wavelet function to transform the signal to obtain coefficients W(a, b); S122: Threshold processing is performed on the wavelet coefficients W(a, b), and the hard threshold method is used to remove noise, and the coefficients less than the threshold λ are set to zero to obtain the processed wavelet coefficients W new (a, b); S123: Use the processed coefficient W new (a, b) The denoised signal is reconstructed by performing inverse wavelet transform through the wavelet function.

5. The abnormality detection and response method for intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The specific steps of S2 are as follows: S21: training and anomaly prediction of data at a certain time interval; S22: Use the sliding window method to capture the data in each time period, perform different feature engineering processes for different data types in each time period, and mark the normal or abnormal status category of each time period; S23: For the log file in time period t: download a large-scale language model suitable for text feature extraction to the local environment, and call the local large model API interface to extract the log text feature vector x t1 ; S24: For sequence data: record its continuous values ​​for normalization and construct a feature vector x t2 ; S25: For device features: Use feature engineering to mine potential rules and key information, and concatenate and normalize the numerical features to obtain the feature vector x t3 ; S26: Construct label Y for each time period t , according to the event records in the historical data, the data of each time period is labeled; if a known abnormal event occurs in a certain time period, it is marked as abnormal, and if no known abnormality occurs, it is marked as normal.

6. The abnormality detection and response method for intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The specific steps of S3 are as follows: S31: Construct a feature vector X containing multiple features for each time period t t =[x t1 ,x t2 ,x t3 ] and assign it an abnormal label Y t ; S32: Log text nodes, sequence data nodes and device information nodes are set according to the heterogeneous graphs of different types of nodes constructed under different types of sliding window time, and all types of nodes are connected according to the task nodes to build a heterogeneous graph network, and the initial features of the nodes are initialized to X t =[x t1 ,x t2 ,x t3 ]feature.

7. The abnormality detection and response method for intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The specific steps of S4 are as follows: S41: Use heterogeneous graph attention network to propagate learning on heterogeneous graphs under sliding window time, and use deep learning torch framework to generate initial embedding x of task nodes t4 , and captures the information of different types of nodes and adjacent nodes through a double-layer attention mechanism. For the v node at time t, the type-level attention mechanism is as follows: Among them, x tv and x tτ They represent the v-node and τ-node type embeddings at time t respectively; x tτ Represented as x tτ =∑ υ' A υυ' x υ' , that is, the sum of the embeddings of all neighbors of node v under type τ; μ τ represents the attention vector learnable by a neural network of type τ; Indicates μ τ Transpose; || represents vector concatenation; σ represents an activation function; Represents all node category types; S42: In order to capture the attention mechanism of different nodes under the corresponding node category, the node-level attention mechanism under the corresponding type τ' is as follows: b υυ' =σ(v T ·a τ' [x] tυ ||x tυ' ]) υ' represents the neighbors of node type τ'; v represents the learnable attention vector; β vv' Represents the value after normalizing the attention weight; S43: A dual-layer attention mechanism that integrates type-level and node-level attention into heterogeneous graph convolution: in, Represents the attention weight matrix, whose element in row v and column v' is β vv' ;node Represents the neighboring nodes through the dual attention mechanism factor and different types of τ Its characteristic information and transformation matrix Multiply by ;σ represents an activation function; S44: After multiple rounds of iterations, the final task node T t We will get an updated embedding vector Among them, L is the number of neural network layers, and its embedding vector contains information from different types of nodes and adjacent nodes, which is used to represent features in different time periods.

8. The abnormality detection and response method for intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The specific steps of S5 are as follows: different task node features are learned for different sliding times Use the Transformer model to capture the overall information of the sequence and optimize the embedding of task nodes, so that the task nodes not only focus on local information, but also on the overall time series information; The global attention formula of its Transformer model is as follows: Q=EW Q ,K=EW K ,V=EW V Where E is the The characteristic matrix of Q , W K and W V are all trainable weight parameters; d represents the dimension of a single hyperedge vector of E; the Transformer model globally updates the task node representation X through the attention scores between all time periods task .

9. The abnormality detection and response method for intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The specific steps of S6 are as follows: S61: Obtain task node representation X through S4 and S5 task , in order to perform anomaly detection, the task node representation is sent to the softmax layer as follows: Z=softmax(X task ) S62: In order to reduce the overfitting problem of the model, L2 regularization and cross entropy training model are used during the training process, as follows: Among them, η||Θ||2 represents L2 regularization; C is the number of categories; Y ij It represents the true probability that the sample in the i-th time period belongs to category j; Z ij is the probability that the model predicts that the i-th sample belongs to category j; S63: After the same preprocessing, the trained model is loaded into the data of the new time period to perform abnormal category prediction.

10. The method for abnormal detection and response of intelligent power heterogeneous data fusion according to claim 3 is characterized in that: The abnormality categories in S7 include slight abnormality, moderate abnormality and severe abnormality.

Images