Federal learning-based power grid abnormal behavior identification method and device

Abstract

The invention discloses a federated learning-based power grid abnormal behavior identification method and device. The method is characterized by comprising the following steps: acquiring to-be-identified power grid multi-dimensional behavior information, and performing Grubrum matrix conversion on the power grid multi-dimensional behavior information to obtain at least one Grubrum behavior matrix; pixel conversion is carried out on matrix elements of the Gramer behavior matrix, and a Gramer behavior image corresponding to the Gramer behavior matrix is determined; and carrying out abnormal behavior identification on the Gramer behavior image through a pre-trained abnormal behavior model, and determining a power grid abnormal behavior corresponding to the power grid multi-dimensional behavior information. According to the method, entity behavior detection is carried out on entities in a power grid network, abnormal behaviors can be screened and warned, possible malicious entities can be found out in time, the reliability and stability of a power grid space are greatly guaranteed, and ordered operation of the society is promoted.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid network security, and in particular to a method and device for identifying abnormal behavior of a power grid based on federated learning. Background Art

[0002] With the informatization gap of the power system and the deployment of the information industry, there are risks such as external entity network attack penetration and internal entity theft in the intranet of the power grid system network. The traditional power grid security risk control system, which mainly focuses on network security boundary protection and, to a certain extent, defaults to trusting users, equipment and applications in the system, can no longer fully meet the security protection requirements of the power system after informatization. Therefore, in order to prevent abnormal entities in the system from causing power system problems and further affecting social production and life, it is urgent to establish a behavior detection mechanism for entities in the power system to fundamentally detect the existence of malicious behavior, thereby reducing the impact of abnormal behavior on the power system.

[0003] Currently, there are several methods for abnormal behavior detection. The first type of method is distance-based, using the distance to the nearest neighbor or cluster in the data to assess whether the data is abnormal. Such methods rely on appropriate distance metrics. Another method is a single-class classification method trained on normal data, such as a single-class SVM (Support Vector Machine) is also widely used. These methods learn classification boundaries around normal data. The third type of method uses the fidelity of reconstruction to determine whether a sample is abnormal. Principal component analysis and its variants are examples of such methods. Another type of method is based on deep neural networks, which reconstruct normal data and identify anomalies as samples with high reconstruction errors.

[0004] However, the existing technology still has some problems and shortcomings. First, the behavior information of entities in the power system contains a large amount of multi-dimensional data, and it is often time-series information, which may make it impossible to carry out simple classification and distance measurement. Secondly, in the power system, analyzing the abnormal behavior of entities often requires collecting data from various business platforms. Compared with the traditional single-party neural network training process, it requires joint training by multiple parties. The training efficiency is low, and the accuracy of the trained neural network model is low. Summary of the invention

[0005] The present invention provides a method and device for identifying abnormal behavior of a power grid based on federated learning, so as to solve the technical problem in the prior art that the power system cannot identify abnormal behavior of entities in the cyberspace.

[0006] According to one aspect of the present invention, a method for identifying abnormal behavior of a power grid based on federated learning is provided, comprising:

[0007] Acquiring multidimensional behavior information of a power grid to be identified, and performing Gram matrix conversion on the multidimensional behavior information of the power grid to obtain at least one Gram behavior matrix;

[0008] Performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix;

[0009] Abnormal behavior recognition is performed on the Gram behavior image using a pre-trained abnormal behavior model to determine abnormal behaviors of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0010] According to another aspect of the present invention, a device for identifying abnormal behavior of a power grid based on federated learning is provided, comprising:

[0011] A data processing module, used for acquiring multi-dimensional behavior information of a power grid to be identified, and performing Gram matrix conversion on the multi-dimensional behavior information of the power grid to obtain at least one Gram behavior matrix;

[0012] An image conversion module, used for performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix;

[0013] The abnormality recognition module is used to perform abnormal behavior recognition on the Gram behavior image through a pre-trained abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0014] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for identifying abnormal behavior of a power grid based on federated learning as described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for identifying abnormal behavior of a power grid based on federated learning as described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention obtains multi-dimensional behavior information of the power grid to be identified, performs Gram matrix conversion on the multi-dimensional behavior information of the power grid, obtains at least one Gram matrix, and converts the multi-dimensional behavior information into a Gram matrix, which can capture the correlation between the behavior information of each dimension, effectively express the interaction between the behavior features, and improve the accuracy of abnormal behavior identification; the matrix elements of the Gram behavior matrix are pixel-converted to determine the Gram behavior image corresponding to the Gram matrix, and the relationship between the features can be more intuitively displayed through the Gram image, which provides a basis for neural network training and identification, and improves the efficiency and accuracy of abnormal behavior identification; the Gram behavior image is used to identify abnormal behavior through a pre-trained abnormal behavior model, and the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid is determined. The abnormal behavior model can accurately identify complex behavior time series data, solve the technical problem that the power system in the prior art cannot identify the abnormal behavior of entities in the network space, realize the entity behavior detection of entities in the power grid network, can screen abnormal behaviors and warn, and timely detect possible malicious entities, so that the reliability and stability of the power network space are greatly guaranteed, and the orderly operation of society is promoted.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a method for identifying abnormal behavior of a power grid based on federated learning is provided for an embodiment of the present invention;

[0023] Figure 2 A flowchart of another method for identifying abnormal behavior of a power grid based on federated learning provided in an embodiment of the present invention;

[0024] Figure 3 A flowchart of another method for identifying abnormal behavior of a power grid based on federated learning provided in an embodiment of the present invention;

[0025] Figure 4 A schematic diagram of the structure of a device for identifying abnormal behavior of a power grid based on federated learning provided in an embodiment of the present invention;

[0026] Figure 5 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Figure 1 The present invention provides a flowchart of a method for identifying abnormal behavior of a power grid based on federated learning. This embodiment is applicable to the case of identifying abnormal behavior information of each entity in a power grid system. The method can be executed by a device for identifying abnormal behavior of a power grid based on federated learning. The device for identifying abnormal behavior of a power grid based on federated learning can be implemented in the form of hardware and / or software. The device for identifying abnormal behavior of a power grid based on federated learning can be configured in an electronic device. Figure 1 As shown, the method includes:

[0030] S110 , obtaining multi-dimensional behavior information of a power grid to be identified, performing Gram matrix conversion on the multi-dimensional behavior information of the power grid, and obtaining at least one Gram behavior matrix.

[0031] Among them, the multi-dimensional behavior information of the power grid can be information related to each entity in the power system. Exemplarily, the entity can be the equipment monitoring information of the power equipment in the power system, or the account information of the power grid staff with the account as the main body in the power system, or the security log information with the log as the theme in the log management system of the power system, or the personal information of the authenticated or authorized subject in the authentication and authorization system of the power system. Taking the personnel account information as an example, the entity can be a power grid account, the attribute is the account number, and the attribute value is xxxxxxxx; the attribute is the account name, and the attribute value is Zhang San; the attribute is the address, and the attribute value is No. XX, XXX Street, XXX District, XXX City; the relationship is belonging, and the corresponding subject is the power company; the relationship is associated, and the subject of the association is the meter.

[0032] The Gram behavior matrix may be a Gram matrix constructed from one dimension of data in the multi-dimensional behavior information of the power grid.

[0033] Optionally, a method of performing Gram matrix conversion on the multi-dimensional behavior information of the power grid is as follows: by constructing a corresponding behavior sequence from the multi-dimensional behavior information of the power grid, by obtaining the data values ​​corresponding to two different times in the time sequence for any dimension of each data in the behavior sequence, and using the inner product of the data values ​​as the matrix element of the Gram matrix of that dimension, and then performing corresponding calculation conversion on each data in the behavior sequence to obtain the Gram behavior matrix corresponding to each dimension.

[0034] Optionally, in another optional embodiment of the present invention, Gram matrix conversion is performed on the multi-dimensional behavior information of the power grid to obtain at least one Gram behavior matrix, including:

[0035] Classify the multi-dimensional behavior information of the power grid and determine the attribute data and relationship data of the power grid entities;

[0036] Clustering the power grid entity relationship data based on a preset abnormal behavior category table to determine the power grid abnormal label data;

[0037] A Gram matrix conversion is performed according to the power grid abnormality label data and the power grid entity attribute data to obtain at least one Gram behavior matrix.

[0038] Among them, the power grid entity attribute data can be data of the data type entity-attribute-attribute value; the power grid entity relationship data can be data of the data type entity-relationship-entity. It should be noted that in the power grid entity attribute data, the entity has attributes, and the data corresponding to the attributes are attribute values. In the power grid entity relationship data, the entity has relationships, and the object associated with the relationship is another entity.

[0039] Optionally, the multi-dimensional behavior information of the power grid is classified, and the data category is split for each entity, the entity-attribute-attribute value data is divided into power grid entity attribute data, and the entity-relationship-entity data is divided into power grid entity relationship data.

[0040] Among them, the abnormal behavior category table can be a table that sets the behavior categories for abnormal behavior detection and the number of categories corresponding to the behavior categories based on the statistical results after the abnormal behaviors are counted in advance. It should be noted that before detecting abnormal behaviors, the abnormal behaviors in the power system are counted, and then based on the statistical results, the behavior categories for detection are selected, and each behavior category is classified to obtain the classification category of each behavior category, and an abnormal behavior category table is constructed based on the behavior categories and the classification categories corresponding to the behavior categories.

[0041] The abnormal label data of the power grid may be the power grid entity relationship data with abnormal labels. Optionally, the classification category of each behavior type is used as the cluster center to cluster the power grid entity relationship data to obtain the corresponding clustering results, and the classification category corresponding to the clustering results is used as the abnormal label to label the power grid entity relationship data in each cluster to obtain the abnormal label data of the power grid.

[0042] Specifically, by distinguishing the data types of the multi-dimensional behavior information of the power grid, the entity-attribute-attribute value data is divided into the power grid entity attribute data, and the entity-relationship-entity data is divided into the power grid entity relationship data. The power grid entity relationship data is clustered through a pre-set abnormal behavior category table, and the power grid abnormal label data is converted into a Gram matrix according to the power grid abnormal label data and the power grid entity attribute data to obtain at least one Gram behavior matrix.

[0043] Optionally, in another optional embodiment of the present invention, clustering the power grid entity relationship data based on a preset abnormal behavior category table to determine the power grid abnormal label data includes:

[0044] Determine the initial cluster center according to the abnormal behavior category table;

[0045] Clustering the power grid entity relationship data according to the initial cluster center, determining at least one abnormal behavior cluster and a cluster label corresponding to the abnormal behavior cluster;

[0046] The labels of the power grid entity relationship data are updated according to the cluster labels and abnormal behavior clusters to determine the abnormal label data of the power grid.

[0047] The initial cluster center may be the classification category of each behavior type in the abnormal behavior type table. It should be noted that, during clustering, the initial cluster center needs to be set in advance, and the classification category of each behavior type in the abnormal behavior type table is used as the initial cluster center.

[0048] Among them, the abnormal behavior clustering cluster can be a data group composed of power grid entity relationship data similar to each initial clustering center in the power grid entity relationship data; in the abnormal behavior clustering cluster, the similarity of each power grid entity relationship data is high, and between different abnormal behavior clustering clusters, the similarity of power grid entity relationship data belonging to different abnormal behavior clustering clusters is low.

[0049] The clustering label may be a classification category corresponding to the abnormal behavior cluster.

[0050] Optionally, the classification category of the abnormal behavior type table is used as the initial clustering center of clustering, and the power grid entity relationship data is clustered based on the initial clustering center to obtain the abnormal behavior clustering clusters corresponding to each initial clustering center. After clustering the power grid entity relationship data, each abnormal behavior clustering cluster is obtained, and the classification category corresponding to the initial clustering center of each abnormal behavior clustering cluster is used as the clustering label, and then the clustering label of the abnormal behavior clustering cluster is set for the power grid entity relationship data in the abnormal behavior clustering cluster to obtain power grid abnormal label data.

[0051] For example, K-Means clustering is selected to cluster the power grid entity relationship data, and N i The classification categories are used as the initial cluster centers c j ; Set each power grid entity data to x, and calculate the corresponding relationship data x of each power grid entity and each initial cluster center c j The specific calculation formula is as follows:

[0052]

[0053] According to each power grid entity relationship data x and each initial clustering center c j The distance dis(x) is assigned to each power grid entity relationship data x, and N i Abnormal behavior clusters are clustered and the cluster center c is updated j ; Set the cluster center c j The number of power grid entity relationship data x included in is n j , set the number of updates to i,x i is the i-th power grid entity relationship data x, and the specific formula is as follows:

[0054]

[0055] Repeat the above clustering process for each power grid entity relationship data x until the power grid entity relationship data is clustered and abnormal behavior clusters are obtained. The initial clustering center c of each abnormal behavior cluster is jAs the clustering label, the clustering label of the abnormal behavior clustering cluster is set for the power grid entity relationship data in the abnormal behavior clustering cluster to obtain the power grid abnormal label data. Each power grid abnormal label data can be represented by l k K represents the number of behavior categories corresponding to the abnormal power grid label data, and the number of behavior categories is obtained by summing the number of classification categories corresponding to each behavior type.

[0056] Optionally, in another optional embodiment of the present invention, a Gram matrix conversion is performed according to the power grid abnormality label data and the power grid entity attribute data to obtain at least one Gram behavior matrix, including:

[0057] An entity behavior sequence corresponding to the multi-dimensional behavior information of the power grid is constructed according to the abnormal label data of the power grid and the attribute data of the power grid entity; wherein the entity behavior sequence includes at least one entity behavior record; the entity behavior records in the entity behavior sequence are polar-encoded to obtain a polar coordinate sequence corresponding to the entity behavior sequence; a Gram matrix is ​​constructed for each dimension based on the polar coordinate sequence to determine at least one Gram behavior matrix.

[0058] Among them, the entity behavior sequence can be a data sequence composed of entity attribute values ​​of the power grid entity attribute data at each time node and power grid abnormal label data within a preset time window; it should be noted that the entity attribute extraction is performed on each power grid entity attribute data corresponding to each time node to obtain the entity attribute values ​​corresponding to all power grid entity attribute data, the entity attribute values ​​and the power grid abnormal label data are combined into an entity behavior record, and the entity behavior records of all time nodes are combined into an entity behavior sequence. Optionally, the preset time window can be a pre-selected sampling period, and the time node can be an actual sampling point in the time sampling period.

[0059] The polar coordinate sequence may be a data sequence composed of polar coordinate records. Optionally, when polar coordinate encoding is performed on the entity behavior sequence, the entity behavior records in the entity behavior sequence are first normalized, the entity attribute values ​​and power grid abnormality label data in the entity behavior record are between [0,1], and the normalized entity behavior record is polar coordinate encoded and calculated, the entity behavior record is marked with a radius that is used more frequently, and the polar coordinate record is obtained, and all polar coordinate records are integrated into a polar coordinate sequence.

[0060] Optionally, since the entity behavior record is composed of entity attribute values ​​and power grid anomaly label data, each entity attribute value or power grid anomaly label data can be used as one-dimensional data, and all entity behavior records are multi-dimensional data. After polar coordinate encoding, the polar coordinate sequence is also multi-dimensional data. When constructing the Gram matrix of the polar coordinate sequence corresponding to each dimension, according to the time node corresponding to the polar coordinate record in the polar coordinate sequence, the cosine value of the sum of the polar coordinate angles corresponding to the two time nodes is selected as a matrix element of a Gram matrix, and according to the order of the time nodes corresponding to the polar coordinate record, the Gram behavior matrix corresponding to the dimension is determined, and then the Gram behavior matrix corresponding to each dimension is formed. Among them, the number of Gram behavior matrices is the same as the number of data dimensions of the entity behavior record.

[0061] S120 , performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix.

[0062] The Gram behavior image can be obtained by performing image conversion on the Gram behavior matrix. Optionally, each matrix element of the Gram behavior matrix is ​​used as an image pixel value, and the Gram behavior matrix is ​​converted into the Gram behavior image by converting each matrix element into a corresponding pixel value.

[0063] Specifically, the matrix elements of the Gram behavior matrix are pixel-converted to determine the Gram behavior image corresponding to the Gram matrix.

[0064] S130, performing abnormal behavior recognition on the Gram behavior image using a pre-trained abnormal behavior model to determine abnormal behaviors of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0065] The abnormal behavior of the power grid may be an abnormal entity attribute and / or entity relationship in the multi-dimensional behavior information of the power grid. It should be noted that there are attributes and relationships of multiple entities in the multi-dimensional behavior information of the power grid, and the abnormal behavior of the power grid may be an abnormal attribute value and / or abnormal relationship of one of the entities.

[0066] The abnormal behavior model may be a pre-trained neural network model for identifying abnormal behavior of power grids. It should be noted that the abnormal behavior model may be a visual self-attention model (Vision Transformer), in which a decoder and an encoder composed of a Vision Transformer are used to extract feature information of an image, and an encoder is used to reconstruct an image based on the feature information of the image.

[0067] Specifically, the Grammar behavior image is input into a pre-trained abnormal behavior model, and the abnormal behavior model is used to extract features and reconstruct the Grammar behavior image to obtain a reconstructed image, and the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid is determined based on the reconstructed image.

[0068] The technical solution of the embodiment of the present invention obtains multi-dimensional behavior information of the power grid to be identified, performs Gram matrix conversion on the multi-dimensional behavior information of the power grid, obtains at least one Gram matrix, and converts the multi-dimensional behavior information into a Gram matrix, which can capture the correlation between the behavior information of each dimension, effectively express the interaction between the behavior features, and improve the accuracy of abnormal behavior identification; the matrix elements of the Gram behavior matrix are pixel-converted to determine the Gram behavior image corresponding to the Gram matrix, and the relationship between the features can be more intuitively displayed through the Gram image, which provides a basis for neural network training and identification, and improves the efficiency and accuracy of abnormal behavior identification; the Gram behavior image is used to identify abnormal behavior through a pre-trained abnormal behavior model, and the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid is determined. The abnormal behavior model can accurately identify complex behavior time series data, solve the technical problem that the power system in the prior art cannot identify the abnormal behavior of entities in the network space, realize the entity behavior detection of entities in the power grid network, can screen abnormal behaviors and warn, and timely detect possible malicious entities, so that the reliability and stability of the power network space are greatly guaranteed, and the orderly operation of society is promoted.

[0069] Figure 2 This is a flowchart of another method for identifying abnormal behavior of a power grid based on federated learning provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is a specific method for identifying abnormal behavior through an abnormal behavior model. Figure 2 As shown, the method includes:

[0070] S210 , obtaining multi-dimensional behavior information of a power grid to be identified, performing Gram matrix conversion on the multi-dimensional behavior information of the power grid, and obtaining at least one Gram behavior matrix.

[0071] S220 , performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix.

[0072] S230, acquiring multi-dimensional abnormal behavior data of the power grid, and performing Gram matrix conversion on the multi-dimensional abnormal behavior data of the power grid to obtain at least one abnormal behavior matrix.

[0073] The multi-dimensional abnormal behavior data of the power grid may be abnormal multi-dimensional behavior information of the power grid obtained in advance through manual identification. It should be noted that the multi-dimensional abnormal behavior data of the power grid are all abnormal abnormal behaviors of the power grid.

[0074] The abnormal behavior matrix may be a Gram matrix constructed from abnormal behavior in any dimension of the multi-dimensional abnormal behavior data of the power grid. It should be noted that the method of performing Gram matrix conversion on the multi-dimensional abnormal behavior data of the power grid is exactly the same as the above embodiment.

[0075] Specifically, the multi-dimensional abnormal behavior data of the power grid is obtained, and the multi-dimensional abnormal behavior of the power grid is converted into a Gram matrix to obtain at least one abnormal behavior matrix.

[0076] S240: Perform pixel conversion on matrix elements of the abnormal behavior matrix to determine an abnormal behavior image.

[0077] The abnormal behavior image may be obtained by performing image transformation on the abnormal behavior matrix.

[0078] Specifically, the matrix elements of the abnormal behavior matrix are pixel-converted to determine the abnormal behavior image corresponding to the abnormal behavior matrix.

[0079] S250 , inputting the abnormal behavior image into the abnormal behavior model for feature extraction and image reconstruction, to obtain an abnormal reconstructed image corresponding to each abnormal behavior image.

[0080] The abnormal reconstructed image may be an image obtained by performing model processing on the abnormal behavior image by the abnormal behavior model.

[0081] Specifically, features of the abnormal behavior image are extracted using the abnormal behavior model, and upsampling is performed based on the extracted features to perform image reconstruction to obtain an abnormal reconstructed image.

[0082] S260: Determine abnormal behavior detection parameters according to each abnormal behavior image and the abnormal reconstructed image corresponding to the abnormal behavior image.

[0083] The abnormal behavior detection parameter can be calculated based on the difference between the abnormal behavior image and the abnormal reconstruction image. Optionally, the abnormal behavior detection parameter is calculated as follows: since the pixel values ​​of the pixels in the abnormal behavior image of each dimension are obtained by transforming the matrix elements of the abnormal behavior matrix, for the abnormal reconstruction image corresponding to the abnormal behavior image of each dimension, the pixel values ​​of the pixels in the abnormal reconstruction image are matrix transformed, and the pixel values ​​of the pixels are converted into matrix elements to obtain the abnormal reconstruction matrix corresponding to each abnormal behavior image, and then the errors of the matrix elements are calculated based on each abnormal behavior matrix and the abnormal reconstruction matrix corresponding to the abnormal behavior image, and the average value and standard deviation are calculated based on all the errors to obtain the error average value and error standard deviation, and the error average value and error standard deviation are used as the abnormal behavior detection parameter based on the rule of thumb.

[0084] Specifically, according to each abnormal behavior matrix corresponding to each abnormal behavior image, matrix conversion is performed according to the abnormal reconstruction image to obtain an abnormal reconstruction matrix, and the abnormal behavior detection parameters are determined based on each abnormal behavior matrix and the abnormal reconstruction matrix corresponding to each abnormal behavior matrix.

[0085] S270: performing abnormal behavior recognition on the Gram behavior image according to the abnormal behavior detection parameter and the abnormal behavior model, and determining the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0086] Specifically, the Grammar behavior image features are extracted and reconstructed through the abnormal behavior model to obtain the reconstructed image, which is then matrix-converted and compared with the Grammar behavior matrix. Based on the comparison result and the abnormal behavior detection parameters, a judgment is made to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0087] Optionally, in another optional embodiment of the present invention, abnormal behavior recognition is performed on the Gram behavior image according to the abnormal behavior detection parameter and the abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid, including:

[0088] The Gram behavior image is input into the abnormal behavior model for feature extraction and image reconstruction, and a behavior reconstruction image corresponding to each Gram behavior image is obtained;

[0089] Abnormal behavior recognition is performed on each Grammar behavior image and the behavior reconstruction image corresponding to the Grammar behavior image according to the abnormal behavior detection parameters, and the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid is determined.

[0090] The behavior reconstruction image can be obtained by extracting features and reconstructing images based on the Gram behavior image by the abnormal behavior model. Optionally, the abnormal behavior model performs specific extraction and image reconstruction on the Gram behavior image to obtain a behavior reconstruction image, performs matrix transformation on the behavior reconstruction image, converts the pixel values ​​of the pixels into matrix elements, obtains the behavior reconstruction matrix corresponding to each behavior reconstruction image, and obtains the behavior error value by performing distance measurement between the Gram behavior matrix and the behavior reconstruction matrix corresponding to the Gram behavior matrix.

[0091] Optionally, the behavior error value corresponding to the Gram behavior matrix is ​​compared with the abnormal behavior detection parameter. If the behavior error value is within the range of the abnormal behavior detection parameter, the power grid behavior corresponding to the Gram behavior matrix is ​​recorded as abnormal power grid behavior.

[0092] Exemplarily, the errors of matrix elements are calculated according to the abnormal reconstruction matrix corresponding to each abnormal behavior matrix and the abnormal behavior image, and the average value and standard deviation are calculated based on all the errors to obtain the error average value and error standard deviation. The error average value can be represented by μ, and the error standard deviation can be represented by σ. Then the abnormal behavior detection parameters obtained can be (μ-3σ,μ+3σ). If the behavior error value corresponding to the Gram behavior matrix is ​​within the abnormal behavior detection parameters, then the power grid behavior record corresponding to the Gram behavior matrix is ​​considered to be abnormal power grid behavior; if the behavior error value corresponding to the Gram behavior matrix is ​​outside the abnormal behavior detection parameters, then the power grid behavior record corresponding to the Gram behavior matrix is ​​considered to be normal power grid behavior.

[0093] Based on empirical rules, the error mean and error standard deviation are used as abnormal behavior detection parameters.

[0094] The embodiment of the present invention processes abnormal behavior records and identifies anomalies through an abnormal behavior model, can accurately identify complex behavior time series data, solve the technical problem that the power system in the prior art cannot identify the abnormal behavior of entities in the network space, and realizes entity behavior detection of entities in the power grid network. It can screen abnormal behaviors and issue warnings, and timely identify possible malicious entities, which greatly guarantees the reliability and stability of the power network space and promotes the orderly operation of society.

[0095] Figure 3 Flow chart of another method for identifying abnormal behavior of power grid based on federated learning provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is the specific method for training abnormal behavior model. Figure 3 As shown, the method includes:

[0096] S310: Acquire training multi-dimensional behavior data, and perform Gram matrix conversion on the training multi-dimensional behavior data to obtain at least one training behavior matrix.

[0097] Among them, the training multidimensional behavior data can be the multidimensional behavior information of the power grid used for training obtained in the power system and various business platforms of the power system; the training behavior matrix can be a Gramian matrix constructed from one dimensional data in the training multidimensional behavior data; it should be noted that the construction method of the training behavior matrix is ​​the same as the above embodiment.

[0098] S320, performing pixel conversion on matrix elements of the training behavior matrix, determining a training Gram image corresponding to the training behavior matrix, and performing image segmentation and image mask processing on the training image to obtain a training image set.

[0099] The training Gram image may be obtained by performing image transformation on the training behavior matrix.

[0100] The training image set may be a data set consisting of multiple training images used to train an abnormal behavior model.

[0101] Optionally, in an embodiment of the present invention, one training Grammar image can generate multiple training images for training an abnormal behavior model. The specific generation method is as follows: corresponding to each Grammar image, the Grammar image is divided to obtain multiple sub-unit images of the Grammar image division, one sub-unit image is selected in turn, and masks are added to the sub-unit images except the sub-unit image to obtain a training image. The number of sub-unit images is the same as the number of training images. Each Grammar image can obtain multiple training images, and the multiple training images are constructed into a training image set.

[0102] S330, inputting the training images in the training image set into the encoder network of the pre-built visual self-attention model to determine the training linear sequence corresponding to the training images.

[0103] Among them, the decoder network of the visual self-attention model can be composed of a Vision Transformer model, which includes an embedding layer and a multi-head self-attention encoding layer.

[0104] Optionally, the process of the visual self-attention model processing the training image is as follows: the embedding layer is used to switch the input image, based on the preset size, the input image is cut into fixed-size image blocks, each image block is linearly transformed through a convolution layer to map it to a low-dimensional feature space, and position encoding and learnable embedding are added to obtain a feature sequence, and the feature sequence is input to the multi-head self-attention encoding layer; the multi-head self-attention encoding layer is used to add the attention weight corresponding to each position in the feature sequence to capture the relationship between different positions, and then linearly transform and map it through a feedforward neural network to obtain a training linear sequence. Among them, the training linear sequence can be the output feature sequence of the multi-head self-attention encoding layer.

[0105] S340, restoring the training linear sequence to the training image to obtain the restored training image, inputting the restored training image into the decoder network of the pre-built visual self-attention model, and determining the training reconstructed image.

[0106] The restored training image may be a training image in which the sub-unit image in the training image is replaced by the training linear sequence. It should be noted that, for each training image, the training linear sequence corresponding to the training image is restored to the sub-unit image of the training image, and the feature vectors in the training linear sequence are converted into pixel values ​​by performing image conversion on the one-dimensional linear sequence. Since the features in the training linear sequence all have corresponding position information, the converted pixel values ​​can be directly used to replace the pixels of the sub-unit image to obtain the restored training image.

[0107] Optionally, the decoder network of the visual self-attention model can be a convolutional neural network. The decoder network of the visual self-attention model can be used to reconstruct images. The decoder network of the visual self-attention model consists of a convolutional layer, a pooling layer, and an upsampling layer. The convolutional layer and the connected activation function are used to extract local features and introduce nonlinearity to the restored training image to obtain a feature image. The pooling layer can be used to reduce the spatial dimension of the feature image, and the upsampling layer can increase the spatial dimension of the feature image to achieve reconstruction of the restored training image and obtain a training reconstructed image.

[0108] Optionally, a conditional random field layer can be introduced into the decoder network of the visual self-attention model, and the conditional random field layer is applied to the output feature sequence, and the feature vector in the output feature sequence is input into the conditional random field layer, and the feature vector in the output feature sequence is scored by the probability transfer matrix of the conditional random field layer to obtain the score of the output feature sequence, and the score of the output feature sequence is probability-converted by the Softmax function to obtain the probability value of the output feature sequence, and the loss is calculated based on the probability value of the output feature sequence of all training images of the decoder network of the input visual self-attention model to obtain the conditional random field loss.

[0109] S350: Perform error calculation based on the training image and the training reconstructed image to determine a training error function.

[0110] Specifically, a matrix transformation is performed on the training reconstruction image corresponding to each training image to obtain a training reconstruction matrix, and a mean square error is calculated between each training behavior matrix and the training reconstruction matrix corresponding to the training behavior matrix to obtain a determined training error function. The training error function may be a function used to train and update the model parameters of the abnormal behavior model.

[0111] Optionally, in another embodiment of the present invention, when calculating the training error function, the mean square error between each training behavior matrix and the training reconstruction matrix corresponding to the training behavior matrix is ​​calculated. After obtaining the error function, the conditional random field loss is added after the error function as the training error function, which can effectively improve the prediction accuracy of the abnormal behavior model.

[0112] S360: Adjust model parameters of the visual self-attention model based on the training error function to determine the local sub-unit detection model.

[0113] Specifically, the visual self-attention model is back-propagated through the training error function, the model parameters of the visual self-attention model are adjusted, and the local sub-unit detection model is determined. The local sub-unit detection model can be a local abnormal behavior model obtained by training the power system and each business platform in the power system on the training multi-dimensional behavior data collected by itself.

[0114] S370: Upload the local sub-unit detection model to the power grid federated learning platform, and receive the global aggregation model issued by the power grid federated learning platform.

[0115] Among them, the power grid federated learning platform can be a service platform pre-set for federated learning of neural network models.

[0116] Optionally, for the local power system or various business platforms in the power system, after training the local subunit detection model, choose to upload the local subunit detection model to the power grid federated learning platform.

[0117] Optionally, in order to ensure the security of the local sub-unit detection model upload process, the power system and each business platform use a homomorphic encryption scheme to encrypt the local sub-unit detection model, upload the encrypted data to the power grid federated learning platform, and the power grid federated learning platform receives the encrypted data and decrypts it to obtain the uploaded local sub-unit detection model. The power grid federated learning platform aggregates the uploaded local sub-unit detection model by average aggregation to obtain a global aggregation model, encrypts the global aggregation model and sends it to the power system and each business platform. The power system and each business platform decrypt the received encrypted data to obtain the global aggregation model. Among them, the encryption algorithm selected in the encryption process can be the Pailier encryption algorithm.

[0118] Specifically, the local sub-unit detection model is uploaded to the power grid federated learning platform, and the global aggregation model issued by the power grid federated learning platform is received.

[0119] S380: When the global aggregation model meets the preset recognition condition, the global aggregation model is used as an abnormal behavior model.

[0120] Among them, the recognition condition can be a pre-set value for detecting the function of the global aggregation model. Optionally, the recognition condition can set the recognition accuracy of the global aggregation model to be greater than 98%. After receiving the global aggregation model, a test image set will be arbitrarily selected from the training image set, and the test image set will be input into the global aggregation model for model testing to obtain the model test result, and the accuracy of the model test result will be analyzed. If the accuracy of the model test result is greater than 98%, it is considered that the global aggregation model meets the preset recognition condition, and the global aggregation model is used as an abnormal behavior model; if the accuracy of the model test result is not greater than 98%, it returns to execute steps S310 to S370 until the global aggregation model meets the preset recognition condition.

[0121] Specifically, after receiving the global aggregation model, if the global aggregation model meets the preset recognition condition, the global aggregation model is used as the abnormal behavior model.

[0122] The embodiment of the present invention trains the abnormal behavior model through a multi-party joint federated learning method that ensures security, which can improve the training efficiency and model capability of the abnormal behavior model, and can accurately identify complex behavior time series data through the abnormal behavior model, thereby realizing entity behavior detection of entities in the power grid network, being able to screen abnormal behaviors and issue warnings, and timely identify possible malicious entities, thereby greatly ensuring the reliability and stability of the power grid space and promoting the orderly operation of society.

[0123] Figure 4 A schematic diagram of the structure of a power grid abnormal behavior identification device based on federated learning provided by an embodiment of the present invention. Figure 4 As shown, the device includes: a data processing module 410, an image conversion module 420 and an abnormality identification module 430; wherein,

[0124] The data processing module 410 is used to obtain the multi-dimensional behavior information of the power grid to be identified, and perform Gram matrix conversion on the multi-dimensional behavior information of the power grid to obtain at least one Gram behavior matrix;

[0125] An image conversion module 420, for performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix;

[0126] The abnormality identification module 430 is used to perform abnormal behavior identification on the Gram behavior image by using a pre-trained abnormal behavior model, and determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0127] The technical solution of the embodiment of the present invention obtains multi-dimensional behavior information of the power grid to be identified, performs Gram matrix conversion on the multi-dimensional behavior information of the power grid, obtains at least one Gram matrix, and converts the multi-dimensional behavior information into a Gram matrix, which can capture the correlation between the behavior information of each dimension, effectively express the interaction between the behavior features, and improve the accuracy of abnormal behavior identification; the matrix elements of the Gram behavior matrix are pixel-converted to determine the Gram behavior image corresponding to the Gram matrix, and the relationship between the features can be more intuitively displayed through the Gram image, which provides a basis for neural network training and identification, and improves the efficiency and accuracy of abnormal behavior identification; the Gram behavior image is used to identify abnormal behavior through a pre-trained abnormal behavior model, and the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid is determined. The abnormal behavior model can accurately identify complex behavior time series data, solve the technical problem that the power system in the prior art cannot identify the abnormal behavior of entities in the network space, realize the entity behavior detection of entities in the power grid network, can screen abnormal behaviors and warn, and timely detect possible malicious entities, so that the reliability and stability of the power network space are greatly guaranteed, and the orderly operation of society is promoted.

[0128] Optionally, the data processing module is specifically used for:

[0129] Classifying the multi-dimensional behavior information of the power grid to determine the attribute data of power grid entities and the relationship data of power grid entities;

[0130] Clustering the power grid entity relationship data based on a preset abnormal behavior category table to determine power grid abnormal label data;

[0131] A Gram matrix conversion is performed according to the power grid abnormality label data and the power grid entity attribute data to obtain at least one Gram behavior matrix.

[0132] Optionally, the data processing module is further used to:

[0133] Determining an initial cluster center according to the abnormal behavior category table;

[0134] Clustering the power grid entity relationship data according to the initial cluster center to determine at least one abnormal behavior cluster and the cluster label corresponding to the abnormal behavior cluster;

[0135] The power grid entity relationship data is labeled and updated according to the cluster labels and the abnormal behavior clusters to determine the power grid abnormal label data.

[0136] Optionally, the data processing module is further used to:

[0137] Constructing an entity behavior sequence corresponding to the multi-dimensional behavior information of the power grid according to the abnormal label data of the power grid and the attribute data of the power grid entity; wherein the entity behavior sequence includes at least one entity behavior record;

[0138] Performing polar coordinate encoding on the entity behavior records in the entity behavior sequence to obtain a polar coordinate sequence corresponding to the entity behavior sequence;

[0139] A Gram matrix is ​​constructed for each dimension based on the polar coordinate sequence to determine at least one Gram behavior matrix.

[0140] Optionally, the abnormality identification module is specifically used for:

[0141] Acquire multi-dimensional abnormal behavior data of the power grid, and perform Gram matrix conversion on the multi-dimensional abnormal behavior data of the power grid to obtain at least one abnormal behavior matrix;

[0142] Performing pixel conversion on matrix elements of the abnormal behavior matrix to determine the abnormal behavior image;

[0143] Inputting the abnormal behavior image into the abnormal behavior model for feature extraction and image reconstruction to obtain an abnormal reconstructed image corresponding to each abnormal behavior image;

[0144] Determine an abnormal behavior detection parameter according to each of the abnormal behavior images and the abnormal reconstructed image corresponding to the abnormal behavior image;

[0145] Abnormal behavior recognition is performed on the Gram behavior image according to the abnormal behavior detection parameter and the abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0146] Optionally, the abnormality identification module is further used to:

[0147] Inputting the Grammar behavior image into the abnormal behavior model for feature extraction and image reconstruction to obtain a behavior reconstruction image corresponding to each Grammar behavior image;

[0148] Abnormal behavior recognition is performed on each of the Grammar behavior images and the behavior reconstruction image corresponding to the Grammar behavior image according to the abnormal behavior detection parameters to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0149] Optionally, the device further includes a first training data processing module, a second training data processing module, a model encoder training module, a model decryptor training module, an error calculation module, a model parameter adjustment module, a federated learning module and a model judgment module; wherein,

[0150] The first training data processing module is used to obtain training multi-dimensional behavior data, and perform Gram matrix conversion on the training multi-dimensional behavior data to obtain at least one training behavior matrix;

[0151] The second training data processing module is used to perform pixel conversion on matrix elements of the training behavior matrix, determine a training Gram image corresponding to the training behavior matrix, and perform image division and image mask processing on the training Gram image to obtain a training image set;

[0152] The model encoder training module is used to input the training images in the training image set into the encoder network of the pre-built visual self-attention model for feature processing, and determine the training linear sequence corresponding to the training images;

[0153] The model decryptor training module is used to restore the training linear sequence to the training image to obtain the restored training image, and input the restored training image into the decoder network of the pre-built visual self-attention model to determine the training reconstructed image;

[0154] The error calculation module is used to perform error calculation based on the training image and the training reconstructed image to determine a training error function;

[0155] The model parameter adjustment module is used to adjust the model parameters of the visual self-attention model based on the training error function to determine the local sub-unit detection model;

[0156] The federated learning module is used to upload the local sub-unit detection model to the power grid federated learning platform and receive the global aggregation model issued by the power grid federated learning platform;

[0157] The model judgment module is used to use the global aggregation model as an abnormal behavior model when the global aggregation model meets a preset recognition condition.

[0158] The device for identifying abnormal behavior of a power grid based on federated learning provided in an embodiment of the present invention can execute the method for identifying abnormal behavior of a power grid based on federated learning provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0159] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their modes are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0160] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0161] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer grid such as the Internet and / or various telecommunication grids.

[0162] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for identifying abnormal behavior of a power grid based on federated learning.

[0163] In some embodiments, a method for identifying abnormal behavior of a power grid based on federated learning may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for identifying abnormal behavior of a power grid based on federated learning described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute a method for identifying abnormal behavior of a power grid based on federated learning in any other appropriate manner (e.g., by means of firmware).

[0164] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0165] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the modes / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0166] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0167] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0168] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a grid browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication grid). Examples of communication grids include: a local area network (LAN), a wide area network (WAN), a blockchain grid, and the Internet.

[0169] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication grid. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0170] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0171] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of a method for identifying abnormal behavior of a power grid based on federated learning as provided in any embodiment of the present invention are implemented. The method includes:

[0172] Acquire multi-dimensional behavior information of a power grid to be identified, and perform Gram matrix conversion on the multi-dimensional behavior information of the power grid to obtain at least one Gram behavior matrix;

[0173] Perform pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix;

[0174] The abnormal behavior of the Gram behavior image is identified through the pre-trained abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

[0175] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0176] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0177] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0178] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of grid, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0179] It should be understood by those skilled in the art that the above modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a grid composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0180] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0181] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying abnormal behavior of power grid based on federated learning, characterized in that: include: Acquiring multidimensional behavior information of a power grid to be identified, and performing Gram matrix conversion on the multidimensional behavior information of the power grid to obtain at least one Gram behavior matrix; Performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix; Abnormal behavior recognition is performed on the Gram behavior image using a pre-trained abnormal behavior model to determine abnormal behaviors of the power grid corresponding to the multi-dimensional behavior information of the power grid.

2. The method according to claim 1, characterized in that The step of performing Gram matrix conversion on the multi-dimensional behavior information of the power grid to obtain at least one Gram behavior matrix includes: Classifying the multi-dimensional behavior information of the power grid to determine the attribute data of power grid entities and the relationship data of power grid entities; Clustering the power grid entity relationship data based on a preset abnormal behavior category table to determine power grid abnormal label data; A Gram matrix conversion is performed according to the power grid abnormality label data and the power grid entity attribute data to obtain at least one Gram behavior matrix.

3. The method according to claim 2, characterized in that The clustering of the power grid entity relationship data based on the preset abnormal behavior category table to determine the power grid abnormal label data includes: Determining an initial cluster center according to the abnormal behavior category table; Clustering the power grid entity relationship data according to the initial cluster center to determine at least one abnormal behavior cluster and a cluster label corresponding to the abnormal behavior cluster; The power grid entity relationship data is labeled and updated according to the cluster labels and the abnormal behavior clusters to determine the power grid abnormal label data.

4. The method according to claim 2, characterized in that: The step of performing Gram matrix conversion according to the power grid abnormality label data and the power grid entity attribute data to obtain at least one Gram behavior matrix includes: Constructing an entity behavior sequence corresponding to the multi-dimensional behavior information of the power grid according to the abnormal label data of the power grid and the attribute data of the power grid entity; wherein the entity behavior sequence includes at least one entity behavior record; Performing polar coordinate encoding on the entity behavior records in the entity behavior sequence to obtain a polar coordinate sequence corresponding to the entity behavior sequence; A Gram matrix is ​​constructed for each dimension based on the polar coordinate sequence to determine at least one Gram behavior matrix.

5. The method according to claim 1, characterized in that The performing abnormal behavior recognition on the Gram behavior image by using a pre-trained abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid includes: Acquire multi-dimensional abnormal behavior data of the power grid, and perform Gram matrix conversion on the multi-dimensional abnormal behavior data of the power grid to obtain at least one abnormal behavior matrix; Performing pixel conversion on matrix elements of the abnormal behavior matrix to determine an abnormal behavior image; Inputting the abnormal behavior image into the abnormal behavior model for feature extraction and image reconstruction to obtain an abnormal reconstructed image corresponding to each abnormal behavior image; Determine an abnormal behavior detection parameter according to each of the abnormal behavior images and the abnormal reconstructed image corresponding to the abnormal behavior image; Abnormal behavior recognition is performed on the Gram behavior image according to the abnormal behavior detection parameter and the abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

6. The method according to claim 5, characterized in that The performing abnormal behavior recognition on the Gram behavior image according to the abnormal behavior detection parameter and the abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid includes: Inputting the Grammar behavior image into the abnormal behavior model for feature extraction and image reconstruction to obtain a behavior reconstruction image corresponding to each Grammar behavior image; Abnormal behavior recognition is performed on each of the Grammar behavior images and the behavior reconstruction image corresponding to the Grammar behavior image according to the abnormal behavior detection parameters to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

7. The method according to claim 1, characterized in that Before performing abnormal behavior recognition on the Gram behavior image by using the pre-trained abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid, the method further includes: Acquire training multidimensional behavior data, and perform Gram matrix conversion on the training multidimensional behavior data to obtain at least one training behavior matrix; Performing pixel conversion on matrix elements of the training behavior matrix, determining a training Grammar image corresponding to the training behavior matrix, and performing image division and image mask processing on the training Grammar image to obtain a training image set; Inputting the training images in the training image set into the encoder network of the pre-built visual self-attention model for feature processing, and determining the training linear sequence corresponding to the training images; Restoring the training linear sequence to a training image to obtain a restored training image, inputting the restored training image into a decoder network of a pre-constructed visual self-attention model to determine a training reconstructed image; Perform error calculation based on the training image and the training reconstructed image to determine a training error function; Adjusting model parameters of the visual self-attention model based on the training error function to determine a local sub-unit detection model; Uploading the local subunit detection model to the power grid federated learning platform, and receiving the global aggregation model issued by the power grid federated learning platform; When the global aggregation model meets the preset identification condition, the global aggregation model is used as the abnormal behavior model.

8. A device for identifying abnormal behavior of a power grid based on federated learning, characterized in that: include: A data processing module, used for acquiring multi-dimensional behavior information of a power grid to be identified, and performing Gram matrix conversion on the multi-dimensional behavior information of the power grid to obtain at least one Gram behavior matrix; An image conversion module, used for performing pixel conversion on matrix elements of the Gram behavior matrix to determine a Gram behavior image corresponding to the Gram matrix; The abnormality recognition module is used to perform abnormal behavior recognition on the Gram behavior image through a pre-trained abnormal behavior model to determine the abnormal behavior of the power grid corresponding to the multi-dimensional behavior information of the power grid.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for identifying abnormal behavior of a power grid based on federated learning as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for identifying abnormal behavior of a power grid based on federated learning as described in any one of claims 1 to 4 when executed.

Images