Method and device for detecting abnormal data of power system

Abstract

The invention provides a power system abnormal data detection method and device, and belongs to the field of power data detection. The method comprises the steps of obtaining power system data, screening suspicious data according to the power system data, and constructing a suspicious data set according to the suspicious data; inputting suspicious data of each node of the graph model into a multi-head graph attention network model, and outputting comprehensive features; wherein the comprehensive features are obtained by fusing spatial features and time features; acquiring a hidden state of the gating circulation unit at a previous moment, and inputting the comprehensive feature at the current moment and the hidden state at the previous moment into the gating circulation unit to obtain an output feature; and calculating the probability that the suspicious data is abnormal data according to the output characteristics, and judging the suspicious data as the abnormal data when the probability is higher than an abnormal threshold value. According to the invention, the problem of accurately detecting abnormal data can be solved.

Description

Technical Field

[0001] The present invention relates to the field of power data detection, and in particular to a method and device for detecting abnormal data in a power system. Background Art

[0002] With the access of a large number of new energy devices, the measurement data of the power system has become increasingly complex and changeable, and it has become increasingly important to ensure the stable and safe operation of the power system. The large amount of data collected by the phasor measurement unit and the monitoring and data acquisition system is the basis for the operation analysis of the power system, providing key support for state estimation, situational awareness and line loss calculation. However, due to the complexity of the on-site environment, such as communication interference, transmission delays and equipment abnormalities, the accuracy of the measurement equipment is difficult to guarantee. At the same time, the measurement data source is located in the non-safe area where the power system is less protected. Through efficient abnormal data detection algorithms and technologies, abnormal data can be identified and eliminated in a timely manner, and the quality and credibility of energy data can be improved, which is crucial for the operation analysis of the power system.

[0003] In traditional power systems, the detection of abnormal data usually relies on manual experience and simple statistical methods. These methods are difficult to deal with large-scale and complex power system data, and cannot quickly identify and eliminate abnormal data, increasing the potential risks of power system operation. In recent years, with the development of machine learning and deep learning technologies, data-driven anomaly detection methods have gradually been applied to power systems.

[0004] However, the physical model of the power system and the power flow lead to strong spatiotemporal correlation between the measurement nodes. The existing patent CN 118260693A discloses a reliability data anomaly detection and correction method based on big data and artificial intelligence, but it focuses on time analysis and ignores the spatiotemporal correlation of the power system measurement data, making it difficult to meet the high-precision detection requirements. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for detecting abnormal data in a power system to solve the problem of accurately detecting abnormal data.

[0006] In a first aspect, an embodiment of the present invention provides a method for detecting abnormal data in a power system, comprising:

[0007] Acquire power system data, filter suspicious data according to the power system data, and construct a suspicious data set according to the suspicious data; wherein the suspicious data includes abnormal data and normal data;

[0008] A graph model is constructed according to the suspicious data set, and the suspicious data of each node of the graph model is input into a multi-head graph attention network model to output a comprehensive feature; wherein the comprehensive feature is obtained by fusing spatial features and temporal features, the spatial feature represents the spatial correlation of different nodes of multi-head attention at the same time, and the temporal feature represents the temporal correlation of the same node of multi-head attention at different times;

[0009] Obtain the hidden state of the gated recurrent unit at the previous moment, input the comprehensive features of the current moment and the hidden state of the previous moment into the gated recurrent unit, obtain the output features, and capture the dependency of the suspicious data at the current moment on the suspicious data at the previous moment;

[0010] The probability that the suspicious data is abnormal data is calculated according to the output feature, and when the probability is higher than an abnormal threshold, the suspicious data is determined to be abnormal data.

[0011] In a possible implementation, the suspicious data of each node of the graph model is input into the multi-head graph attention network model, and the comprehensive features are output, including:

[0012] Calculate the unnormalized attention scores between different nodes of all attention heads, normalize the unnormalized attention scores to obtain node attention weights, perform weighted sum operation on the features of adjacent nodes according to the node attention weights, average the weighted sum results of all attention heads to obtain spatial features;

[0013] Calculate the unnormalized attention scores of the same node of all attention heads at different time points, normalize the unnormalized attention scores to obtain the time attention weights, perform weighted summation operation on the features at different time points according to the time attention weights, average the weighted summation results of all attention heads to obtain the time features;

[0014] The spatial feature and the temporal feature are fused to obtain the comprehensive feature.

[0015] In a possible implementation, the comprehensive features at the current moment and the hidden state at the previous moment are input into the gated recurrent unit to obtain the output features, including:

[0016] The comprehensive feature is input into the gated recurrent unit, a reset gate and an update gate are calculated according to the comprehensive feature, a candidate hidden state is calculated according to the reset gate, the hidden state at the previous moment and the comprehensive feature, and a current hidden state is calculated according to the candidate hidden state, the hidden state at the previous moment and the update gate. The current hidden state is the output feature at the current moment, and the formula is as follows:

[0017] rt =σ(W rx x t +W rh h t-1 +b r )

[0018] z t =σ(W zx x t +W zh h t-1 +b z )

[0019] h′ t =tanh(Wh x x t +W hr h t-1 +b h )

[0020] h t =(1-z t )h t-1 +z t h′ t

[0021] In the formula, r t is the reset gate, σ is the sigmoid activation function, W rx and W rh For r t The weight matrix, x t is a comprehensive feature, h t-1 is the hidden state of the previous moment, h′ t is the candidate hidden state, tanh is the hyperbolic tangent activation function, W hx and W hr is the hidden layer weight matrix, z t is the update gate, W zx and W zh For z t The weight matrix, h t is the current hidden state, b z 、b r and b h is the bias term.

[0022] In a possible implementation, screening suspicious data according to power system data includes:

[0023] Calculating the slope between adjacent power system data, and calculating the slope confidence interval distance radius according to the slope;

[0024] If the slope confidence interval distance radius is greater than the suspicious data decision threshold, the power system data is identified as suspicious data.

[0025] In a possible implementation, calculating the slope confidence interval distance radius according to the slope includes:

[0026] Calculate the mean and mean square error of the power system data according to the slopes between adjacent power system data;

[0027] An upper confidence limit and a lower confidence limit are calculated according to the mean and the mean square error, and a slope confidence interval distance radius is calculated according to the upper confidence limit and the lower confidence limit.

[0028] In a possible implementation, before acquiring the power system data, the following is further included:

[0029] Record missing power system data;

[0030] Clean extreme and negative data in power system data;

[0031] Clear duplicate power system data.

[0032] In a possible implementation, before acquiring the power system data, the following is further included:

[0033] The power system data is normalized, and the formula is as follows:

[0034]

[0035] Where x(i) is any power system data value, min(x(n)) is the minimum value of the power system data, and max(x(n)) is the maximum value of the power system data.

[0036] In a possible implementation, the power system data includes voltage, current, frequency, power and load.

[0037] In a possible implementation, the calculating the probability that the suspicious data is abnormal data according to the output feature includes:

[0038] The output features are linearly transformed, and the results of the linear transformation are mapped to [0, 1] through the sigmoid activation function to obtain the probability that the current data is abnormal data.

[0039] In a second aspect, an embodiment of the present invention provides a device for detecting abnormal data in a power system, comprising:

[0040] A suspicious data set construction module is used to obtain power system data, filter suspicious data according to the power system data, and construct a suspicious data set according to the suspicious data; wherein the suspicious data includes abnormal data and normal data;

[0041] The comprehensive feature output module is used to build a graph model based on the suspicious data set, input the suspicious data of each node of the graph model into the multi-head graph attention network model, and output comprehensive features; wherein the comprehensive features are obtained by fusing spatial features and temporal features. The spatial features represent the spatial correlation of different nodes of the multi-head attention at the same time, and the temporal features represent the temporal correlation of the same node of the multi-head attention at different times.

[0042] The output feature output module is used to obtain the hidden state of the gated recurrent unit at the previous moment, input the comprehensive features of the current moment and the hidden state of the previous moment into the gated recurrent unit, obtain the output features, and capture the dependency of the suspicious data at the current moment on the suspicious data at the previous moment;

[0043] The abnormal data judgment module is used to calculate the probability that the suspicious data is abnormal data based on the output characteristics, and when the probability is higher than the abnormal threshold, the suspicious data is judged as abnormal data.

[0044] The embodiment of the present invention provides a method and device for detecting abnormal data in a power system. The method reduces the amount of data for abnormal data detection in subsequent steps by screening out suspicious data based on power system data, thereby improving the overall efficiency of abnormal data detection. The suspicious data is input into a multi-head graph attention network model to capture the complex spatial dependency between different nodes of the multi-head attention at the same time in space, and to capture the temporal feature changes of the same node of the multi-head attention at different times in time, and to capture the dependency in the time dimension, thereby capturing the spatial and temporal features of the multi-head attention, and being able to consider various feature relationships, making data detection more accurate. The spatial features and temporal features are fused to obtain comprehensive features, thereby capturing the spatiotemporal correlation of power system data. The comprehensive features are input into a gated recurrent unit to obtain output features, capturing the dependency of the suspicious data at the current moment on the suspicious data at the previous moment, thereby using the gated recurrent unit to capture the long-term dependency in the time series, which is helpful for the subsequent detection of abnormal data. Whether the suspicious data is abnormal data is determined based on the output features, and finally the real-time detection of abnormal data in the power system is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 is a flow chart of an implementation of a method for detecting abnormal data in a power system provided by an embodiment of the present invention;

[0047] Figure 2 It is a structural diagram of an abnormal data detection device for a power system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present invention. However, it should be clear to those skilled in the art that the present invention may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present invention.

[0049] In order to make the purpose, technical solutions and advantages of the present invention more clear, specific embodiments will be described below in conjunction with the accompanying drawings.

[0050] The amount of operating data in modern power systems is huge and complex. While traditional methods ensure detection accuracy, it is often difficult to complete anomaly detection within a reasonable time, affecting the real-time and practical nature of detection.

[0051] The following preparations need to be made before implementing this application.

[0052] Collect the measurement data of the power system from various sensors, smart meters, protection devices, energy management systems, etc., to continuously monitor and record the key operating parameters of the power system, including voltage, current, frequency, power, load, etc. Provide necessary data support for deep learning model training, and ensure that the power system abnormal data detection model can be trained on a comprehensive and rich data set, thereby improving the generalization ability and accuracy of the model.

[0053] In a possible implementation manner, before acquiring the power system data, the method further includes:

[0054] Record missing power system data;

[0055] Clean extreme and negative data in power system data;

[0056] Clear duplicate power system data.

[0057] As the input of the algorithm, the power system data will inevitably affect the analysis results of the algorithm output. Therefore, data cleaning and preprocessing are crucial to improving the accuracy of the anomaly detection algorithm. Therefore, data cleaning and data preprocessing are required after collecting the data to be detected.

[0058] In a possible implementation manner, before acquiring the power system data, the method further includes:

[0059] Normalize the power system data, and the formula is as follows:

[0060]

[0061] Where x(i) is any power system data value, min(x(n)) is the minimum value of the power system data, and max(x(n)) is the maximum value of the power system data.

[0062] In the complex power network communication environment, due to the huge and complex data, it is generally necessary to linearly normalize the data and convert all samples into numbers between 0 and 1.

[0063] Figure 1 The implementation flow chart of the abnormal data detection method for the power system provided by the embodiment of the present invention is described in detail as follows:

[0064] Step 101: Acquire power system data, filter suspicious data based on the power system data, and construct a suspicious data set based on the suspicious data; wherein the suspicious data includes abnormal data and normal data.

[0065] The slope-based sliding window algorithm is used to pre-identify the data, marking all potential abnormal data as suspicious data and marking the rest of the data as normal data. In order to more accurately describe the structural characteristics of the data segment, the slope confidence interval distance radius is used, and the data segment that significantly deviates from the normal distribution is marked as suspicious data by setting an appropriate suspicious data decision threshold. It not only greatly shortens the time for subsequent detection of abnormal data processing, but also improves the efficiency and accuracy of overall detection. In addition, through this pre-screening method, the occurrence of missed detection and false detection in the subsequent processing process can be effectively reduced, ensuring the quality and reliability of the data set, and providing higher quality data input for subsequent anomaly detection.

[0066] In a possible implementation, screening suspicious data based on power system data includes:

[0067] Calculate the slope between adjacent power system data, and calculate the slope confidence interval distance radius based on the slope;

[0068] If the slope confidence interval distance radius is greater than the suspicious data decision threshold, the power system data is identified as suspicious data.

[0069] In a possible implementation, calculating the slope confidence interval distance radius according to the slope includes:

[0070] Calculate the mean and mean square error of the power system data according to the slopes between adjacent power system data;

[0071] The upper and lower confidence limits are calculated based on the mean and mean square error, and the slope confidence interval distance radius is calculated based on the upper and lower confidence limits.

[0072] The specific steps are as follows:

[0073] 1) Window size and sliding step size

[0074] The window size determines the number of data points included in each slope calculation. The window size should be selected according to the specific application scenario. It should be large enough to capture trends, but small enough to maintain sensitivity. The sliding step size determines the distance the window slides each time. Usually the step size is set to 1 to ensure the continuity and integrity of the detection.

[0075] For a data set with a sequence length of N, a sliding window with a length of L and a step size of R can be used to slide (NL) / R times continuously to form (NL) / R+1 data segments. The data segments generated by the sliding data window can be expressed as follows:

[0076] M=(m(t1),m(t2)…,m(t n ))

[0077] Here, m(t1) represents the data at time i.

[0078] 2) Slope within the window

[0079] By calculating the slope of the data in the sliding window and analyzing the change of the slope, data anomalies can be detected. Sudden changes or significant deviations in the slope are usually abnormal signals. In each window, the slope between any two adjacent points is calculated based on the slope formula of adjacent points, which can sensitively capture local changes and mutations in the data. The slope calculation formula is as follows:

[0080]

[0081] Among them, M j represents the jth data segment, and i represents the i-th value in the window.

[0082] 3) Slope confidence interval distance radius

[0083] The method based on data slope can clearly express the structural characteristics of the data segment. However, the distribution of slope information is random. In order to accurately describe the distribution of slope information of the data segment, the slope confidence interval distance radius is used to describe the characteristics of the data segment. The slope confidence interval distance radius and the confidence upper and lower limits are as follows:

[0084]

[0085] in, and σ j They represent the mean and mean square error of the slope of the jth data segment, respectively. and θ jThey represent the upper confidence limit and the lower confidence limit respectively, Z is a random variable that obeys the N(0,1) normal distribution, α=0.05 represents the confidence level, and L is the length.

[0086] The confidence interval distance radius is a further statistical analysis of the slope within the window, which indicates the uncertainty of the slope estimate. When calculating the slope within the window, the specific value of the slope may be affected by data fluctuations, so it is necessary to add a confidence interval to the slope estimate to reflect its possible fluctuation range. The confidence interval distance radius is a measure of this uncertainty. The upper and lower limits of the confidence interval provide a possible range for the slope, and the confidence interval distance radius represents half of the distance between the upper and lower limits, that is, the degree of uncertainty of the slope.

[0087] Set the suspicious data decision threshold to ξ1, when d j When >ξ1, the data is considered suspicious. The sliding window avoids ignoring the local features of the abnormal points and further reduces the occurrence of missed detection.

[0088] When j When >ξ1, it means that the slope change in the window exceeds the predetermined suspicious data decision threshold range, which may indicate that the data in the window is abnormal and the system will mark it as suspicious data.

[0089] Sliding window is a local analysis method that processes time series data segment by segment, but due to the size and movement of the window, it may ignore some important global or more subtle features. False positives: Fluctuations or short-term anomalies within the window may be noise or normal fluctuations, but because the slope within the window exceeds the threshold, the system will misjudge it as an anomaly. Therefore, these problems are common and need to be further detected based on subsequent detection technologies.

[0090] In a possible implementation, the power system data includes voltage, current, frequency, power and load.

[0091] Step 102: Build a graph model based on the suspicious data set, input the suspicious data of each node of the graph model into the multi-head graph attention network model, and output comprehensive features; wherein the comprehensive features are obtained by fusing spatial features and temporal features, the spatial features represent the spatial correlation of different nodes of the multi-head attention at the same time, and the temporal features represent the temporal correlation of the same node of the multi-head attention at different times.

[0092] Due to the increasing number of measuring devices, it is difficult to achieve high precision requirements in multivariate anomaly detection tasks. Many deep learning methods focus on time correlation rather than spatial correlation. However, the grid topology is a typical non-Euclidean structure and is difficult to process through neural network training. Therefore, the present invention introduces a graph attention network with multi-head dynamic attention to capture the time and space correlation between different data, learn the dependencies between each measuring device in the time and space dimensions through the training model, and realize the aggregation of multi-node information by expanding the aggregate information domain of a single node. In the establishment of the graph model, the network nodes are abstracted as graph nodes, and the transmission lines connecting each node are abstracted as graph edges. The measured values ​​(voltage phase angle, voltage amplitude, active and reactive power) of each node at each time point are regarded as multivariate time series data. Since the power system may have equipment failures, maintenance or flow distribution adjustment during operation, the topological graph structure of the power system will change over time, so the concept of dynamic graph is introduced. In the time series data, each timestamp may correspond to a different graph structure. The changing relationship between nodes in time is captured in the form of dynamic graph to ensure that the model can handle the dynamic changes in the relationship between sensors.

[0093] The graph attention network uses multiple attention heads to calculate the attention weights between nodes and performs weighted summation of the features of neighboring nodes, thereby capturing the complex spatial dependencies between different nodes. At the same time, the graph attention network also uses the attention mechanism of the time layer to analyze the feature changes of the same node at different times and capture the dependencies in the time dimension. After fusing spatial features and temporal features, a comprehensive feature representation containing spatiotemporal correlation is formed.

[0094] In a possible implementation, the suspicious data of each node of the graph model is input into a multi-head graph attention network model, and the comprehensive features are output, including:

[0095] Calculate the unnormalized attention scores between different nodes of all attention heads, normalize the unnormalized attention scores to obtain the node attention weights, perform weighted sum operation on the features of adjacent nodes according to the node attention weights, and average the weighted sum results of all attention heads to obtain the spatial features;

[0096] Calculate the unnormalized attention scores of the same node of all attention heads at different time points, normalize the unnormalized attention scores to obtain the temporal attention weights, perform weighted summation on the features at different time points according to the temporal attention weights, and average the weighted summation results of all attention heads to obtain the temporal features;

[0097] The spatial features and temporal features are integrated to obtain comprehensive features.

[0098] For multivariate time series anomaly detection, this application uses two graph attention layers (spatial layer and temporal layer) with attention mechanism to learn dependencies in spatiotemporal correlation. First, multi-source time series data is input into the spatial layer and the temporal layer. By capturing the spatial correlation between different nodes at the same time point and the temporal correlation between the same node at different time points, the feature representation of each node in the spatial dimension and the feature representation of each single node in the temporal dimension are output. Finally, the output features of the spatial layer and the temporal layer are spliced ​​by using feature aggregation to form a feature vector containing spatiotemporal correlation. The output of each node calculated in the graph attention network layer is shown in the following formula:

[0099]

[0100] e ij =α·LeakyReLU(w·(v i ||v j ))

[0101]

[0102] Among them, h i is the output feature of node i, obtained by weighted summing of the features of its neighboring nodes; α ij represents the attention weight of node j to node i, which also reflects the importance of node j to node i, and is obtained by normalizing the unnormalized attention score through the softmax function; e ij is the unnormalized attention score between node i and node j, which is calculated by linear transformation and LeakyReLU activation function, v i ∥v j Represents the feature concatenation of node i and node j, α∈R 2N′ is a trainable parameter vector, w∈R 2N is the weight matrix, N(i) is the set of neighbor nodes of node i, j ′ Represents the adjacent nodes of node i.

[0103] In the traditional attention mechanism, each node only calculates one set of attention weights. However, in the multi-head attention mechanism, the model will calculate multiple sets of attention weights at the same time, generate multiple feature representations, and then average the output feature vectors calculated by the k-head attention mechanism to make the model more accurate. It can be expressed as follows:

[0104]

[0105] Among them, σ is the sigmoid activation function; K is the number of attention heads; The attention weight between node i and node j calculated for the Kth attention head; w k is the parameter matrix of the input vector; h′ i is the feature vector of node j′.

[0106] In the spatial layer, the unnormalized attention score between node i and node j is first calculated for each attention head K The unnormalized attention scores are normalized by the sigmoid function to obtain the attention weights Then use the attention weight to perform weighted sum operation on the features of neighboring nodes Finally, the weighted feature summation results of each attention head K are averaged to obtain the spatial features of node i:

[0107]

[0108] In the time layer, for each attention head K, we first calculate the unnormalized attention score of node i at different time points t The unnormalized attention scores are normalized by the sigmoid function to obtain the attention weights Then use the attention weights to perform weighted summation on the features at different time points: Finally, the weighted feature summation results of all attention heads are averaged to obtain the temporal features of node i:

[0109]

[0110] The spatial features and temporal features are integrated to form comprehensive features that include spatiotemporal correlation:

[0111]

[0112] Step 103: Obtain the hidden state of the gated recurrent unit at the previous moment, input the comprehensive features of the current moment and the hidden state of the previous moment into the gated recurrent unit, obtain the output features, and capture the dependency of the suspicious data at the current moment on the suspicious data at the previous moment.

[0113] As an improved form of LSTM, the gated recurrent unit not only has the characteristics of LSTM, but also has the advantages of fewer parameter settings, simple structure, small storage volume, and high efficiency. As an efficient time series data processing model, it can effectively capture the long-term dependencies of data through its unique gating mechanism, and has significant advantages in processing time series data.

[0114] It plays an important role in detecting abnormal data in power systems. By building, training and deploying gated recurrent units, real-time monitoring and anomaly detection of power system data can be achieved, improving the reliability and safety of the system.

[0115] The gated recurrent unit consists of two gate control units: an update gate z t and a reset gate r t , update gate z t By processing the historical state h t-1 and candidate state h′ t The information in controls the current state h t , and achieve a balance between input and forgetting. Reset gate r t The function is to process the state h of the previous moment t-1 To control the candidate state h′ t , whose value can reflect the degree of dependence on the information of the previous moment.

[0116] In a possible implementation, the comprehensive features at the current moment and the hidden state at the previous moment are input into the gated recurrent unit to obtain output features, including:

[0117] The comprehensive features are input into the gated recurrent unit, and the reset gate and update gate are calculated according to the comprehensive features. The candidate hidden state is calculated according to the reset gate, the hidden state at the previous moment and the comprehensive features. The current hidden state is calculated according to the candidate hidden state, the hidden state at the previous moment and the update gate. The current hidden state is the output feature at the current moment. The formula is as follows:

[0118] r t =σ(W rx x t +W rh h t-1 +b r )

[0119] z t =σ(W zx x t +W zh h t-1 +b z )

[0120] h′ t =tanh(W hx x t +W hr h t-1 +b h )

[0121] h t =(1-z t )h t-1 +z t h′ t

[0122] In the formula, r t is the reset gate, σ is the sigmoid activation function, Wrx and W rh For r t The weight matrix, x t is a comprehensive feature, h t-1 is the hidden state of the previous moment, h′ t is the candidate hidden state, tanh is the hyperbolic tangent activation function, W hx and W hr is the hidden layer weight matrix, z t is the update gate, W zx and W zh For z t The weight matrix, h t is the current hidden state, b z 、b r and b h is the bias term. Comprehensive features

[0123] Initialize the hidden state of the gated recurrent unit and obtain the hidden state h at time t-1 t-1 , the input value of the gated recurrent unit is the input value x at time t t (i.e. comprehensive features). First, the update gate z is obtained by calculating the formula t and reset gate r t , then the candidate state h′ t Update, finally, update the hidden state h t The hidden state contains the information of the previous t time steps and is regarded as the output feature of the gated recurrent unit at time step t. Therefore, h t Denoted as h GRU , represents the output feature of the gated recurrent unit.

[0124] Step 104: Calculate the probability that the suspicious data is abnormal data based on the output features. When the probability is higher than the abnormal threshold, the suspicious data is judged as abnormal data.

[0125] In a possible implementation, calculating the probability that the suspicious data is abnormal data according to the output features includes:

[0126] The output features are linearly transformed, and the results of the linear transformation are mapped to [0, 1] through the sigmoid activation function to obtain the probability that the current data is abnormal data.

[0127] The output feature h of the gated recurrent unit model is transformed into GRU Mapped to a linearly transformed target output space, the calculation formula is: y = W fc ·h GRU +b fc , where W fc The output feature hGRU The weight matrix, b fc The calculation result is processed by the sigmoid activation function, and the output value is mapped between 0 and 1, indicating the probability that the current data is abnormal data. The probability is compared with the abnormal threshold, and the abnormal detection result is finally generated. It can not only detect and identify abnormal data in the power system in real time, but also effectively reduce the false alarm rate and missed alarm rate, and improve the reliability and safety of the system.

[0128] Through the application of this deep learning model, efficient and accurate monitoring of abnormal data in the power system is achieved, providing important support for the stable operation of the power system.

[0129] This invention significantly improves the efficiency and accuracy of anomaly detection, effectively solves the limitations of traditional methods in processing complex power system data, ensures the stable operation of the power system, and has broad application prospects and important practical significance.

[0130] The embodiment of the present invention reduces the amount of data for abnormal data detection in subsequent steps by screening out suspicious data based on power system data, thereby improving the overall efficiency of abnormal data detection. The suspicious data is input into the multi-head graph attention network model to capture the complex spatial dependencies between different nodes of the multi-head attention at the same time in space, and to capture the temporal feature changes of the same node of the multi-head attention at different times in time, and to capture the dependencies in the time dimension, thereby capturing the spatial and temporal features of the multi-head attention, and being able to consider various feature relationships to make data detection more accurate. The spatial features and temporal features are fused to obtain comprehensive features, thereby capturing the spatiotemporal correlation of power system data. The comprehensive features are input into the gated recurrent unit to obtain output features, capturing the dependency of the suspicious data at the current moment on the suspicious data at the previous moment, thereby using the gated recurrent unit to capture the long-term dependencies in the time series, which is helpful for the subsequent detection of abnormal data. Whether the suspicious data is abnormal data is determined based on the output features, and finally the real-time detection of abnormal data in the power system is realized.

[0131] In other possible implementations, after suspicious data is determined to be abnormal data, in-depth analysis is performed in combination with data from other sources (such as weather information, equipment status, historical operating data, etc.), feature extraction and analysis of multi-source data, and comprehensive evaluation of the authenticity of abnormal data can more comprehensively reflect the operating status of the power system.

[0132] First, the information of each data source is extracted and preprocessed, and mapped to a unified feature space. Then, a multi-source data fusion algorithm (such as variational autoencoder) is used to evaluate the abnormal data to determine whether it is a real abnormality or a false abnormality. Finally, the fused judgment result is output to provide a reference for the decision-making of the power system, further improving the accuracy and reliability of abnormal data detection.

[0133] Multi-source data fusion can not only supplement the deficiency of measurement data, but also improve the accuracy of anomaly detection. Specifically, the fused data can better capture the spatiotemporal correlation between measurement nodes, thereby improving the ability to judge abnormal data. Through the collaborative analysis of multi-source data, the false alarm rate can be effectively reduced, the safety and stability of the power system in complex environments can be enhanced, and the efficient operation of the power system can be ensured.

[0134] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0135] The following is an embodiment of the device of the present invention. For details not described in detail therein, reference may be made to the corresponding method embodiment described above.

[0136] Figure 2 The structure diagram of the abnormal data detection device for a power system provided by an embodiment of the present invention is shown. For the convenience of explanation, only the part related to the embodiment of the present invention is shown, which is described in detail as follows:

[0137] like Figure 2 As shown, the power system abnormal data detection device 2 includes:

[0138] The suspicious data set construction module 21 is used to obtain power system data, filter suspicious data according to the power system data, and construct a suspicious data set according to the suspicious data; wherein the suspicious data includes abnormal data and normal data;

[0139] A comprehensive feature output module 22 is used to construct a graph model based on a suspicious data set, input the suspicious data of each node of the graph model into a multi-head graph attention network model, and output a comprehensive feature; wherein the comprehensive feature is obtained by fusing spatial features and temporal features, the spatial feature represents the spatial correlation of different nodes of the multi-head attention at the same time, and the temporal feature represents the temporal correlation of the same node of the multi-head attention at different times;

[0140] The output feature output module 23 is used to obtain the hidden state of the gated recurrent unit at the previous moment, input the comprehensive feature of the current moment and the hidden state of the previous moment into the gated recurrent unit, obtain the output feature, and capture the dependency relationship between the suspicious data at the current moment and the suspicious data at the previous moment;

[0141] The abnormal data judging module 24 is used to calculate the probability that the suspicious data is abnormal data according to the output characteristics, and when the probability is higher than the abnormal threshold, the suspicious data is judged as abnormal data.

[0142] In a possible implementation, the suspicious data set construction module 21 is used to:

[0143] Screen suspicious data based on power system data, including:

[0144] Calculate the slope between adjacent power system data, and calculate the slope confidence interval distance radius based on the slope;

[0145] If the slope confidence interval distance radius is greater than the suspicious data decision threshold, the power system data is identified as suspicious data.

[0146] In a possible implementation, the suspicious data set construction module 21 is used to:

[0147] Calculate the slope confidence interval distance radius based on the slope, including:

[0148] Calculate the mean and mean square error of the power system data according to the slopes between adjacent power system data;

[0149] The upper and lower confidence limits are calculated based on the mean and mean square error, and the slope confidence interval distance radius is calculated based on the upper and lower confidence limits.

[0150] In a possible implementation, the comprehensive feature output module 22 is used to:

[0151] The suspicious data of each node of the graph model is input into the multi-head graph attention network model, and the comprehensive features are output, including:

[0152] Calculate the unnormalized attention scores between different nodes of all attention heads, normalize the unnormalized attention scores to obtain the node attention weights, perform weighted sum operation on the features of adjacent nodes according to the node attention weights, and average the weighted sum results of all attention heads to obtain the spatial features;

[0153] Calculate the unnormalized attention scores of the same node of all attention heads at different time points, normalize the unnormalized attention scores to obtain the temporal attention weights, perform weighted summation on the features at different time points according to the temporal attention weights, and average the weighted summation results of all attention heads to obtain the temporal features;

[0154] The spatial features and temporal features are integrated to obtain comprehensive features.

[0155] The embodiment of the present invention reduces the amount of data for abnormal data detection in subsequent steps by screening out suspicious data based on power system data, thereby improving the overall efficiency of abnormal data detection. The suspicious data is input into the multi-head graph attention network model to capture the complex spatial dependencies between different nodes of the multi-head attention at the same time in space, and to capture the temporal feature changes of the same node of the multi-head attention at different times in time, and to capture the dependencies in the time dimension, thereby capturing the spatial and temporal features of the multi-head attention, and being able to consider various feature relationships to make data detection more accurate. The spatial features and temporal features are fused to obtain comprehensive features, thereby capturing the spatiotemporal correlation of power system data. The comprehensive features are input into the gated recurrent unit to obtain output features, capturing the dependency of the suspicious data at the current moment on the suspicious data at the previous moment, thereby using the gated recurrent unit to capture the long-term dependencies in the time series, which is helpful for the subsequent detection of abnormal data. Whether the suspicious data is abnormal data is determined based on the output features, and finally the real-time detection of abnormal data in the power system is realized.

[0156] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0157] Those of ordinary skill in the art will appreciate that the templates, units, and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0158] If the module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various power system abnormal data detection method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory, random access memory, electrical carrier signal, telecommunication signal and software distribution medium.

[0159] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal data in a power system, characterized in that: include: Obtain power system data, filter suspicious data based on the power system data, and construct a suspicious data set based on the suspicious data; wherein the suspicious data includes abnormal data and normal data; construct a graph model based on the suspicious data set, input the suspicious data of each node of the graph model into the multi-head graph attention network model, and output comprehensive features; wherein the comprehensive features are obtained by fusion of spatial features and temporal features, the spatial features represent the spatial correlation of different nodes of multi-head attention at the same time, and the temporal features represent the temporal correlation of the same node of multi-head attention at different times; obtain the hidden state of the gated recurrent unit at the previous moment, input the comprehensive features of the current moment and the hidden state of the previous moment into the gated recurrent unit, obtain the output features, and capture the dependency of the suspicious data at the current moment on the suspicious data at the previous moment; calculate the probability that the suspicious data is abnormal data based on the output features, and when the probability is higher than the abnormal threshold, judge the suspicious data as abnormal data.

2. The method for detecting abnormal data in a power system according to claim 1, characterized in that: The suspicious data of each node of the graph model is input into the multi-head graph attention network model, and the comprehensive features are output, including: Calculate the unnormalized attention scores between different nodes of all attention heads, normalize the unnormalized attention scores to obtain node attention weights, perform weighted sum operation on the features of adjacent nodes according to the node attention weights, average the weighted sum results of all attention heads to obtain spatial features; Calculate the unnormalized attention scores of the same node of all attention heads at different time points, normalize the unnormalized attention scores to obtain the time attention weights, perform weighted summation operation on the features at different time points according to the time attention weights, average the weighted summation results of all attention heads to obtain the time features; The spatial feature and the temporal feature are fused to obtain the comprehensive feature.

3. The method for detecting abnormal data in a power system according to claim 1, characterized in that: The comprehensive features at the current moment and the hidden state at the previous moment are input into the gated recurrent unit to obtain output features, including: The comprehensive feature is input into the gated recurrent unit, a reset gate and an update gate are calculated according to the comprehensive feature, a candidate hidden state is calculated according to the reset gate, the hidden state at the previous moment and the comprehensive feature, and a current hidden state is calculated according to the candidate hidden state, the hidden state at the previous moment and the update gate. The current hidden state is the output feature at the current moment, and the formula is as follows: r t =σ(W rx x t +W rh h t-1 +b r ) z t =σ(W zx x t +W zh h t-1 +b z ) h' t =tanh(W hx x t +W hr h t-1 +b h ) h t =(1-z t )h t-1 +z t h′ t In the formula, r t is the reset gate, σ is the sigmoid activation function, W rx and W rh For r t The weight matrix, x t is a comprehensive feature, h t-1 is the hidden state of the previous moment, h′ t is the candidate hidden state, tanh is the hyperbolic tangent activation function, W hx and W hr is the hidden layer weight matrix, z t is the update gate, W zx and W zh For z t The weight matrix, h t is the current hidden state, b z 、b r and b h is the bias term.

4. The method for detecting abnormal data in a power system according to claim 1, characterized in that: The screening of suspicious data based on power system data includes: Calculating the slope between adjacent power system data, and calculating the slope confidence interval distance radius according to the slope; If the slope confidence interval distance radius is greater than the suspicious data decision threshold, the power system data is identified as suspicious data.

5. The method for detecting abnormal data in a power system according to claim 4, characterized in that: Calculating the slope confidence interval distance radius according to the slope includes: Calculate the mean and mean square error of the power system data according to the slopes between adjacent power system data; An upper confidence limit and a lower confidence limit are calculated according to the mean and the mean square error, and a slope confidence interval distance radius is calculated according to the upper confidence limit and the lower confidence limit.

6. The method for detecting abnormal data in a power system according to claim 1, characterized in that: Before acquiring power system data, it also includes: Record missing power system data; Clean extreme and negative data in power system data; Clear duplicate power system data.

7. The method for detecting abnormal data in a power system according to claim 6, characterized in that: Before acquiring power system data, it also includes: The power system data is normalized, and the formula is as follows: Where x(i) is any power system data value, min(x(n)) is the minimum value of the power system data, and max(x(n)) is the maximum value of the power system data.

8. The method for detecting abnormal data in a power system according to claim 1, characterized in that: The power system data includes voltage, current, frequency, power and load.

9. The method for detecting abnormal data in a power system according to claim 1, characterized in that: The calculating the probability that the suspicious data is abnormal data according to the output characteristics includes: The output features are linearly transformed, and the results of the linear transformation are mapped to [0, 1] through the sigmoid activation function to obtain the probability that the current data is abnormal data.

10. A power system abnormal data detection device, characterized in that: include: A suspicious data set construction module is used to obtain power system data, filter suspicious data according to the power system data, and construct a suspicious data set according to the suspicious data; wherein the suspicious data includes abnormal data and normal data; The comprehensive feature output module is used to build a graph model based on the suspicious data set, input the suspicious data of each node of the graph model into the multi-head graph attention network model, and output comprehensive features; wherein the comprehensive features are obtained by fusing spatial features and temporal features. The spatial features represent the spatial correlation of different nodes of the multi-head attention at the same time, and the temporal features represent the temporal correlation of the same node of the multi-head attention at different times. The output feature output module is used to obtain the hidden state of the gated recurrent unit at the previous moment, input the comprehensive features of the current moment and the hidden state of the previous moment into the gated recurrent unit, obtain the output features, and capture the dependency of the suspicious data at the current moment on the suspicious data at the previous moment; The abnormal data judgment module is used to calculate the probability that the suspicious data is abnormal data based on the output characteristics, and when the probability is higher than the abnormal threshold, the suspicious data is judged as abnormal data.

Images