Electricity larceny prevention detection alarm method and device, electronic equipment and medium

Abstract

The invention provides an electricity larceny prevention detection alarm method and device, electronic equipment and a medium, and relates to the technical field of power system monitoring, and the method comprises the steps: collecting the power utilization data of a target user through an intelligent electric meter, and building a historical power utilization data set; after obtaining a target user authentication result, performing multi-granularity feature extraction on the historical power consumption data set to generate a feature extraction result; behavior abnormity is judged based on the extraction result through the real-time monitoring data set, and a first abnormity score is established; performing transverse anomaly verification by combining the joint similarity factor with the real-time power consumption data of the joint user, and establishing a second anomaly score; establishing a joint verification feature set to discriminate anomaly, and generating a third anomaly score; and matching alarm levels according to the three types of abnormal scores, and executing alarm management. The technical problems of low electricity stealing detection accuracy and poor real-time performance caused by insufficient electricity stealing behavior detection sensitivity and single feature extraction of an existing power system under the interference of factors such as complex and changeable user electricity consumption behaviors, environment and time periods are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of power system monitoring, and in particular to an anti-electricity theft detection alarm method, device, electronic equipment and medium. Background Art

[0002] With the rapid growth of electricity demand and the popularization of smart grids, the intelligence level of electricity information collection and management has been continuously improved. However, in the actual operation of the power system, electricity theft is still a long-standing problem that is difficult to completely eradicate. These behaviors not only cause economic losses to power companies, but also threaten the safe operation of the power grid and the fair electricity environment of users. Existing anti-electricity theft detection technology mainly relies on rule threshold discrimination or single feature extraction. This method has the following problems when facing complex and diverse electricity usage scenarios: First, electricity theft is diverse and hidden, and traditional detection methods are difficult to cover all possible abnormal electricity usage characteristics, resulting in a high false alarm rate; secondly, in the process of distinguishing abnormal electricity usage behavior, there is a lack of deep mining and multi-granularity feature analysis of user historical behavior data, which cannot fully reflect the user's electricity usage habits and potential abnormal behaviors; in addition, the existing technology has obvious deficiencies in real-time performance and cannot respond quickly to electricity theft, resulting in delayed alarms and processing. At the same time, due to the influence of environmental factors (such as temperature and humidity) and time characteristics (such as peak and valley periods), electricity usage data shows large volatility under different conditions, which further increases the complexity of electricity theft detection. Therefore, how to use smart meters and advanced data analysis technology to integrate multi-dimensional electricity usage characteristics for accurate detection and real-time alarm of abnormal behavior has become the focus and difficulty of current anti-electricity theft technology research. Summary of the invention

[0003] The present application provides an anti-electricity theft detection alarm method, device, electronic device and medium, which are used to solve the technical problems that the existing power system has low accuracy and poor real-time performance in electricity theft detection due to insufficient sensitivity in electricity theft detection and single feature extraction under the influence of complex and changeable user electricity consumption behavior, environmental and time period factors.

[0004] In view of the above problems, the present application provides an anti-electricity theft detection alarm method, device, electronic device and medium.

[0005] In a first aspect of the present application, a method for detecting and warning against electricity theft is provided, the method comprising: using a smart meter to collect electricity consumption data of a target user, and establishing a historical electricity consumption data set, wherein the electricity consumption data includes current data, voltage data, and power factor data; obtaining target user authentication of the historical electricity consumption data set, and performing multi-granularity feature extraction of the authenticated historical electricity consumption data set based on the target user authentication result, and establishing a multi-granularity feature extraction result; using a smart meter to obtain a real-time monitoring data set of the target user, and performing behavioral abnormality discrimination on the real-time monitoring data set based on the multi-granularity feature extraction result, and establishing a first abnormality score; establishing a joint similarity factor among all users based on the multi-granularity feature extraction result, calling the real-time electricity consumption data of the joint users through the joint similarity factor, and performing horizontal abnormality verification of the real-time monitoring data set using the real-time electricity consumption data of the joint users and the joint similarity factor, and establishing a second abnormality score; establishing a joint verification feature set, wherein the joint verification feature set includes environmental features and time period correlation features, and performing abnormal discrimination of the real-time monitoring data set using the joint verification feature set, and establishing a third abnormality score; matching alarm levels according to the first abnormality score, the second abnormality score, and the third abnormality score, and performing alarm management based on the matched alarm levels.

[0006] In a second aspect of the present application, an anti-electricity theft detection and alarm device is provided, the device comprising: an electricity consumption data acquisition module, used to use a smart meter to perform electricity consumption data acquisition of a target user, and establish a historical electricity consumption data set, wherein the electricity consumption data includes current data, voltage data, and power factor data; a multi-granularity feature extraction module, used to obtain target user authentication of the historical electricity consumption data set, perform multi-granularity feature extraction of the authenticated historical electricity consumption data set based on the target user authentication result, and establish a multi-granularity feature extraction result; a behavior anomaly discrimination module, used to obtain a real-time monitoring data set of the target user with a smart meter, perform behavior anomaly discrimination on the real-time monitoring data set based on the multi-granularity feature extraction result, and establish a first anomaly Score; a horizontal anomaly verification module, which is used to establish a joint similarity factor among all users based on the multi-granularity feature extraction results, call the real-time electricity consumption data of the joint users through the joint similarity factor, and use the real-time electricity consumption data of the joint users and the joint similarity factor to perform horizontal anomaly verification of the real-time monitoring data set to establish a second anomaly score; an anomaly discrimination module, which is used to establish a joint verification feature set, the joint verification feature set includes environmental features and time period correlation features, and uses the joint verification feature set to perform anomaly discrimination of the real-time monitoring data set to establish a third anomaly score; an alarm management module, which is used to match the alarm level according to the first anomaly score, the second anomaly score, and the third anomaly score, and perform alarm management based on the matched alarm level.

[0007] In a third aspect of the present application, the present application provides an electronic device, comprising: a processor; a memory for storing instructions executable by the processor; wherein the processor is used to execute an anti-electricity theft detection alarm method provided in the present application.

[0008] In a fourth aspect of the present application, the present application provides a computer-readable storage medium storing a computer program, wherein the computer program is used to execute an anti-electricity theft detection and alarm method provided by the present application.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] The method provided in the embodiment of the present application uses a smart meter to execute electricity consumption data collection of a target user, establishes a historical electricity consumption data set, and the electricity consumption data includes current data, voltage data, and power factor data; obtains target user authentication of the historical electricity consumption data set, and performs multi-granularity feature extraction of the authenticated historical electricity consumption data set based on the target user authentication result, and establishes a multi-granularity feature extraction result; obtains a real-time monitoring data set of the target user by using a smart meter, and performs behavioral abnormality discrimination on the real-time monitoring data set based on the multi-granularity feature extraction result to establish a first abnormality score; establishes a joint similarity factor among all users based on the multi-granularity feature extraction result, calls the real-time electricity consumption data of the joint users through the joint similarity factor, and performs horizontal abnormality verification of the real-time monitoring data set using the real-time electricity consumption data of the joint users and the joint similarity factor to establish a second abnormality score; establishes a joint verification feature set, and the joint verification feature set includes environmental features and time period correlation features, and uses the joint verification feature set to perform abnormal discrimination of the real-time monitoring data set to establish a third abnormality score; matches the alarm level according to the first abnormality score, the second abnormality score, and the third abnormality score, and performs alarm management based on the matched alarm level. The technical effect of achieving comprehensive analysis based on multi-granularity feature extraction and joint similarity factors, accurately identifying abnormal electricity usage behavior, and improving the accuracy of electricity theft detection has been achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A flowchart of an anti-electricity theft detection and alarm method provided in this application.

[0012] Figure 2 A schematic diagram of the structure of an anti-electricity theft detection and alarm device provided in this application.

[0013] Figure 3 A schematic diagram of the structure of an electronic device provided in this application.

[0014] Explanation of the accompanying drawings: electricity consumption data collection module 11, multi-granularity feature extraction module 12, behavior abnormality identification module 13, lateral abnormality verification module 14, abnormality identification module 15, alarm management module 16, processor 21, memory 22, input device 23, output device 24. DETAILED DESCRIPTION

[0015] The present application provides an anti-electricity theft detection alarm method, device, electronic device and medium, which are used to solve the technical problem that the existing power system has low accuracy and poor real-time performance due to insufficient sensitivity to electricity theft detection and single feature extraction under the influence of complex and changeable user electricity consumption behavior, environment and time period. The technical effect of achieving comprehensive analysis based on multi-granularity feature extraction and joint similarity factors, accurately distinguishing abnormal electricity consumption behavior, and improving the accuracy of electricity theft detection is achieved.

[0016] Below, the technical solutions in the present invention will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments of the present invention. It should be understood that the present invention is not limited to the example embodiments described herein. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. It should also be noted that, for the convenience of description, only the parts related to the present invention are shown in the accompanying drawings, rather than all of them.

[0017] Embodiment 1, as Figure 1 As shown, the present application provides an anti-electricity theft detection alarm method, the method comprising:

[0018] The smart meter is used to collect the target user's electricity consumption data and establish a historical electricity consumption data set, wherein the electricity consumption data includes current data, voltage data, and power factor data.

[0019] In one embodiment, the target user's electricity consumption is fully monitored through smart meters, and the user's electricity consumption data is collected in real time. These data include the magnitude of the current, the change in voltage, and the value of the power factor. The current data can reflect the working status and power consumption characteristics of the electrical equipment, the voltage data can monitor the stability of the power supply, and the power factor is used to evaluate the power efficiency and power loss of the user's equipment. The collected data will be recorded and stored, and after being sorted, it will form a historical electricity consumption data set for the target user, providing basic support for subsequent analysis and abnormal behavior detection.

[0020] Obtain target user authentication of the historical electricity consumption data set, perform multi-granularity feature extraction of the authenticated historical electricity consumption data set based on the target user authentication result, and establish a multi-granularity feature extraction result.

[0021] In one embodiment, for the collected historical power consumption data set, first check whether there are abnormal data in the historical power consumption data set, such as data loss, invalid values ​​or duplicate values, to ensure data integrity. Then compare the collected historical power consumption data to verify whether it is consistent with the registration information of the target user (such as user number, meter number, etc.) to prevent data confusion or misuse. When the target user is authenticated, the authenticated historical power consumption data set is grouped according to the time dimension, space dimension and characteristic dimension. The time dimension includes daily, weekly, monthly and other periods; the space dimension includes the user's area, the distribution of power equipment, etc.; the characteristic dimension includes current, voltage, power factor, etc. Subsequently, the long-term change trend of the user's power consumption data is analyzed, that is, the characteristics such as the average daily power consumption, the monthly peak power consumption, and the seasonal power consumption characteristics are extracted as long-term characteristics by means of mean calculation, cumulative calculation, etc. Then calculate the fluctuation amplitude and frequency of the power consumption data in the short term, such as the change of power consumption during the peak period of the day, and mark and extract the power consumption data that deviates significantly from the normal value in the short term, and then combine the fluctuation amplitude and frequency of the power consumption data in the short term calculated as the short-term characteristics. In addition, based on historical electricity consumption data, the load characteristics of different electrical equipment are separated, such as the high-power consumption mode of air conditioners and the low-power consumption mode of lighting equipment, and the start-stop frequency, start-stop time distribution, and corresponding current and power factor changes of the equipment are extracted as equipment characteristic features. After that, the extracted long-cycle features, short-cycle features and equipment characteristic features are integrated to form a multi-granularity feature set. The integrated multi-granularity feature set is then stored as structured data to form a multi-granularity feature extraction result, which provides basic data support for subsequent abnormal behavior detection and alarm management.

[0022] The real-time monitoring data set of the target user is obtained by using a smart meter, and the behavior anomaly is judged on the real-time monitoring data set based on the multi-granularity feature extraction result to establish the first anomaly score.

[0023] In one embodiment, the electricity consumption data of the target user is collected in real time through a smart meter to generate a real-time monitoring data set. These data include key parameters such as current, voltage, and power factor, which reflect the user's current electricity consumption status. Subsequently, these real-time data are input into the abnormal behavior recognition network constructed based on the previously extracted multi-granularity feature extraction results for analysis and comparison. The analysis and comparison results are weighted and summed, and a first abnormal score is established based on the summation result to quantify the abnormal degree of the current electricity consumption behavior. This process timely discovers possible abnormal electricity consumption behaviors through careful analysis of real-time monitoring data, laying the foundation for subsequent comprehensive abnormality verification and alarm level matching.

[0024] Furthermore, the method of performing behavioral abnormality discrimination on the real-time monitoring data set based on the multi-granularity feature extraction result and establishing a first abnormality score also includes:

[0025] An abnormal behavior recognition network is constructed using multi-granularity feature extraction results, and multi-granularity weights of the abnormal behavior recognition network are configured, wherein the abnormal behavior recognition network includes a first granularity subnetwork, a second granularity subnetwork, and a third granularity subnetwork; based on the abnormal behavior recognition network, abnormal behavior recognition at different granularities is performed on a real-time monitoring data set, the granular abnormal behavior recognition results are weighted by the multi-granularity weights and then output, and a first abnormal score is established according to the output results.

[0026] Preferably, based on the multi-granularity feature extraction results, an abnormal behavior recognition network is constructed to comprehensively analyze the power consumption features of different granularities to accurately identify abnormal behaviors. The entire network includes a first granularity subnetwork, a second granularity subnetwork, and a third granularity subnetwork. The first granularity subnetwork is constructed based on the long-term features in the multi-granularity feature extraction results, and is responsible for analyzing the long-term power consumption trend of the target user, including features such as daily average power consumption and monthly peak power consumption, judging whether the real-time data is consistent with the user's historical trend, and generating a first granularity abnormal score. The second granularity subnetwork is constructed based on the short-term features in the multi-granularity feature extraction results, and analyzes the fluctuation amplitude, frequency and other characteristics of the current power consumption in the real-time data within a specific period of time, judging whether there is abnormal short-term behavior, and generating a second granularity abnormal score. The third granularity subnetwork is constructed based on the device characteristic features in the multi-granularity feature extraction results, focusing on device characteristics, including device start / stop frequency, load characteristics, etc., and comparing real-time data with historical device characteristics to identify whether there is abnormality in the operation of the power-consuming equipment, and generating a third granularity abnormal score. The specific construction methods of these three sub-networks are the same. Taking the first granularity sub-network as an example, long-term features such as daily average power consumption and monthly peak value are extracted from the multi-granularity feature extraction results to form input data, and then abnormal and normal power consumption behaviors are annotated based on historical experience and industry knowledge to form training sets and validation sets. Subsequently, the first granularity sub-network is constructed. The first granularity sub-network can use a one-dimensional convolutional neural network (1DCNN), which specifically includes an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. It can also use a recurrent neural network, and then use a random method to initialize the network weights. After that, the training set is input into the sub-network in batches. The data passes through the convolutional layer, the pooling layer, and the fully connected layer from the input layer, and finally generates an abnormal score at the output layer. The binary cross entropy loss function is then used to calculate the error between the predicted score and the true label, and the gradient of the error relative to the network parameters is calculated to update the parameters of the sub-network such as the convolution kernel and the fully connected layer weights. After each training cycle (epoch), the validation set is used to evaluate the sub-network performance (such as accuracy and recall). Adjust the learning rate or training batch size of the subnetwork according to the performance on the validation set. Repeat the above steps until the preset training rounds are reached or the validation set performance no longer improves. When the validation set performance reaches the optimal level, save the parameters of the first granularity subnetwork. For the training of the second and third granularity subnetworks, the training process is the same as that of the first granularity subnetwork, except that the input data corresponds to short-term features and device characteristic features. After the training of the first, second, and third granularity subnetworks is completed, the three subnetworks are integrated, and an integrated input layer and an integrated output layer are set for the integrated three subnetworks. The integrated input layer is used to distribute the data in the multi-granularity feature extraction results to the corresponding subnetworks. The integrated output layer is used to synthesize the inputs of the three subnetworks.In the integrated output layer, an initial weight is assigned to the anomaly score of each sub-network, and the sum of these three weights is 1. Then the multi-granularity feature extraction results are input into the integrated input layer, and the first granularity anomaly score, the second granularity anomaly score, and the third granularity anomaly score are obtained through the analysis of the three sub-networks. After that, the three anomaly scores are weighted and summed according to the current weights to generate a predicted anomaly score, and the error between the predicted anomaly score and the true label is calculated using the binary cross entropy loss, and then the multi-granularity weights are adjusted using the back propagation algorithm to minimize the binary cross entropy loss. Continue training until the preset training rounds are reached or the comprehensive anomaly score performance on the validation set is stable, thereby constructing an abnormal behavior recognition network. After the abnormal behavior recognition network is constructed, the real-time monitoring data is input into the abnormal behavior recognition network, and the data in the real-time monitoring data is distributed to the three sub-networks through the integrated input layer of the abnormal behavior recognition network, and analyzed at the long-term, short-term, and device characteristic levels respectively. Each sub-network outputs an anomaly score of the corresponding granularity according to its analysis results. Then, the granular anomaly scores of the three sub-networks are weighted and summed according to the multi-granularity weights through the integrated output layer to generate a comprehensive first anomaly score. The weighting process ensures that the combined effects of long-term, short-term and device characteristics are accurately reflected without distorting the results due to deviations from single granularity features. This first anomaly score is used to quantify the degree of abnormality of the current user's real-time electricity consumption behavior and will serve as an important reference for subsequent horizontal anomaly verification and comprehensive analysis.

[0027] The real-time monitoring data of the target user is compared with the weighted comprehensive data in the trust reconstruction results to evaluate the abnormality of the comprehensive characteristics.

[0028] Based on the multi-granularity feature extraction results, a joint similarity factor is established among all users. The real-time electricity consumption data of the joint users is called through the joint similarity factor. The real-time electricity consumption data of the joint users and the joint similarity factor are used to perform lateral anomaly verification of the real-time monitoring data set to establish a second anomaly score.

[0029] In one embodiment, the multi-granularity feature extraction results of the target user are compared with the feature data of other users, including long-term features (such as power consumption trends), short-term features (such as fluctuation characteristics), and equipment characteristics (such as load characteristics). The closeness of the features is then measured by Euclidean distance or cosine similarity, and the joint similarity factor between the target user and all users is calculated. Subsequently, according to the value of the joint similarity factor of each user, a group of representative users are selected from all users as joint users, and their current real-time power consumption data, including key parameters such as current, voltage, and power factor, are called from these joint users. After that, the real-time monitoring data set of the target user is compared with the real-time power consumption data of the joint user, and the differences between the features (such as current and power factor) are analyzed. Through trust reconstruction and anomaly score verification, a second anomaly score is established. This second anomaly score quantifies the horizontal difference between the target user's power consumption behavior and similar users, which can effectively supplement the deficiencies in the target user's own features, enhance the comprehensiveness and robustness of anomaly detection, and provide an important basis for subsequent anomaly determination.

[0030] Furthermore, before performing horizontal anomaly verification of the real-time monitoring data set using the combined user real-time electricity consumption data and the combined similarity factor, the method further includes:

[0031] Through the preset threshold and joint similarity factor, the threshold of joint users is screened, the target joint user is established, the real-time electricity consumption data of the target joint user is extracted as the real-time electricity consumption data of the joint user, and the trust reconstruction is performed based on the joint similarity factor corresponding to the target joint user to establish the trust reconstruction result; the anomaly score verification of the independent characteristics and comprehensive characteristics of the real-time monitoring data set is performed based on the real-time electricity consumption data of the joint user, and the anomaly score verification result is established; the horizontal anomaly verification is completed through the trust reconstruction result and the anomaly score verification result.

[0032] Preferably, a similarity threshold (e.g., 0.8) is pre-set according to actual business needs. This threshold is used to screen joint users who are highly similar to the target user in terms of electricity usage behavior. After calculating the joint similarity factor between the target user and all users, the joint similarity factor of the user is compared with the preset threshold, and the user group whose joint similarity factor is higher than the threshold is screened out as the target joint user, and their real-time electricity usage data, including key parameters such as current, voltage, and power factor, are extracted from the target joint user to form the real-time electricity usage data of the joint user. Subsequently, a trust value is assigned to each target joint user, and the trust value is determined by its joint similarity factor. The higher the similarity factor, the greater the trust value. For example, the trust value can be proportional to the similarity factor. According to the trust value of each target joint user, its real-time electricity usage data is weighted, that is, the trust value of each target joint user is used as the weight of its real-time electricity usage data to generate a weighted comprehensive data set. For this weighted comprehensive data set, the trust reconstruction deviation score is calculated by the trust reconstruction deviation score calculation formula, and the trust reconstruction deviation score calculation formula is as follows: Among them, S 信任 The deviation score for trust reconstruction. N is the number of time steps, i.e. the length of real-time monitoring data. 目标,i is the real-time electricity consumption data of the target user at the i-th time step in the real-time monitoring data set. M is the number of target joint users. T j The weight of the real-time electricity consumption data of each target joint user, that is, the trust value of each target joint user. 联合,j,i is the real-time electricity consumption data of the jth joint user at the i-th time step. After calculating the trust reconstruction deviation score of this weighted comprehensive data set, the trust reconstruction result is established based on the weighted comprehensive data set and the trust reconstruction deviation score to reflect the overall electricity consumption characteristics of the target joint user. In addition, the real-time monitoring data of the target user is compared with the real-time electricity consumption data of the target joint user feature by feature, the abnormality of the independent features is analyzed, the current data deviation, voltage data deviation, power factor deviation, etc. are calculated, and the average of these deviations is calculated to obtain the independent feature verification score. The weighted comprehensive data set in the trust reconstruction result is then weighted to obtain weighted comprehensive data, and the real-time monitoring data of the target user is compared with this weighted comprehensive data as a whole to evaluate the abnormality of the comprehensive features. The comprehensive feature verification score is generated by calculating the comprehensive deviation index (such as mean square error or cosine similarity). After obtaining the independent feature verification score and the comprehensive feature verification score, the two scores are weighted to obtain the abnormal verification score, and the abnormal score verification result is established based on this. Afterwards, the trust reconstruction deviation score in the trust reconstruction result and the anomaly verification score in the anomaly score verification result are weighted and summed to obtain the second anomaly score, thereby completing the horizontal anomaly verification of the real-time monitoring data set.

[0033] A joint verification feature set is established, wherein the joint verification feature set includes environmental features and time period related features, and the joint verification feature set is used to perform anomaly discrimination of the real-time monitoring data set to establish a third anomaly score.

[0034] In one embodiment, in order to further improve the comprehensiveness of anomaly detection, environmental data of the area where the target user is located is collected to construct environmental features, such as temperature. Then, time period-related features are established based on the historical power consumption data and time information of the target user. The environmental features and time period-related features are combined to form a joint verification feature set to provide a reference between the target user's power consumption behavior and external conditions. Subsequently, the real-time power consumption data of the target user is mapped with the current environmental features to establish a first fitting tolerance factor. The real-time power consumption data of the target user is mapped with the associated features of the corresponding time period to establish a second fitting tolerance factor. The real-time power consumption data of the target user is identified with the self-check joint features for anomaly recognition, and a self-check anomaly recognition result is established. Afterwards, the first fitting tolerance factor, the second fitting tolerance factor, and the self-check anomaly recognition result are summarized to establish a third anomaly score. This third anomaly score is used to quantify whether the power consumption behavior of the target user is within a reasonable range and consistent with the environment and time period conditions. By establishing a joint verification feature set and combining the analysis of environmental features and time period-related features, the power consumption behavior of the target user can be more comprehensively understood and abnormal situations can be identified. This method can effectively reduce misjudgments caused by relying solely on historical data and improve the accuracy and reliability of detection.

[0035] Furthermore, the method of using the joint verification feature set to perform abnormal identification of the real-time monitoring data set also includes:

[0036] The temperature data of the joint verification feature set is called, and the temperature data is used as the environmental feature to perform power consumption mapping fitting, and a first fitting tolerance factor is established; the time period data of the joint verification feature set is called, and the time period data is used as the time period associated feature to perform power consumption mapping fitting, and a second fitting tolerance factor is established; the fluctuation ratio data of the joint verification feature set is called, and the fluctuation ratio data is used as the self-check joint feature to perform anomaly identification of the real-time monitoring data set, and a self-check anomaly identification result is established; the anomaly discrimination is completed according to the first fitting tolerance factor, the second fitting tolerance factor, and the self-check anomaly identification result.

[0037] Preferably, the temperature data of the area where the target user is located is called from the joint verification feature set, the historical correlation characteristics of temperature and power consumption are analyzed, and the relationship between temperature and power is fitted by using a fitting algorithm (such as linear regression, polynomial regression or nonlinear fitting) to obtain a first power consumption mapping function. Subsequently, the current temperature and the corresponding power are extracted from the real-time monitoring data set, the theoretical power value at the current temperature is calculated using the first power consumption mapping function, and the absolute deviation between the real-time power and the theoretical power is compared, and then the absolute deviation is compared with the deviation tolerance range. This deviation tolerance range is determined by adding multiple standard deviations to the mean of the historical data. Usually, two standard deviations are added to represent a 95% tolerance range. If the absolute deviation is within this deviation tolerance range, the first fitting tolerance factor is 1. Conversely, the ratio of 1 minus the absolute deviation to the maximum value of the deviation tolerance range is used. When the absolute value of this difference is between 0 and 1, the first fitting tolerance factor is the absolute value of this difference, and when the absolute value of this difference is greater than 1, the first fitting tolerance factor is 0. Similarly, in the same way, the characteristic data of the target user in the current period is called from the joint verification feature set, the historical power consumption pattern of the target user is analyzed, the second power consumption mapping function is obtained, and the characteristic data of the current period is input into the second power consumption mapping function to obtain the theoretical power of the current period. The second fitting tolerance factor is calculated by comparing the theoretical power with the real-time power and combining the deviation tolerance range.

[0038] In addition, the fluctuation ratio data of the joint verification feature set is also called, that is, the current fluctuation ratio, voltage fluctuation ratio and power fluctuation ratio in the joint verification feature set. These ratios are the ratios of the real-time change amplitude to the average value, and the tolerance ranges of the current fluctuation ratio, voltage fluctuation ratio and power fluctuation ratio are determined respectively according to the same method as the above-mentioned deviation tolerance range. Subsequently, it is detected whether the joint ratio of current fluctuation, voltage fluctuation and power fluctuation conforms to the normal power consumption law, that is, the current fluctuation, voltage fluctuation and power fluctuation are proportional. If the power fluctuation increases significantly, but the current fluctuation or voltage fluctuation is small, it may indicate that the power factor is forged. If the current or voltage fluctuation increases significantly, but the power fluctuation is small, it may indicate abnormal load operation. When the above-mentioned situations occur, that is, the current fluctuation, voltage fluctuation and power fluctuation are not proportional, the real-time deviation of current, voltage and power is obtained by calculating the absolute difference between the real-time fluctuation ratio of the target user and the corresponding historical fluctuation mean. Afterwards, the tolerance factors of these deviations are calculated in the same way as above, and the calculated tolerance factors are averaged and added to the self-check abnormality recognition results.

[0039] Finally, the first fitting tolerance factor, the second fitting tolerance factor, and the tolerance factor mean in the self-checking abnormal identification result are weighted and calculated to obtain the third abnormal score, completing the abnormal identification of the real-time monitoring data set. By combining the fitting tolerance factor of temperature characteristics and time period characteristics with the self-checking characteristics of the fluctuation ratio data, the potential abnormalities of the target user's electricity consumption behavior can be fully captured, the accuracy of detection can be improved, and a basis can be provided for subsequent alarm classification.

[0040] Alarm levels are matched according to the first abnormality score, the second abnormality score, and the third abnormality score, and alarm management is performed based on the matched alarm levels.

[0041] In one embodiment, in order to achieve effective alarm management of abnormal power consumption behavior of target users, the first abnormal score, the second abnormal score, and the third abnormal score are averaged to obtain a comprehensive abnormal score, and the comprehensive abnormal score is compared with the preset alarm level threshold to divide the alarm level. For example, if the comprehensive abnormal score is below 0.3, it is a first-level alarm (low), which means that the behavior deviation is slight, and the abnormal behavior can be recorded, an internal log can be generated, and no immediate intervention measures are taken. The comprehensive abnormal score is between 0.3 and 0.7, which is a second-level alarm (medium), which means that there are obvious abnormal signs, and an abnormal power consumption reminder can be sent to the target user, and regular monitoring can be started to further analyze user behavior. The comprehensive abnormal score is above 0.7, which is a third-level alarm (high), which means that the behavior is significantly abnormal and the risk is high. The power management department or relevant responsible personnel can be notified immediately to take mandatory intervention measures (such as power outages, on-site inspections, etc.). Subsequently, an alarm message is generated according to the matched alarm level, including the abnormal type (such as abnormal behavior, lateral abnormality, abnormal external conditions, etc.), the alarm level (first, second, third level), and the specific score and description of the abnormal indicator. By combining multi-dimensional anomaly scores with alarm levels, we can quickly and accurately determine the severity of the target user's abnormal behavior and adopt corresponding management strategies according to different levels. This alarm management method can effectively reduce false alarms and ensure that high-risk behaviors are intervened in a timely manner.

[0042] Further, matching the alarm level according to the first abnormality score, the second abnormality score, and the third abnormality score, and performing alarm management based on the matched alarm levels, further includes:

[0043] Based on the historical electricity consumption data set, a calibrated ratio value of the target user is obtained, and the calibrated ratio value includes the ratio of total electricity consumption to maximum power and the ratio of total electricity consumption to minimum power; the calibrated ratio value is used to perform additional verification of the real-time monitoring data set to establish a fourth anomaly score; the fourth anomaly score is used to adjust the matching alarm level, and alarm management is performed based on the adjustment result.

[0044] Preferably, based on the historical power consumption data set, the calibrated proportion values ​​of the target user are first extracted, and these proportion values ​​include the ratio of total power consumption to maximum power and the ratio of total power consumption to minimum power. These calibrated proportion values ​​can reflect the power consumption characteristics of the user, such as the frequency of use of high-power equipment and the stability of the operation of basic equipment. By analyzing the user's historical data, the fluctuation range and law of these proportion values ​​under normal circumstances can be understood, providing a benchmark for the additional verification of subsequent real-time data. In the real-time monitoring stage, the total power consumption, maximum power and minimum power of the current time period are obtained from the real-time monitoring data set of the target user, and the real-time proportion values ​​of these data are calculated. Subsequently, these real-time proportion values ​​are compared and analyzed with the historical calibrated proportion values. If there is a significant deviation between the real-time proportion value and the historical proportion value, it indicates that the power consumption behavior may be abnormal. For example, when the total power consumption of the user is high, but the maximum power and minimum power are continuously low, it may represent the presence of hidden power consumption equipment that has not been recorded; and if the growth rate of the total power consumption is much higher than the change range of the maximum power and the minimum power, it may represent that the user is consuming electricity through external loads or other ways to bypass the meter. Based on these deviations, the degree of abnormality will be quantified, that is, the absolute difference between the real-time calibration ratio value and the data in the calibration ratio value will be calculated, and the calculation results will be averaged to generate an abnormal score for additional verification, and the fourth abnormal score will be established accordingly. If the ratio value in the real-time monitoring data deviates seriously from the historical reference value, the fourth abnormal score will increase significantly, indicating that the current electricity consumption behavior of the target user has high-risk characteristics. After that, the fourth abnormal score is weighted and calculated with the average of the first abnormal score, the second abnormal score, and the third abnormal score to adjust the alarm level of the target user. Finally, the adjusted alarm level and related abnormal analysis results are recorded, and corresponding management measures are taken according to the alarm level, thereby improving the accuracy and management efficiency of electricity theft detection.

[0045] Further, matching the alarm level according to the first abnormality score, the second abnormality score, and the third abnormality score, and performing alarm management based on the matched alarm levels, further includes:

[0046] Based on the historical electricity consumption data set, reverse identification of electrical equipment is performed to establish the equipment start and stop frequency benchmark; current spike extraction is performed on the real-time monitoring data set to obtain the current spike frequency characteristics; deviation identification is performed based on the current spike frequency characteristics and the equipment start and stop frequency benchmark, and the fifth anomaly score is established based on the deviation identification result; and the matching alarm level is corrected based on the fifth anomaly score.

[0047] Preferably, key features are extracted from the historical electricity consumption data set of the target user, including time series data such as current, voltage, and power factor. The power characteristics of specific equipment (such as the power range and fluctuation mode of air conditioners, electric furnaces, etc.) are used to reversely identify the main power-consuming equipment. For each identified device, its start-stop mode is extracted. For example, the current of high-power equipment increases significantly when it starts, and the current drops rapidly when it stops. The current fluctuation of low-power equipment when it starts and stops is small, but the frequency is high. Based on these analyses of historical electricity consumption data, the start-stop frequency of each device is counted to form the equipment start-stop benchmark of the target user. For example, the start-stop frequency of the air conditioner is 2 times per hour, and the start-stop frequency of the electric furnace is 4 times per hour. Subsequently, the current data sequence is extracted from the real-time monitoring data set of the target user, and the peak detection algorithm is used to identify the moment when the current suddenly increases or decreases, that is, the mean and standard deviation of the current data sequence are calculated, and the value of a certain point is compared to see whether it satisfies the inequality |current value-mean|>k·standard deviation. If it does, it is regarded as a spike. Then the number of current spikes in a unit time (such as per hour or day) is counted to form a peak frequency feature. After that, the real-time peak frequency characteristics are compared with the historical equipment start-stop frequency benchmark. Under normal circumstances, the peak frequency is close to the start-stop benchmark and the deviation value is small. Under abnormal circumstances, the peak frequency is significantly higher or lower than the start-stop benchmark, indicating that the power consumption behavior does not match the equipment characteristics. For peak frequencies significantly lower than the start-stop benchmark, it may be that there is a device that is not recorded or an external device is used. For peak frequencies significantly higher than the start-stop benchmark, it may be that illegal loads are connected or the equipment is operating abnormally. According to the difference between the peak frequency characteristics and the start-stop benchmark, the absolute deviation value is calculated, and the difference between the absolute deviation value and the lower limit of the deviation value is calculated by ratio with the difference between the upper limit of the deviation value and the lower limit of the deviation value, and the absolute value is taken. Then, this absolute value is compared with 1. If it is greater than 1, the fifth abnormality score is set to 1. If it is less than 1, the absolute value is used as the fifth abnormality score. This fifth abnormality score is used to quantify the degree of abnormality of the equipment operation mode. Finally, the fifth anomaly score is weighted with the previously calculated comprehensive anomaly score (the result weighted by the fourth anomaly score) to adjust the alarm level of the target user, thereby improving the accuracy and efficiency of anomaly detection and alarm management.

[0048] Furthermore, the method further comprises:

[0049] Alarm records are made for the matched alarm levels, and a cumulative abnormal profile of the target user is established. The cumulative abnormal profile is subjected to time-series superposition abnormality discrimination, and a response plan is configured according to the discrimination results, and alarm management is performed based on the response plan.

[0050] Preferably, after the target user is alarmed, the current alarm level and related information will be recorded, including the source of the abnormal score (such as the first, second, third, fourth, and fifth abnormal scores), the trigger time, and the abnormal description. This information will be stored in the abnormal log in chronological order, and the user's cumulative statistical data, such as the number of alarms, the frequency of occurrence of different alarm levels, and the average value of the abnormal score, will be updated. These statistical information is used to construct a cumulative abnormal profile of the target user to describe the overall abnormal behavior characteristics of the user. The cumulative abnormal profile is based on historical alarm records and real-time data to extract the user's abnormal behavior intensity, high-frequency abnormal type, abnormal occurrence time distribution, and trend change characteristics. The intensity of abnormal behavior is measured by the sum and average of the abnormal scores, and the high-frequency abnormal type reflects the most common abnormal source of the user (such as abnormal equipment start-stop frequency or power ratio). At the same time, combined with the abnormal occurrence time distribution characteristics, it is identified whether the abnormal behavior is concentrated in certain time periods, such as nighttime or peak hours. The trend change characteristics are used to evaluate the dynamic change trend of the user's abnormal behavior in the short or long term, whether it is rising, falling, or fluctuating and stable. After establishing the abnormal profile, a time series superposition analysis is performed on it. By combining the short-term (such as the last 7 days) alarm records with the long-term (such as a month) trend, the abnormal behavior characteristics of the user are further identified. In the short-term superposition analysis, the cumulative value and average value of the abnormal score are statistically analyzed to determine whether there is an abnormal concentration, for example, multiple high-level alarms are triggered in a short period of time. In the long-term superposition analysis, the time series trend of the abnormal score is used to determine whether the user's abnormal behavior is in a continuous upward state. If the cumulative value of the short-term abnormal score is significantly higher than the average level, it is determined to be a short-term high-risk abnormality; if the long-term trend shows that the score continues to rise, it is determined to be a long-term continuous abnormality; if the abnormal behavior intensity is low and the trend is stable or declining, it is determined to be normal. Different response plans are configured according to the judgment results of the time series superposition. For short-term high-risk abnormalities, response measures are triggered immediately, and the power management department is notified to conduct on-site inspections. At the same time, the frequency of real-time data collection is increased to closely monitor the user's electricity consumption behavior. For long-term continuous abnormalities, a formal warning is sent to the user and it is recommended that the equipment be checked. If necessary, continuous monitoring is started to eliminate potential illegal loads or equipment failures. For normal behavior, only records are retained without further intervention. The execution results and feedback information of all response measures will be stored in the user log, which will be used to dynamically adjust the subsequent alarm management strategy. Through this process, the closed-loop management of alarm recording, abnormal profile construction, time series superposition analysis and response plan configuration is realized. Each step of the data serves the next step of analysis and management, thereby improving the accuracy of abnormal behavior monitoring and the pertinence of response.

[0051] Embodiment 2 is based on the same inventive concept as the anti-electricity theft detection and alarm method in the above embodiment. Figure 2As shown, the present application provides an anti-electricity theft detection and alarm device, wherein the device comprises:

[0052] The power consumption data collection module 11 is used to collect the power consumption data of the target user by using the smart meter and establish a historical power consumption data set, wherein the power consumption data includes current data, voltage data, and power factor data; the multi-granularity feature extraction module 12 is used to obtain the target user authentication of the historical power consumption data set, perform multi-granularity feature extraction of the authenticated historical power consumption data set based on the target user authentication result, and establish a multi-granularity feature extraction result; the behavior anomaly discrimination module 13 is used to obtain the real-time monitoring data set of the target user by using the smart meter, perform behavior anomaly discrimination on the real-time monitoring data set based on the multi-granularity feature extraction result, and establish a first anomaly score; the horizontal anomaly verification module 14 is used to Based on the multi-granularity feature extraction results, a joint similarity factor is established among all users, and the real-time electricity consumption data of the joint users is called through the joint similarity factor. The real-time electricity consumption data of the joint users and the joint similarity factor are used to perform horizontal anomaly verification of the real-time monitoring data set to establish a second anomaly score; an anomaly discrimination module 15 is used to establish a joint verification feature set, and the joint verification feature set includes environmental features and time period association features. The joint verification feature set is used to perform anomaly discrimination of the real-time monitoring data set to establish a third anomaly score; an alarm management module 16 is used to match the alarm level according to the first anomaly score, the second anomaly score, and the third anomaly score, and perform alarm management based on the matched alarm level.

[0053] In one embodiment, the abnormal behavior identification module 13 includes:

[0054] An abnormal behavior recognition network is constructed using multi-granularity feature extraction results, and multi-granularity weights of the abnormal behavior recognition network are configured, wherein the abnormal behavior recognition network includes a first granularity subnetwork, a second granularity subnetwork, and a third granularity subnetwork; based on the abnormal behavior recognition network, abnormal behavior recognition at different granularities is performed on a real-time monitoring data set, the granular abnormal behavior recognition results are weighted by the multi-granularity weights and then output, and a first abnormal score is established according to the output results.

[0055] In one embodiment, the lateral anomaly verification module 14 includes:

[0056] Through the preset threshold and joint similarity factor, the threshold of joint users is screened, the target joint user is established, the real-time electricity consumption data of the target joint user is extracted as the real-time electricity consumption data of the joint user, and the trust reconstruction is performed based on the joint similarity factor corresponding to the target joint user to establish the trust reconstruction result; the anomaly score verification of the independent characteristics and comprehensive characteristics of the real-time monitoring data set is performed based on the real-time electricity consumption data of the joint user, and the anomaly score verification result is established; the horizontal anomaly verification is completed through the trust reconstruction result and the anomaly score verification result.

[0057] In one embodiment, the abnormality determination module 15 includes:

[0058] The temperature data of the joint verification feature set is called, and the temperature data is used as the environmental feature to perform power consumption mapping fitting, and a first fitting tolerance factor is established; the time period data of the joint verification feature set is called, and the time period data is used as the time period associated feature to perform power consumption mapping fitting, and a second fitting tolerance factor is established; the fluctuation ratio data of the joint verification feature set is called, and the fluctuation ratio data is used as the self-check joint feature to perform anomaly identification of the real-time monitoring data set, and a self-check anomaly identification result is established; the anomaly discrimination is completed according to the first fitting tolerance factor, the second fitting tolerance factor, and the self-check anomaly identification result.

[0059] In one embodiment, the alarm management module 16 includes:

[0060] Based on the historical electricity consumption data set, a calibrated ratio value of the target user is obtained, and the calibrated ratio value includes the ratio of total electricity consumption to maximum power and the ratio of total electricity consumption to minimum power; the calibrated ratio value is used to perform additional verification of the real-time monitoring data set to establish a fourth anomaly score; the fourth anomaly score is used to adjust the matching alarm level, and alarm management is performed based on the adjustment result.

[0061] In one embodiment, the alarm management module 16 includes:

[0062] Based on the historical electricity consumption data set, reverse identification of electrical equipment is performed to establish the equipment start and stop frequency benchmark; current spike extraction is performed on the real-time monitoring data set to obtain the current spike frequency characteristics; deviation identification is performed based on the current spike frequency characteristics and the equipment start and stop frequency benchmark, and the fifth anomaly score is established based on the deviation identification result; and the matching alarm level is corrected based on the fifth anomaly score.

[0063] In one embodiment, the alarm management module 16 includes:

[0064] Alarm records are made for the matched alarm levels, and a cumulative abnormal profile of the target user is established. The cumulative abnormal profile is subjected to time-series superposition abnormality discrimination, and a response plan is configured according to the discrimination results, and alarm management is performed based on the response plan.

[0065] Embodiment 3, based on the same inventive concept as the anti-electricity theft detection and alarm method in the above embodiment, this embodiment provides an electronic device, Figure 3 The schematic diagram of the structure of the electronic device provided in the third embodiment of the present invention shows a block diagram of an exemplary electronic device suitable for implementing the implementation mode of the present invention. Figure 3 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention. Figure 3As shown, the electronic device includes a processor 21, a memory 22, an input device 23 and an output device 24; the number of processors 21 in the electronic device can be one or more. Figure 3 Taking a processor 21 as an example, the processor 21, memory 22, input device 23 and output device 24 in the electronic device can be connected through a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0066] Embodiment 4, based on the same inventive concept as the anti-electricity theft detection alarm method in the above embodiment, this embodiment provides a computer-readable storage medium, which can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the anti-electricity theft detection alarm method in the embodiment of the present application. The processor executes various functional applications and data processing of the computer device by running the software programs, instructions and modules stored in the memory, that is, realizing the above anti-electricity theft detection alarm method.

[0067] Any of the methods or steps described above may be stored as computer instructions or programs in various types of computer memories, and the computer instructions or programs may be recognized by various types of computer processors to implement any of the methods or steps described above.

[0068] Based on the above specific embodiments of the present invention, any improvements and modifications made to the present invention by those skilled in the art without departing from the principles of the present invention shall fall within the patent protection scope of the present invention.

Claims

1. A method for detecting and warning against electricity theft, characterized in that: The method comprises: Using smart meters to collect electricity consumption data of target users and establish a historical electricity consumption data set, wherein the electricity consumption data includes current data, voltage data, and power factor data; Obtain target user authentication of the historical electricity consumption data set, perform multi-granularity feature extraction of the authenticated historical electricity consumption data set based on the target user authentication result, and establish a multi-granularity feature extraction result; Using smart meters to obtain real-time monitoring data sets of target users, performing behavioral anomaly discrimination on the real-time monitoring data sets based on multi-granularity feature extraction results, and establishing a first anomaly score; Based on the multi-granularity feature extraction results, a joint similarity factor among all users is established, the real-time electricity consumption data of the joint users is called through the joint similarity factor, and the real-time electricity consumption data of the joint users and the joint similarity factor are used to perform horizontal anomaly verification of the real-time monitoring data set to establish a second anomaly score; Establishing a joint verification feature set, the joint verification feature set includes environmental features and time period related features, using the joint verification feature set to perform anomaly discrimination of the real-time monitoring data set, and establishing a third anomaly score; Alarm levels are matched according to the first abnormality score, the second abnormality score, and the third abnormality score, and alarm management is performed based on the matched alarm levels.

2. The anti-electricity theft detection and alarm method according to claim 1, characterized in that: The method of performing behavioral abnormality discrimination on the real-time monitoring data set based on the multi-granularity feature extraction result to establish a first abnormality score also includes: Constructing an abnormal behavior recognition network using the multi-granularity feature extraction results, and configuring multi-granularity weights of the abnormal behavior recognition network, wherein the abnormal behavior recognition network includes a first granularity subnetwork, a second granularity subnetwork, and a third granularity subnetwork; Based on the abnormal behavior recognition network, abnormal behaviors at different granularities are recognized for the real-time monitoring data set, and the granular abnormal behavior recognition results are weighted by multi-granularity weights and then output, and a first abnormal score is established according to the output results.

3. The anti-electricity theft detection and alarm method according to claim 1, characterized in that: Before the horizontal anomaly verification of the real-time monitoring data set using the combined user real-time electricity consumption data and the combined similarity factor is performed, the method further includes: The joint user threshold is screened by preset thresholds and joint similarity factors, the target joint user is established, the real-time electricity consumption data of the target joint user is extracted as the real-time electricity consumption data of the joint user, and trust reconstruction is performed based on the joint similarity factors corresponding to the target joint user to establish a trust reconstruction result; Based on the real-time electricity consumption data of joint users, the anomaly score verification of independent features and comprehensive features of the real-time monitoring data set is carried out, and the anomaly score verification results are established; The horizontal anomaly verification is completed through the trust reconstruction results and anomaly score verification results.

4. The anti-electricity theft detection and alarm method according to claim 1, characterized in that: The method of using the joint verification feature set to perform abnormal identification of the real-time monitoring data set also includes: Call the temperature data of the joint verification feature set, use the temperature data as the environmental feature to perform power consumption mapping fitting, and establish the first fitting tolerance factor; Call the time period data of the joint verification feature set, use the time period data as the time period associated feature to perform power consumption mapping fitting, and establish a second fitting tolerance factor; Call the fluctuation ratio data of the joint verification feature set, use the fluctuation ratio data as the self-check joint feature to perform anomaly recognition of the real-time monitoring data set, and establish the self-check anomaly recognition result; The abnormality discrimination is completed according to the first fitting tolerance factor, the second fitting tolerance factor, and the self-checking abnormality identification result.

5. The anti-electricity theft detection and alarm method according to claim 1, characterized in that: The matching of the alarm levels according to the first abnormality score, the second abnormality score, and the third abnormality score, and performing alarm management based on the matched alarm levels, further includes: Acquire a calibration ratio value of the target user based on a historical power consumption data set, wherein the calibration ratio value includes a ratio of total power consumption to maximum power and a ratio of total power consumption to minimum power; performing additional verification of the real-time monitoring data set using the calibration ratio value to establish a fourth anomaly score; The matched alarm level is adjusted according to the fourth abnormality score, and alarm management is performed based on the adjustment result.

6. The anti-electricity theft detection and alarm method according to claim 1, characterized in that: The method further comprises: Reversely identify power-consuming equipment based on historical power consumption data sets and establish a benchmark for equipment start and stop frequency; Extract current spikes from real-time monitoring data sets to obtain current spike frequency characteristics; Deviating from the current peak frequency characteristics and the equipment start-stop frequency benchmark is performed, and a fifth abnormality score is established based on the deviation identification result; The matched alarm level is modified according to the fifth anomaly score.

7. The anti-electricity theft detection and alarm method according to claim 1, characterized in that: The method further comprises: Alarms are recorded for the matching alarm levels, and a cumulative abnormal profile of the target user is established; Perform time-series superposition of abnormality identification on the accumulated abnormality portraits, configure response plans according to the identification results, and perform alarm management based on the response plans. 8.An anti-electricity theft detection and alarm device, characterized in that: A device for implementing an anti-electricity theft detection and alarm method according to any one of claims 1 to 7, comprising: An electricity consumption data collection module is used to collect electricity consumption data of target users using smart meters and establish a historical electricity consumption data set, wherein the electricity consumption data includes current data, voltage data, and power factor data; A multi-granularity feature extraction module is used to obtain target user authentication of the historical electricity consumption data set, perform multi-granularity feature extraction of the authenticated historical electricity consumption data set based on the target user authentication result, and establish a multi-granularity feature extraction result; A behavior anomaly identification module is used to obtain a real-time monitoring data set of a target user using a smart meter, perform behavior anomaly identification on the real-time monitoring data set based on a multi-granularity feature extraction result, and establish a first anomaly score; A horizontal anomaly verification module is used to establish a joint similarity factor among all users based on the multi-granularity feature extraction result, call the real-time electricity consumption data of the joint users through the joint similarity factor, use the real-time electricity consumption data of the joint users and the joint similarity factor to perform horizontal anomaly verification of the real-time monitoring data set, and establish a second anomaly score; An anomaly discrimination module is used to establish a joint verification feature set, wherein the joint verification feature set includes environmental features and time period related features, and uses the joint verification feature set to perform anomaly discrimination of the real-time monitoring data set to establish a third anomaly score; The alarm management module is used to match the alarm level according to the first abnormality score, the second abnormality score, and the third abnormality score, and perform alarm management based on the matched alarm level.

9. An electronic device, characterized in that: The electronic device comprises: a processor; and a memory for storing instructions executable by the processor; wherein the processor is used to execute the anti-electricity theft detection and alarm method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, so the computer program is used to execute the anti-electricity theft detection and alarm method according to any one of claims 1 to 7.

Images