Intelligent power grid anomaly detection method and system based on graph neural network

Abstract

The invention relates to an intelligent power grid anomaly detection method and system based on a graph neural network, and the method comprises the steps: processing the data of an intelligent power grid, converting the flow data into a graph structure, and enabling the graph structure to serve as the input of a model based on a space-time graph neural network; extracting potential representation of each node in the source graph and the target graph through a shared encoder, and generating node embedding; whether the nodes on the source graph are abnormal or not is distinguished through an abnormal classifier; a domain discriminator is utilized to distinguish whether embedding of nodes is from a source graph or a target graph, so that an adversarial domain is executed to enable an encoder to be subjected to adversarial training to deceive the domain discriminator, and adversarial domain adaptation is executed in a minimum-maximum game; the difference between the source image and the target image is bridged by maximizing the loss function of the domain discriminator; after node embedding is generated by using the shared encoder, detecting the exception on the target graph through an exception classifier; by minimizing the complete loss function, the shared encoder completes domain conversion between the source map and the target map and maintains an anomaly classifier.

Description

Technical Field

[0001] The present invention relates to a smart grid anomaly detection method and system based on graph neural network, belonging to the field of smart grid. Background Art

[0002] The emergence of the Internet of Things (IoT) has promoted the development of cyber-physical systems (CPSs), which build a complex communication system on top of the physical network by integrating the information flow between several interconnected sensors and controllers. As a cyber-physical system, the smart grid deploys a large number of sensors, measurement devices, and controllers on top of the grid. As more and more grid data is collected by sensors and transmitted to the control center through the network, the control center issues instructions to the controllers in the grid to perform critical tasks based on the collected data. However, due to the high integration of the communication network and the power network in the cyber-physical system, attacks on the communication network will not only affect the operation of the communication network, but also have a serious impact on the power network, leading to serious consequences such as grid failure.

[0003] like Figure 2 As shown, the communication network contains three control centers X1, X2 and X3, and the power network contains two generators Y2 and Y3 and two power relay nodes Y1 and Y4. If X2 fails due to some attack in the communication network, it will cause the Y2 generator to stop working in the power system network, and the corresponding two relay nodes Y1 and Y4 will also fail in the power network, which will cause X1 and X3 to fail in the communication network. According to the cascading failure in the coupled network, this may eventually lead to the collapse of the entire power network. Therefore, ensuring network security in smart grids is crucial to national security.

[0004] Deep learning is widely used in anomaly detection in cyber-physical systems due to its powerful data abstraction capability and ability to extract potential connections between data in communication networks. Considering that the devices in the Industrial Internet of Things (IIoT) are interconnected, such as Figure 2As shown in Figure 1, graphs are usually used to represent the spatial relationship between devices. However, traditional deep learning models are mainly used to process data with regular structures (Euclidean structures), such as images and texts, and they are not sufficient to effectively encode spatial information in complex non-Euclidean structures such as graphs. In contrast, graph neural networks extend deep neural networks to graph structured data by jointly encoding network structure and node features, making them more suitable for anomaly detection in smart grids using spatial information. For example, weather data obtained from sensor measurements are processed using graph neural networks to determine the possibility of power outages. In recent studies, relevant scholars have also proposed using graph convolutional networks (GCNs) to analyze the nonlinear relationship mapping from dissolved gas types to transformer fault types. However, after severe weather or dissolved gas threats to the power grid occur, only a simple mapping between weather and dissolved gas and abnormal events in the smart grid can be constructed. It is impossible to integrate data from different domains (communication layer, power layer, and transmission layer) in the smart grid in the neural network model, and it is impossible to comprehensively consider the impact of weather and dissolved gas on the power grid, resulting in inaccurate prediction results. However, in smart grids, changes in grid topology often indicate that anomalies have occurred, and traditional anomaly detection models for cyber-physical systems based on spatiotemporal graph neural networks cannot be directly applied to smart grids.

[0005] The Chinese patent document with publication number CN117347783A discloses a method for locating faulty lines in a distribution network based on a graph neural network. The main steps of the method are: 1) abstracting the distribution network into graph data; 2) extracting the structural information of the graph and the attribute information of the nodes as the input of the model; 3) abstracting and compressing the node features in the graph using a variational graph autoencoder (VGAE); 4) locating the faulty lines in the distribution network based on the Graph SAGE model. The present invention fully explores the correlation between the distribution network lines, can more naturally reflect the distribution network operation law in real scenarios, and can accurately locate the faulty line section under the conditions of noise interference, high-resistance grounding faults, and distributed power supply access. The prediction results can provide auxiliary decision support for distribution operation and maintenance managers on the premise of meeting the accuracy requirements. However, this method only locates faults based on the operation law of the distribution network, cannot perform cross-domain anomaly detection or prediction in the smart grid, and cannot comprehensively consider the impact of other factors such as weather on the power grid. Summary of the invention

[0006] The purpose of the present invention is to provide a smart grid anomaly detection method and system based on graph neural network, so as to solve the problem of inaccurate anomaly prediction caused by simply combining the influence of a single factor on the power grid in the prior art.

[0007] To achieve the above object, the solution of the present invention includes:

[0008] A method for detecting anomalies in a smart grid based on a graph neural network of the present invention comprises the following steps:

[0009] Process the communication layer, power layer, and transport layer data sets, convert the traffic data into a graph structure as the input of the model based on spatiotemporal graph neural network;

[0010] In the spatiotemporal graph neural network-based model, the latent representation of each node in the source graph representing the communication layer and the transmission layer and the target graph representing the power layer is extracted through a shared encoder to generate node embeddings; after the shared encoder extracts the latent representation of the node, an anomaly classifier is used to distinguish whether the node on the source graph is abnormal; a domain discriminator is used to distinguish whether the node embedding is from the source graph or the target graph, thereby performing an adversarial domain so that the encoder is adversarially trained to deceive the domain discriminator, and adversarial domain adaptation is performed in a minimax game; the difference between the source graph and the target graph is bridged by maximizing the domain discriminator loss function; after generating node embeddings using the shared encoder, anomalies on the target graph are detected by an anomaly classifier; by minimizing the complete loss function, the shared encoder completes the domain conversion between the source graph and the target graph and maintains the anomaly classifier.

[0011] Furthermore, the model based on spatiotemporal graph neural network is obtained through the following steps:

[0012] 2.1) Represent the time step set as Semi-supervised anomaly detection using attribute graph G = (A, X) where is a symmetric adjacency matrix of n nodes, is the node feature matrix on T time slices, where d is the dimension of the node feature; in the acquisition of geographical location information, the node features obtained from the prediction at time T+1 are used as the features of the power network and transmission network for cross-domain anomaly detection;

[0013] 2.2) Graph neural networks obtain node representations by aggregating network structures and features. The feature information of nodes is propagated through the network topology, and node embedding is generated through the information obtained by node aggregation;

[0014] 2.3) Use information transfer to define the graph neural network, the formula used is:

[0015]

[0016] in, represents the computational embedding after l propagations of the graph neural network, is the symmetric normalized adjacency matrix, W (l) is the weighting matrix, when l = 0,

[0017] 2.4) Communication network prediction is to simultaneously capture the high correlation in the temporal and spatial dimensions of adjacent data points in different layers of the network measured by sensor nodes, so as to accurately predict the state of the information network at the future moment;

[0018] 2.5) The model based on spatiotemporal graph neural network includes a GCGRU layer and a fully connected layer; the network composed of sensor measurement data is represented as an undirected graph, and the GCGRU is defined as follows:

[0019]

[0020]

[0021] H (t) =u (t) H (t-1) +(1- (t) )C (t)

[0022] Among them, σ represents the nonlinear activation function, X (t) and H (t) Represent the input and output at time t, r (t) and u (t) Respectively represent the reset and update at time t;

[0023] 2.6) After obtaining the hidden variable H of the communication network at time t (t) Afterwards, use MLP to predict the network status at time t+1:

[0024]

[0025] Where b is a constant;

[0026] 2.7) The prediction model tends to minimize the negative log-likelihood of the prediction when the prediction function is When , the loss function of the prediction model is defined as:

[0027]

[0028] By minimizing the loss function Predict the network status of the communication network at the next moment.

[0029] Furthermore, the shared encoder is constructed by Graph SAGE to extract the latent representation of each node in the source and target graphs. In the lth layer, the node v i The representation of the l+1th layer is obtained by integrating the features of adjacent nodes in the following way:

[0030]

[0031] in, is node v i The set of neighbor nodes of , i and j represent the i-th and j-th nodes respectively.

[0032] Furthermore, given a node v generated by a shared encoder i The potential representation is z i , the domain discriminator Dis is constructed using an MLP with tanh nonlinearity, and its sigmoid function is as follows:

[0033] p i =tanh(W a z i +b d )

[0034]

[0035] Among them, p i is the output of MLP, b d is a constant in the corresponding domain label d, is the predicted domain label, u is a trainable weight vector, so the discriminator loss function is:

[0036]

[0037] Where N represents the number of all nodes in different graphs, d i Represents node v i The domain label of , i represents the i-th node. Further, the anomaly classifier is constructed by MLP with tanh nonlinearity, and its sigmoid function is as follows:

[0038] q i =tamh(W c z i +b c )

[0039]

[0040] Among them, b c represents a constant corresponding to the anomaly classifier c;

[0041] The anomaly classification loss function is:

[0042]

[0043] Among them, N S represents the number of nodes sampled from the labeled source graph, y i and Respectively represent the node v i The true anomaly label and predicted anomaly label of , i and j represent the i-th and j-th nodes respectively.

[0044] Furthermore, the complete loss function is expressed as:

[0045]

[0046] Furthermore, the power layer data includes power data and weather data related to the smart grid.

[0047] Furthermore, the shared encoder is also used to train all parameters in the spatiotemporal graph neural network based model using the back-propagation algorithm.

[0048] A smart grid anomaly detection system based on a graph neural network of the present invention includes a processor, and the processor is used to execute a smart grid anomaly detection method based on a graph neural network.

[0049] The beneficial effects of the present invention are:

[0050] This invention is a pioneering invention. First, the data set in the existing smart grid is processed, and the flow data is converted into a graph structure as the input of the model based on the spatiotemporal graph neural network to ensure the effective integration of feature information and generate a graph structure. Secondly, the attention mechanism is introduced as the node state update function, and multiple Graph SAGE layers are combined to realize the dimensionality reduction extraction of interactive features and the mining of high-order structural information. Finally, the abnormal information from the communication system and the transmission system is used to analyze the deviation between the actual data and the normal data learned by the model, so as to generate anomaly scores to classify nodes and complete anomaly detection. In the smart grid, various factors such as weather can be comprehensively considered to perform cross-domain data analysis to complete anomaly prediction or detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a flow chart of a smart grid anomaly detection method based on graph neural network;

[0052] Figure 2 It is the mutual coupling diagram between the power network and the communication network in the cyber-physical system;

[0053] Figure 3 It is a plurality of information network diagrams with the same topology structure measured by power network sensors;

[0054] Figure 4 It is a mutual coupling diagram of power network, communication network and transmission network. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0056] The idea of ​​the present invention is that as more and more intelligent, information-based and automated equipment are integrated into the power network, the power system is transformed from a traditional physical power grid to an information-physical system that can integrate real-time perception, dynamic control and information decision-making. The construction of this system has a new impact on the vulnerability of the power grid. The present invention provides a method and system for detecting anomalies in a smart grid based on a graph neural network. The method introduces a graph neural network into the smart grid scenario. After obtaining multiple data measured by the grid sensor nodes that affect the grid load, the spatiotemporal graph neural network is used to capture the spatiotemporal dependencies of these data to predict the state of the information network at a future time and simulate the dynamic changes of the grid state; using cross-domain collaboration technology, after obtaining the attribute values ​​related to the grid, attribute values ​​are assigned to the power network and transmission network nodes according to the geographical proximity to represent the values ​​of the relevant factors affecting the nodes in the future time. The method uses the abnormal information from the communication system and the transmission system to assist the power system in abnormal detection, explores the deep-level relationship problems between the communication network, the power network and the transmission network requests, processes the existing communication layer data set, and converts the flow data into a graph structure as the input of the model to ensure the effective integration of feature information.

[0057] In the present invention, the difference between different domains is bridged by maximizing the domain discriminator loss function. After the shared encoder extracts the node representation, the domain labels of the nodes in different graphs cannot be accurately identified by the domain discriminator. Therefore, an anomaly classifier is trained after the shared encoder to distinguish whether the nodes on the source graph are anomalies. After generating node embeddings using the shared encoder, the anomaly classifier can be directly used to detect anomalies on the target graph. By minimizing the complete loss function, the shared encoder completes the domain conversion between the source and target graphs, maintains a powerful anomaly classifier, and uses the back-propagation algorithm to train all parameters in the model.

[0058] Method Example:

[0059] A method for detecting anomalies in smart grids based on graph neural networks is proposed. The graph neural network used in this method extends deep neural networks to graph structure data by jointly encoding network structure and node features, making it more suitable for using spatial information to detect anomalies in smart networks. Figure 1 As shown, the technical solution of this method specifically includes the following steps:

[0060] 1) Graph structure generation: Process the data sets of the communication layer, power layer, and transmission layer; the components of the communication layer, power layer, and transmission layer are as follows: Figure 4 as shown; Figure 3 As shown, the power layer data includes power data related to the smart grid and weather data. The flow data is converted into a graph structure and used as the input of the model based on the spatiotemporal graph neural network to ensure the effective integration of feature information.

[0061] 2) Training models based on spatiotemporal graph neural networks and pattern learning based on spatiotemporal graph neural networks: Dividing time windows, introducing attention mechanisms as node state update functions, combining multiple graph sampling and aggregation layers (Graph SAGE) to achieve dimensionality reduction extraction of interactive features and mining of high-order structural information, and using information transfer to define graph neural networks, including:

[0062] 2.1) Represent the time step set as Semi-supervised anomaly detection using attribute graph G = (A, X) where is a symmetric adjacency matrix of n nodes, is the node feature matrix on T time slices, where d is the dimension of the node feature; in the acquisition of geographical location information, the node features obtained from the prediction at time T+1 are used as the features of the power network and transmission network for cross-domain anomaly detection;

[0063] 2.2) Graph neural networks effectively obtain node representations by aggregating network structures and features. The feature information of nodes is propagated through the network topology, and node embedding is generated through the information obtained through node aggregation;

[0064] 2.3) Use information transfer to define the graph neural network, the formula used is:

[0065]

[0066] in, represents the computational embedding after l propagations of the graph neural network, is the symmetric normalized adjacency matrix, W (l) is the weighting matrix, when l = 0,

[0067] 2.4) Communication network prediction is to simultaneously capture the high correlation in the temporal and spatial dimensions of adjacent data points in different layers of the network measured by sensor nodes, so as to accurately predict the state of the information network at the future moment;

[0068] 2.5) The model based on spatiotemporal graph neural network includes a graph convolution gated recursive unit (GCGRU) layer and a fully connected layer; the network composed of sensor measurement data is represented as an undirected graph, and GCGRU can be defined as follows:

[0069]

[0070] H (t) =u(t) H (t-1) +(1-u (t) )C (t)

[0071] Among them, σ represents the nonlinear activation function, X (t) and H (t) Represent the input and output at time t, r (t) and u (t) Respectively represent the reset and update at time t;

[0072] 2.6) After obtaining the hidden variable H of the communication network at time t (t) Afterwards, a multi-layer perceptron (MLP) is used to predict the network status at time t+1:

[0073]

[0074] Where b is an arbitrary constant;

[0075] 2.7) The prediction model tends to minimize the negative log-likelihood of the prediction when the prediction function is When , the loss function of the prediction model is defined as:

[0076]

[0077] By minimizing the loss function The network status of the communication network at the next moment can be predicted.

[0078] In the model based on spatiotemporal graph neural network, the composition of communication network, power network and transmission network is as follows: Figure 4 As shown, the communication network (communication layer) corresponds to the communication system in the figure, the power network (power layer) corresponds to the power system in the figure, and the transmission network (transmission layer) corresponds to the transmission system in the figure.

[0079] 3) Cross-domain anomaly detection: Utilize anomaly information from the communication system and transmission system to analyze the deviation between the real data and the normal data learned by the model, thereby generating anomaly scores to classify nodes and complete anomaly detection. By maximizing the above loss function to bridge the gap between different domains, after the encoder extracts the node representation, the domain labels of nodes in different graphs cannot be accurately identified by the domain discriminator. After the shared encoder, an anomaly classifier is trained to distinguish whether the nodes on the source graph are anomalies. The specific steps include:

[0080] 3.1) After obtaining the attribute values ​​related to the smart grid, attribute values ​​are assigned to the power network and transmission network nodes according to the geographical proximity to represent the values ​​of the relevant factors that affect the nodes in the future. In order to use the abnormal information in the communication network and the transmission network to assist in the detection of power grid anomalies, it is necessary to first realize the domain adaptation of different domain graphs, that is, to learn the domain-invariant representation of the combined samples of the source domain and the target domain;

[0081] 3.2) Using the shared encoder built with Graph SAGE, we extract the latent representation of each node in the source and target graphs. In layer l, node v i The representation of the l+1th layer is obtained by integrating the features of adjacent nodes in the following way:

[0082]

[0083] in, is node v i The set of neighbor nodes, i and j represent the i-th and j-th nodes respectively;

[0084] 3.3) The above shared encoder can map learned node representations from different graphs into aligned embedding spaces and further achieve knowledge transfer between graphs from different domains;

[0085] 3.4) To further enhance the domain adaptation capability of the shared encoder, the idea of ​​adversarial learning is used to utilize a domain discriminator to distinguish whether the embedding of a node is from a source graph or a target graph, thereby performing adversarial domain adaptation. The shared encoder is adversarially trained to deceive the domain discriminator, performing adversarial domain adaptation in a minimax game.

[0086] 3.5) Given the node v generated by the above shared encoder i The potential representation is z i , i represents the i-th node. The domain discriminator Dis is constructed using an MLP with tanh nonlinearity, and its sigmoid function is as follows:

[0087] p i =tamh(W d z i +b d )

[0088]

[0089] Among them, p i is the output of MLP, b d is a constant in the corresponding domain label d, is the predicted domain label and u is a trainable weight vector. Therefore, the domain discriminator loss can be formulated as:

[0090]

[0091] Where N represents the number of all nodes in different graphs, d i Represents node v i The domain label of , i represents the i-th node;

[0092] 3.6) Bridge the gap between different domains by maximizing the above domain discriminator loss function. After the shared encoder extracts the node representation, the domain labels of nodes in different graphs cannot be accurately identified by the domain discriminator. An anomaly classifier is trained after the shared encoder to distinguish whether a node on the source graph is an anomaly or not;

[0093] 3.7) The sigmoid function of the MLP with tanh nonlinearity to construct anomaly classifier is as follows:

[0094] q i =tanh(W c z i +b c )

[0095]

[0096] Among them, b c represents a constant corresponding to the anomaly classifier c;

[0097] The anomaly classification loss can be formulated as:

[0098]

[0099] Among them, N S represents the number of nodes sampled from the labeled source graph, y i and Respectively represent the node v i The true anomaly labels and predicted anomaly labels of , i and j represent the i-th and j-th nodes respectively. After generating node embeddings using the shared encoder, the anomaly classifier can be directly used to detect anomalies on the target graph;

[0100] 3.8) After generating node embeddings using the shared encoder, the anomaly classifier can be directly used to detect anomalies on the target graph. Therefore, the complete functionality of cross-domain anomaly detection can be expressed as follows:

[0101]

[0102] By minimizing the above full loss function, the shared encoder completes the domain conversion between source and target images and maintains a strong anomaly classifier, and uses the back-propagation algorithm to train all parameters in this model.

[0103] In summary, the present invention first processes the existing data sets in the smart grid, converts the flow data into a graph structure and uses it as the input of the model based on the spatiotemporal graph neural network to ensure the effective integration of feature information and generate a graph structure; secondly, the attention mechanism is introduced as the node state update function, and multiple Graph SAGE layers are combined to achieve dimensionality reduction extraction of interactive features and mining of high-order structural information; finally, the abnormal information from the communication system and the transmission system is used to analyze the deviation between the actual detection data and the normal data learned by the model, so as to generate anomaly scores to classify nodes and complete anomaly detection.

[0104] System Example:

[0105] This embodiment provides a smart grid anomaly detection system based on a graph neural network, including a processor for implementing a smart grid anomaly detection method based on a graph neural network. The smart grid anomaly detection method based on a graph neural network has been introduced clearly enough in the method embodiment and will not be repeated here.

Claims

1. A smart grid anomaly detection method based on graph neural network, characterized in that: The steps include: Process the communication layer, power layer, and transport layer data sets, convert the traffic data into a graph structure as the input of the model based on spatiotemporal graph neural network; In the model based on spatiotemporal graph neural network, the potential representation of each node in the source graph representing the communication layer and the transmission layer and the target graph representing the power layer is extracted by a shared encoder to generate node embedding; after the shared encoder extracts the potential representation of the node, an abnormal classifier is used to distinguish whether the node on the source graph is abnormal; A domain discriminator is used to distinguish whether the embedding of a node is from the source graph or the target graph, thereby performing an adversarial domain so that the encoder is adversarially trained to deceive the domain discriminator and perform adversarial domain adaptation in a minimax game; the difference between the source graph and the target graph is bridged by maximizing the domain discriminator loss function; after using a shared encoder to generate node embeddings, anomalies on the target graph are detected by an anomaly classifier; by minimizing the full loss function, the shared encoder completes the domain conversion between the source graph and the target graph and maintains the anomaly classifier.

2. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 1, characterized in that: The model based on spatiotemporal graph neural network is obtained by the following steps: 2.1) Represent the time step set as Semi-supervised anomaly detection using attribute graph G = (A, X) where is a symmetric adjacency matrix of n nodes, is the node feature matrix on T time slices, where d is the dimension of the node feature; The information obtained at the geographical location is used to use the node features obtained from the prediction at time T+1 as the features of the power network and transmission network for cross-domain anomaly detection; 2.2) Graph neural networks obtain node representations by aggregating network structures and features. The feature information of nodes is propagated through the network topology, and node embedding is generated through the information obtained by node aggregation; 2.3) Use information transfer to define the graph neural network, the formula used is: in, represents the computational embedding after l propagations of the graph neural network, is the symmetric normalized adjacency matrix, W (l) is the weighting matrix, when l = 0, 2.4) Communication network prediction is to simultaneously capture the high correlation in the temporal and spatial dimensions of adjacent data points in different layers of the network measured by sensor nodes, so as to accurately predict the state of the information network at the future moment; 2.5) The model based on spatiotemporal graph neural network includes a GCGRU layer and a fully connected layer; the network composed of sensor measurement data is represented as an undirected graph, and the GCGRU is defined as follows: H (t) =u (t) H (t-1) +(1-u (t) )C (t) Among them, σ represents the nonlinear activation function, X (t) and H (t) Represent the input and output at time t, r (t) and u (t) Respectively represent the reset and update at time t; 2.6) After obtaining the hidden variable H of the communication network at time t (t) Afterwards, use MLP to predict the network status at time t+1: Where b is a constant; 2.7) The prediction model tends to minimize the negative log-likelihood of the prediction when the prediction function is When , the loss function of the prediction model is defined as: By minimizing the loss function Predict the network status of the communication network at the next moment.

3. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 1, characterized in that: The shared encoder is constructed by Graph SAGE. When extracting the potential representation of each node in the source graph and the target graph, in the lth layer, the node υ i The representation of the l+1th layer is obtained by integrating the features of adjacent nodes in the following way: in, is node v i The set of neighbor nodes of , i and j represent the i-th and j-th nodes respectively.

4. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 1, characterized in that: Given a node v generated by the shared encoder i The potential representation is z i , the domain discriminator Dis is constructed using an MLP with tanh nonlinearity, and its sigmoid function is as follows: p i =tanh(W d z i +b d ) Among them, p i is the output of MLP, bd is the constant in the corresponding domain label d, is the predicted domain label, u is a trainable weight vector, so the discriminator loss function is: Where N represents the number of all nodes in different graphs, d i Represents node v i The domain label of , i represents the i-th node.

5. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 4, characterized in that: The anomaly classifier is constructed by MLP with tanh nonlinearity, and its sigmoid function is as follows: q i =tanh(W c z i +b c ) Among them, b c represents a constant corresponding to the anomaly classifier c; The anomaly classification loss function is: Among them, N S represents the number of nodes sampled from the labeled source graph, y i and Respectively represent the node v i The true anomaly label and predicted anomaly label of , i and j represent the i-th and j-th nodes respectively.

6. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 5, characterized in that: The complete loss function is expressed as:

7. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 1, characterized in that: The power layer data includes power data and weather data related to the smart grid.

8. The method for detecting anomalies in a smart grid based on a graph neural network according to claim 1, characterized in that: The shared encoder is also used to train all parameters in the spatiotemporal graph neural network based model using a back-propagation algorithm.

9. A smart grid anomaly detection system based on a graph neural network, comprising a processor, characterized in that: The processor is used to execute the smart grid anomaly detection method based on graph neural network as described in any one of claims 1 to 8.

Images