Power grid terminal behavior detection method and system based on big data

Abstract

The invention discloses a power grid terminal behavior detection method and system based on big data, and relates to the technical field of power grid terminal behavior detection. The method comprises the steps of collecting power grid data and user behavior data of a power grid node, and judging whether a power grid terminal behavior is abnormal; if the power grid terminal behavior is judged to be abnormal, extracting node abnormal data of the power grid node, and estimating to obtain a terminal estimation behavior of the power grid terminal; obtaining a topological structure diagram of the power grid nodes, searching for associated nodes of the power grid nodes, collecting power grid data of the associated nodes, and confirming to obtain terminal abnormal behaviors of the power grid terminal; acquiring all abnormal nodes, and determining an abnormal range in combination with the topological structure diagram to obtain an abnormal degree of the power grid terminal; and forming a detection result of the power grid terminal behavior by combining the terminal abnormal behavior and the abnormal degree of the power grid terminal, and transmitting the detection result to the user side. The timeliness of power grid terminal behavior detection based on big data is improved.

Description

Technical Field

[0001] The present application relates to the technical field of power grid terminal behavior detection, and in particular to a power grid terminal behavior detection method and system based on big data. Background Art

[0002] Grid terminal behavior detection refers to the monitoring and analysis of the behavior of various terminal devices in the power grid. These terminal devices play a vital role in the power grid, responsible for tasks such as data collection, transmission, processing and control. The normality of their behavior is directly related to the stable operation of the power grid and the quality of power supply. By monitoring the behavior of the power grid terminal in real time, the abnormal behavior of the terminal device can be discovered and handled in time, thereby avoiding the adverse effects of these abnormal behaviors on the stable operation of the power grid. In the existing power grid terminal behavior detection, it is generally based on the power grid terminal log and power grid terminal data for detection, and the log data of the power grid terminal behavior is not always transmitted to other power grid nodes in real time, which will cause other power grid nodes to fail to detect the abnormal behavior of the power grid terminal in time, thereby increasing the loss and damage caused by abnormal behavior to the power grid. Summary of the invention

[0003] The purpose of the present invention is to provide a method and system for detecting power grid terminal behavior based on big data to solve the problems raised in the above background technology.

[0004] In the first aspect, the present application provides a method for detecting power grid terminal behavior based on big data, which adopts the following technical solution: Collect grid data and user behavior data of grid nodes, and determine whether the grid terminal behavior is abnormal based on the grid data and user behavior data; If it is determined that the behavior of the power grid terminal is abnormal, the node abnormal data of the power grid node is extracted, and the terminal estimated behavior of the power grid terminal is estimated based on the node abnormal data; Obtain a topological structure diagram of the power grid node, find the associated nodes of the power grid node according to the topological structure diagram, collect power grid data of the associated nodes, verify the estimated behavior of the terminal, and confirm the abnormal behavior of the terminal of the power grid according to the verification result; Obtain all abnormal nodes, confirm the abnormal range in combination with the topological structure diagram, and obtain the abnormal degree of the power grid terminal based on the abnormal range; The abnormal behavior and degree of abnormality of the power grid terminal are combined to form the detection result of the power grid terminal behavior and transmitted to the user end.

[0005] Preferably, the step of collecting grid data and user behavior data of grid nodes, and judging whether the grid terminal behavior is abnormal according to the grid data and user behavior data, is specifically: Collecting real-time grid data of grid nodes, wherein the real-time grid data includes real-time electricity data, real-time voltage data and real-time power data; Collecting historical grid data of grid nodes, wherein the historical grid data includes historical electricity data, historical voltage data and historical power data; Compare and obtain the data similarity between the real-time power grid data and the historical power grid data, and obtain the power grid abnormality according to the data similarity; Collect user behavior data of power grid nodes, and obtain the abnormality of user behavior based on the user behavior data analysis; The terminal abnormality of the power grid terminal behavior is estimated by combining the power grid abnormality and the behavior abnormality, and it is judged whether the terminal abnormality reaches the preset terminal abnormality threshold. If it reaches the terminal abnormality threshold, it is judged that the power grid terminal behavior is abnormal, otherwise it is judged that the power grid terminal behavior is not abnormal.

[0006] Preferably, the step of collecting user behavior data of power grid nodes and obtaining the degree of abnormal behavior of user behavior according to the user behavior data analysis is specifically: Acquire real-time time points, and collect real-time behavior data of users of power grid nodes at real-time time points, wherein the real-time behavior data includes user operation data, user interaction data, and user activity data; Acquire historical behavior data, wherein the historical behavior data includes historical operation data, historical interaction data, and historical activity data; Compare user operation data with historical operation data to obtain the degree of operation abnormality; Compare user interaction data with historical interaction data to obtain interaction anomaly degree; Compare user activity data with historical activity data to obtain activity abnormality; The abnormality of user behavior is comprehensively obtained by combining the abnormality of operation, abnormality of interaction and abnormality of activity.

[0007] Preferably, the step of comparing the user operation data with the historical operation data to obtain the degree of operation abnormality is specifically: Collect the usage time periods of different electrical appliances, and find the appliances that are used in real time according to the real-time time points and record them as the used appliances; The average operating frequency of electrical appliances operated by users is collected and recorded as real-time frequency, and the average operating frequency of electrical appliances used when the power grid is fault-free is extracted from historical operating data and recorded as standard frequency; Calculate the frequency difference between the real-time frequency and the standard frequency, and sum up the frequency differences of all electrical appliances in use to obtain the frequency difference of the electrical appliances; The appliance alarm frequency and appliance failure frequency of all users are collected, and the user's operation abnormality degree is obtained by combining the appliance frequency difference.

[0008] Preferably, the step of comparing the user interaction data with the historical interaction data to obtain the interaction abnormality degree is specifically: Obtain interactive applications between users and the power grid, count the real-time login volume of all interactive applications, and count the interactive information volume of all interactive applications; Count the real-time complaints of all interactive applications, and combine the real-time login volume and interactive information volume to obtain the real-time interaction value; Obtain historical interaction data, calculate the average of interaction values ​​at different time points and record it as the interaction standard value; Determine whether the real-time interaction value is greater than the interaction standard value. If so, calculate the difference between the real-time interaction value and the interaction standard value as the interaction abnormality. If it is not greater than the interaction difference, the interaction anomaly is 0.

[0009] Preferably, the step of comparing the user activity data with the historical activity data to obtain the activity abnormality degree is specifically: Setting a grid anomaly standard, determining whether the grid anomaly is within the grid anomaly standard, and if it is within the grid anomaly standard, extracting user activity features based on user activity data; Extracting standard activity features at a time point corresponding to a real-time time point and with no power grid faults based on historical activity data; Compare and obtain the standard similarity between the user activity feature and the standard activity feature, and find out the feature whose standard similarity is less than the preset feature similarity threshold and record it as the changed feature; Extracting fault activity characteristics at a time point corresponding to a real-time time point and when a power grid fails based on historical activity data; Compare the fault similarity between the user activity feature and the fault activity feature, and find out the feature whose fault similarity reaches the preset feature similarity threshold and record it as the fault feature; An intersection set of change features and fault features is formed, the features in the intersection set are recorded as abnormal features, and the fault similarity of the abnormal features is superimposed to obtain the activity abnormality.

[0010] Preferably, if it is determined that the behavior of the power grid terminal is abnormal, the step of extracting node abnormal data of the power grid node and estimating the terminal estimated behavior of the power grid terminal according to the node abnormal data is specifically: If it is determined that the behavior of the power grid terminal is abnormal, then node abnormality data in the power grid data of the power grid node is extracted; Obtain historical abnormal data of power grid terminal behavior, and form a grid abnormal state-terminal abnormal behavior comparison table based on the historical abnormal data; According to the node abnormal state in the node abnormal data, the corresponding terminal estimated behavior is obtained from the power grid abnormal state-terminal abnormal behavior comparison table.

[0011] Preferably, the steps of obtaining a topological structure diagram of a power grid node, finding associated nodes of the power grid node according to the topological structure diagram, collecting power grid data of the associated nodes, verifying the estimated behavior of the terminal, and confirming the abnormal behavior of the terminal of the power grid terminal according to the verification result are specifically as follows: Obtain the conditions that cause node abnormality due to the terminal's estimated behavior and record them as abnormal conditions, and determine whether the power grid node meets the abnormal conditions; Screening and removing terminal estimated behaviors that do not meet the abnormal conditions to obtain a first estimated behavior; Obtain a topological structure diagram of the power grid nodes, obtain the topological structure diagram of the power grid nodes, and select the power grid nodes affected by the first estimated behavior according to the topological structure diagram and the first estimated behavior and record them as associated nodes; Collect the power grid data of the associated nodes, determine whether the associated nodes are abnormal, and count the number of abnormal associated nodes; The ratio of the number of abnormal associated nodes to the total number of associated nodes is recorded as the abnormal ratio of the first estimated behavior; The first estimated behavior with the highest abnormal ratio is selected as the terminal abnormal behavior of the power grid terminal.

[0012] Preferably, the step of acquiring all abnormal nodes, confirming the abnormal range in combination with the topological structure diagram, and obtaining the abnormal degree of the power grid terminal according to the abnormal range is specifically as follows: Collect grid data of all grid nodes and identify abnormal nodes based on the grid data; Mark abnormal nodes on the topological structure diagram, collect the geographical locations of abnormal nodes, and confirm the abnormal geographical scope based on the geographical locations; The abnormal number of abnormal nodes is counted, and the abnormal degree of the power grid terminal is obtained by combining the abnormal geographical range and the terminal abnormality degree.

[0013] In the second aspect, the present application provides a detection system for power grid terminal behavior based on big data, which adopts the following technical solution: A detection system for power grid terminal behavior based on big data, comprising: The abnormality judgment module collects the grid data and user behavior data of the grid nodes, and judges whether the grid terminal behavior is abnormal based on the grid data and user behavior data; The behavior estimation module extracts node abnormality data of the power grid node if it is determined that the power grid terminal behavior is abnormal, and estimates the terminal estimated behavior of the power grid terminal based on the node abnormality data; The abnormal behavior module obtains the topological structure diagram of the power grid node, searches for the associated nodes of the power grid node according to the topological structure diagram, collects the power grid data of the associated nodes, verifies the estimated behavior of the terminal, and confirms the abnormal behavior of the terminal of the power grid according to the verification result; The abnormality degree module obtains all abnormal nodes, confirms the abnormal range in combination with the topological structure diagram, and obtains the abnormality degree of the power grid terminal according to the abnormal range; The detection result module combines the abnormal behavior and abnormal degree of the power grid terminal to form the detection result of the power grid terminal behavior and transmits it to the user end.

[0014] In summary, the present application includes at least one of the following beneficial technical effects: 1. Based on the grid data and user operation data, user interaction data and user activity data of the grid node, determine whether the grid node is abnormal, and further determine whether the grid terminal behavior is abnormal. The grid node can infer whether the grid terminal behavior is abnormal through the data collected by the grid node itself, so that the grid node can detect the abnormal behavior of the grid terminal in time, reduce the loss caused by the abnormal terminal behavior, and improve the timeliness of the detection of grid terminal behavior based on big data.

[0015] 2. Use the user's operation of the appliance and the appliance's fault alarm to confirm whether the user's operation is abnormal, use the user's interaction and complaint to analyze whether the user's interaction with the power grid is abnormal, combine the user's real-time activities with the activities during power grid faults and when the power grid is not faulty to determine whether the user's activities are abnormal, and then combine the power grid data to determine whether the power grid node is abnormal. The judgment of abnormality of power grid nodes comes from many aspects, which enhances the reliability of judgment and improves the reliability of detection of power grid terminal behavior based on big data.

[0016] 3. According to the grid topology diagram, other nodes in the grid are combined to verify and confirm the grid terminal behavior, which reduces the situation where grid node fault anomalies are mistaken for grid terminal anomalies. At the same time, combined with the conditions required for grid terminal anomalies to cause node anomalies, the accuracy of the detection results is further improved, and the accuracy of the detection of grid terminal behavior based on big data is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of specific steps of an embodiment of a method for detecting power grid terminal behavior based on big data of the present invention.

[0018] Figure 2 It is a module connection diagram of an embodiment of a detection system for power grid terminal behavior based on big data of the present invention. DETAILED DESCRIPTION

[0019] Below is a combination of the embodiments and Figure 1-Figure 2 The present invention is further described in detail, but the embodiments of the present invention are not limited thereto.

[0020] The present invention discloses a method for detecting power grid terminal behavior based on big data, which specifically comprises the following steps: Step S1, collecting grid data and user behavior data of grid nodes, and judging whether grid terminal behavior is abnormal based on the grid data and user behavior data.

[0021] Step S2: if it is determined that the behavior of the power grid terminal is abnormal, node abnormality data of the power grid node is extracted, and the terminal estimated behavior of the power grid terminal is estimated based on the node abnormality data.

[0022] Step S3, obtaining a topological structure diagram of the power grid node, searching for associated nodes of the power grid node according to the topological structure diagram, collecting power grid data of the associated nodes, verifying the estimated behavior of the terminal, and confirming the abnormal behavior of the terminal of the power grid terminal according to the verification result.

[0023] Step S4, obtaining all abnormal nodes, confirming the abnormal range in combination with the topological structure diagram, and obtaining the abnormal degree of the power grid terminal according to the abnormal range.

[0024] Step S5: combining the abnormal behavior and the degree of abnormality of the power grid terminal to form a detection result of the power grid terminal behavior, and transmit it to the user end.

[0025] In actual use, the behavior of power grid terminals is usually saved in the form of logs, and if the power grid nodes want to know the behavior of power grid terminals, they need to receive relevant data sent by the power grid terminals. However, the log data of power grid terminals is not always transmitted to other power grid nodes in real time. The transmission frequency of power grid terminal log data depends on many factors, including meter type, electricity consumption site, user needs, and requirements of the power supply department. This will cause other power grid nodes to be unable to know the behavior of power grid terminals in time. When the power grid terminal behavior is abnormal, other nodes cannot get it in time and take countermeasures. By using the data collected by the node itself to infer whether the behavior of the power grid terminal is abnormal, the detection of the power grid terminal behavior can be completed, and the abnormal information of the power grid terminal behavior can be obtained in time. At the same time, some power grid terminal behaviors only have minor abnormalities and do not affect the power grid nodes. The transmission of such abnormal data to the power grid nodes also increases the redundancy of the power grid node data, causing inconvenience to the staff of the power grid nodes. By detecting the behavior of power grid terminals through the relevant data of the power grid nodes, on the one hand, the interference of useless data can be reduced, and at the same time, the staff of the power grid nodes can be notified in time to reduce the losses caused by abnormal terminal behavior.

[0026] The steps of collecting grid data and user behavior data of grid nodes and determining whether the grid terminal behavior is abnormal based on the grid data and user behavior data are as follows: Step S11, collecting real-time grid data of grid nodes, the real-time grid data including real-time electricity data, real-time voltage data and real-time power data.

[0027] Step S12, collecting historical grid data of the grid nodes, the historical grid data including historical electricity data, historical voltage data and historical power data.

[0028] Step S13, comparing the real-time power grid data and the historical power grid data to obtain data similarity, and obtaining the power grid abnormality according to the data similarity.

[0029] When the parameters such as power, voltage, and power in the power grid change significantly, it means that the power grid node is abnormal, and the abnormal behavior of the power grid terminal may or may not cause the power grid node to be abnormal. If the abnormal behavior of the power grid terminal does not cause the abnormal behavior of the power grid node, then the node does not need to know that the power grid terminal behavior is abnormal, because the node is not affected. Therefore, only when the power grid node is abnormal, it may be caused by the abnormal behavior of the power grid terminal. The lower the data similarity, the higher the abnormality of the power grid. The abnormality of the power grid is obtained through data similarity.

[0030] Step S14, collecting user behavior data of the power grid nodes, and obtaining the degree of abnormal behavior of the user behavior based on the user behavior data analysis.

[0031] Step S15, combining the power grid abnormality and behavior abnormality to estimate the terminal abnormality of the power grid terminal behavior, and judging whether the terminal abnormality reaches a preset terminal abnormality threshold. If so, the power grid terminal behavior is judged to be abnormal, otherwise, the power grid terminal behavior is judged to be normal.

[0032] In actual application, the weight ratios of the power grid abnormality and the behavior abnormality are set respectively, and the terminal abnormality of the power grid terminal behavior is calculated according to the weight ratio. When the terminal abnormality reaches the threshold, it means that the node abnormality is serious, and it is judged that the node abnormality may be caused by the abnormal terminal behavior, so the power grid terminal behavior is judged to be abnormal. When the node is not abnormal, it is judged that the power grid terminal behavior is also not abnormal, that is, even if the power grid terminal behavior is abnormal at this time, it does not affect the node, and it is only a slight abnormality for the node, which can be ignored, so it is judged that the power grid terminal behavior is not abnormal.

[0033] The steps of collecting user behavior data of power grid nodes and obtaining the abnormality of user behavior according to the user behavior data analysis are as follows: Step S141, obtaining a real-time point, collecting real-time behavior data of users of the power grid node at the real-time point, the real-time behavior data including user operation data, user interaction data and user activity data.

[0034] Step S142, obtaining historical behavior data, the historical behavior data includes historical operation data, historical interaction data and historical activity data.

[0035] Step S143, comparing the user operation data with the historical operation data to obtain the degree of operation abnormality.

[0036] Step S144, comparing the user interaction data with the historical interaction data to obtain the interaction abnormality degree.

[0037] Step S145, comparing the user activity data with the historical activity data to obtain the activity abnormality degree.

[0038] Step S146, combining the operation abnormality, interaction abnormality and activity abnormality to comprehensively obtain the behavior abnormality of the user behavior.

[0039] In actual use, since electricity is extremely important in people's lives, when there is an abnormality in the power grid, it will affect the power grid users, which can be directly reflected in the user behavior data. The abnormality of user behavior is confirmed from the user operation, the interaction between the user and the power grid, and the actual activity of the user, so as to judge the abnormality of the power grid node. Multi-faceted analysis and confirmation are conducive to obtaining more accurate results. The weight ratios of the operation abnormality, interaction abnormality, and activity abnormality are set respectively, and the behavioral abnormality of the user behavior is calculated according to the weight ratio.

[0040] The steps for comparing user operation data with historical operation data to obtain the degree of operation abnormality are as follows: Step S1431, collecting the usage time periods of different electrical appliances, searching for the electrical appliances in real time according to the real time point and recording them as the used electrical appliances.

[0041] Electrical appliances are everywhere in people's lives, and their use depends on the power grid. Different appliances are used in different time periods, such as electric fans in summer and heaters in winter. With the development of smart grid and Internet of Things technology, the information collection capability of the power grid is constantly improving. Through the Internet of Things technology, some monitoring smart devices at the user end can collect relevant information authorized by the user and obtain data on the use of electrical appliances.

[0042] Step S1432, collecting the average operating frequency of the electrical appliances operated by the users and recording it as the real-time frequency, and extracting the average operating frequency of the electrical appliances when the power grid is fault-free from the historical operating data and recording it as the standard frequency.

[0043] When the power grid is unstable or fails, it will affect the use of users' electrical appliances, so users will operate the appliances multiple times, increasing the frequency of electrical appliance operation. For example, when the grid load is low, if the voltage is unstable or low, high-power electrical appliances will not work properly. In summer, if the grid load is low and the air conditioner stops working, the user needs to restart the air conditioner, which will increase the frequency of air conditioner operation. Low voltage will cause the output power of the air conditioner compressor to decrease, thus affecting the cooling effect. At this time, the user needs to adjust the air conditioner temperature to achieve the ideal state.

[0044] Step S1433, calculate the frequency difference between the real-time frequency and the standard frequency, and count the sum of the frequency differences of all electrical appliances in use to obtain the electrical appliance frequency difference.

[0045] Step S1434, collecting the appliance alarm frequencies and appliance failure frequencies of all users, and combining the appliance frequency differences to obtain the user's operation abnormality degree.

[0046] In actual use, the weight ratios of the appliance alarm frequency, appliance failure frequency, and appliance frequency difference are set respectively, and the user's operation abnormality is calculated according to the weight ratio. The larger the appliance frequency difference, the greater the degree to which the user is affected by the abnormality of the power grid, and also reflects the greater degree of abnormal operation of the user. During the use of appliances, if the power grid is unstable, it is easy to cause appliance failures and alarms. Therefore, the higher the frequency of appliance failures and alarms, the greater the impact on the user and the more abnormal the user's operation behavior. The abnormality of the user's operation is reflected by the use of the appliance, thereby reflecting the abnormality of the power grid node, and finally using it to infer the behavior of the power grid terminal, which is conducive to obtaining more accurate results.

[0047] The steps for comparing user interaction data with historical interaction data to obtain the degree of interaction anomaly are as follows: Step S1441, obtaining interactive applications between the user and the power grid, counting the real-time login volume of all interactive applications, and counting the interactive information volume of all interactive applications.

[0048] Users can interact with the power grid through payment software, telephones, complaint channels, etc. These are interactive applications between users and the power grid. Some software requires users to log in, and telephone channels can use dialing as login. The amount of interactive information is obtained by counting the number of interactions and content between users and interactive applications.

[0049] Step S1442, count the real-time complaint volume of all interactive applications, and combine the real-time login volume and interactive information volume to obtain the real-time interaction value.

[0050] The weight ratios of the real-time complaint volume, real-time login volume, and interactive information volume of all interactive applications are set respectively, and the real-time interaction value is calculated based on the weight ratios.

[0051] Step S1443, obtaining historical interaction data, calculating the average of interaction values ​​at different time points and recording it as the interaction standard value.

[0052] The interaction values ​​at different time points are calculated according to step S1441 - step S1442 , that is, they are calculated according to the total number of complaints, the amount of interactive logins and the amount of interactive information at different time points.

[0053] Step S1444, determining whether the real-time interaction value is greater than the interaction standard value, if it is greater than the interaction standard value, calculating the difference between the real-time interaction value and the interaction standard value as the interaction abnormality.

[0054] Step S1445: If it is not greater than the interaction difference, the interaction abnormality is 0.

[0055] In actual use, the interaction between users and the power grid is generally carried out when there are needs such as querying fees, paying fees, and abnormal faults. When there is no abnormal fault in the power grid node, there will be no interaction in terms of abnormal faults, and the interaction value will decrease. If the real-time interaction value is greater than the interaction standard value, it means that the interaction has increased, and it is inferred that it is caused by the abnormality of the power grid node. If the real-time interaction value is not greater than the interaction standard value, it is inferred that there is no abnormality in the power grid node. Even if the power grid node is abnormal, it is only a slight abnormality. It is within the user's acceptable range, so it is ignored and considered to be normal, so the interaction abnormality is 0.

[0056] The steps for comparing user activity data with historical activity data to obtain the activity abnormality are as follows: Step S1451, setting a grid anomaly standard, determining whether the grid anomaly is within the grid anomaly standard, and if it is within the grid anomaly standard, extracting user activity features based on user activity data.

[0057] Abnormalities in the power grid can affect user activities. For example, if a power outage in summer causes indoor overheating, users will go out to cool off. When the power grid is abnormal to the point of affecting user activities, it means that the degree of abnormality of the power grid is high. At this time, the changes in related voltage, power and other data are also large, so the degree of abnormality of the power grid will be high. Therefore, only when the degree of abnormality of the power grid is within the standard of abnormality of the power grid, is the terminal behavior confirmed to be abnormal based on user activities. For example, low voltage will cause the output power of the air conditioner compressor to decrease, thereby affecting the cooling effect. If it only affects the cooling difference of the air conditioner within one or two degrees, the user will hardly be affected, so it will not affect the user's activity behavior. If the air conditioner stops working, the user may choose to go out to cool off. If the degree of abnormality of the power grid is not within the standard of abnormality of the power grid, the degree of abnormality of the activity is 0.

[0058] Step S1452, extracting standard activity features of a time point corresponding to the real time point and with no power grid faults based on historical activity data.

[0059] Users' activities vary at different time points, such as sleeping at night, shopping during the day, eating at noon, and so on.

[0060] Step S1453: Compare and obtain the standard similarity between the user activity feature and the standard activity feature, and find out the features whose standard similarity is less than a preset feature similarity threshold and record them as changed features.

[0061] User activities at different time points are also diverse. Activity features include activity duration, activity path, etc. If an activity feature has a low similarity with the standard feature, it means that the activity feature is abnormal. For example, if the user used to walk for 1 hour in the evening, but now the evening walking time has changed to 2 hours, the similarity is low, and the increase in walking duration is a change feature.

[0062] Step S1454, extracting fault activity characteristics at a time point corresponding to the real-time time point and when the power grid fails based on the historical activity data.

[0063] When a power grid fails, the user's activities change, so the activity characteristics also change. For example, when a power grid fails, the user walks for 2 hours, which is the fault activity characteristic.

[0064] Step S1455 , compare and obtain the fault similarity between the user activity feature and the fault activity feature, and find out the feature whose fault similarity reaches a preset feature similarity threshold and record it as the fault feature.

[0065] The more similar the user activity feature is to the fault activity feature, the greater the possibility that the feature is abnormal, so it is first recorded as a fault feature.

[0066] Step S1456, forming an intersection set of change features and fault features, recording the features in the intersection set as abnormal features, superimposing the fault similarities of the abnormal features, and obtaining the activity abnormality degree.

[0067] In actual application, the features at the intersection of the change features and the fault features can basically be confirmed as abnormal features, because through the dual verification of standard activities and fault activities, the abnormality of the activity is obtained according to the confirmed abnormal features, which is conducive to reducing the interference of non-abnormal features and obtaining more accurate data. For example, the number of people eating Lantern Festival on the 15th day of the first lunar month increased, but this feature was not included in the fault features. Then this feature is due to changes in the Lantern Festival, not affected by the power grid, and can be screened out through the fault features. The more abnormal the user activity is, the greater the probability of being affected by the power grid, which means the greater the probability of abnormality of the power grid node.

[0068] If it is determined that the behavior of the power grid terminal is abnormal, the node abnormal data of the power grid node is extracted, and the steps of estimating the terminal estimated behavior of the power grid terminal according to the node abnormal data are specifically as follows: Step S21: if it is determined that the grid terminal behavior is abnormal, node abnormality data in the grid data of the grid node is extracted.

[0069] Step S22, obtaining historical abnormal data of power grid terminal behavior, and forming a power grid abnormal state-terminal abnormal behavior comparison table according to the historical abnormal data.

[0070] For example, if the abnormal state of the power grid is abnormal voltage parameters, the corresponding abnormal behavior of the terminal may be communication failure, excessive error in collected data, etc.

[0071] Step S23, according to the node abnormal state in the node abnormal data, the corresponding terminal estimated behavior is searched from the power grid abnormal state-terminal abnormal behavior comparison table.

[0072] In actual use, since different terminal abnormal behaviors may cause the same terminal abnormal behavior, multiple terminal abnormal behaviors may be found according to the comparison table, and it is necessary to screen from multiple terminal behaviors to obtain the final terminal behavior. The terminal estimated behavior is estimated according to the comparison table, which has reliable historical abnormal data analysis, which is conducive to improving the accuracy and reliability of the terminal estimated behavior.

[0073] The steps of obtaining a topological structure diagram of a power grid node, finding associated nodes of the power grid node according to the topological structure diagram, collecting power grid data of the associated nodes, verifying the estimated behavior of the terminal, and confirming the abnormal behavior of the terminal of the power grid terminal according to the verification result are specifically as follows: Step S31, obtaining the condition that the terminal estimated behavior causes the node abnormality and recording it as the abnormal condition, and judging whether the power grid node satisfies the abnormal condition.

[0074] Terminal behavior does not necessarily lead to abnormalities in power grid nodes, such as abnormal terminal behavior, but only when the load demand of the power grid node reaches a certain requirement will the power grid node be affected by the abnormal terminal behavior.

[0075] Step S32, screening out terminal estimated behaviors that do not meet the abnormal condition to obtain a first estimated behavior.

[0076] For example, the condition for the estimated behavior of terminal A to cause the abnormality of the grid node is that the load demand of the grid node reaches the preset threshold, but the load demand of the grid node does not reach the preset threshold, so even if the grid terminal has the estimated behavior of terminal A, the node will not be abnormal. However, the grid node has already been abnormal, so it can be ruled out that it is caused by the estimated behavior of terminal A.

[0077] Step S33, obtaining a topological structure diagram of the power grid nodes, obtaining a topological structure diagram of the power grid nodes, and screening the power grid nodes affected by the first estimated behavior according to the topological structure diagram and the first estimated behavior and recording them as associated nodes.

[0078] The topological structure diagram of the power grid node is a graph that uses abstract points and lines to represent the connection relationship between each node in the power grid and the power lines connecting these nodes. This graphical representation method helps to intuitively understand and analyze the structure and operating characteristics of the power grid. Through the topological structure diagram of the power grid node, it is possible to confirm which power grid nodes are connected to the real-time nodes, and find other power grid nodes that meet the abnormal conditions of the terminal estimated behavior among the connected nodes as associated nodes. For example, now based on the detection of the power grid terminal behavior according to the A power grid node, the first estimated behavior is screened out, and other power grid nodes that have a connection relationship with the A power grid node are searched according to the topological structure diagram of the power grid node, and then the abnormal conditions that meet the first estimated behavior, that is, the power grid nodes affected by the first estimated behavior are screened as associated nodes.

[0079] Step S34, collecting power grid data of associated nodes, determining whether associated nodes are abnormal, and counting the number of abnormal associated nodes.

[0080] The abnormal judgment of the associated node can be based on the changes in parameters such as power, voltage, and power in the power grid data. When the parameter change exceeds the preset change range threshold, the associated node is judged to be abnormal.

[0081] Step S35: Compare and obtain the ratio of the number of abnormal associated nodes to the total number of associated nodes, and record it as the abnormal ratio of the first estimated behavior.

[0082] Step S36, selecting the first estimated behavior with the highest abnormal ratio as the terminal abnormal behavior of the power grid terminal.

[0083] In actual application, because the power grid terminal behavior affects not only a certain power grid node, and because of the connectivity between power grid nodes, the power grid terminal behavior often affects multiple power grid nodes, and different first estimated behaviors affect different power grid nodes. According to the associated nodes of the power grid node, the analysis is carried out according to the behavior A in the first estimated behavior. The power grid nodes affected by behavior A are A, D, E, V, and N. The power grid node being detected is node D. Therefore, the associated nodes of node D are A, E, V, and N. Among them, only node A is abnormal, so the abnormal ratio is 25%. The power grid nodes affected by behavior B are A, B, C, D, F, R, and Y. The power grid node being detected is node D. Therefore, the associated nodes of node D are A, B, C, F, R, and Y. Among them, nodes A, B, C, F, R, and Y are abnormal, so the abnormal ratio is 100%. Therefore, it can be explained that the cause of the abnormality of node D is behavior B, which is the abnormal behavior of the terminal of the power grid terminal.

[0084] The steps of obtaining all abnormal nodes, confirming the abnormal range in combination with the topological structure diagram, and obtaining the abnormal degree of the power grid terminal according to the abnormal range are as follows: Step S41, collecting grid data of all grid nodes, and determining abnormal nodes based on the grid data.

[0085] Although some nodes are not associated nodes of the power grid node being detected, they may also be affected due to serious abnormal terminal behavior. Therefore, the power grid data of the power grid nodes is collected, and whether the power grid nodes are abnormal is judged based on whether there are obvious changes in parameters such as power, voltage, and power in the power grid.

[0086] Step S42: mark abnormal nodes on the topological structure diagram, collect the geographical locations of the abnormal nodes, and confirm the abnormal geographical range according to the geographical locations.

[0087] Step S43, counting the number of abnormal nodes, and combining the abnormal geographical range and the terminal abnormality to obtain the abnormality degree of the power grid terminal.

[0088] In actual application, the weight ratios of the number of abnormalities, the abnormal geographical range, and the terminal abnormality are set respectively, and the abnormality degree of the power grid terminal is calculated according to the weight ratio. The more abnormal nodes there are and the larger the abnormal geographical range covered, the more users are affected by the abnormal terminal behavior and the more serious the consequences. The greater the terminal abnormality, the greater the impact on the power grid node, which reflects the greater abnormality of the power grid terminal.

[0089] A detection system for power grid terminal behavior based on big data, by applying the above-mentioned detection method for power grid terminal behavior based on big data, comprises: The abnormality judgment module collects the grid data and user behavior data of the grid nodes, and judges whether the grid terminal behavior is abnormal based on the grid data and user behavior data.

[0090] The behavior estimation module extracts node abnormality data of the power grid node if it is determined that the power grid terminal behavior is abnormal, and estimates the terminal estimated behavior of the power grid terminal based on the node abnormality data.

[0091] The abnormal behavior module obtains the topological structure diagram of the power grid node, searches for the associated nodes of the power grid node according to the topological structure diagram, collects the power grid data of the associated nodes, verifies the terminal estimated behavior, and confirms the terminal abnormal behavior of the power grid terminal according to the verification result.

[0092] The abnormality degree module obtains all abnormal nodes, confirms the abnormal range in combination with the topological structure diagram, and obtains the abnormality degree of the power grid terminal based on the abnormal range.

[0093] The detection result module combines the abnormal behavior and abnormal degree of the power grid terminal to form the detection result of the power grid terminal behavior and transmits it to the user end.

[0094] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for detecting power grid terminal behavior based on big data, characterized in that: The following steps are involved: Collect grid data and user behavior data of grid nodes, and determine whether the grid terminal behavior is abnormal based on the grid data and user behavior data; If it is determined that the behavior of the power grid terminal is abnormal, the node abnormal data of the power grid node is extracted, and the terminal estimated behavior of the power grid terminal is estimated based on the node abnormal data; Obtain a topological structure diagram of the power grid node, find the associated nodes of the power grid node according to the topological structure diagram, collect power grid data of the associated nodes, verify the estimated behavior of the terminal, and confirm the abnormal behavior of the terminal of the power grid according to the verification result; Obtain all abnormal nodes, confirm the abnormal range in combination with the topological structure diagram, and obtain the abnormal degree of the power grid terminal based on the abnormal range; The abnormal behavior and degree of abnormality of the power grid terminal are combined to form the detection result of the power grid terminal behavior and transmitted to the user end.

2. According to a method for detecting power grid terminal behavior based on big data according to claim 1, it is characterized in that: The step of collecting grid data and user behavior data of grid nodes and determining whether grid terminal behavior is abnormal based on the grid data and user behavior data is specifically as follows: Collecting real-time grid data of grid nodes, wherein the real-time grid data includes real-time electricity data, real-time voltage data and real-time power data; Collecting historical grid data of grid nodes, wherein the historical grid data includes historical electricity data, historical voltage data and historical power data; Compare and obtain the data similarity between the real-time power grid data and the historical power grid data, and obtain the power grid abnormality according to the data similarity; Collect user behavior data of power grid nodes, and obtain the abnormality of user behavior based on the user behavior data analysis; The terminal abnormality of the power grid terminal behavior is estimated by combining the power grid abnormality and the behavior abnormality, and it is judged whether the terminal abnormality reaches the preset terminal abnormality threshold. If it reaches the terminal abnormality threshold, it is judged that the power grid terminal behavior is abnormal, otherwise it is judged that the power grid terminal behavior is not abnormal.

3. According to the method for detecting power grid terminal behavior based on big data in claim 2, it is characterized in that: The step of collecting user behavior data of power grid nodes and obtaining the degree of abnormal behavior of user behavior according to the user behavior data analysis is specifically: Acquire real-time time points, and collect real-time behavior data of users of power grid nodes at real-time time points, wherein the real-time behavior data includes user operation data, user interaction data, and user activity data; Acquire historical behavior data, wherein the historical behavior data includes historical operation data, historical interaction data, and historical activity data; Compare user operation data with historical operation data to obtain the degree of operation abnormality; Compare user interaction data with historical interaction data to obtain interaction anomaly degree; Compare user activity data with historical activity data to obtain activity abnormality; The abnormality of user behavior is comprehensively obtained by combining the abnormality of operation, abnormality of interaction and abnormality of activity.

4. The method for detecting power grid terminal behavior based on big data according to claim 3 is characterized in that: The step of comparing the user operation data with the historical operation data to obtain the operation abnormality degree is specifically as follows: Collect the usage time periods of different electrical appliances, and find the appliances that are used in real time according to the real-time time points and record them as the used appliances; The average operating frequency of electrical appliances operated by users is collected and recorded as real-time frequency, and the average operating frequency of electrical appliances used when the power grid is fault-free is extracted from historical operating data and recorded as standard frequency; Calculate the frequency difference between the real-time frequency and the standard frequency, and sum up the frequency differences of all electrical appliances in use to obtain the frequency difference of the electrical appliances; The appliance alarm frequency and appliance failure frequency of all users are collected, and the user's operation abnormality is obtained by combining the appliance frequency difference.

5. The method for detecting power grid terminal behavior based on big data according to claim 3 is characterized in that: The step of comparing the user interaction data with the historical interaction data to obtain the interaction abnormality degree is specifically as follows: Obtain interactive applications between users and the power grid, count the real-time login volume of all interactive applications, and count the interactive information volume of all interactive applications; Count the real-time complaints of all interactive applications, and combine the real-time login volume and interactive information volume to obtain the real-time interaction value; Obtain historical interaction data, calculate the average of interaction values ​​at different time points and record it as the interaction standard value; Determine whether the real-time interaction value is greater than the interaction standard value. If so, calculate the difference between the real-time interaction value and the interaction standard value as the interaction abnormality. If it is not greater than the interaction difference, the interaction anomaly is 0.

6. The method for detecting power grid terminal behavior based on big data according to claim 3 is characterized in that: The step of comparing the user activity data with the historical activity data to obtain the activity abnormality degree is specifically as follows: Setting a grid anomaly standard, determining whether the grid anomaly is within the grid anomaly standard, and if it is within the grid anomaly standard, extracting user activity features based on user activity data; Extracting standard activity features at a time point corresponding to a real-time time point and with no power grid faults based on historical activity data; Compare and obtain the standard similarity between the user activity feature and the standard activity feature, and find out the feature whose standard similarity is less than the preset feature similarity threshold and record it as the changed feature; Extracting fault activity characteristics at a time point corresponding to a real-time time point and when a power grid fails based on historical activity data; Compare the fault similarity between the user activity feature and the fault activity feature, and find out the feature whose fault similarity reaches the preset feature similarity threshold and record it as the fault feature; An intersection set of change features and fault features is formed, the features in the intersection set are recorded as abnormal features, and the fault similarity of the abnormal features is superimposed to obtain the activity abnormality.

7. The method for detecting power grid terminal behavior based on big data according to claim 1, characterized in that: If it is determined that the behavior of the power grid terminal is abnormal, the step of extracting node abnormal data of the power grid node and estimating the terminal estimated behavior of the power grid terminal according to the node abnormal data is specifically as follows: If it is determined that the behavior of the power grid terminal is abnormal, then node abnormality data in the power grid data of the power grid node is extracted; Obtain historical abnormal data of power grid terminal behavior, and form a comparison table of power grid abnormal state and terminal abnormal behavior based on the historical abnormal data; According to the node abnormal state in the node abnormal data, the corresponding terminal estimated behavior is obtained from the power grid abnormal state-terminal abnormal behavior comparison table.

8. The method for detecting power grid terminal behavior based on big data according to claim 1, characterized in that: The steps of obtaining a topological structure diagram of a power grid node, finding associated nodes of the power grid node according to the topological structure diagram, collecting power grid data of the associated nodes, verifying the estimated behavior of the terminal, and confirming the abnormal behavior of the terminal of the power grid terminal according to the verification result are specifically as follows: Obtain the conditions that cause node abnormality due to the terminal's estimated behavior and record them as abnormal conditions, and determine whether the power grid node meets the abnormal conditions; Screening and removing terminal estimated behaviors that do not meet the abnormal conditions to obtain a first estimated behavior; Acquire a topological structure diagram of power grid nodes, and select power grid nodes affected by the first estimated behavior according to the topological structure diagram and the first estimated behavior and record them as associated nodes; Collect the power grid data of the associated nodes, determine whether the associated nodes are abnormal, and count the number of abnormal associated nodes; The ratio of the number of abnormal associated nodes to the total number of associated nodes is recorded as the abnormal ratio of the first estimated behavior; The first estimated behavior with the highest abnormal ratio is selected as the terminal abnormal behavior of the power grid terminal.

9. The method for detecting power grid terminal behavior based on big data according to claim 2, characterized in that: The steps of obtaining all abnormal nodes, confirming the abnormal range in combination with the topological structure diagram, and obtaining the abnormal degree of the power grid terminal according to the abnormal range are specifically as follows: Collect grid data of all grid nodes and identify abnormal nodes based on the grid data; Mark abnormal nodes on the topological structure diagram, collect the geographical locations of abnormal nodes, and confirm the abnormal geographical scope based on the geographical locations; The abnormal number of abnormal nodes is counted, and the abnormal degree of the power grid terminal is obtained by combining the abnormal geographical range and the terminal abnormality degree.

10. A detection system for power grid terminal behavior based on big data, characterized in that: A method for detecting power grid terminal behavior based on big data according to any one of claims 1 to 9 is applied, comprising: The abnormality judgment module collects the grid data and user behavior data of the grid nodes, and judges whether the grid terminal behavior is abnormal based on the grid data and user behavior data; The behavior estimation module extracts node abnormality data of the power grid node if it is determined that the power grid terminal behavior is abnormal, and estimates the terminal estimated behavior of the power grid terminal based on the node abnormality data; The abnormal behavior module obtains the topological structure diagram of the power grid node, searches for the associated nodes of the power grid node according to the topological structure diagram, collects the power grid data of the associated nodes, verifies the estimated behavior of the terminal, and confirms the abnormal behavior of the terminal of the power grid according to the verification result; The abnormality degree module obtains all abnormal nodes, confirms the abnormal range in combination with the topological structure diagram, and obtains the abnormality degree of the power grid terminal according to the abnormal range; The detection result module combines the abnormal behavior and abnormal degree of the power grid terminal to form the detection result of the power grid terminal behavior and transmits it to the user end.

Images