A method, system and electronic device for detecting abnormal data in a charging pile network

Abstract

The present application discloses a method, system and electronic device for detecting abnormal data in a charging pile network, belonging to the field of computer technology, including: obtaining Open Charge Point Protocol (OCPP) communication data of the charging pile network to obtain communication data to be detected; performing data preprocessing on the communication data to be detected to obtain first communication data; extracting a timestamp, the number of charging times, the charging amount and the charging duration from the first communication data; determining the original linear features of the OCPP communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; performing feature correlation screening on the original linear features to obtain first linear features; identifying the charging mode, user behavior mode and abnormal usage mode of the charging pile according to the first linear features; classifying the OCPP communication data based on the above modes to obtain the abnormal data detection result of the charging pile network. The present application can better perform more accurate abnormal data detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular, to a method, a system, and an electronic device for detecting abnormal data in a charging pile network. Background Art

[0002] With the transformation of the global energy structure and the rapid development of new energy vehicles, the demand for new energy charging piles is increasing continuously. As an important supporting facility for new energy vehicles, the improvement of its infrastructure directly affects the popularization and application of new energy vehicles. In the field of new energy vehicles, Open Charge Point Protocol (OCPP) 2.0, as a crucial communication standard for communication between electric vehicle charging stations and central management systems, has become one of the widely adopted charging infrastructure communication protocols globally. Especially in realizing intelligent charging management and cross-platform interoperability, OCPP 2.0 plays a key role.

[0003] However, the main problems faced by related technologies in the field of charging pile safety include limited detection ability for abnormal behaviors, especially in real-time monitoring and automated response. When dealing with a large amount of OCPP data, existing solutions often lack effective automated analysis capabilities and are difficult to accurately identify potential security threats from massive data. Summary of the Invention

[0004] To solve at least one of the above problems, embodiments of the present application propose a method, a system, and an electronic device for detecting abnormal data in a charging pile network with high detection accuracy.

[0005] To achieve the above object, on the one hand, an embodiment of the present application proposes a method for detecting abnormal data in a charging pile network, the method comprising:

[0006] Obtaining Open Charge Point Protocol communication data of a charging pile network to obtain communication data to be detected;

[0007] Performing data preprocessing on the communication data to be detected to obtain first communication data;

[0008] Extracting a timestamp, a charging count, a charging amount, and a charging duration from the first communication data;

[0009] Determining original linear features of the Open Charge Point Protocol communication data according to the timestamp, the charging count, the charging amount, and the charging duration; wherein the original linear features include historical translation features, differential features, and window statistical features;

[0010] Performing feature correlation screening on the original linear features to obtain first linear features;

[0011] Identify the charging mode, user behavior mode, and abnormal usage mode of the charging pile according to the first linear feature;

[0012] Classify the Open Charge Point Protocol communication data based on the charging mode, the user behavior mode, and the abnormal usage mode to obtain an abnormal data detection result of the charging pile network.

[0013] In some embodiments, the data preprocessing of the communication data to be detected to obtain the first communication data includes the following steps:

[0014] Perform denoising processing on the communication data to be detected using median filtering to obtain the second communication data;

[0015] Perform normalization processing on the second communication data to obtain the first communication data.

[0016] In some embodiments, the determination of the original linear feature of the Open Charge Point Protocol communication data according to the timestamp, the number of charging times, the charging amount, and the charging duration includes the following steps:

[0017] Use the timestamp, the number of charging times, the charging amount, and the charging duration as key features;

[0018] Calculate the change amount of each key feature within a preset window to obtain the historical translation feature of each key feature;

[0019] Calculate the continuous value difference of each key feature to obtain the differential feature of each key feature;

[0020] Calculate the statistical data of each key feature within a fixed time window to obtain the window statistical feature.

[0021] In some embodiments, the feature correlation screening of the original linear feature to obtain the first linear feature includes the following steps:

[0022] Calculate the feature correlation between all feature pairs in the original linear feature;

[0023] When the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, calculate the missing value ratio of each feature pair;

[0024] Remove the feature with a smaller missing value ratio in the feature pair;

[0025] Return to execute the step of when the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, calculate the missing value ratio of each feature pair until all the original linear features are processed to obtain the first linear feature.

[0026] In some embodiments, identifying the charging mode, user behavior pattern, and abnormal usage pattern of the charging pile according to the first linear feature includes the following steps:

[0027] Analyze the historical translation feature and window statistical feature in the first linear feature through a pre-trained target pattern recognition sub-model to obtain the charging mode;

[0028] For each user, analyze the window statistical feature in the first linear feature through the target pattern recognition sub-model to obtain the user behavior pattern of each user;

[0029] Analyze the differential feature in the first linear feature through the target pattern recognition sub-model to obtain the abnormal usage pattern.

[0030] In some embodiments, classifying the Open Charge Point Protocol communication data based on the charging mode, the user behavior pattern, and the abnormal usage pattern to obtain the abnormal data detection result of the charging pile network includes the following steps:

[0031] Use the charging mode, the user behavior pattern, and the abnormal usage pattern as non-linear features;

[0032] Adopt a decision function to calculate the distance from the data point in the non-linear feature to the decision boundary to obtain an output value;

[0033] Judge the abnormality of the output value through a threshold to obtain a judgment result;

[0034] Output the label of the data point according to the judgment result to obtain the abnormal data detection result of the charging pile network.

[0035] In some embodiments, the method further includes constructing and training the target pattern recognition sub-model, which specifically includes the following steps:

[0036] Construct an initial pattern recognition sub-model including an input layer, several hidden layers, and an output layer; wherein, the number of neurons in the input layer is configured as the first number of input features; the number of neurons in the output layer is configured as the second number of output features; the number of neurons in the hidden layer is configured to be between the first number and the second number;

[0037] Obtain the Open Charge Point Protocol communication data of the charging pile network under normal operation and abnormal operation to obtain normal state data and abnormal state data;

[0038] Perform data preprocessing on the normal state data and the abnormal state data, and generate a training data set;

[0039] Training the initial pattern recognition sub - model based on the training data set to obtain a target pattern recognition sub - model.

[0040] In some embodiments, the method further includes the following steps:

[0041] Extracting abnormal behaviors and abnormal times according to the detection result of the abnormal data of the charging pile network;

[0042] Collating the abnormal behaviors and the abnormal times into an abnormal report;

[0043] Sending the abnormal report to the management staff.

[0044] To achieve the above object, on the other hand, an embodiment of the present application proposes a system for detecting abnormal data of a charging pile network, the system includes:

[0045] A first module, configured to obtain Open Charge Point Protocol (OCPP) communication data of the charging pile network to obtain communication data to be detected;

[0046] A second module, configured to perform data pre - processing on the communication data to be detected to obtain first communication data;

[0047] A third module, configured to extract a timestamp, the number of charging times, the charging amount, and the charging duration from the first communication data;

[0048] A fourth module, configured to determine the original linear features of the OCPP communication data according to the timestamp, the number of charging times, the charging amount, and the charging duration; wherein, the original linear features include historical translation features, differential features, and window statistical features;

[0049] A fifth module, configured to perform feature correlation screening on the original linear features to obtain first linear features;

[0050] A sixth module, configured to identify the charging mode, user behavior mode, and abnormal usage mode of the charging pile according to the first linear features;

[0051] A seventh module, configured to classify the OCPP communication data based on the charging mode, the user behavior mode, and the abnormal usage mode to obtain a detection result of the abnormal data of the charging pile network.

[0052] To achieve the above object, on the other hand, an embodiment of the present application proposes an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the above - described method is implemented.

[0053] To achieve the above object, on the other hand, an embodiment of the present application proposes a computer-readable storage medium storing a computer program, which when executed by a processor implements the method described above.

[0054] The embodiments of the present application at least include the following beneficial effects: The present application provides a method, a system and an electronic device for detecting abnormal data in a charging pile network. By obtaining the Open Charge Point Protocol (OCPP) communication data of the charging pile network and preprocessing these data, random noise in the data can be filtered out, improving the data quality and facilitating the improvement of the accuracy of subsequent recognition and processing. Extracting timestamps, charging times, charging amounts, and charging durations from the preprocessed data, and determining the historical translation features, differential features, and window statistical features of the OCPP communication data based on the extracted features, can integrate information of a large amount of data. After extracting useful features, based on these features, the charging mode, user behavior mode, and abnormal usage mode of the charging pile are identified, and then the OCPP communication data is classified based on the identified modes, enabling a more accurate detection result of the abnormal data in the charging pile network, and enhancing the overall security and reliability of the charging pile network. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The drawings are used to provide a further understanding of the technical solutions of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solutions of the present application, and do not constitute a limitation to the technical solutions of the present application.

[0056] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0057] Figure 2 It is a flowchart of a method for detecting abnormal data in a charging pile network provided by an embodiment of the present application;

[0058] Figure 3 It is a flowchart of the working process of a target pattern recognition sub-model provided by an embodiment of the present application;

[0059] Figure 4 It is a flowchart of the working process of SVM provided by an embodiment of the present application;

[0060] Figure 5 It is an application flowchart of a method for detecting abnormal data in a charging pile network provided by an embodiment of the present application;

[0061] Figure 6 It is a schematic diagram of the modules of a system for detecting abnormal data in a charging pile network provided by an embodiment of the present application;

[0062] Figure 7 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0063] In order to make the objectives, technical solutions and advantages of the present application more clear and understandable, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numerals in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application detailed in the appended claims.

[0064] Although functional modules are divided in the system schematic diagram and the logical sequence is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from the module division in the system or the sequence in the flowchart. The terms "first / S100", "second / S200", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar objects and do not necessarily need to be used to describe a specific order or sequence.

[0065] It can be understood that the terms "first", "second", etc. used in the present application can be used in this document to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information can also be called the second information. Similarly, the second information can also be called the first information. Depending on the context, the words "if", "when" as used herein can be interpreted as "when...", "while...", or "in response to determining".

[0066] The terms "at least one", "multiple", "each", "any one", etc. used in the present application, at least one includes one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any one refers to any one of the multiple.

[0067] Referring to "embodiments" herein means that the specific features, structures or characteristics described in connection with the embodiments can be included in at least one embodiment of the present application. The appearance of this phrase in various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this application belongs. The terms used herein are for the purpose of describing embodiments of this application only and are not intended to limit this application.

[0069] It can be understood that a method for detecting abnormal data in a charging pile network provided by an embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various types of terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto.

[0070] As Figure 1 shown, it is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Referring to Figure 1 , this implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be network-connected by wireless or wired means to complete data transmission and exchange.

[0071] The server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0072] In addition, the server 101 can also be a node server in a blockchain network. Among them, the blockchain is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithms.

[0073] The terminal 102 can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal 102 and the server 101 can be directly or indirectly connected by wired or wireless communication means, and the embodiments of the present invention do not limit this here.

[0074] Exemplarily based on Figure 1In the illustrated implementation environment, embodiments of the present invention provide a lateral velocity analysis and structure mapping method. Taking the application of this lateral velocity analysis and structure mapping method in server 101 as an example for illustration, it can be understood that this lateral velocity analysis and structure mapping method can also be applied to terminal 102.

[0075] This application can be used in numerous general-purpose or special-purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and so on. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This application can also be practiced in a distributed computing environment where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0076] It should be noted that in each specific implementation manner of this application, when it comes to relevant processing that needs to be based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application need to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through methods such as pop-up windows or redirecting to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiments of this application will be obtained.

[0077] Before elaborating on the embodiments of this application in detail, some nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following explanations.

[0078] Charging pile network: The charging pile network is an infrastructure system that provides charging services for new energy vehicles, mainly composed of charging piles, charging stations, management platforms, payment systems, and other related supporting facilities. During the use of the charging pile network, abnormal data may occur due to being attacked or due to charging pile failures, and these abnormal data reflect potential security threats.

[0079] OCPP: The full name is Open Charge Point Protocol, which is the Open Charge Point Protocol. In the field of new energy vehicles, it is usually used for communication between charging stations and the central management system of charging stations. OCPP 2.0 has become a crucial communication standard, especially in realizing intelligent charging management and cross-platform interoperability.

[0080] Precision: The probability that a sample is actually positive among all samples predicted to be positive.

[0081] Recall: The probability that a sample is predicted to be positive among samples that are actually positive.

[0082] F1 Score: The harmonic mean of precision and recall, used to measure the overall performance of a model.

[0083] In related technologies, traditional security measures often rely on static rules and signatures, making it difficult to cope with rapidly changing attack methods and complex network environments, resulting in insufficiently timely identification and response to abnormal data. Moreover, existing solutions often lack effective automated analysis capabilities when dealing with a large amount of OCPP data, and it is difficult to accurately identify potential security threats from massive data.

[0084] In view of this, in the embodiments of the present application, a method, system, and electronic device for detecting abnormal data in a charging pile network are provided. This solution can filter out random noise in the data by obtaining Open Charge Point Protocol communication data of the charging pile network and preprocessing these data, improving the data quality, which is beneficial to improving the accuracy of subsequent identification and processing; extracting timestamps, charging times, charging amounts, and charging durations from the preprocessed data, and determining historical translation features, differential features, and window statistical features of the Open Charge Point Protocol communication data based on the extracted features above, can integrate information of massive data. After extracting useful features, then classify the Open Charge Point Protocol communication data based on the identified patterns, and can more accurately obtain the final detection result of abnormal data in the charging pile network, improving the overall security and reliability of the charging pile.

[0085] Figure 2 It is an optional flowchart of a method for detecting abnormal data in a charging pile network provided by an embodiment of the present application. Figure 2 The method in may include but is not limited to steps S100 to S700.

[0086] Step S100, obtain the Open Charge Point Protocol communication data of the charging pile network to obtain the communication data to be detected.

[0087] Specifically, the OCPP communication data between the charging pile and the central management system is captured, that is, the open charging point protocol communication data, which includes various OCPP messages, such as Authorize.req (authorization request), BootNotification.req (boot notification request), etc. These messages contain key features such as message type, parameter value, timestamp, etc., which are helpful for the subsequent analysis of the data characteristics of the charging pile network operation.

[0088] Step S200: performing data preprocessing on the communication data to be detected to obtain first communication data.

[0089] Furthermore, OCPP communication data usually contains structured messages, which may be affected by pulse noise during transmission, generating random noise. These random noises usually appear as random fluctuations or abnormal signals in the data, which will interfere with the real signal of the data and affect the accuracy of subsequent analysis. Therefore, after obtaining the communication data to be detected, the present application performs data preprocessing on the communication data to be detected. Specifically, median filtering is used to perform denoising on the communication data to be detected to obtain the second communication data. The specific process of the above denoising process is: first, a window size is preset. , for each data sampling point in the window , calculate the median value in its neighborhood , the calculation formula is as follows:

[0090] ;

[0091] Calculated using Replace the original data sampling points After each data point is processed, the second communication data is obtained.

[0092] In the preprocessing step, the second communication data needs to be normalized to obtain the first communication data so that all features are in the same dimension for easy model processing. Furthermore, the Min-Max normalization method can be used for normalization to scale the data to the [0,1] interval. The calculation formula is:

[0093] .

[0094] in, is the normalized first communication data.

[0095] Step S300: extracting a timestamp, charging times, charging amount and charging duration from the first communication data.

[0096] In some embodiments, based on the content such as timestamps, parameter values, and message types included in the first communication data, certain key features of some or all charging piles in the charging pile network during use, such as timestamps, charging times, charging amounts, and charging durations, can be extracted for subsequent analysis of the original linear features of the charging piles.

[0097] Step S400, determine the original linear features of the Open Charge Point Protocol communication data according to the timestamp, the charging times, the charging amount, and the charging duration; wherein, the original linear features include historical translation features, differential features, and window statistical features.

[0098] In the embodiments of the present application, based on these key features such as timestamps, charging times, charging amounts, and charging durations, extracting these original linear features such as historical translation features, differential features, and window statistical features is beneficial to the learning and prediction of machine learning models, thereby improving the accuracy and efficiency of abnormal data detection in the charging pile network.

[0099] Specifically, it includes the following steps ①~③:

[0100] ① Calculate the change amount of each key feature within a preset window to obtain the historical translation feature of each key feature.

[0101] For each key feature, through the past value and the current value, the historical translation feature is obtained, and these features can help the model understand the change of the charging pile usage pattern over time.

[0102] In this step, key features such as timestamps, charging times, charging amounts, and charging durations in the OCPP communication data are used as data sources, and the change amount of each key feature within the time window T is calculated. Taking the charging times as an example, if T is 1 hour, then calculate the difference between the charging times in the past 1 hour and the charging times at the current moment. Further, the calculation process of the historical translation feature is as follows:

[0103] Let be the feature value of a certain key feature at the current moment and be the feature value of this key feature time units ago, then the historical translation feature of this key feature can be calculated as:

[0104] ;

[0105] wherein, can be an arbitrarily set time window length. For example, if is set to 1 hour, then represents the change amount of the feature value within 1 hour, that is, the historical translation feature.

[0106] ② Calculate the difference in consecutive values for each key feature to obtain the differential feature of each key feature.

[0107] For each key feature, the differential feature of each key feature is extracted by calculating the difference between its consecutive observed values. These features help capture sudden changes in the charging pile usage pattern, which may be signs of normal changes or abnormal behaviors. For example, it can be the time difference between two charging requests, or the difference in the charging amount for two consecutive times.

[0108] For two consecutive observed values and , the differential feature can be calculated as:

[0109] ;

[0110] Calculate for all key features to obtain a second feature quantity representing the sudden change in the charging pile usage pattern. This second feature vector, as the differential feature, helps capture abnormal behaviors.

[0111] ③ Calculate the statistical data of each key feature within a fixed time window to obtain the window statistical feature.

[0112] By performing statistical analysis on the data of each key feature within a fixed time window, the window statistical features are extracted. These window statistical features can help the model understand the usage trend of the charging pile within a specific time period. For example, for the number of charging times, it can be the average number of charging times, the maximum number of charging times, or the standard deviation of the number of charging times within a specific time period.

[0113] Taking the number of charging times as an example, let be the sequence of the number of charging times within the time window , then the formula for calculating the average number of charging times is:

[0114] ;

[0115] Within the time window , the maximum number of charging times is:

[0116] ;

[0117] Within the time window , the standard deviation of the number of charging times is calculated as:

[0118] ;

[0119] where n represents the time window The number of observed values of this key feature. The above average number of charging times, maximum number of charging times, standard deviation of the number of charging times, etc. can all be used as window statistical features.

[0120] Step S500: Perform feature correlation screening on the original linear features to obtain the first linear features.

[0121] In fact, the results obtained by different feature extraction methods are usually different, and each method has its own unique focus and calculation method. The historical translation feature focuses on the change trend in the time series and reveals the charging pile usage pattern by comparing data at different time points; the difference feature focuses on the difference between consecutive observed values and is used to capture mutations or anomalies; the window statistical feature focuses on the statistical characteristics within a certain time window, such as the average value, maximum value, standard deviation, etc.

[0122] These methods extract information from different perspectives, so the obtained feature vectors will differ in nature and usage. Extracting these original linear features can capture the characteristics of the data in different dimensions, improve the generalization ability and prediction accuracy of the model, but there may be a problem of feature redundancy. In this application, the Pearson correlation coefficient is used to measure the correlation between pairwise features, and highly correlated features are removed to reduce the redundancy between features, complete the screening of features, and enable better extraction of useful original linear features when performing original linear feature extraction. Specifically, the calculation formula of the Pearson correlation coefficient is as follows:

[0123] ;

[0124] where is the key feature and the key feature The Pearson correlation coefficient between them ranges from [-1, 1]; and are the th observed values of the key feature and the key feature respectively; and are the average values of the key feature and the feature respectively; is the number of observed values.

[0125] When , it means that the two features are completely positively correlated; when , it means that the two features are completely negatively correlated; when , it means that the two key features have no linear relationship.

[0126] When performing feature selection, a threshold value (such as 0.8 or 0.9) can be set. If the correlation coefficient between two features exceeds this threshold, the proportion of missing values for each of the two features is calculated, and the feature with fewer missing values is selected for removal to reduce redundancy between features. The proportion of missing values p can be calculated using the following formula:

[0127] ;

[0128] where, represents the proportion of missing values; represents the number of missing values; represents the total number of data points.

[0129] When the feature screening for all features in the original linear features is completed, the remaining features form the first linear features.

[0130] Step S600, based on the first linear features, identify the charging mode, user behavior mode, and abnormal usage mode of the charging pile.

[0131] Specifically, the charging mode, user behavior mode, and abnormal usage mode in the embodiments of the present application can generally be referred to as non-linear features. Non-linear features usually refer to those features that cannot be described by simple linear relationships. In OCPP communication data, non-linear features may involve complex patterns and relationships in the data, and these patterns and relationships are not simple linear combinations but can be obtained through multi-level abstraction and transformation of the data.

[0132] For OCPP communication data, the above non-linear features may change due to attacks or malicious behaviors on the charging pile network. Therefore, identifying them can determine possible abnormal data and abnormal behaviors in the charging pile network. The various non-linear features proposed in the present application are introduced as follows:

[0133] Charging mode: By analyzing historical translation features and window statistical features, the embodiments of the present application construct a neural network to analyze historical translation features and window statistical features to identify the charging time period pattern, such as "night charging" or "peak hour charging". This pattern may be related to the user's charging habits and the load of the power grid, and is non-linear due to the complex interaction of time series data. The embodiments of the present application assist in identifying abnormal behaviors of the charging pile by analyzing and identifying the charging mode.

[0134] Exemplarily, if a large number of new charging requests suddenly appear at a charging pile during off-peak hours, there may be abnormal operation behaviors or faults at this charging pile; if the charging frequency of a charging pile suddenly increases within a short period of time, there may be abnormal operation behaviors or faults at this charging pile, such as the charging pile being maliciously occupied.

[0135] User behavior patterns: By analyzing the statistical features of windows and the user identification field (user_id) in communication data, the charging behavior patterns of each user can be inferred. For example, some users may tend to charge quickly when the battery level is low, while others may prefer slow charging. These user behavior patterns may be related to the users' daily activities and charging needs, and are non-linear due to the complexity of each user's behavior. By analyzing and identifying these user behavior patterns, it is possible to assist in identifying abnormal data and abnormal behaviors of charging piles.

[0136] Exemplarily, if a user's behavior suddenly changes, such as from slow charging to fast charging, this may indicate abnormal data or abnormal behavior of the charging pile; if a user frequently charges during abnormal time periods (such as late at night), it indicates that there may be abnormal behavior or the charging pile is being maliciously used.

[0137] Abnormal usage patterns: By analyzing differential features, the usage patterns of charging piles can be identified. For example, a certain charging pile may have an abnormally high usage frequency during a specific time period, which may indicate abnormal behavior or a fault. Due to the statistical characteristics of charging pile usage data and abnormal detection algorithms, this pattern is non-linear.

[0138] These non-linear features are different from the original linear features (i.e., simple statistics such as mean, maximum, minimum, etc.). They need to be extracted through complex data processing. In the embodiments of the present application, a target pattern recognition sub-model based on a neural network is constructed and trained to automatically learn and extract these non-linear features from a large amount of data without the need for manual intervention to define feature extraction rules. Through training, the target pattern recognition sub-model can identify the above-mentioned complex patterns.

[0139] The target pattern recognition sub-model can analyze historical translation features, window statistical features, and differential features from the input original data, and then preliminarily classify the above-mentioned patterns based on these features. The process of the target recognition sub-model for identifying the above patterns includes the following steps ④~⑥:

[0140] ④ Analyze the historical translation features and window statistical features in the first linear features through the pre-trained target pattern recognition sub-model to obtain the charging pattern.

[0141] ⑤ For each user, analyze the window statistical features in the first linear features through the target pattern recognition sub-model to obtain the user behavior pattern of each user.

[0142] ⑥ Analyze the differential features in the first linear features through the target pattern recognition sub-model to obtain the abnormal usage pattern.

[0143] In some embodiments, the target pattern recognition sub-model proposed in the embodiments of the present application needs to be built, and the hyperparameters of the model are adjusted through model training to optimize the model performance. The specific steps are as follows:

[0144] (1) Build an initial pattern recognition sub-model including an input layer, several hidden layers, and an output layer.

[0145] As Figure 3 shown, in the input layer, the original data is received, such as the number of charging times, the amount of charge, the charging duration, etc.

[0146] The hidden layer includes a convolutional layer, an activation function, and a pooling layer. In the embodiments of the present application, the convolutional layer convolves the input data through a convolution kernel to extract local features. The convolution formula is:

[0147] ;

[0148] where x is the input data, k is the convolution kernel, a and b are the sizes of the convolution kernel, c is the bias term, and y is the output feature map.

[0149] A non-linear activation function, such as ReLU, is applied after the convolutional layer to introduce non-linear features. The ReLU function is defined as:

[0150] ;

[0151] that is, if the input is less than 0, the output is 0, otherwise the output is the input value.

[0152] The pooling layer is used to reduce the spatial dimension of the feature map, reduce the amount of calculation and the number of parameters, and at the same time retain the most important feature information. The pooling operation includes max pooling and average pooling. Max pooling selects the maximum value within the region, while average pooling calculates the average value within the region.

[0153] In the output layer, the extracted features are passed through a fully connected layer to generate the final prediction output. The output formula of the fully connected layer is:

[0154] ;

[0155] where is the weight matrix, is the input feature vector, is the bias vector.

[0156] After the construction is completed, it is necessary to initialize the initial pattern recognition sub-model, configure the number of neurons in the input layer as the first number of input features; the number of neurons in the output layer as the second number of output features; and the number of neurons in the hidden layer between the first number and the second number.

[0157] Use He initialization to initialize the weights in the model. He initialization is a weight initialization method designed for the ReLU activation function, and its purpose is to maintain the variance of the activation values and gradients during forward and backward propagation in a deep network. For each weight matrix , use He initialization, and the expression is:

[0158] ;

[0159] where represents a normal distribution with a mean of and a variance of , and is the number of neurons in the previous layer.

[0160] For each bias vector , initialize it to zero, that is .

[0161] Select the cross-entropy loss function and the SGD optimizer for loss value calculation and model optimization.

[0162] (3) Obtain the open charging point protocol communication data of the charging pile network under normal operation and abnormal operation to obtain normal state data and abnormal state data.

[0163] Abnormal operation means that the charging pile network is attacked or an abnormal fault occurs. At this time, the OCPP data may include tampered messages or non-standard messages. In actual operation, various messages specified by the standard protocol can be simulated and sent through a protocol analyzer, a simulator, or a dedicated charging pile test software to check the reception, parsing, and response of the charging pile. If the response of the charging pile to certain messages does not conform to the standard protocol, these messages may be non-standard or tampered. The normal state data refers to the OCPP data of the charging pile network under normal operation. Collecting this data can be used to train the model.

[0164] (4) Perform data preprocessing on the normal state data and abnormal state data, and generate a training dataset;

[0165] For both the normal state data and the abnormal state data, use the data preprocessing method in the above step S200 to process and generate a training dataset.

[0166] (5) Train the initial pattern recognition sub - model based on the training data set to obtain the target pattern recognition sub - model.

[0167] When using the training set data to train the model, the key lies in optimizing the model's performance by adjusting hyperparameters. Hyperparameters include learning rate, batch size, number and size of network layers, selection of activation functions, etc. During the training process, cross - validation can be used to evaluate the effects of different hyperparameter combinations, and methods such as grid search or random search can be used to find the optimal hyperparameter combination. At the same time, to prevent overfitting, regularization techniques such as L1 or L2 regularization, and dropout mechanism can be introduced. Through these adjustments, the model can improve the recognition ability of abnormal patterns while learning the normal behavior patterns of the charging pile network, thereby improving the recognition accuracy of the target pattern recognition sub - model.

[0168] Step S700: Classify the OCPP communication data based on the charging mode, user behavior pattern, and abnormal usage pattern to obtain the abnormal data detection result of the charging pile network.

[0169] Support Vector Machine (SVM) can be used for the classification decision in this step, which can find the optimal decision boundary in a higher - dimensional feature space, thus more accurately determining whether the OCPP communication data is abnormal.

[0170] Specifically, take the charging mode, user behavior pattern, and abnormal usage pattern as non - linear features, use the decision function to calculate the distance from the data points in the non - linear features to the decision boundary to obtain the output value; judge the abnormality of the output value through a threshold to obtain the judgment result, and output the label of the data point according to the judgment result to obtain the abnormal data detection result of the charging pile network.

[0171] Among them, the formula of the decision function is:

[0172] ;

[0173] Among them, is the Lagrange multiplier; is the label of the training data; is the kernel function; is the bias term.

[0174] As Figure 4 shown, according to the output value of the decision function, judge whether the data point is abnormal. If the output value is less than a certain threshold (such as 0), then the data point is considered abnormal.

[0175] When classifying new data points, the model will output the label of each data point according to the result of the threshold judgment. For example, a label of 1 indicates normal, and - 1 indicates abnormal.

[0176] Before applying SVM, it is necessary to initialize and train the SVM model.

[0177] During initialization, for the OCPP communication function, the radial basis function (RBF) can be selected as the initial kernel function. The formula for the RBF kernel function is:

[0178] ;

[0179] where is the coefficient of the kernel function, which controls the influence range of a single training sample.

[0180] When setting the initialization parameters, the penalty coefficient is initialized to 1.0, which is used to balance the classification margin and the penalty for misclassified samples; the RBF kernel function is initially set to , where is the number of features; the outlier ratio is initialized to 0.1, indicating the expected outlier ratio, and this parameter also affects the decision boundary of the model.

[0181] During the training process of SVM, the parameters and the kernel parameter can be adjusted to optimize the performance of the model. The parameter controls the sensitivity of the model to abnormal data. A smaller value will make the model more strict in identifying abnormal data, while a larger value will make the model more tolerant. The kernel parameter affects the complexity of the model in the feature space. A larger value will make the model pay more attention to the local features of the data, while a smaller value will make the model pay more attention to the overall trend of the data.

[0182] In steps S100 - S700 of the embodiment of the present application, by extracting the original linear features in the OCPP communication data, and then identifying non - linear features such as charging mode, user behavior mode, and abnormal usage mode, and then making classification decisions, it is possible to better utilize the massive data for more accurate abnormal data detection. Further, the non - linear features extracted by the neural network provide richer information for SVM, enabling SVM to make more refined and accurate classification decisions. This method combining the feature extraction ability of the neural network and the classification performance of SVM further improves the efficiency of the entire abnormal detection system.

[0183] In some embodiments, the present application further includes the following content:

[0184] During the model training process, an independent test set is used to evaluate the performance of the model, and metrics such as precision, recall, and F1-score are calculated to comprehensively evaluate the performance of the model, and then optimize to ensure that the model has good generalization ability.

[0185] As Figure 5 shown, conduct case studies and error analysis: select some specific OCPP communication data cases, analyze the prediction results of the model, and check on which types of messages the model performs well and on which types of messages there are misjudgments. For cases where the model makes incorrect predictions, deeply analyze the reasons, whether it is due to insufficient feature extraction, insufficient model training, or the complexity of the OCPP messages themselves, and further optimize the model.

[0186] Real-time monitoring and feedback: Deploy the model in the actual environment, monitor the OCPP message data in real time, evaluate the performance of the model in actual applications, and collect feedback based on the real-time monitoring results to continuously adjust and optimize the model.

[0187] Through real-time monitoring of the model and automated analysis of abnormal data and messages during the operation of the charging pile, identify abnormal behaviors, such as specific OCPP message tampering or specific attacked time periods, organize them into an abnormal report, and distribute it to relevant security teams and management to achieve automated detection of abnormal data in the charging pile network.

[0188] Next, combined with the application example of the specific charging pile network abnormal data detection scenario, the solution of the embodiment of the present application will be introduced and described in detail:

[0189] In the embodiment of the present application, a method for detecting abnormal data in a charging pile network is provided. This method can be applied to detect abnormal data in the charging pile network. Further, it can achieve the following:

[0190] Collect OCPP protocol communication data, perform preprocessing such as denoising and normalization on the collected data to obtain the first communication data, and then extract features from the first communication data, such as timestamps, charging times, charging amounts, and charging durations. Construct and train the machine learning model (target pattern recognition sub-model) described in step S600 to extract non-linear features and identify the charging patterns, user behavior patterns, and abnormal usage patterns of the charging pile during use; then construct the SVM model described in step S700 to make classification decisions on the non-linear features and achieve abnormal data detection.

[0191] In practical applications, continuously adjust and optimize the model by analyzing the feedback of the actual operation of the model to ensure the accuracy of the model. And during real-time monitoring, automatically analyze the abnormal data and messages during the operation of the charging pile, identify abnormal behaviors and their time periods, organize them into a report, and distribute it to the security team and management.

[0192] In summary, the embodiments of the present application at least include the following beneficial effects:

[0193] (1) By extracting the original linear features in the OCPP communication data, and then identifying non-linear features such as charging modes, user behavior patterns, and abnormal usage patterns, and then making classification decisions, it is possible to better utilize the massive data for more accurate abnormal data detection.

[0194] (2) The non-linear features extracted by the neural network provide richer information for the SVM, enabling the SVM to make more refined and accurate classification decisions. This method that combines the feature extraction ability of the neural network and the classification performance of the SVM can more accurately identify abnormal data in the charging pile network, further improving the efficiency of the entire abnormal detection system.

[0195] (3) The real-time monitoring and feedback mechanism ensure that the performance of the model in actual applications can be evaluated and optimized in a timely manner. By real-time monitoring the OCPP message data, the model can identify abnormal behaviors in a timely manner and make adjustments according to the feedback.

[0196] (4) The present application automatically analyzes the abnormal data and messages in the operation process of the charging pile, identifies abnormal behaviors and their time periods, and organizes them into reports, which is beneficial for coping with rapidly changing attack means and complex network environments, and timely responding to the identification of abnormal data.

[0197] Please refer to Figure 6 , the embodiments of the present application further provide an abnormal data detection system for a charging pile network, which can implement the above-mentioned abnormal data detection method for a charging pile network. The system includes:

[0198] The first module 201 is used to obtain the Open Charge Point Protocol communication data of the charging pile network to obtain the communication data to be detected;

[0199] The second module 202 is used to perform data preprocessing on the communication data to be detected to obtain the first communication data;

[0200] The third module 203 is used to extract the timestamp, charging times, charging amount, and charging duration from the first communication data;

[0201] The fourth module 204 is used to determine the original linear features of the Open Charge Point Protocol communication data according to the timestamp, the charging times, the charging amount, and the charging duration; wherein, the original linear features include historical translation features, difference features, and window statistical features;

[0202] The fifth module 205 is used to perform feature correlation screening on the original linear features to obtain the first linear features;

[0203] The sixth module 206 is configured to identify the charging mode, user behavior mode, and abnormal usage mode of the charging pile according to the first linear feature;

[0204] The seventh module 207 is configured to classify the Open Charge Point Protocol communication data based on the charging mode, the user behavior mode, and the abnormal usage mode to obtain an abnormal data detection result of the charging pile network.

[0205] It can be understood that the content in the above method embodiments is applicable to the system embodiments of the present application. The functions specifically implemented in the system embodiments of the present application are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those in the above method embodiments.

[0206] An embodiment of the present application further provides an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the above method for detecting abnormal data of a charging pile network is implemented. The electronic device can be any intelligent terminal including a tablet computer, an in-vehicle computer, etc.

[0207] It can be understood that the content in the above method embodiments is applicable to the device embodiments of the present application. The functions specifically implemented in the device embodiments of the present application are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those in the above method embodiments.

[0208] Please refer to Figure 7 , Figure 7 which illustrates the hardware structure of an electronic device according to another embodiment. The electronic device includes:

[0209] A processor 301, which can be implemented by using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0210] A memory 302, which can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM), etc. The memory 302 can store an operating system and other application programs. When implementing the technical solutions provided in the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 302 and are called by the processor 301 to execute the above methods;

[0211] An input / output interface 303 for implementing information input and output;

[0212] A communication interface 304 for implementing communication interaction between this device and other devices, which can achieve communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.);

[0213] A bus 305 for transmitting information between various components of the device (such as a processor 301, a memory 302, an input / output interface 303, and a communication interface 304);

[0214] Among them, the processor 301, the memory 302, the input / output interface 303, and the communication interface 304 achieve communication connections with each other inside the device through the bus 305.

[0215] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0216] It can be understood that the content in the above method embodiment is applicable to the present storage medium embodiment. The functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those of the above method embodiment.

[0217] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include high-speed random access memory, and can also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may optionally include a memory remotely provided relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0218] The embodiments described in the embodiments of the present application are for more clearly explaining the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art know that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0219] Those skilled in the art can understand that the technical solutions shown in the figure do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figure, or combine certain steps, or different steps.

[0220] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0221] Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and their appropriate combinations.

[0222] It should be understood that in this application, the terms "first", "second", "third", "fourth", etc. (if any) in the specification and the above drawings are used to distinguish similar objects and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so that the embodiments of this application described here can be implemented in an order different from those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0223] It should be understood that in this application, "at least one (item)" means one or more, and "multiple" means two or more. "And / or" is used to describe the association relationship of associated objects and indicates that there can be three relationships. For example, "A and / or B" can mean: only A exists, only B exists, and both A and B exist at the same time. Among them, A and B can be singular or plural. The character " / " generally means that the associated objects before and after are in an "or" relationship. "At least one (one)" or its similar expression below refers to any combination of these items, including any combination of single item (one) or plural items (ones). For example, at least one (one) of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0224] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the above division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of devices or units can be in electrical, mechanical or other forms.

[0225] The units described above as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0226] In addition, in each embodiment of the present application, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0227] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in each embodiment of the present application. And the aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical discs that can store programs.

[0228] The preferred embodiments of the embodiments of the present application have been described above with reference to the drawings, but this does not limit the scope of rights of the embodiments of the present application. Any modifications, equivalent replacements, and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of rights of the embodiments of the present application.

Claims

1. A charging pile network abnormal data detection method, characterized in that: The following steps are involved: Obtaining the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; Performing data preprocessing on the communication data to be detected to obtain first communication data; extracting a timestamp, a charging number, a charging amount, and a charging duration from the first communication data; Determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; Performing feature correlation screening on the original linear feature to obtain a first linear feature; According to the first linear feature, identifying the charging mode, user behavior pattern and abnormal usage pattern of the charging pile; Based on the charging mode, the user behavior mode and the abnormal usage mode, the open charging point protocol communication data is classified to obtain abnormal data detection results of the charging pile network; Wherein, determining the original linear characteristics of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration includes: using the timestamp, the number of charging times, the charging amount and the charging duration as key features; Calculating the change amount of each key feature within a preset window to obtain a historical translation feature of each key feature; Calculating the difference of the continuous values ​​of each of the key features to obtain the differential feature of each of the key features; Calculate the statistical data of each key feature within a fixed time window to obtain a window statistical feature; The performing feature correlation screening on the original linear feature to obtain the first linear feature includes: Calculating feature correlations between all feature pairs in the original linear features; When the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, calculating the missing value ratio of each feature pair; Remove the feature with the smaller missing value ratio in the feature pair; Returning to the step of calculating the missing value ratio of each of the feature pairs when the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, until all the original linear features are processed to obtain a first linear feature; The identifying, according to the first linear feature, the charging mode, the user behavior mode, and the abnormal usage mode of the charging pile includes: Analyzing the historical translation features and window statistical features in the first linear features through a pre-trained target pattern recognition sub-model to obtain a charging mode; For each user, analyzing the window statistical features in the first linear features by using the target pattern recognition sub-model to obtain a user behavior pattern of each user; The target pattern recognition sub-model is used to analyze the differential features in the first linear features to obtain an abnormal usage pattern.

2. The method according to claim 1, characterized in that The step of performing data preprocessing on the communication data to be detected to obtain first communication data comprises the following steps: Using median filtering to perform denoising on the communication data to be detected to obtain second communication data; The second communication data is normalized to obtain first communication data.

3. The method according to claim 1, characterized in that The method of classifying the open charging point protocol communication data based on the charging mode, the user behavior mode and the abnormal usage mode to obtain abnormal data detection results of the charging pile network includes the following steps: taking the charging pattern, the user behavior pattern and the abnormal usage pattern as nonlinear features; The decision function is used to calculate the distance from the data point in the nonlinear feature to the decision boundary to obtain an output value; Performing a threshold judgment on the abnormality of the output value to obtain a judgment result; The label of the data point is output according to the judgment result to obtain the abnormal data detection result of the charging pile network.

4. The method according to claim 1, characterized in that: The method further includes constructing and training the target pattern recognition sub-model, specifically comprising the following steps: Constructing an initial pattern recognition sub-model including an input layer, a plurality of hidden layers and an output layer; wherein the number of neurons in the input layer is configured as a first number of input features; the number of neurons in the output layer is configured as a second number of output features; and the number of neurons in the hidden layer is configured as between the first number and the second number; Acquire the open charging point protocol communication data of the charging pile network under normal operation and abnormal operation, and obtain normal state data and abnormal state data; Performing data preprocessing on the normal state data and the abnormal state data, and generating a training data set; The initial pattern recognition sub-model is trained based on the training data set to obtain a target pattern recognition sub-model.

5. The method according to claim 1, characterized in that The method further comprises the following steps: Extracting abnormal behaviors and abnormal times according to the abnormal data detection results of the charging pile network; Organizing the abnormal behavior and the abnormal time into an abnormal report; The exception report is sent to management personnel.

6. A charging pile network abnormal data detection system, characterized in that: include: The first module is used to obtain the open charging point protocol communication data of the charging pile network to obtain the communication data to be detected; The second module is used to perform data preprocessing on the communication data to be detected to obtain first communication data; A third module is used to extract a timestamp, a charging number, a charging amount and a charging duration from the first communication data; A fourth module is used to determine the original linear features of the open charging point protocol communication data according to the timestamp, the number of charging times, the charging amount and the charging duration; wherein the original linear features include historical translation features, differential features and window statistical features; A fifth module is used to perform feature correlation screening on the original linear features to obtain a first linear feature; A sixth module, configured to identify a charging mode, a user behavior mode, and an abnormal usage mode of a charging pile according to the first linear feature; A seventh module is used to classify the open charging point protocol communication data based on the charging mode, the user behavior mode and the abnormal use mode to obtain abnormal data detection results of the charging pile network; Wherein, the fourth module is specifically used for: using the timestamp, the number of charging times, the charging amount and the charging duration as key features; Calculating the change amount of each key feature within a preset window to obtain a historical translation feature of each key feature; Calculating the difference of the continuous values ​​of each of the key features to obtain the differential feature of each of the key features; Calculate the statistical data of each key feature within a fixed time window to obtain a window statistical feature; The fifth module is specifically used for: Calculating feature correlations between all feature pairs in the original linear features; When the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, calculating the missing value ratio of each feature pair; Remove the feature with the smaller missing value ratio in the feature pair; Returning to the step of calculating the missing value ratio of each of the feature pairs when the feature correlation between the feature pairs exceeds a preset correlation coefficient threshold, until all the original linear features are processed to obtain a first linear feature; The sixth module is specifically used for: Analyzing the historical translation features and window statistical features in the first linear features through a pre-trained target pattern recognition sub-model to obtain a charging mode; For each user, analyzing the window statistical features in the first linear features by using the target pattern recognition sub-model to obtain a user behavior pattern of each user; The target pattern recognition sub-model is used to analyze the differential features in the first linear features to obtain an abnormal usage pattern.

7. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 5.

Images