Data anomaly detection method and system for data privacy protection of novel power system

Abstract

The invention belongs to the technical field of electric power data processing, and particularly relates to a novel electric power system data privacy protection-oriented data anomaly detection method and system, and the method comprises the steps that a central server randomly initializes a model, and a terminal downloads the initialization model from the central server as a local model; the terminal collects local data according to the sensor and carries out preprocessing, and a local model is trained according to the preprocessed local data; the terminal adopts a Paillier algorithm to encrypt local model parameters and uploads the local model parameters to the central server; the central server carries out aggregation according to the received encrypted local models of the terminals and issues updated model parameters to the terminals; judging whether the reconstruction error converges or not, if so, storing local model parameters by each terminal, and otherwise, repeating the operation; the terminal detects the collected data in real time according to an abnormal threshold setting method; according to the method, a homomorphic encryption mechanism is integrated into the FL, and the privacy problem of local model parameter transmission between the client and the server is solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of power data processing, and in particular relates to a data anomaly detection method and system for data privacy protection of a new power system. Background Art

[0002] In order to achieve green and sustainable social development, the traditional power system has gradually evolved into a new power system. Digitalization and intelligence are one of the important features of the new power system. In recent years, with the in-depth advancement of the construction of the new power system, the equipment infrastructure, management and protection of the power system have been basically realized. Intelligent management is used to provide advanced control and management services. Its main functions include improving energy productivity, balancing supply and demand, controlling emissions, reducing management costs and promoting the development of public utilities; intelligent protection is used to provide power system reliability analysis, fault protection services, security and privacy protection services; intelligent infrastructure consists of intelligent energy subsystems, intelligent information subsystems and intelligent communication subsystems. The intelligent energy subsystem includes power generation systems such as nuclear power plants, oil plants, and coal-fired power plants, as well as transmission networks for stepping down high-voltage electricity, safely distributing electricity, redirecting electricity, etc. The transmission network also includes intelligent control centers, intelligent transmission networks and intelligent substations. The intelligent information subsystem consists of smart meters, phasor measurement units and other sensors for transmitting information between users and utility providers. The intelligent communication subsystem includes wired and wireless technologies as the baseline for communication between entities.

[0003] The real-time monitoring and management, fault detection and maintenance, energy optimization and other functions of the new power system require the support of a large amount of data. If there are errors in the data, it may lead to wrong decisions, failure to detect faults in time, improper energy scheduling and user dissatisfaction. Therefore, it is crucial to ensure the accuracy of the data. Artificial intelligence algorithms play a key role in abnormal data detection. However, transmitting the data collected by smart sensors deployed in substations to the central cloud server for knowledge extraction using artificial intelligence algorithms may lead to serious data abuse, data manipulation or data privacy leakage. In addition, due to privacy issues, various data collection clients in the power system industry are reluctant to exchange data with others, which hinders the creation of high-quality comprehensive anomaly detection models. In this context, designing a high-quality detection model to identify sensor data anomalies in power systems is a challenging problem.

[0004] Among the existing technologies, some are based on extracting features using convolutional neural networks and building knowledge graphs for anomaly detection. However, convolutional neural networks ignore the temporal relationship of data, which reduces the effectiveness and stability of anomaly detection to a certain extent. Some technologies are based on the Federated Learning (FL) framework, which uses local models for anomaly detection locally and uploads the local models to the server. FL reduces the risk of privacy leakage while still providing accurate results for anomaly detection applications. However, FL introduces new privacy issues regarding the transmission of local model parameters between the client and the server, as this data may be used by third parties to reconstruct sensitive information. Summary of the invention

[0005] To solve the above problems, the present invention provides a data anomaly detection method and system for data privacy protection in a new type of power system.

[0006] In a first aspect, the present invention provides a data anomaly detection method for data privacy protection of a new power system, comprising the following steps:

[0007] S1. The central server randomly initializes the model, and each terminal downloads the initialized model from the central server as the local model.

[0008] S2. Each terminal collects and preprocesses local data based on its own sensors, and then trains a local model based on the preprocessed local data;

[0009] S3. Each terminal uses the Paillier algorithm to encrypt the local model parameters, and then uploads the encrypted local model parameters to the central server;

[0010] S4. The central server aggregates the encrypted local models received from each terminal to obtain an aggregate model parameter M, and sends the aggregate model parameter M to each terminal;

[0011] S5. The terminal updates the local model parameters according to the aggregate model parameters M, and determines whether the reconstruction error converges. If so, the terminal saves the updated local model parameters and proceeds to step S6, otherwise returns to step S2;

[0012] S6. The terminal performs real-time detection on the collected data according to the abnormal threshold setting method.

[0013] Furthermore, the central server adopts and initializes the long short-term memory autoencoder model, and the terminal downloads the initialized long short-term memory autoencoder model from the central server as a local model for training, including:

[0014] S21. Process the preprocessed local data into a series of time series [X1, X2, …, XN ], where X n =[x1,x2,…,x T ] represents the nth time series, x t Represents the features of the tth time step in the nth time series, N represents the number of time series, and T represents the length of the time series;

[0015] S22. Convert the time series X n =[x1,x2,…,x T ] Input LSTM encoder, and get the implicit vector z=[z (1,1) ,z (2 ,2),…,z (T,L) ],z (t,l) represents the implicit vector at the tth time step, where

[0016] z (t,l) =μ t +σ t ·ε l

[0017] μ t , σ t represents the mapping vector at the tth time step, ε l is the distribution factor, A is a diagonal matrix;

[0018] S22. The implicit vector z = [z (1,1) ,z (2,2) ,…,z (T,L) ] Input LSTM decoder to get the reconstructed time series

[0019] S23. Based on the time series and the reconstructed time series, the divergence cost loss is calculated and the model parameters are back-propagated. The calculation formula of the divergence cost loss is:

[0020]

[0021] Where cosh(·) represents the hyperbolic cosine function, D KL (·) represents the KL divergence between the approximate value and the true posterior value, LC t Denotes the cost function, from the encoder’s point of view, q φ (z|x t ) is the LSTM encoder, p θ (z) is the LSTM decoder;

[0022] S24. Repeat steps S22-S23 until the model parameters converge.

[0023] Furthermore, in step S3, the process of any terminal using the Paillier algorithm to encrypt the local model parameters includes:

[0024] S31. The central server randomly selects two prime numbers p and q and calculates the product N = pq as the public key, and then calculates the private key λ = lcm(p-1,q-1) based on the prime numbers p and q, where lcm(·) represents the operation of calculating the least common multiple;

[0025] S32. The terminal generates a random number r i , then use the public key N and the random number r i For the local model parameter m i Encrypt and generate ciphertext c i Expressed as

[0026] c i =((1+N×m i )×r i N )modN 2

[0027] S33. The terminal sends the ciphertext c i Upload to the central server.

[0028] Furthermore, the central server aggregates the encrypted local models received from each terminal, including:

[0029] S41. The central server performs addition operations on the ciphertexts uploaded by all terminals according to the additive homomorphic property and obtains the aggregated ciphertext C, which is expressed as

[0030]

[0031] Where n represents the number of terminals, and N represents the central server public key;

[0032] S42. The aggregated ciphertext is decrypted to restore the aggregated model parameter M, and the aggregated model parameter M is sent to each terminal; wherein the aggregated model parameter M is expressed as:

[0033]

[0034] Among them, λ represents the private key of the central server.

[0035] Further, in step S6, the terminal performs real-time detection on the collected data according to the abnormal threshold setting method, including:

[0036] S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data;

[0037] S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as

[0038] MAD m =kmedian(|y i -median(y)|)

[0039] Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the sorting and median operation;

[0040] S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers;

[0041] S64. Calculate the reconstruction error between the real-time data of each abnormal point and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as

[0042] τ MSD =μ+p.σ

[0043] Where p represents a constant;

[0044] S62. Calculate real-time data y and reconstruct data The mean square error MSE between the two is used to determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

[0045] In a second aspect, based on the method proposed in the first aspect, the present invention further provides a data anomaly detection system for data privacy protection of a new power system, including a federated training system and a real-time detection system, wherein the federated training system includes a central processing module, a terminal module and an encryption module, wherein:

[0046] A central processing module, which includes an initial model building unit and a parameter aggregation updating unit;

[0047] An initial model building unit, used to build an initialization model according to a long short-term memory autoencoder model;

[0048] The parameter aggregation update unit is used to receive the ciphertext uploaded by the encryption module, aggregate all the ciphertexts and restore the aggregate model parameters through decryption operation.

[0049] A terminal module, which includes a plurality of terminal units, each terminal unit is equipped with a sensor unit;

[0050] The sensor unit is used to collect and pre-process local data, and then send the pre-processed local data to the corresponding terminal unit;

[0051] The terminal unit is used to download the initialization model from the central processing module as the local model, use the pre-processed local data to train the local model, and send the trained local model parameters to the encryption module; download the aggregate model parameters from the central processing module in each iteration, and update the local model parameters according to the aggregate model parameters;

[0052] An encryption module, used for receiving the local model parameters of each terminal unit and encrypting them to obtain ciphertext, and sending the ciphertext to the parameter aggregation update unit;

[0053] The real-time detection system uses trained terminal modules to perform real-time detection of abnormal data.

[0054] Beneficial effects of the present invention:

[0055] In order to protect the privacy of power grid data, the present invention adopts the federated learning (FL) anomaly detection model for training, and the Long Short-Term Memory Autoencoder (LSTM-AE) model is used as the local model of the terminal during the training process to better detect anomalies in the sensor data obtained in the smart grid infrastructure. In order to solve the new privacy problem introduced by FL regarding the transmission of local model parameters between the client and the server, the present invention further integrates the homomorphic encryption (HE) mechanism into FL. Since homomorphic encryption can perform mathematical calculations on encrypted ciphertext and generate encrypted results without decrypting it first. HE maintains the privacy of client encrypted data and allows third parties to perform specific operations on client encrypted data without decrypting the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 is a flow chart of the method of the present invention;

[0057] Figure 2 This is a diagram of the federated learning framework of the present invention. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] The present invention provides a data anomaly detection method for data privacy protection of a new power system, such as Figure 1 , Figure 2 As shown, the following steps are included:

[0060] S1. The central server randomly initializes the model, and each terminal downloads the initialized model from the central server as the local model.

[0061] S2. Each terminal collects and preprocesses local data based on its own sensors, and then trains a local model based on the preprocessed local data.

[0062] Specifically, preprocessing operations include data cleaning, data integration, data conversion, etc.

[0063] Specifically, the central server uses a long short-term memory autoencoder (LSTM-AE) model and initializes it. One LSTM-AE model uses an LSTM network to implement the architecture of the encoder and decoder of the autoencoder, that is, the encoder and decoder of the autoencoder are constructed by LSTM. The LSTM-AE model has the properties of both the LSTM network and the autoencoder.

[0064] The terminal downloads the initialized long short-term memory autoencoder (LSTM-AE) model from the central server as a local model for training, including:

[0065] S21. Process the preprocessed local data into a series of time series [X1, X2, …, X N ], where X n =[x1,x2,…,x T ] represents the nth time series, x t Represents the features of the tth time step in the nth time series, N represents the number of time series, and T represents the length of the time series;

[0066] S22. Convert the time series X n =[x1,x2,…,x T ] Input LSTM encoder, which is composed of multiple LSTM units, each LSTM unit works together to retain all data points in the time series and analyze the pattern of features; time series X n In the LSTM encoder, the implicit vector z is obtained by mapping (1,1) ,z (2 ,2),…,z (T,l) ],z (t,l) represents the implicit vector at the tth time step, where

[0067] z (t,l) =μ t+σ t ·ε l

[0068] μ t , σ t represents the mapping vector at the tth time step, ε l To satisfy The distribution hypothesis is the l=1, 2, …, Lth distribution factor, A is a diagonal matrix. L is the number of distribution factors, L=T; Denotes a multivariate Gaussian distribution. ε is determined by using the eigenvalues ​​of the diagonal matrix A. l The variance of the latent variables of the model is reduced, making the latent variable sampling of the model more consistent with the statistical characteristics of the training data, especially in the high-frequency and medium-frequency characteristics. In other words, the structure of the latent space is better adapted to the main frequency components of the data, rather than just assuming that the data of each dimension is independent and has the same variance. This improvement can help VAE capture the complexity of the data more accurately, especially in data involving frequency decomposition (such as wavelet transform).

[0069] Specifically, the mapping space in the LSTM encoder of the present invention is g φ (.), after the time series is input into the LSTM encoder, each element is mapped through the mapping space to obtain the mapping vector μ t ,σ t =g φ (z (t,l) |x t ), thereby constructing the implicit vector z (t,l) .

[0070] Specifically, the process of obtaining the diagonal matrix A includes:

[0071] The principal component analysis (PCA) is performed on the preprocessed local data to obtain the first principal component and the second principal component; the main features are extracted through principal component analysis to reduce the data dimension.

[0072] The first principal component is subjected to wavelet transformation, using db4 wavelet, with a maximum of 4 decomposition layers; the focus is on high-frequency and medium-frequency detail coefficients (wavelet detail coefficients), and the wavelet detail coefficients of each layer are used as a column vector to construct the first wavelet detail coefficient matrix;

[0073] Similarly, the second principal component is subjected to wavelet transformation, wherein the db4 wavelet is used, and the number of decomposition layers is at most 4; the wavelet detail coefficient of each layer is used as a column vector to construct the second wavelet detail coefficient matrix;

[0074] In order to ensure that the size of each column vector in the wavelet detail coefficient matrix is ​​equal, the wavelet detail coefficients of the lower level are expanded by filling with 0.

[0075] Wavelet transform is used to separate high-frequency and medium-frequency components. This method enables the main features to be accurately represented while removing redundancy and noise.

[0076] For the first wavelet detail coefficient matrix and the second wavelet detail coefficient matrix, the average value of each element is calculated to obtain an average matrix B;

[0077] Perform eigenvalue decomposition on the average matrix B, extract the first two largest eigenvalues ​​to construct the diagonal matrix A, which can be expressed as

[0078]

[0079] Among them, λ1 and λ2 are the first two largest eigenvalues ​​of the average matrix B.

[0080] The constructed diagonal matrix A, whose elements are the first two eigenvalues ​​of the average matrix B. This processing method simplifies the representation of complex features and facilitates subsequent modeling.

[0081] S22. The implicit vector z = [z (1,1) ,z (2,2) ,…,z (T,L) ] Input LSTM decoder, which is also composed of multiple LSTM units. LSTM decoder reconstructs a fixed-size input sequence from the low-dimensional implicit vector in the latent space, that is, obtains the reconstructed time series

[0082] S23. Based on the time series and the reconstructed time series, calculate the divergence cost loss and back-propagate the training model parameters;

[0083] Specifically, the calculation formula for the divergence cost loss is:

[0084]

[0085] Where cosh(·) represents D KL (·) represents the KL divergence between the approximate value and the true posterior value, LC t Denotes the cost function, from the encoder's perspective, to approximate the posterior q φ (z|x t ) can be viewed as an LSTM encoder, a directed probabilistic graph model p θ (z) can be viewed as an LSTM decoder.

[0086] S24. Repeat steps S22-S23 until the model parameters converge.

[0087] S3. Each terminal uses the Paillier algorithm to encrypt the local model parameters, and then uploads the encrypted local model parameters to the central server.

[0088] Specifically, the process of any terminal using the Paillier algorithm to encrypt the local model parameters in step S3 includes:

[0089] S31. The central server randomly selects two prime numbers p and q and calculates the product N = pq as the public key, and then calculates the private key λ = lcm(p-1,q-1) based on the prime numbers p and q, where lcm(·) represents the operation of calculating the least common multiple;

[0090] S32. The terminal generates a random number r i , then use the public key N and the random number r i For the local model parameter m i Encrypt and generate ciphertext c i Expressed as

[0091] c i =(1+N×m i )×r i N mod N 2

[0092] S33. The terminal converts the encrypted local model parameters, i.e., the ciphertext c i Upload to the central server.

[0093] S4. The central server aggregates the encrypted local model parameters uploaded by each terminal to obtain the aggregated model parameter M, and sends the aggregated model parameter M to each terminal. At this time, without decrypting the ciphertext, the central server directly performs an addition homomorphic operation on all ciphertexts to aggregate the encrypted local model parameters of all terminals.

[0094] Specifically, the central server aggregates the encrypted local models received from each terminal, including:

[0095] S41. Based on the homomorphic encryption feature, the central server performs addition operation on the ciphertext uploaded by all terminals, that is, the encrypted local model parameters, to obtain the aggregated ciphertext C, which is expressed as:

[0096]

[0097] Where n represents the number of terminals;

[0098] S42. The aggregated ciphertext is decrypted to restore the aggregated model parameter M, and the aggregated model parameter M is sent to each terminal; wherein the aggregated model parameter M is expressed as:

[0099]

[0100] S5. The terminal updates the local model parameters according to the aggregate model parameters M and determines whether the reconstruction error converges. If so, each terminal saves the updated local model parameters and organizes the reconstruction errors corresponding to all abnormal data in the training process into an error sequence and proceeds to step S6, otherwise returns to step S2.

[0101] Specifically, the reconstruction error here refers to the mean square error between the data input to the local model and the data reconstructed and output by the local model.

[0102] S6. The terminal performs real-time detection on the collected data according to the abnormal threshold setting method.

[0103] Specifically, in step S6, the terminal performs real-time detection on the collected data according to the abnormal threshold setting method, including:

[0104] S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data;

[0105] S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as

[0106] MAD m =kmedian(|y i -median(y)|)

[0107] Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the sorting and median operation;

[0108] S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers;

[0109] S64. Calculate the reconstruction error between the real-time data of each abnormal point and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as

[0110] τ MSD =μ+p.σ

[0111] Among them, p represents a constant used to adjust the threshold, which needs to be adjusted according to the specific characteristics of the data;

[0112] S62. Calculate real-time data y and reconstruct data The mean square error MSE between

[0113]

[0114] Determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

[0115] The present invention also provides a data anomaly detection system for data privacy protection of a new power system, including a federated training system and a real-time detection system. The federated training system includes a central processing module, a terminal module and an encryption module, wherein:

[0116] A central processing module, which includes an initial model building unit and a parameter aggregation updating unit;

[0117] An initial model building unit, used to build an initialization model according to a long short-term memory autoencoder model;

[0118] The parameter aggregation update unit is used to receive the ciphertext uploaded by the encryption module, aggregate all the ciphertexts and restore the aggregate model parameters through decryption operation.

[0119] A terminal module, which includes a plurality of terminal units, each terminal unit is equipped with a sensor unit;

[0120] The sensor unit is used to collect and pre-process local data, and then send the pre-processed local data to the corresponding terminal unit;

[0121] The terminal unit is used to download the initialization model from the central processing module as the local model, use the pre-processed local data to train the local model, and send the trained local model parameters to the encryption module; download the aggregate model parameters from the central processing module in each iteration, and update the local model parameters according to the aggregate model parameters;

[0122] An encryption module, used for receiving the local model parameters of each terminal unit and encrypting them to obtain ciphertext, and sending the ciphertext to the parameter aggregation update unit;

[0123] The real-time detection system uses trained terminal modules to perform real-time detection of abnormal data.

[0124] In the present invention, unless otherwise clearly stipulated and limited, the terms such as "installation", "setting", "connection", "fixation" and "rotation" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral one; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. Unless otherwise clearly defined, ordinary technicians in this field can understand the specific meanings of the above terms in the present invention according to the specific circumstances.

[0125] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data anomaly detection method for data privacy protection in a new power system, characterized in that: The following steps are involved: S1. The central server randomly initializes the model, and each terminal downloads the initialized model from the central server as the local model. S2. Each terminal collects and preprocesses local data based on its own sensors, and then trains a local model based on the preprocessed local data; S3. Each terminal uses the Paillier algorithm to encrypt the local model parameters, and then uploads the encrypted local model parameters to the central server; S4. The central server aggregates the encrypted local models received from each terminal to obtain an aggregate model parameter M, and sends the aggregate model parameter M to each terminal; S5. The terminal updates the local model parameters according to the aggregate model parameters M, and determines whether the reconstruction error converges. If so, the terminal saves the updated local model parameters and proceeds to step S6, otherwise returns to step S2; S6. The terminal performs real-time detection on the collected data according to the abnormal threshold setting method.

2. According to claim 1, a data anomaly detection method for data privacy protection of a new power system is characterized in that: The central server uses the long short-term memory autoencoder model and initializes it. The terminal downloads the initialized long short-term memory autoencoder model from the central server as a local model for training, including: S21. Process the preprocessed local data into a series of time series [X1, X2, …, X N ], where X n =[x1,x2,…,x T ] represents the nth time series, x t Represents the features of the tth time step in the nth time series, N represents the number of time series, and T represents the length of the time series; S22. Convert the time series X n =[x1,x2,…,x T ] Input LSTM encoder, and get the implicit vector z=[z (1,1) ,z (2,2) ,…,z (T,L) ],z (t,l) represents the implicit vector at the tth time step, where z (t,l) =μ t +s t ·e l μ t , σ t represents the mapping vector at the tth time step, ε l is the distribution factor, A is a diagonal matrix; S22. The implicit vector z = [z (1,1) ,z (2,2) ,…,z (T,L) ] Input LSTM decoder to get the reconstructed time series S23. Based on the time series and the reconstructed time series, the divergence cost loss is calculated and the model parameters are trained by back propagation; the calculation formula of the divergence cost loss is: Where cosh(·) represents the hyperbolic cosine function, D KL (·) represents the KL divergence between the approximate value and the true posterior value, LC t Denotes the cost function. From the encoder’s perspective, q φ (z|x t ) is the LSTM encoder, p θ (z) is the LSTM decoder; S24. Repeat steps S22-S23 until the model parameters converge.

3. According to claim 1, a data anomaly detection method for data privacy protection of a new power system is characterized in that: In step S3, the process of any terminal using the Paillier algorithm to encrypt the local model parameters includes: S31. The central server randomly selects two prime numbers p and q and calculates the product N = pq as the public key, and then calculates the private key λ = lcm(p-1,q-1) based on the prime numbers p and q, where lcm(·) represents the operation of calculating the least common multiple; S32. The terminal generates a random number r i , then use the public key N and the random number r i For the local model parameter m i Encrypt and generate ciphertext c i Expressed as c i =((1+N×m i )×r i N )modN 2 S33. The terminal sends the ciphertext c i Upload to the central server.

4. According to claim 1, a data anomaly detection method for data privacy protection of a new power system is characterized in that: The central server aggregates the encrypted local models received from each terminal, including: S41. The central server performs addition operations on the ciphertexts uploaded by all terminals according to the additive homomorphic property and obtains the aggregated ciphertext C, which is expressed as Where n represents the number of terminals, and N represents the central server public key; S42. The aggregated ciphertext is decrypted to restore the aggregated model parameter M, and the aggregated model parameter M is sent to each terminal; wherein the aggregated model parameter M is expressed as: Among them, λ represents the private key of the central server.

5. The data anomaly detection method for data privacy protection of a new power system according to claim 1 is characterized in that: Step S6: the terminal performs real-time detection on the collected data according to the abnormal threshold setting method, including: S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data; S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as MAD m =kmedian(|y i -median(y)|) Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the sorting and median operation; S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers; S64. Calculate the reconstruction error between the real-time data of each abnormal point and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as t MSD =μ+p.σ Where p represents a constant; S62. Calculate real-time data y and reconstruct data The mean square error MSE between the two is used to determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

6. A data anomaly detection system for data privacy protection in a new power system, characterized in that: It includes a federated training system and a real-time detection system. The federated training system includes a central processing module, a terminal module and an encryption module, wherein: A central processing module, which includes an initial model building unit and a parameter aggregation updating unit; An initial model building unit, used to build an initialization model according to a long short-term memory autoencoder model; The parameter aggregation update unit is used to receive the ciphertext uploaded by the encryption module, aggregate all the ciphertexts and restore the aggregate model parameters through decryption operation. A terminal module, which includes a plurality of terminal units, each terminal unit is equipped with a sensor unit; The sensor unit is used to collect and pre-process local data, and then send the pre-processed local data to the corresponding terminal unit; The terminal unit is used to download the initialization model from the central processing module as the local model, use the pre-processed local data to train the local model, and send the trained local model parameters to the encryption module; download the aggregate model parameters from the central processing module in each iteration, and update the local model parameters according to the aggregate model parameters; An encryption module, used for receiving the local model parameters of each terminal unit and encrypting them to obtain ciphertext, and sending the ciphertext to the parameter aggregation update unit; The real-time detection system uses trained terminal modules to perform real-time detection of abnormal data.

7. A data anomaly detection system for data privacy protection of a new power system according to claim 6, characterized in that: Each trained terminal module performs real-time detection of abnormal data, including: S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data; S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as MAD m =kmedian(|y i -median(y)|) Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the sorting and median operation; S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers; S64. Calculate the reconstruction error between the real-time data of each abnormal point and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as t MSD =μ+p.σ Where p represents a constant; S62. Calculate real-time data y and reconstruct data The mean square error MSE between the two is used to determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

Images