A data anomaly detection method and system for data privacy protection in new power systems

Abstract

The present invention belongs to the technical field of power data processing, and specifically relates to a data anomaly detection method and system for data privacy protection in a novel power system. The method comprises the following steps: a central server randomly initializes a model, and a terminal downloads the initialized model from the central server as a local model; the terminal collects local data according to sensors and preprocesses it, and trains a local model based on the preprocessed local data; the terminal encrypts the local model parameters using the Paillier algorithm and uploads them to the central server; the central server aggregates the encrypted local models received from each terminal and sends the updated model parameters to each terminal; it determines whether the reconstruction error has converged, and if so, each terminal saves the local model parameters; otherwise, the above operation is repeated; the terminal performs real-time detection on the collected data according to an anomaly threshold setting method; the present invention integrates a homomorphic encryption mechanism into FL to solve the privacy problem of local model parameter transmission between the client and the server.

Description

Technical Field

[0001] The present invention belongs to the technical field of power data processing, and in particular relates to a data anomaly detection method and system for protecting data privacy in a novel power system. Background Art

[0002] To achieve green and sustainable social development, traditional power systems are gradually evolving into new power systems, with digitalization and intelligence being key features of these systems. In recent years, with the in-depth development of new power systems, intelligent equipment infrastructure, management, and protection have been largely realized. Intelligent management provides advanced control and management services, primarily focusing on improving energy productivity, balancing supply and demand, controlling emissions, reducing management costs, and promoting utility development. Intelligent protection provides power system reliability analysis, fault protection services, and security and privacy protection services. Intelligent infrastructure comprises intelligent energy subsystems, intelligent information subsystems, and intelligent communications subsystems. The intelligent energy subsystem encompasses power generation systems such as nuclear power plants, oil refineries, and coal-fired power plants, as well as the transmission network, which is responsible for stepping down high-voltage electricity, safely distributing electricity, and redirecting power. The transmission network also includes intelligent control centers, intelligent transmission networks, and smart substations. The intelligent information subsystem, comprised of smart meters, phasor measurement units, and other sensors, transmits information between users and utility providers. The intelligent communications subsystem, encompassing both wired and wireless technologies, serves as the baseline for communication between entities.

[0003] Real-time monitoring and management, fault detection and maintenance, and energy optimization functions of new power systems require the support of large amounts of data. Errors in the data can lead to incorrect decisions, undetected faults, improper energy scheduling, and user dissatisfaction. Therefore, ensuring the accuracy of the data is crucial. Artificial intelligence algorithms play a key role in abnormal data detection. However, transmitting data collected by smart sensors deployed in substations to a central cloud server for knowledge extraction using artificial intelligence algorithms can lead to serious data abuse, data manipulation, or data privacy leakage. In addition, due to privacy issues, various data collection clients in the power system industry are reluctant to exchange data with others, which hinders the creation of high-quality comprehensive anomaly detection models. In this context, designing a high-quality detection model to identify sensor data anomalies in power systems is a challenging problem.

[0004] Some existing technologies use convolutional neural networks to extract features and build knowledge graphs for anomaly detection. However, convolutional neural networks ignore the temporal relationships of data, which reduces the effectiveness and stability of anomaly detection. Some technologies are based on the federated learning (FL) framework, using local models for anomaly detection and uploading them to the server. FL reduces the risk of privacy leakage while still providing accurate results for anomaly detection applications. However, FL introduces new privacy issues regarding the transmission of local model parameters between the client and server, as this data can be used by third parties to reconstruct sensitive information. Summary of the Invention

[0005] To solve the above problems, the present invention provides a data anomaly detection method and system for data privacy protection in a new type of power system.

[0006] In a first aspect, the present invention provides a data anomaly detection method for protecting data privacy in a novel power system, comprising the following steps:

[0007] S1. The central server randomly initializes the model, and each terminal downloads the initialized model from the central server as the local model.

[0008] S2. Each terminal collects and preprocesses local data based on its own sensors, and then trains a local model based on the preprocessed local data.

[0009] S3. Each terminal encrypts the local model parameters using the Paillier algorithm and then uploads the encrypted local model parameters to the central server;

[0010] S4. The central server obtains the aggregate model parameter M by aggregating the encrypted local model received from each terminal, and sends the aggregate model parameter M to each terminal;

[0011] S5. The terminal updates the local model parameters according to the aggregate model parameters M and determines whether the reconstruction error converges. If so, the terminal saves the updated local model parameters and proceeds to step S6, otherwise returns to step S2;

[0012] S6. The terminal performs real-time detection on the collected data according to the abnormal threshold setting method.

[0013] Furthermore, the central server uses and initializes the long short-term memory autoencoder model, and the terminal downloads the initialized long short-term memory autoencoder model from the central server as a local model for training, including:

[0014] S21. Process the preprocessed local data into a series of time series [X1, X2,…, XN ], where X n =[x1,x2,…,x T ] represents the nth time series, x t Represents the features of the t-th time step in the n-th time series, N represents the number of time series, and T represents the length of the time series;

[0015] S22. Convert the time series X n =[x1,x2,…,x T ] Input LSTM encoder, and get the implicit vector z=[z (1,1) ,z (2 ,2),…,z (T,L) ],z (t,l) represents the latent vector at the t-th time step, where

[0016] z (t,l) =μ t +σ t ·ε l

[0017] μ t , σ t represents the mapping vector at the tth time step, ε l is the distribution factor, A is a diagonal matrix;

[0018] S22. Set the implicit vector z = [z (1,1) ,z (2,2) ,…,z (T,L) ] Input LSTM decoder to get the reconstructed time series

[0019] S23. Based on the time series and the reconstructed time series, the divergence cost loss is calculated and the model parameters are trained through backpropagation. The calculation formula of the divergence cost loss is:

[0020]

[0021] Where cosh(·) represents the hyperbolic cosine function, D KL (·) represents the KL divergence between the approximate value and the true posterior value, LC t Denotes the cost function, from the encoder’s perspective, q φ (z|x t ) is the LSTM encoder, p θ (z) is the LSTM decoder;

[0022] S24. Repeat steps S22-S23 until the model parameters converge.

[0023] Furthermore, in step S3, the process of encrypting the local model parameters by any terminal using the Paillier algorithm includes:

[0024] S31. The central server randomly selects two prime numbers p and q and calculates the product N = pq as the public key. Then, the central server calculates the private key λ = lcm(p-1,q-1) based on the prime numbers p and q, where lcm(·) represents the least common multiple operation.

[0025] S32. The terminal generates a random number r i , then use the public key N and the random number r i For the local model parameter m i Encrypt and generate ciphertext c i Expressed as

[0026] c i =((1+N×m i )×r i N )modN 2

[0027] S33. The terminal sends the ciphertext c i Upload to the central server.

[0028] Furthermore, the central server aggregates the encrypted local models received from each terminal, including:

[0029] S41. The central server performs an addition operation on the ciphertexts uploaded by all terminals based on the additive homomorphic property to obtain the aggregated ciphertext C, which is expressed as

[0030]

[0031] Where n represents the number of terminals and N represents the central server public key;

[0032] S42. The aggregated ciphertext is decrypted to restore the aggregated model parameter M, which is then sent to each terminal. The aggregated model parameter M is expressed as:

[0033]

[0034] Where λ represents the private key of the central server.

[0035] Furthermore, in step S6, the terminal performs real-time detection on the collected data according to the abnormality threshold setting method, including:

[0036] S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data;

[0037] S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as

[0038] MAD m =kmedian(|y i -median(y)|)

[0039] Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the median operation of sorting;

[0040] S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers;

[0041] S64. Calculate the reconstruction error between the real-time data of each outlier and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as

[0042] τ MSD =μ+p.σ

[0043] Where p represents a constant;

[0044] S62. Calculate real-time data y and reconstruct data The mean square error MSE between the two values ​​is used to determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

[0045] In a second aspect, based on the method proposed in the first aspect, the present invention further provides a data anomaly detection system for data privacy protection in a novel power system, including a federated training system and a real-time detection system. The federated training system includes a central processing module, a terminal module, and an encryption module, wherein:

[0046] a central processing module, which includes an initial model building unit and a parameter aggregation updating unit;

[0047] An initial model building unit, used to build an initialization model based on a long short-term memory autoencoder model;

[0048] The parameter aggregation update unit is used to receive the ciphertext uploaded by the encryption module, aggregate all the ciphertexts and restore the aggregate model parameters through decryption operation.

[0049] A terminal module, comprising a plurality of terminal units, each terminal unit being equipped with a sensor unit;

[0050] The sensor unit is used to collect local data and pre-process it, and then send the pre-processed local data to the corresponding terminal unit;

[0051] The terminal unit is configured to download the initialization model from the central processing module as the local model, train the local model using the preprocessed local data, and send the trained local model parameters to the encryption module; download the aggregated model parameters from the central processing module in each iteration, and update the local model parameters based on the aggregated model parameters;

[0052] An encryption module, configured to receive the local model parameters of each terminal unit and encrypt them to obtain ciphertext, and send the ciphertext to the parameter aggregation and updating unit;

[0053] The real-time detection system uses trained terminal modules to perform real-time detection of abnormal data.

[0054] Beneficial effects of the present invention:

[0055] To protect the privacy of power grid data, the present invention adopts a federated learning (FL) anomaly detection model for training. During the training process, a long short-term memory autoencoder (LSTM-AE) model is used as the local model of the terminal to better detect anomalies in the sensor data obtained in the smart grid infrastructure. In order to solve the new privacy issues introduced by FL regarding the transmission of local model parameters between the client and the server, the present invention further integrates the homomorphic encryption (HE) mechanism into FL. Because homomorphic encryption can perform mathematical calculations on encrypted ciphertext and generate encrypted results without decrypting it first. HE maintains the privacy of client-encrypted data and allows third parties to perform specific operations on client-encrypted data without decrypting the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 Flow chart of the method of the present invention;

[0057] Figure 2 This is the federated learning framework diagram of the present invention. DETAILED DESCRIPTION

[0058] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0059] The present invention provides a data anomaly detection method for data privacy protection in a new type of power system. Figure 1 、 Figure 2 As shown, the following steps are included:

[0060] S1. The central server randomly initializes the model, and each terminal downloads the initialized model from the central server as the local model.

[0061] S2. Each terminal collects and preprocesses local data based on its own sensors, and then trains a local model based on the preprocessed local data.

[0062] Specifically, preprocessing operations include data cleaning, data integration, data conversion, etc.

[0063] Specifically, the central server uses and initializes a Long Short-Term Memory Autoencoder (LSTM-AE) model. One type of LSTM-AE model uses an LSTM network to implement the encoder and decoder architecture of an autoencoder. This architecture uses LSTM to construct the encoder and decoder of the autoencoder. The LSTM-AE model combines the properties of both an LSTM network and an autoencoder.

[0064] The terminal downloads the initialized long short-term memory autoencoder (LSTM-AE) model from the central server as a local model for training, including:

[0065] S21. Process the preprocessed local data into a series of time series [X1, X2,…, X N ], where X n =[x1,x2,…,x T ] represents the nth time series, x t Represents the features of the t-th time step in the n-th time series, N represents the number of time series, and T represents the length of the time series;

[0066] S22. Convert the time series X n =[x1,x2,…,x T ] Input LSTM encoder, which is composed of multiple LSTM units. Each LSTM unit works together to retain all data points in the time series and analyze the pattern of features; time series X n In the LSTM encoder, the implicit vector z=[z (1,1) ,z (2 ,2),…,z (T,l) ],z (t,l) represents the latent vector at the t-th time step, where

[0067] z (t,l) =μ t+σ t ·ε l

[0068] μ t , σ t represents the mapping vector at the tth time step, ε l To satisfy The distribution hypothesis is l = 1, 2, ..., L distribution factors, A is a diagonal matrix. L is the number of distribution factors, L = T; Denotes a multivariate Gaussian distribution. ε is determined by using the eigenvalues ​​of the diagonal matrix A. l The variance of the latent variables is reduced, allowing the model's latent variable sampling to better match the statistical characteristics of the training data, especially the high- and medium-frequency features. In other words, the structure of the latent space is better adapted to the main frequency components of the data, rather than simply assuming that the data in each dimension are independent and homoscedastic. This improvement can help VAEs more accurately capture the complexity of the data, especially in data that requires frequency decomposition (such as wavelet transforms).

[0069] Specifically, the mapping space in the LSTM encoder of the present invention is g φ (.), after the time series is input into the LSTM encoder, each element is mapped through the mapping space to obtain the mapping vector μ t ,σ t =g φ (z (t,l) |x t ), thereby constructing the implicit vector z (t,l) .

[0070] Specifically, the process of obtaining the diagonal matrix A includes:

[0071] The preprocessed local data is subjected to principal component analysis (PCA) to obtain the first principal component and the second principal component; the main features are extracted through principal component analysis to reduce the data dimension.

[0072] Perform wavelet transform on the first principal component, using db4 wavelet with a maximum decomposition layer of 4. Focus on the high-frequency and mid-frequency detail coefficients (wavelet detail coefficients), and use the wavelet detail coefficients of each layer as a column vector to construct the first wavelet detail coefficient matrix.

[0073] Similarly, the second principal component is subjected to wavelet transform, wherein the db4 wavelet is used and the number of decomposition layers is at most 4; the wavelet detail coefficient of each layer is used as a column vector to construct the second wavelet detail coefficient matrix;

[0074] In order to ensure that the size of each column vector in the wavelet detail coefficient matrix is ​​equal, the wavelet detail coefficients of the lower level are expanded by filling with 0.

[0075] Wavelet transform is used to separate high-frequency and medium-frequency components. This method enables the main features to be accurately represented while removing redundancy and noise.

[0076] For the first wavelet detail coefficient matrix and the second wavelet detail coefficient matrix, the average value of each element is calculated to obtain the average matrix B;

[0077] Perform eigenvalue decomposition on the average matrix B, extract the first two largest eigenvalues ​​to construct the diagonal matrix A, which can be expressed as

[0078]

[0079] Among them, λ1 and λ2 are the first two largest eigenvalues ​​of the average matrix B.

[0080] The constructed diagonal matrix A, whose elements are the first two eigenvalues ​​of the average matrix B. This processing method simplifies the representation of complex features and facilitates subsequent modeling.

[0081] S22. Set the implicit vector z = [z (1,1) ,z (2,2) ,…,z (T,L) ] Input LSTM decoder, which is also composed of multiple LSTM units. LSTM decoder reconstructs the fixed-size input sequence from the low-dimensional implicit vector in the latent space, that is, the reconstructed time series

[0082] S23. Based on the time series and the reconstructed time series, calculate the divergence cost loss and backpropagate the training model parameters;

[0083] Specifically, the calculation formula for the divergence cost loss is:

[0084]

[0085] Where cosh(·) represents D KL (·) represents the KL divergence between the approximate value and the true posterior value, LC t Denotes the cost function, from the encoder's perspective, to approximate the posterior q φ (z|x t ) can be viewed as an LSTM encoder, a directed probabilistic graph model p θ (z) can be viewed as an LSTM decoder.

[0086] S24. Repeat steps S22-S23 until the model parameters converge.

[0087] S3. Each terminal uses the Paillier algorithm to encrypt the local model parameters and then uploads the encrypted local model parameters to the central server.

[0088] Specifically, the process of any terminal using the Paillier algorithm to encrypt the local model parameters in step S3 includes:

[0089] S31. The central server randomly selects two prime numbers p and q and calculates the product N = pq as the public key. Then, the central server calculates the private key λ = lcm(p-1,q-1) based on the prime numbers p and q, where lcm(·) represents the least common multiple operation.

[0090] S32. The terminal generates a random number r i , then use the public key N and the random number r i For the local model parameter m i Encrypt and generate ciphertext c i Expressed as

[0091] c i =(1+N×m i )×r i N mod N 2

[0092] S33. The terminal converts the encrypted local model parameters, i.e., the ciphertext c i Upload to the central server.

[0093] S4. The central server aggregates the encrypted local model parameters uploaded by each terminal to obtain the aggregated model parameter M and sends the aggregated model parameter M to each terminal. In this case, without decrypting the ciphertext, the central server directly performs an additive homomorphic operation on all ciphertexts to aggregate the encrypted local model parameters of all terminals.

[0094] Specifically, the central server aggregates the encrypted local models received from each terminal, including:

[0095] S41. Based on the homomorphic encryption feature, the central server performs an addition operation on the ciphertexts uploaded by all terminals, i.e., the encrypted local model parameters, to obtain the aggregated ciphertext C, which is expressed as:

[0096]

[0097] Where n represents the number of terminals;

[0098] S42. The aggregated ciphertext is decrypted to restore the aggregated model parameter M, which is then sent to each terminal. The aggregated model parameter M is expressed as:

[0099]

[0100] S5. The terminal updates the local model parameters according to the aggregate model parameters M and determines whether the reconstruction error converges. If so, each terminal saves the updated local model parameters and organizes the reconstruction errors corresponding to all abnormal data in the training process into an error sequence and proceeds to step S6. Otherwise, it returns to step S2.

[0101] Specifically, the reconstruction error here refers to the mean square error between the data input to the local model and the data reconstructed by the local model.

[0102] S6. The terminal performs real-time detection on the collected data according to the abnormal threshold setting method.

[0103] Specifically, in step S6, the terminal performs real-time detection on the collected data according to the abnormality threshold setting method, including:

[0104] S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data;

[0105] S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as

[0106] MAD m =kmedian(|y i -median(y)|)

[0107] Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the median operation of sorting;

[0108] S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers;

[0109] S64. Calculate the reconstruction error between the real-time data of each outlier and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as

[0110] τ MSD =μ+p.σ

[0111] Among them, p represents the constant used to adjust the threshold, which needs to be adjusted according to the specific characteristics of the data;

[0112] S62. Calculate real-time data y and reconstruct data The mean square error MSE between

[0113]

[0114] Determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

[0115] The present invention also provides a data anomaly detection system for data privacy protection in a novel power system, including a federated training system and a real-time detection system. The federated training system includes a central processing module, a terminal module, and an encryption module, wherein:

[0116] a central processing module, which includes an initial model building unit and a parameter aggregation updating unit;

[0117] An initial model building unit, used to build an initialization model based on a long short-term memory autoencoder model;

[0118] The parameter aggregation update unit is used to receive the ciphertext uploaded by the encryption module, aggregate all the ciphertexts and restore the aggregate model parameters through decryption operation.

[0119] A terminal module, comprising a plurality of terminal units, each terminal unit being equipped with a sensor unit;

[0120] The sensor unit is used to collect local data and pre-process it, and then send the pre-processed local data to the corresponding terminal unit;

[0121] The terminal unit is configured to download the initialization model from the central processing module as the local model, train the local model using the preprocessed local data, and send the trained local model parameters to the encryption module; download the aggregated model parameters from the central processing module in each iteration, and update the local model parameters based on the aggregated model parameters;

[0122] An encryption module, configured to receive the local model parameters of each terminal unit and encrypt them to obtain ciphertext, and send the ciphertext to the parameter aggregation and updating unit;

[0123] The real-time detection system uses trained terminal modules to perform real-time detection of abnormal data.

[0124] In the present invention, unless otherwise clearly stipulated and limited, the terms "installation", "setting", "connection", "fixation", "rotation" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. Unless otherwise clearly defined, ordinary technicians in this field can understand the specific meanings of the above terms in the present invention according to the specific circumstances.

[0125] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A data anomaly detection method for data privacy protection in a new power system, characterized by: The following steps are involved: S1. The central server randomly initializes the model, and each terminal downloads the initialized model from the central server as the local model. S2. Each terminal collects and preprocesses local data based on its own sensors, and then trains a local model based on the preprocessed local data. The central server uses the long short-term memory autoencoder model and initializes it. The terminal downloads the initialized long short-term memory autoencoder model from the central server as a local model for training, including: S21. Process the preprocessed local data into a series of time series [X1, X2,…, X N ], where X n =[x1,x2,…,x T ] represents the nth time series, x t Represents the features of the t-th time step in the n-th time series, N represents the number of time series, and T represents the length of the time series; S22. Convert the time series X n =[x1,x2,…,x T ] Input LSTM encoder, and obtain the implicit vector z=[z (1,1) ,z (2,2) ,…,z (T,L) ],z (t,l) represents the latent vector at the t-th time step, where z (t,l) =μ t +s t ·e l μ t , σ t represents the mapping vector at the t-th time step, ε l To satisfy The l=1, 2, ..., L distribution factors of the distribution hypothesis, A is a diagonal matrix; L is the number of distribution factors, L=T; represents a multivariate Gaussian distribution; The process of obtaining the diagonal matrix A includes: Perform principal component analysis on the preprocessed local data to obtain the first principal component and the second principal component; Perform wavelet transform on the first principal component, using db4 wavelet with 4 decomposition layers; use the wavelet detail coefficient of each layer as a column vector to construct the first wavelet detail coefficient matrix; The second principal component is subjected to wavelet transform, using db4 wavelet with 4 decomposition layers. The wavelet detail coefficients of each layer are used as a column vector to construct the second wavelet detail coefficient matrix. For the first wavelet detail coefficient matrix and the second wavelet detail coefficient matrix, the average value of each element is calculated to obtain the average matrix B; Perform eigenvalue decomposition on the average matrix B and extract the first two largest eigenvalues ​​to construct the diagonal matrix A; S23. Set the implicit vector z = [z (1,1) ,z (2,2) ,…,z (T,L) ] Input LSTM decoder to get the reconstructed time series S24. Based on the time series and the reconstructed time series, calculate the divergence cost loss and back-propagate the training model parameters; the calculation formula of the divergence cost loss is Where cosh(·) represents the hyperbolic cosine function, D KL (·) represents the KL divergence between the approximate value and the true posterior value, LC t Denotes the cost function, from the encoder’s perspective, q φ (z|x t ) is the LSTM encoder, p θ (z) is the LSTM decoder; S25. Repeat steps S22-S24 until the model parameters converge; S3. Each terminal uses the Paillier algorithm to encrypt the local model parameters and then uploads the encrypted local model parameters to the central server; S4. The central server obtains the aggregate model parameter M based on the encrypted local model received from each terminal, and sends the aggregate model parameter M to each terminal; S5. The terminal updates the local model parameters according to the aggregate model parameters M and determines whether the reconstruction error converges. If so, the terminal saves the updated local model parameters and proceeds to step S6, otherwise returns to step S2; S6. The terminal performs real-time detection on the collected data according to the abnormal threshold setting method; Step S6: The terminal performs real-time detection on the collected data according to the abnormality threshold setting method, including: S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data; S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as MAD m =kmedian(|y i -median(y)|) Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the median operation of sorting; S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers; S64. Calculate the reconstruction error between the real-time data of each outlier and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as t MSD =μ+p.σ Where p represents a constant; S65. Calculate real-time data y and reconstruct data The mean square error MSE between the two values ​​is used to determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

2. A data anomaly detection method for data privacy protection in a new type of power system according to claim 1, characterized in that: In step S3, the process of any terminal using the Paillier algorithm to encrypt the local model parameters includes: S31. The central server randomly selects two prime numbers p and q and calculates the product N = pq as the public key. Then, the central server calculates the private key λ = lcm(p-1,q-1) based on the prime numbers p and q, where lcm(·) represents the least common multiple operation. S32. The terminal generates a random number r i , then use the public key N and the random number r i For the local model parameter m i Encrypt and generate ciphertext c i Expressed as c i =((1+N×m i )×r i N )towards N 2 S33. The terminal sends the ciphertext c i Upload to the central server.

3. A data anomaly detection method for data privacy protection in a new type of power system according to claim 2, characterized in that: The central server aggregates the encrypted local models received from each terminal, including: S41. The central server performs an addition operation on the ciphertexts uploaded by all terminals based on the additive homomorphic property to obtain the aggregated ciphertext C, which is expressed as Where n represents the number of terminals and N represents the central server public key; S42. The aggregated ciphertext is decrypted to restore the aggregated model parameter M, which is then sent to each terminal. The aggregated model parameter M is expressed as: Where λ represents the private key of the central server.

4. A data anomaly detection system using a data anomaly detection method for protecting data privacy in a new power system according to any one of claims 1 to 3, characterized in that: It includes a federated training system and a real-time detection system. The federated training system includes a central processing module, a terminal module, and an encryption module, among which: a central processing module, which includes an initial model building unit and a parameter aggregation updating unit; An initial model building unit, used to build an initialization model based on a long short-term memory autoencoder model; The parameter aggregation update unit is used to receive the ciphertext uploaded by the encryption module, aggregate all the ciphertexts and restore the aggregate model parameters through decryption operation. A terminal module, comprising a plurality of terminal units, each terminal unit being equipped with a sensor unit; The sensor unit is used to collect local data and pre-process it, and then send the pre-processed local data to the corresponding terminal unit; The terminal unit is configured to download the initialization model from the central processing module as the local model, train the local model using the preprocessed local data, and send the trained local model parameters to the encryption module; download the aggregated model parameters from the central processing module in each iteration, and update the local model parameters based on the aggregated model parameters; An encryption module, configured to receive the local model parameters of each terminal unit and encrypt them to obtain ciphertext, and send the ciphertext to the parameter aggregation and updating unit; The real-time detection system uses trained terminal modules to perform real-time detection of abnormal data.

5. A data anomaly detection system for data privacy protection in a new type of power system according to claim 4, characterized in that: Each trained terminal module performs real-time detection of abnormal data, including: S61. The terminal collects a set of real-time data y=[y1,y2,…,y m ] and input the trained local model to output a set of reconstructed data Where m represents the amount of data; S62. Calculate the median absolute deviation (MAD) of real-time data m , expressed as MAD m =kmedian(|y i -median(y)|) Where k represents the scaling factor assuming normal distribution data, y i represents the i-th data point in the real-time data y, and median(·) represents the median operation of sorting; S63. The real-time data is greater than the median absolute deviation MAD m The data points are marked as outliers; S64. Calculate the reconstruction error between the real-time data of each outlier and its corresponding reconstructed data, calculate the mean μ and standard deviation σ based on all reconstruction errors; calculate the error threshold τ based on the mean μ and standard deviation σ MSD , which is expressed as t MSD =μ+p.σ Where p represents a constant; S65. Calculate real-time data y and reconstruct data The mean square error MSE between the two values ​​is used to determine whether the mean square error MSE is greater than the error threshold τ MSD ,If so, the real-time data is abnormal, otherwise the real-time data is not abnormal.

Images