Power grid flow data risk identification method and system based on incremental collaborative learning

Abstract

The invention discloses a power grid flow data risk identification method and system based on incremental collaborative learning, and the method comprises the steps: enabling an intelligent gateway to adjust the power grid flow data transmitted by a client into a two-dimensional tensor of a specified size through preprocessing, inputting the two-dimensional tensor into a convolutional neural network model, obtaining the probability distribution of each power grid flow data belonging to each risk category, calculating the change condition of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs along with time, identifying a new risk category, performing fine tuning on the model by adopting the new category, and sending the fine-tuned incremental model to the server; and the server receives the models from the intelligent gateways, carries out aggregation and then issues the aggregated models to the intelligent gateways. According to the invention, through fusion of a new category detection technology and an increment collaborative learning technology, the problems of complex types, rapid change and diversification of the power grid flow data in rapid development of the smart power grid are solved, and the processing efficiency and the identification accuracy of the power grid flow data are improved.

Description

Technical Field

[0001] The present invention relates to the field of smart grid communication technology, and in particular to a method and system for identifying risks in power grid flow data based on incremental collaborative learning. Background Art

[0002] In the era of rapid development of smart grids, the field of power grid network information security is facing unprecedented complex challenges. Among them, power grid flow data, as the core information carrier of smart grid operation, is of great importance. However, with the expansion of power grid scale and the improvement of intelligence, the types of power grid flow data are increasing, and the data changes rapidly and diversely, which undoubtedly brings great pressure to the security management of power grid. Traditional power grid flow data risk identification methods mainly rely on fixed feature libraries and classification models. However, this static identification technology cannot handle dynamic and changeable power grid flow data well. On the one hand, due to the complexity of power grid information security requirements, traditional methods are difficult to accurately identify all power grid flow data risks, especially when facing new or unknown flow risk types, the identification performance is poor. This may not only lead to frequent false alarms and missed alarms, but also bring potential threats to the stable operation of the power grid. On the other hand, the response speed of traditional power grid flow data risk identification methods is slow. When there is a fault or abnormality in power grid data processing, it is necessary to quickly identify and take measures to avoid greater impact on power grid operation. However, traditional methods often fail to meet this real-time requirement, resulting in low processing efficiency and even delaying the best processing time. Summary of the invention

[0003] Purpose of the invention: In order to solve the above-mentioned technical problems, the present invention provides a method and system for identifying risks of power grid flow data based on incremental collaborative learning. By combining new category detection technology and incremental collaborative learning technology, it can achieve efficient processing of massive and complex power grid network traffic and accurate identification of unknown power grid flow data risks.

[0004] Technical solution: In the first aspect, a method for identifying risks of power grid flow data based on incremental collaborative learning comprises the following steps:

[0005] The intelligent gateway collects power grid flow data, adjusts it into a two-dimensional tensor of a specified size through preprocessing, inputs the two-dimensional tensor into a convolutional neural network model, uses the convolutional neural network model to obtain the probability distribution of each power grid flow data belonging to each risk category, and calculates the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time, and determines whether a new risk category has appeared based on the change. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server;

[0006] The server receives convolutional neural network models from each intelligent gateway, aggregates the models to form a global convolutional neural network model, and sends the aggregated global convolutional neural network model to each intelligent gateway.

[0007] According to some embodiments of the first aspect, adjusting the flow data into a two-dimensional tensor of a specified size by preprocessing includes:

[0008] Eliminate invalid values, correct erroneous values ​​and normalize the collected power grid flow data, and convert the data to the same scale;

[0009] According to the input size of the convolutional neural network model, the flow data is resized into a two-dimensional tensor with the same input size.

[0010] According to certain embodiments of the first aspect, the convolutional neural network model processes the two-dimensional tensor including:

[0011] The two-dimensional tensor passes through the convolution layer, and the convolution kernel slides on the width, height, and depth channels of the tensor to calculate the dot product of the input data and the convolution kernel to generate a feature map;

[0012] The 2D tensor then passes through a pooling layer, which reduces the dimensionality of the data and the amount of computation by downsampling operations;

[0013] After alternating processing of multiple convolutional layers and pooling layers, the features of the data are mapped to a higher-level feature space and classified or regressed through a fully connected layer. In the fully connected layer, each neuron is connected to all neurons in the previous layer to calculate the weighted sum of the input features and output the final classification result through an activation function, that is, the probability that each grid flow data belongs to each risk category.

[0014] According to certain implementations of the first aspect, calculating, on the intelligent gateway, how the average entropy value of the probability distribution of the risk category to which each power grid flow data belongs changes over time includes:

[0015] According to the output of the convolutional neural network model, the probability distribution of the risk category to which the power grid flow data belongs at time t is obtained in represents all samples received by the jth intelligent gateway at time t, M t is the convolutional neural network model received from the server at time t, θ is M t Parameters;

[0016] Calculate the risk category probability distribution of all power grid flow data Entropy E:

[0017] Probability distribution of risk categories to which all power grid flow data of smart gateways belong The entropy E is averaged: in is the number of grid flow data samples collected by the jth smart gateway at time t;

[0018] Calculate the average entropy of the smart gateway at time t-1 and time t The difference between ΔE, ΔE reflects the change of the mean entropy of the probability distribution of the risk category to which the power grid flow data belongs over time.

[0019] According to certain implementations of the first aspect, determining whether a new risk category has appeared according to the change situation includes:

[0020] The difference ΔE between the mean entropy values ​​of the probability distribution of the risk category to which the power grid flow data belongs at the previous and next moments is compared with the predetermined threshold T. If ΔE is greater than or equal to the threshold T, it is considered that a new category of power grid flow data that has never appeared before time t-1 appears at time t in the smart gateway, and it is marked as a new risk category.

[0021] According to certain embodiments of the first aspect, fine-tuning the convolutional neural network model includes: using labeled data, adjusting model parameters of the convolutional neural network model at a given learning rate and number of iterations, and updating the weight matrix and bias terms of the model.

[0022] According to some implementations of the first aspect, the weight matrix updating method is expressed as follows:

[0023]

[0024] Among them, W new is the updated weight matrix, W old is the weight matrix before updating, α is the learning rate, is the gradient of the loss function with respect to the weight matrix.

[0025] According to some embodiments of the first aspect, the bias term updating method is expressed as follows:

[0026]

[0027] Among them, b new is the updated bias term, b old is the bias term before updating, α is the learning rate, is the gradient of the loss function with respect to the bias term.

[0028] In a second aspect, a power grid flow data risk identification system based on incremental collaborative learning includes an intelligent gateway and a server, wherein the intelligent gateway collects power grid flow data, adjusts it to a two-dimensional tensor of a specified size through preprocessing, inputs the two-dimensional tensor into a convolutional neural network model, uses the convolutional neural network model to obtain the probability distribution of each power grid flow data belonging to each risk category, and calculates the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time, determines whether a new risk category has appeared based on the change, and in the case of a new risk category, fine-tunes the convolutional neural network model, and sends the fine-tuned convolutional neural network model to the server;

[0029] The server receives convolutional neural network models from each intelligent gateway, aggregates the models to form a global convolutional neural network model, and sends the aggregated global convolutional neural network model to each intelligent gateway.

[0030] In a third aspect, the present invention further provides a device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and when the programs are executed by the processors, the following method is implemented:

[0031] The power grid flow data is collected, and adjusted to a two-dimensional tensor of a specified size through preprocessing, and the two-dimensional tensor is input into a convolutional neural network model. The convolutional neural network model is used to obtain the probability distribution of each power grid flow data belonging to each risk category, and the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time is calculated. According to the change, it is determined whether a new risk category has appeared. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server for collaborative aggregation, and then the aggregated and updated convolutional neural network model is received from the server.

[0032] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following method is implemented:

[0033] The power grid flow data is collected, and adjusted to a two-dimensional tensor of a specified size through preprocessing, and the two-dimensional tensor is input into a convolutional neural network model. The convolutional neural network model is used to obtain the probability distribution of each power grid flow data belonging to each risk category, and the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time is calculated. According to the change, it is determined whether a new risk category has appeared. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server for collaborative aggregation, and then the aggregated and updated convolutional neural network model is received from the server.

[0034] Beneficial effects: The present invention proposes a method and system for identifying risks in power grid flow data based on incremental collaborative learning. By integrating new category detection technology and incremental collaborative learning technology, it not only solves the problem of complex, rapidly changing and diversified types of power grid flow data in the rapid development of smart grids, but also improves the processing efficiency and recognition accuracy of power grid flow data. More importantly, this technology can discover and effectively identify new types of power grid flow risks in real time, and respond to unknown risks in a timely manner, thereby greatly enhancing the stability and security of the power grid. At the same time, by continuously absorbing new data samples and optimizing model performance, this technology ensures the continuous improvement of recognition accuracy, providing solid technical support and strong guarantee for the safe operation of smart grids. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is an incremental collaborative learning system framework for risk identification of power grid flow data;

[0036] Figure 2 It is a flow chart of the risk identification method of power grid flow data based on incremental collaborative learning;

[0037] Figure 3 It is a schematic diagram of the CNN model used in the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below through specific implementations and in conjunction with the accompanying drawings.

[0039] In order to achieve dynamic learning and identification of unknown risks of power grid flow data and meet the urgent needs of smart grids for data risk identification, the present invention proposes a method and system for identifying risks of power grid flow data based on incremental collaborative learning. In the technical scheme of the present invention, new types of power grid flow data risks can be discovered and identified in a timely manner through new category detection technology; at the same time, incremental collaborative learning technology can continuously absorb new flow data samples, optimize model performance, enable it to adapt to new data environments, and improve identification accuracy. The present invention has a promoting effect on improving the level of network information security of smart grids.

[0040] Reference Figure 1 The incremental collaborative learning system for risk identification of power grid flow data of the present invention adopts a three-layer architecture of client-intelligent gateway-central server, aiming to collect, analyze and process power grid flow data in real time to realize intelligent management and risk detection of power grid. In the whole system, the data flow involves collection, uploading, storage and analysis to ensure the stability and security of power grid operation.

[0041] In the present invention, the client is responsible for collecting flow data at the power grid node, and these flow data are sent to the intelligent gateway. The intelligent gateway identifies the flow risk based on the data and uploads the processed model and data to the central server. The central server, referred to as the server, is responsible for receiving the models and data uploaded from each intelligent gateway, and performing model aggregation and updating. It also stores collaborative models and historical data, and provides the latest models for the intelligent gateway to use. It can be seen that in this architecture, the intelligent gateway and the server are the core parts of the system. The former completes the flow identification within the jurisdiction and updates the local model, and the latter is responsible for collecting the models of each intelligent gateway for global model updates. Two-way communication is adopted between the server and multiple intelligent gateways, which can obtain the data of the intelligent gateway and send the latest collaborative model to each intelligent gateway.

[0042] Specifically, the client is composed of power communication equipment such as smart meters, power grid flow collectors and power grid flow probes. Smart meters, power grid flow collectors and power grid flow probes are responsible for real-time collection of user data and sending it to the smart gateway device in real time. The smart gateway is composed of workstations and data storage. The smart gateway uses the collected data to update the model (incremental model) and uploads these models to the server regularly. The server aggregates the models uploaded by all smart gateways and builds an incremental collaborative model to optimize decision-making and improve recognition performance to ensure that the operating status of the entire power grid can be accurately reflected. The updated collaborative model is then sent to all smart gateways through the server. After receiving the new model, the smart gateway replaces the local model to adapt to the current power grid flow data to ensure the accuracy of real-time detection and analysis.

[0043] This architecture helps to achieve distributed collection and processing of power grid data, quickly acquire and upload data through power communication equipment (such as smart meters, power grid flow collectors, etc.), and aggregate data and update models through smart gateways and central servers, playing an important role in optimizing power grid management, risk detection and decision-making. The server and the smart gateway collaborate through two-way communication to ensure the safe, efficient and intelligent operation of the power grid network.

[0044] Reference Figure 2 The invention provides a method for identifying risks of power grid flow data based on incremental collaborative learning, comprising the following steps:

[0045] S1, power grid flow data collection and preprocessing:

[0046] The client collects the grid network traffic in real time through the grid traffic collection technology. For example, smart meters, grid traffic collectors, grid traffic probes, etc. are responsible for real-time data collection and send it to the smart gateway. The smart gateway converts the collected grid traffic data into a two-dimensional tensor form that can be processed by the convolutional neural network and further processes it.

[0047] In the embodiment, a power grid traffic risk dataset (such as CICIDS2017) is used, which contains a variety of traffic data risks, such as violent FTP, violent SSH, DoS, Heartbleed, Web attack, penetration, botnet and DDoS, etc. Before using the power grid traffic risk dataset, data preprocessing is performed, including data cleaning, numerical standardization and normalization, etc. Then the power grid data is converted into a graph form to better extract data features.

[0048] S1-1: Power grid flow data cleaning:

[0049] First, convert the power grid flow data (such as the size of the data packet, sending time, source address, destination address, etc.) into numerical data. Since the data characteristics of different power grid flows may have different dimensions and value ranges, in order to eliminate the impact of such differences on model training, it is necessary to normalize the data and convert the data to the same scale. Check and correct errors and outliers in the data.

[0050] S1-2, power grid flow data preprocessing:

[0051] Since the proposed method uses a convolutional neural network (CNN) model to extract power flow features, the dimension of the input power flow data needs to be changed to match the input size of the model. For example, the maximum message length of the power flow data is d, and the input of CNN is defined as Before inputting the power grid flow data into the CNN model, the flow data needs to be preprocessed and resized from a 1-dimensional vector of size d to a tensor of size To do this, first, we pad each piece of data with zeros so that the length of all messages is the same as the length of the longest message, and then use OpenCV's resize function to resize each message to The 2D tensor is used as the input of the CNN model. The classification of power grid network flow data is realized and new categories can be detected.

[0052] S2, Power Grid Traffic Feature Extraction and Classification Based on New Category Detection and Incremental Collaborative Learning:

[0053] CNN is a deep learning model for high-dimensional data analysis, with powerful feature extraction and classification capabilities. The present invention applies CNN convolutional neural network to power grid flow data classification. The power grid flow is subjected to multiple levels of feature extraction. Figure 3 First, the power grid flow data enters the convolution layer, which extracts local features of the data through a series of learnable convolution kernels. For the power grid flow input tensor, the convolution kernel slides on the width, height and color channels of the tensor, calculates the dot product of the input data and the convolution kernel, and generates feature maps. These feature maps retain the key information in the tensor and have lower resolution and deeper feature levels than the original tensor. Subsequently, the tensor passes through the pooling layer, which further reduces the dimension and computation of the data through downsampling operations while retaining important features. Finally, after alternating multiple convolutional and pooling layers, the features of the data are mapped to a higher-level feature space and passed through a fully connected layer for classification or regression tasks. In the fully connected layer, each neuron is connected to all neurons in the previous layer to calculate the weighted sum of the input features and output the final classification result (i.e., the probability that each power grid flow data belongs to each risk category) through the activation function.

[0054] In the CNN convolutional neural network classification process, in order to determine whether the data to be identified belongs to a new unknown risk category, the present invention introduces a new category detection technology, and its implementation method is as follows.

[0055] S2-1, input all the grid flow data collected by the client at time t into the smart gateway, and the smart gateway uses the collaborative model M received from the server t Further processing of the power grid flow data can obtain the probability distribution of the risk category to which all power grid flow data of the corresponding smart gateway j belongs.

[0056]

[0057] in, M represents all samples of the jth intelligent gateway at time t. t is the collaborative aggregation model received by smart gateway j at time t. θ is the collaborative model Mt Parameters.

[0058] S2-2, calculate the risk category probability distribution of all power grid flow data Entropy E:

[0059]

[0060] S2-3, probability distribution of risk categories to which all grid flow data of the smart gateway belongs The entropy E is averaged:

[0061]

[0062] in is the number of grid flow data samples received by the jth smart gateway at time t.

[0063] S2-4, calculate the average entropy of the smart gateway at time t-1 and time t The difference is compared with the threshold T:

[0064]

[0065] S2-5, set threshold: according to the calculation result, set a threshold T. If the average entropy of the intelligent gateway at time t-1 and time t If the difference is greater than or equal to a certain threshold T, it is considered that the smart gateway has a new type of power grid flow data that has never appeared before time t-1 at time t. For example, the threshold can be set to 1.3, then When the average entropy calculated by a smart gateway increases significantly, it is considered that a new category of power grid flow data has appeared in the area under the jurisdiction of the smart gateway. At this time, the previously trained model will no longer be suitable for the current data. In order to ensure the model effect, corresponding measures need to be taken.

[0066] When new unknown risks are detected, in order to maintain the classification ability of the CNN model, the present invention uses an adaptive learning algorithm to update the historical model.

[0067] First, unknown risks are labeled: Based on the previous identification results and combined with expert knowledge, newly discovered unknown risks are labeled to obtain an unknown risk knowledge base.

[0068] Then fine-tune the model: On the smart gateway device, use the labeled data to fine-tune the CNN convolutional neural network and adjust the model parameters to adapt to the new risk category. The fine-tuning process can use a smaller learning rate and fewer iterations to avoid excessive damage to existing knowledge.

[0069] Perform weight update: Update the model's weight matrix and bias terms based on the fine-tuning results. The weight update can be expressed as:

[0070]

[0071] Among them, W new is the updated weight matrix, W old is the weight matrix before updating, α is the learning rate, is the gradient of the loss function with respect to the weight matrix.

[0072] The bias update can be expressed as:

[0073]

[0074] Among them, b new is the updated bias term, b old is the bias term before updating, α is the learning rate, is the gradient of the loss function with respect to the bias term.

[0075] Performance evaluation: Use the test data set to evaluate the performance of the updated model, including indicators such as recognition accuracy and computational efficiency. Optimize the model based on the evaluation results, such as adjusting parameters such as network structure and learning rate. The smart gateway device sends the fine-tuned CNN model (i.e., incremental CNN model) parameters to the server, and the server collaboratively aggregates the received incremental CNN model and then distributes it to all smart gateway devices, so that these smart gateway devices have the ability to recognize the new type.

[0076] Another embodiment of the present invention provides a power grid flow data risk identification system based on incremental collaborative learning, including: a client, an intelligent gateway and a server, the client collects power grid flow data, uploads the collected data to the intelligent gateway, the intelligent gateway adjusts the data to a two-dimensional tensor of a specified size through preprocessing, and then uses a deep learning neural network to train the two-dimensional tensor to obtain an initial model. Each intelligent gateway uploads its own initial model to the server, which performs collaborative aggregation, and then distributes the obtained collaborative aggregation model to all intelligent gateways for deployment and use. For the subsequent use of new power grid network flow data input to the intelligent gateway by the intelligent gateway, the convolutional neural network model is used to obtain the probability distribution of each risk category, and the change of the entropy average value of the probability distribution over time is calculated, and whether a new risk category has appeared is determined based on the change. In the case of a new risk category, the convolutional neural network model is fine-tuned on the intelligent gateway, and the fine-tuned convolutional neural network model is collaboratively aggregated by the server and then sent to each intelligent gateway.

[0077] Another embodiment of the present invention provides a power grid flow data risk identification system based on incremental collaborative learning, including an intelligent gateway and a server, wherein the intelligent gateway collects power grid flow data, adjusts the data into a two-dimensional tensor of a specified size through preprocessing, inputs the two-dimensional tensor into a convolutional neural network model, uses the convolutional neural network model to obtain the probability distribution of each power grid flow data belonging to each risk category, and calculates the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time, determines whether a new risk category has appeared based on the change, and in the case of a new risk category appearing, fine-tunes the convolutional neural network model, and sends the fine-tuned convolutional neural network model to the server;

[0078] The server receives convolutional neural network models from each intelligent gateway, aggregates the models to form a global convolutional neural network model, and sends the aggregated global convolutional neural network model to each intelligent gateway.

[0079] It should be understood that the power grid flow data risk identification system based on incremental collaborative learning in the embodiment of the present invention can implement all the technical solutions in the above-mentioned method embodiment, and the functions of its various components can be specifically implemented according to the power grid flow data risk identification method based on incremental collaborative learning in the above-mentioned method embodiment. The specific implementation process can refer to the relevant description in the above-mentioned embodiment, which will not be repeated here.

[0080] The present invention also provides a device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and when the programs are executed by the processors, the following method is implemented:

[0081] The power grid flow data is collected, and adjusted to a two-dimensional tensor of a specified size through preprocessing, and the two-dimensional tensor is input into a convolutional neural network model. The convolutional neural network model is used to obtain the probability distribution of each power grid flow data belonging to each risk category, and the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time is calculated. According to the change, it is determined whether a new risk category has appeared. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server for collaborative aggregation, and then the aggregated and updated convolutional neural network model is received from the server.

[0082] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following method is implemented:

[0083] The power grid flow data is collected, and adjusted to a two-dimensional tensor of a specified size through preprocessing, and the two-dimensional tensor is input into a convolutional neural network model. The convolutional neural network model is used to obtain the probability distribution of each power grid flow data belonging to each risk category, and the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time is calculated. According to the change, it is determined whether a new risk category has appeared. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server for collaborative aggregation, and then the aggregated and updated convolutional neural network model is received from the server.

[0084] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices (systems), computer equipment or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0085] The present invention is described with reference to a flowchart of a method according to an embodiment of the present invention. It should be understood that each process in the flowchart and a combination of processes in the flowchart can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A device that specifies functions in a process or multiple processes.

[0086] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A function specified in a process or multiple processes.

[0087] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 The steps of a specified function in a process or multiple processes.

Claims

1. A method for identifying power grid flow data risks based on incremental collaborative learning, characterized in that: The following steps are involved: The intelligent gateway collects power grid flow data, adjusts it into a two-dimensional tensor of a specified size through preprocessing, inputs the two-dimensional tensor into a convolutional neural network model, uses the convolutional neural network model to obtain the probability distribution of each power grid flow data belonging to each risk category, and calculates the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time, and determines whether a new risk category has appeared based on the change. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server; The server receives convolutional neural network models from each intelligent gateway, aggregates the models to form a global convolutional neural network model, and sends the aggregated global convolutional neural network model to each intelligent gateway.

2. The method according to claim 1, characterized in that The flow data is reshaped into a two-dimensional tensor of a specified size through preprocessing, including: Eliminate invalid values, correct erroneous values ​​and normalize the collected power grid flow data, and convert the data to the same scale; According to the input size of the convolutional neural network model, the flow data is resized into a two-dimensional tensor with the same input size.

3. The method according to claim 1, characterized in that: The convolutional neural network model processes the two-dimensional tensor by: The two-dimensional tensor passes through the convolution layer, and the convolution kernel slides on the width, height, and depth channels of the tensor to calculate the dot product of the input data and the convolution kernel to generate a feature map; After that, the two-dimensional tensor passes through the pooling layer, which reduces the dimension of the data and the amount of computation through downsampling operations; After alternating processing of multiple convolutional layers and pooling layers, the features of the data are mapped to a higher-level feature space and classified or regressed through a fully connected layer. In the fully connected layer, each neuron is connected to all neurons in the previous layer to calculate the weighted sum of the input features and output the final classification result through an activation function, that is, the probability that each grid flow data belongs to each risk category.

4. The method according to claim 1, characterized in that Calculate the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time, including: According to the output of the convolutional neural network model, the probability distribution of the risk category to which the power grid flow data belongs at time t is obtained in represents all samples of the jth smart gateway at time t, M t is the convolutional neural network model received by the smart gateway from the server at time t, and θ is the model M t Parameters; Calculate the risk category probability distribution of all power grid flow data Entropy E: Probability distribution of risk categories to which all power grid flow data of smart gateways belong The entropy E is averaged: in is the number of grid flow data samples of the jth smart gateway at time t; Calculate the average entropy of the smart gateway at time t-1 and time t The difference between ΔE, ΔE reflects the change of the mean entropy of the probability distribution of the risk category to which the power grid flow data belongs over time.

5. The method according to claim 1, characterized in that Determine whether new risk categories have emerged based on the changes, including: The difference ΔE between the mean entropy values ​​of the probability distribution of the risk category to which the power grid flow data belongs at the previous and next moments is compared with the predetermined threshold T. If ΔE is greater than or equal to the threshold T, it is considered that a new category of power grid flow data that has never appeared before time t-1 appears at time t in the smart gateway, and it is identified as a new risk category.

6. The method according to claim 1, characterized in that Fine-tuning the convolutional neural network model includes: using labeled data, adjusting model parameters of the convolutional neural network model at a given learning rate and number of iterations, and updating the weight matrix and bias items of the model.

7. The method according to claim 6, characterized in that The weight matrix update method is expressed as follows: Among them, W new is the updated weight matrix, =W old is the weight matrix before updating, α is the learning rate, is the gradient of the loss function with respect to the weight matrix; The bias term update method is expressed as follows: Among them, b new is the updated bias term, b old is the bias term before updating, α is the learning rate, is the gradient of the loss function with respect to the bias term.

8. A power grid flow data risk identification system based on incremental collaborative learning, characterized in that: It includes an intelligent gateway and a server. The intelligent gateway collects power grid flow data, adjusts the data into a two-dimensional tensor of a specified size through preprocessing, inputs the two-dimensional tensor into a convolutional neural network model, uses the convolutional neural network model to obtain the probability distribution of each power grid flow data belonging to each risk category, and calculates the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time, and determines whether a new risk category has appeared based on the change. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server; The server receives convolutional neural network models from each intelligent gateway, aggregates the models to form a global convolutional neural network model, and sends the aggregated global convolutional neural network model to each intelligent gateway.

9. A device, characterized in that: The apparatus comprises: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and when the programs are executed by the processors, the following method is implemented: The power grid flow data is collected, and adjusted to a two-dimensional tensor of a specified size through preprocessing, and the two-dimensional tensor is input into a convolutional neural network model. The convolutional neural network model is used to obtain the probability distribution of each power grid flow data belonging to each risk category, and the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time is calculated. According to the change, it is determined whether a new risk category has appeared. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server for collaborative aggregation, and then the aggregated and updated convolutional neural network model is received from the server.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the following method is implemented: The power grid flow data is collected, and adjusted to a two-dimensional tensor of a specified size through preprocessing, and the two-dimensional tensor is input into a convolutional neural network model. The convolutional neural network model is used to obtain the probability distribution of each power grid flow data belonging to each risk category, and the change of the entropy average value of the probability distribution of the risk category to which each power grid flow data belongs over time is calculated. According to the change, it is determined whether a new risk category has appeared. In the case of a new risk category, the convolutional neural network model is fine-tuned, and the fine-tuned convolutional neural network model is sent to the server for collaborative aggregation, and then the aggregated and updated convolutional neural network model is received from the server.

Images