Electricity larceny detection method and device based on two-way encoder and decoder attention mechanism

Abstract

The invention provides an electricity larceny detection method and device based on a bidirectional encoder and decoder attention mechanism. The electricity larceny detection method comprises the following steps: acquiring a to-be-detected electricity data set; inputting a to-be-detected power utilization data set into the Gaussian mixture model, and outputting a user type corresponding to the to-be-detected power utilization data set; determining a first estimation mean value, a first estimation covariance, a second estimation mean value and a second estimation covariance corresponding to the user type; the first estimation mean value and the first estimation covariance are determined based on a historical benign power utilization data set corresponding to the user type; the second estimated mean value and the second estimated covariance are determined based on a historical reconstructed benign power utilization data set corresponding to the historical benign power utilization data set; and inputting a to-be-detected power utilization data set into the attention-based BLSTM encoder decoder model, and outputting a detection result. Only intelligent instrument data without any label need to be collected, and under the condition that the sampling rate is low, robustness is achieved for non-malicious changes and data pollution attacks.

Description

Technical Field

[0001] The present application relates to the field of smart grid technology, and in particular to a method and device for detecting electricity theft based on a bidirectional encoder-decoder attention mechanism. Background Art

[0002] As a highly automated transmission network, smart grid enables bidirectional flow of information and power between all nodes in the entire transmission and distribution process. Smart grid is a cyber-physical system and is vulnerable to cyber attacks. Some malicious electricity consumers design some attack functions to disrupt meter measurements and bypass power theft detection in the control center. In addition to the huge economic losses caused by non-payment of utility bills, power theft can also lead to poor energy management and even regional power outages.

[0003] Traditional detection methods need to be performed manually, which is neither timely nor efficient. The training data based on machine learning methods are vulnerable to attacks and contamination. Therefore, the electricity theft detection methods in related technologies have the problem of insufficient accuracy. Summary of the invention

[0004] In view of this, the purpose of this application is to propose a method and device for electricity theft detection based on a bidirectional encoder-decoder attention mechanism.

[0005] Based on the above objectives, the present application provides a method for detecting electricity theft based on a bidirectional encoder-decoder attention mechanism, which may include:

[0006] Acquire a power consumption data set to be detected, wherein the power consumption data set to be detected includes multi-dimensional power consumption data; each dimension of power consumption data includes a sampling time and corresponding power consumption;

[0007] Input the power consumption data set to be detected into a pre-trained Gaussian mixture model, and output the user type corresponding to the power consumption data set to be detected;

[0008] Determine a first estimated mean and a first estimated covariance, as well as a second estimated mean and a second estimated covariance corresponding to the user type; the first estimated mean is an estimated mean of a reconstruction error of a historically reconstructed benign power consumption data set corresponding to the historical benign power consumption data set corresponding to the user type; the first estimated covariance is an estimated covariance of a reconstruction error of a historically reconstructed benign power consumption data set corresponding to the historical benign power consumption data set corresponding to the user type; the second estimated mean is an estimated mean of a historically benign power consumption data set corresponding to the user type; the second estimated covariance is an estimated covariance of a historically benign power consumption data set corresponding to the user type;

[0009] Input the power consumption data set to be detected into a pre-trained attention-based BLSTM encoder-decoder model to obtain a reconstructed power consumption data set to be detected corresponding to the power consumption data set to be detected; determine the detection result of the power consumption data set to be detected based on the difference between the reconstruction error of the reconstructed power consumption data in the power consumption data set to be detected and the first estimated mean and the first estimated covariance, as well as the difference between the power consumption data corresponding to the reconstructed power consumption data and the second estimated mean and the second estimated covariance, and a preset threshold, and output the detection result.

[0010] In some embodiments, the detection result of the power consumption data set to be detected is determined based on the difference between the reconstruction error of the reconstructed power consumption data in the power consumption data set to be detected and the first estimated mean and the first estimated covariance, and the difference between the power consumption data corresponding to the reconstructed power consumption data and the second estimated mean and the second estimated covariance, and a preset threshold, and outputting the detection result includes:

[0011] Obtaining an abnormality score of the i-th dimension electricity consumption data according to a difference between a reconstruction error of the i-th dimension reconstructed electricity consumption data in the reconstructed data set in the electricity consumption data set to be detected and the first estimated mean and the first estimated covariance, and a difference between the i-th dimension electricity consumption data corresponding to the i-th dimension reconstructed electricity consumption data and the second estimated mean and the second estimated covariance;

[0012] According to the relationship between the abnormal score and the preset threshold, the detection result of the i-th dimension electricity consumption data is determined.

[0013] In some embodiments, the outlier score is expressed as Get; among them, a i is the abnormal value score of the electricity consumption data of the i-th dimension in the electricity consumption data set to be detected; e i is the reconstruction error of the i-th dimension reconstructed power consumption data in the reconstructed data set of the power consumption data set to be detected; is the first estimated mean; is the first estimated covariance; T is the transpose of the matrix; γ is the element parameter; x i The i-th dimension of the power consumption data in the power consumption data set to be detected; is the second estimated mean; is the second estimated covariance.

[0014] In some embodiments, determining the detection result of the i-th dimension electricity usage data according to the relationship between the abnormal score and the preset threshold value includes:

[0015] Pass-through Determine the detection result of the i-th dimension electricity consumption data; where y iWhen the value is 0, the electricity consumption data of the i-th dimension is determined to be normal data; i When the value is 1, the electricity consumption data of the i-th dimension is determined to be abnormal data.

[0016] In some embodiments, the attention-based BLSTM encoder-decoder model includes an AE model; the encoder of the AE model has a BLSTM layer; the decoder of the AE model has an attention mechanism;

[0017] The BLSTM layer includes: in, For x i The state representation of the first hidden layer of the encoder; x i is the value of the i-th dimension in the input data; U and W are weight matrices, b is the bias vector, and f EN To encode the operation of the LSTM unit, It is the concatenation operation of vectors;

[0018] The attention mechanism includes: For x i An estimated value of is the hidden state of the decoder at time i, f DE is an LSTM cell in the decoder, g is the softmax activation function; h j For x j The hidden layer state of Among them, h l For x l The hidden layer state of x j is the value of the jth dimension input in the encoder; x l is the value of the lth dimension input in the encoder.

[0019] In some embodiments, the objective function is: Where Θ is the parameter set of the AE model, Θ = [U, W, b], λ is the regularization parameter; D k It is a user sample data set.

[0020] In some embodiments, the training method of the pre-trained attention-based BLSTM encoder-decoder model includes:

[0021] Build an attention-based BLSTM encoder-decoder model;

[0022] The attention-based BLSTM encoder-decoder model is trained using a historical electricity consumption data set belonging to the same user type output by the Gaussian mixture model after initial training to obtain a preliminarily trained attention-based BLSTM encoder-decoder model;

[0023] Using the initially trained attention-based BLSTM encoder-decoder model to detect the historical electricity consumption data set to identify malicious electricity consumption data;

[0024] Delete the malicious electricity consumption data in the historical electricity consumption data set to obtain the historical benign electricity consumption data set;

[0025] The attention-based BLSTM encoder-decoder model that has been initially trained is retrained using a historical benign electricity consumption dataset belonging to the same user type output by a pre-trained Gaussian mixture model to obtain the pre-trained attention-based BLSTM encoder-decoder model training method.

[0026] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the methods described above when executing the program.

[0027] An embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the methods described above.

[0028] An embodiment of the present application further provides a computer program product, comprising computer program instructions, which, when executed on a computer, enable the computer to execute any of the methods described above.

[0029] From the above, it can be seen that the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism provided by the present application obtains the electricity consumption data set to be detected, and the electricity consumption data set to be detected includes multi-dimensional electricity consumption data; each dimension of electricity consumption data includes sampling time and corresponding electricity consumption; inputs the electricity consumption data set to be detected into a pre-trained Gaussian mixture model, and outputs the user type corresponding to the electricity consumption data set to be detected; determines the first estimated mean and the first estimated covariance corresponding to the user type, as well as the second estimated mean and the second estimated covariance; inputs the electricity consumption data set to be detected into a pre-trained attention-based BLSTM In the encoder-decoder model, a reconstructed electricity data set to be detected corresponding to the electricity data set to be detected is obtained; according to the difference between the reconstruction error of the reconstructed electricity data in the electricity data set to be detected and the first estimated mean and the first estimated covariance, and the difference between the electricity data corresponding to the reconstructed electricity data and the second estimated mean and the second estimated covariance, and the preset threshold, the detection result of the electricity data set to be detected is determined, and the detection result is output; only smart meter data without any labels needs to be collected, and under the condition of low sampling rate, it is also robust to non-malicious changes in electricity consumption patterns and data pollution attacks. In addition, the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism provided in the embodiment of the present application has a greatly improved accuracy rate for electricity theft detection compared with the traditional detection method, and the covariance rate has a greatly reduced rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 A schematic diagram of a flow chart of a method for detecting electricity theft based on a bidirectional encoder-decoder attention mechanism according to an embodiment of the present application;

[0032] Figure 2 A flowchart of a training method for an attention-based BLSTM encoder-decoder model according to an embodiment of the present application;

[0033] Figure 3 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0035] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0036] Traditional methods of electricity theft detection include checking for problematic meter installations or configuration errors, comparing abnormal measurements with benign measurements, and inspecting transmission lines. However, all of these traditional detection methods need to be performed manually, which is neither timely nor efficient.

[0037] For machine learning methods, they mainly include SVM support vector machine method, local anomaly factor method, artificial neural network and improved linear model. Among them, SVM support vector machine method is used to detect malicious attacks based on the load profile of power consumers. The algorithm uses the daily consumption data of power consumers within 2 years to predict future power consumption trends to detect malicious users. This method requires the use of a training data set containing data for a sufficiently long period of time and can only perform well when the changes are sudden.

[0038] As a widely used density-based anomaly detection method, the local anomaly factor method assigns an abnormality degree to each object and has achieved strong performance in the works. The advantage of the local anomaly factor method is that it can detect even without labels in the training data and calculates the degree based on the isolation of the object relative to the surrounding neighborhood, rather than being regarded as an outlier as a binary attribute.

[0039] Artificial neural networks have been widely used in detection. Recurrent neural networks have been studied as a new tool for detecting false data injection and have been shown to be superior in detecting attacks. In related work, the nonlinear mapping ability of nonlinear autoregressive exogenous neural networks is used to calculate the estimated covariance of voltage and current and detect electricity theft.

[0040] The improved linear model detects abnormal electricity theft by leveraging power consumption and voltage data from smart meter data without requiring transformer measurements or information about network topology. The improved linear model is unsupervised and effective in identifying electricity theft.

[0041] However, the local anomaly factor method, artificial neural network and improved linear model methods all have three disadvantages. First, the electricity theft detection task belongs to completely unsupervised learning, without data labels, and the training data is also vulnerable to attacks and contamination. In addition, during the training phase, only some attack patterns are known. Other possible attack patterns will only occur after the training data is collected, and this problem cannot be avoided. Second, since the electricity consumption pattern is time-varying and unknown, and the statistical changes in the observed values ​​are caused by electricity theft or changes in electricity consumption patterns, it is necessary to determine which specific pattern is caused, which will bring difficulties and challenges to electricity theft detection. Third, machine learning-based methods usually require high sampling rates to improve performance. However, high sampling rates may lead to the risk of user privacy leakage. Improving the effectiveness of electricity theft detection methods comes at the cost of leaking private information.

[0042] Based on this, the embodiment of the present application provides a method and device for detecting electricity theft based on a bidirectional encoder-decoder attention mechanism. First, GMM is used to distinguish different usage patterns, and then the attention-based BLSTM encoder-decoder scheme is used to detect abnormal data attacks. Then, combined with the losses in clustering and reconstruction data, anomaly scoring is used for detection, which is conducive to achieving better performance. No data labels are required, and no high sampling rate is required. It is also robust to non-malicious changes in electricity consumption patterns and data pollution attacks. Therefore, the method and device for detecting electricity theft based on a bidirectional encoder-decoder attention mechanism provided in the embodiment of the present application can solve the problems of low accuracy and high covariance rate in existing detection methods to a certain extent.

[0043] like Figure 1 As shown, the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism provided in the embodiment of the present application may include:

[0044] S100, obtaining a power consumption data set to be detected, wherein the power consumption data set to be detected includes multi-dimensional power consumption data; each dimension of power consumption data includes a sampling time and a corresponding power consumption;

[0045] S200, inputting the power consumption data set to be detected into a pre-trained Gaussian mixture model, and outputting the user type corresponding to the power consumption data set to be detected;

[0046] S300, determine a first estimated mean and a first estimated covariance, as well as a second estimated mean and a second estimated covariance corresponding to the user type; the first estimated mean is an estimated mean of a reconstruction error of a historically reconstructed benign power consumption data set corresponding to the historical benign power consumption data set corresponding to the user type; the first estimated covariance is an estimated covariance of a reconstruction error of a historically reconstructed benign power consumption data set corresponding to the historical benign power consumption data set corresponding to the user type; the second estimated mean is an estimated mean of a historically benign power consumption data set corresponding to the user type; the second estimated covariance is an estimated covariance of a historically benign power consumption data set corresponding to the user type;

[0047] S400, input the power consumption data set to be detected into a pre-trained attention-based BLSTM encoder-decoder model to obtain a reconstructed power consumption data set to be detected corresponding to the power consumption data set to be detected; determine the detection result of the power consumption data set to be detected based on the difference between the reconstruction error of the reconstructed power consumption data in the power consumption data set to be detected and the first estimated mean and the first estimated covariance, and the difference between the power consumption data corresponding to the reconstructed power consumption data and the second estimated mean and the second estimated covariance, and a preset threshold, and output the detection result.

[0048] The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism provided in the embodiment of the present application only needs to collect smart meter data without any labels, and is robust to non-malicious changes in power consumption patterns and data pollution attacks at a low sampling rate. In addition, the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism provided in the embodiment of the present application has a significant improvement in the accuracy of electricity theft detection compared with the traditional detection method, and the covariance rate has a significant reduction.

[0049] In some embodiments, in step S100, the data set to be detected may be the electricity consumption data of the electricity consumer over a period of time, such as the electricity consumption data for a week, the electricity consumption data for a month, or the electricity consumption data for a quarter. Generally, the data set to be detected may be the electricity consumption data obtained at a fixed sampling frequency, such as all the electricity consumption data every half an hour (i.e., 30 minutes). Multidimensional electricity consumption data may be understood as electricity consumption data at multiple sampling time points (i.e., multiple moments).

[0050] In some embodiments, the unit of the power consumption in the power consumption data may be kwh, which can be obtained by simply collecting smart meter data without any tags.

[0051] In some of the embodiments, in step S200, the Gaussian mixture model may be a pre-trained Gaussian mixture model. The existing Gaussian mixture model may be trained using a historical electricity consumption dataset, and the parameters of the Gaussian mixture model may be estimated using an EM algorithm and Bayesian Information Criterion (BIC) estimation. The pre-trained Gaussian mixture model may identify different user consumption habits, cluster electricity consumption data, and assign consumption samples (such as electricity consumption data) with similar consumption patterns to the same cluster. Typically, a historical electricity consumption dataset may include historical electricity consumption datasets of multiple users. For example, each user's historical electricity consumption dataset may be all electricity consumption datasets of the user that are currently available.

[0052] In some embodiments, the user type may include a residential user type and an enterprise user type. After the power consumption data set to be detected is input into the Gaussian mixture model, the user type corresponding to the output power consumption data set to be detected is usually one of a residential user type and an enterprise user type. There are obvious differences in the consumption habits of different user types, which are mainly due to the differences in the consumer's usage period (such as the time when the power consumption is generated in the multidimensional power consumption data, etc.) and the total amount (such as the total amount corresponding to the total power consumption in the power consumption data set).

[0053] In some possible embodiments, the historical electricity consumption data set can be divided into a training set, a validation set, and a test set. During the initial training, all electricity consumption data in all training sets, validation sets, and test sets are set to be benign electricity consumption data. After the initial training of the attention-based BLSTM encoder-decoder model is completed, the training set, validation set, and test set can be identified for anomalies respectively. Based on the results of anomaly identification, the historical electricity consumption data set can be adjusted to delete the malicious electricity consumption data therein. By deleting the malicious electricity consumption data from the training set, the overall performance can be improved. Then, the Gaussian mixture model can be retrained based on the training set after deleting the malicious electricity consumption data, and the attention-based BLSTM encoder-decoder model can be retrained to obtain a Gaussian mixture model with higher accuracy and an attention-based BLSTM encoder-decoder model, that is, the pre-trained Gaussian mixture model and the pre-trained attention-based BLSTM encoder-decoder model are obtained.

[0054] In some of the embodiments, in step S300, the historical benign electricity consumption data set corresponding to the same user type can be reconstructed based on the benign electricity consumption data in the training data set in the historical electricity consumption data set and the pre-trained attention-based BLSTM encoder-decoder model, and the historical reconstructed benign electricity consumption data set corresponding to the same user type is obtained, and the reconstruction error between each reconstructed electricity consumption data in the historical reconstructed benign electricity consumption data set and each corresponding electricity consumption data in the corresponding historical benign electricity consumption data set is obtained, and then the first estimated mean and first estimated covariance of the reconstruction error of the historical reconstructed benign electricity consumption data set corresponding to the historical benign electricity consumption data set are obtained. The second estimated mean and second estimated covariance of the historical benign electricity consumption data set corresponding to the same user type can be obtained based on the benign electricity consumption data in the training data set in the historical electricity consumption data set.

[0055] In some embodiments, such as Figure 2 As shown, in step S400, the training method of the pre-trained attention-based BLSTM encoder-decoder model includes:

[0056] S410, construct an attention-based BLSTM encoder-decoder model. Wherein, the attention-based BLSTM encoder-decoder model may include an AE model. The encoder of the AE model may have a BLSTM layer, so that the encoder can consider past and future data at the same time. The decoder of the AE model has an attention mechanism.

[0057] S420, using the historical electricity consumption data set belonging to the same user type output by the Gaussian mixture model after initial training to train the attention-based BLSTM encoder-decoder model to obtain a preliminarily trained attention-based BLSTM encoder-decoder model.

[0058] S430, using the attention-based BLSTM encoder-decoder model after preliminary training to detect the historical electricity consumption data set (including training set, validation set and test set) to identify malicious electricity consumption data. Usually, only a few users attack the smart meter used, and a small number of records of each malicious consumer are forged. Therefore, there are usually more benign samples (i.e., benign electricity consumption data) than abnormal samples (i.e., malicious electricity consumption data), and this characteristic can be summarized as an imbalance of the data set.

[0059] S440, deleting the malicious power usage data in the historical power usage data set to obtain a historical benign power usage data set, and retraining the initially trained Gaussian mixture model based on the historical benign power usage data set to obtain the pre-trained Gaussian mixture model.

[0060] S450, using the historical benign electricity consumption data set belonging to the same user type output by the pre-trained Gaussian mixture model to retrain the attention-based BLSTM encoder-decoder model after the preliminary training, to obtain the pre-trained attention-based BLSTM encoder-decoder model.

[0061] In some embodiments, in step S410, the BLSTM layer may include the formula: in, For x i The state representation of the first hidden layer in the encoder. i is the value of the i-th dimension in the input data, which can be the power consumption of the i-th dimension power consumption data in the multi-dimensional power data; f EN is the operation of the LSTM unit in the encoding. U is the weight matrix, E 1 is the first layer of the encoder in the attention-based BLSTM encoder-decoder model, is the weight matrix of the first layer of the encoder. For x i-1 The state representation of the first hidden layer in the encoder. i-1 is the value of the i-1th dimension in the input data, which can be the power consumption of the i-1th dimension of the multidimensional power data. W is the weight matrix, is the weight matrix of the first layer of the encoder. b is the bias vector. is the bias vector of the first layer of the encoder. in, For x L-i+1 The state representation of the second hidden layer in the encoder. is the weight matrix of the second layer of the encoder. For x L-i The state representation of the second hidden layer of the encoder. L is the dimension of the input data. L-i+1 is the value of the L-i+1th dimension in the input data; x L-i is the value of the Li-th dimension in the input data. is the weight matrix of the second layer of the encoder. is the bias vector of the second layer of the encoder 。 Among them, h i For x i The state representation of the encoder hidden layer. Concatenates vectors.

[0062] In some embodiments, the attention mechanism comprises: For x iThe estimated value of . g is the softmax activation function. For x i+1 An estimated value of x i+1 is the value of the i+1th dimension in the input data. is the hidden state of the decoder at time i. Among them, f DE is an LSTM cell in the decoder. is the hidden state of the decoder at time i+1. c i is the calculation of the context vector. L is the dimension of the input data. α ij is the weight. j For x j The hidden layer state of x j is the value of the j-th dimension input in the encoder. h l For x l The hidden layer state of x l is the value of the lth dimension input in the encoder. Exp is the natural exponential function, and L is the dimension of the input data.

[0063] In some embodiments, the objective function of the attention mechanism includes in, is the objective function, D k is a user sample data set. λ is a regularization parameter. Θ is the parameter set of the model (AE model). Θ=[U,W,b], U and W are weight matrices respectively, and b is a bias vector. is the sum of the reconstruction errors. 2 Regularization term to prevent overfitting.

[0064] In some of the embodiments, the attention-based BLSTM encoder-decoder model is used to minimize the reconstruction error between the input data and the output data. Typically, the reconstruction error of benign samples (i.e., benign power usage data) is usually lower than that of abnormal samples (i.e., malicious power usage data). It can be understood that the principle of the attention-based BLSTM encoder-decoder model is to use this imbalance to detect attacks (i.e., malicious power usage data).

[0065] In some of these embodiments, in step S420, an Adam optimizer may be used to train the attention-based BLSTM encoder-decoder model.

[0066] In some of the embodiments, in step S430, the pre-trained attention-based BLSTM encoder-decoder model is used to receive the power data set to be detected, encode the reconstructed power data set to be detected corresponding to the power data set to be detected; based on the difference between the multidimensional reconstructed power data in the power data set to be detected and the first estimated mean and the first estimated covariance, as well as the difference between the multidimensional power data in the power data set to be detected and the second estimated mean and the second estimated covariance, and a preset threshold, determine the detection result of the power data set to be detected, and output the detection result.

[0067] It should be understood that after obtaining the pre-trained attention-based BLSTM encoder-decoder model, the first estimated mean and the first estimated covariance of the historical benign power consumption data set corresponding to the same user type are obtained based on the historical benign power consumption data set corresponding to the same user type in the training data set in the historical power consumption data set that has been screened (i.e., used for training). At the same time, the second estimated mean and the second estimated covariance of the historical reconstructed benign power consumption data set corresponding to the same user type can be obtained based on the historical reconstructed benign power consumption data set obtained after reconstruction of the historical benign power consumption data set corresponding to the same user type in the training data set in the historical power consumption data set that has been screened (i.e., used for training).

[0068] In some embodiments, the detection result of the power consumption data set to be detected is determined according to the difference between the reconstruction error of the reconstructed power consumption data in the power consumption data set to be detected and the first estimated mean and the first estimated covariance, and the difference between the power consumption data corresponding to the reconstructed power consumption data and the second estimated mean and the second estimated covariance, and a preset threshold, and outputting the detection result may include:

[0069] Obtaining an abnormality score of the i-th dimension electricity consumption data according to a difference between a reconstruction error of the i-th dimension reconstructed electricity consumption data in the reconstructed data set in the electricity consumption data set to be detected and the first estimated mean and the first estimated covariance, and a difference between the i-th dimension electricity consumption data corresponding to the i-th dimension reconstructed electricity consumption data and the second estimated mean and the second estimated covariance;

[0070] According to the relationship between the abnormal score and the preset threshold, the detection result of the i-th dimension electricity consumption data is determined.

[0071] In some embodiments, the outlier score is expressed as Get; among them, a i is the abnormal value score of the electricity consumption data of the i-th dimension in the electricity consumption data set to be detected; e i is the reconstruction error of the i-th dimension reconstructed power consumption data in the reconstructed data set of the power consumption data set to be detected; is the first estimated mean, that is, the estimated mean of the reconstruction errors of the historical reconstructed benign power consumption data set corresponding to the historical benign power consumption data set corresponding to the same user type (for example, the user type corresponding to the power consumption data set to be detected); is the first estimated covariance, that is, the estimated covariance of the reconstruction error of the historical benign power consumption data set corresponding to the same user type (for example, the user type corresponding to the power consumption data set to be detected) and the historical reconstructed benign power consumption data set; T is the transpose of the matrix; γ is the element parameter; x i The i-th dimension of the power consumption data in the power consumption data set to be detected; is the second estimated mean, that is, the estimated mean of the historical benign electricity consumption data set corresponding to the same user type; is the second estimated covariance, that is, the estimated covariance of the historical benign electricity consumption data set corresponding to the same user type.

[0072] In some embodiments, determining the detection result of the i-th dimension electricity usage data according to the relationship between the abnormal score and the preset threshold value includes:

[0073] In response to determining that the abnormality score is less than a preset threshold, the detection result of the i-th dimension electricity usage data is determined to be benign data; or in response to determining that the abnormality score is not less than a preset threshold, the detection result of the i-th dimension electricity usage data is determined to be abnormal data.

[0074] In some embodiments, the detection result of the i-th dimension electricity consumption data is determined according to the relationship between the abnormal score and the preset threshold value by the formula: Determine the detection result of the i-th dimension electricity consumption data; where y i When the value is 0, it is normal data, and the electricity consumption data of the i-th dimension is determined to be normal data. i When the value is 1, it is abnormal data, and the electricity consumption data of the i-th dimension is determined to be abnormal data.

[0075] The electricity theft detection method and device based on the bidirectional encoder-decoder attention mechanism provided in the embodiment of the present application, the experiment on the real data set shows that even if the sampling rate is low, the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism in the embodiment of the present application is robust to non-malicious changes in the power consumption pattern and data pollution attacks. In addition, the accuracy of the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism proposed in the embodiment of the present application is greatly improved compared with the traditional detection method, and the error rate is greatly reduced compared with the traditional detection method.

[0076] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0077] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0078] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0079] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0080] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0081] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0082] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism described in any of the above embodiments is implemented.

[0083] Figure 3 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0084] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0085] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0086] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0087] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0088] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0089] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for achieving good operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0090] The electronic device of the above embodiment is used to implement the corresponding electricity theft detection method based on the bidirectional encoder-decoder attention mechanism in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0091] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism as described in any of the above embodiments.

[0092] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0093] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0094] Based on the same inventive concept, corresponding to the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism. Corresponding to the execution subject corresponding to each step in each embodiment of the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism, the processor that executes the corresponding step may belong to the corresponding execution subject.

[0095] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the electricity theft detection method based on the bidirectional encoder-decoder attention mechanism as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0096] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0097] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0098] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0099] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for detecting electricity theft based on a bidirectional encoder-decoder attention mechanism, characterized in that: include: Acquire a power consumption data set to be detected, wherein the power consumption data set to be detected includes multi-dimensional power consumption data; Each dimension of electricity consumption data includes sampling time and corresponding electricity consumption; Input the power consumption data set to be detected into a pre-trained Gaussian mixture model, and output the user type corresponding to the power consumption data set to be detected; Determine a first estimated mean and a first estimated covariance, and a second estimated mean and a second estimated covariance corresponding to the user type; the first estimated mean is an estimated mean of a reconstruction error of a historically reconstructed benign power usage data set corresponding to a historically benign power usage data set corresponding to the user type; The first estimated covariance is an estimated covariance of a reconstruction error of a historical reconstructed benign power consumption data set corresponding to the historical benign power consumption data set corresponding to the user type; The second estimated mean is an estimated mean of a historical benign electricity consumption data set corresponding to the user type; The second estimated covariance is an estimated covariance of a historical benign electricity usage data set corresponding to the user type; Inputting the power consumption data set to be detected into a pre-trained attention-based BLSTM encoder-decoder model to obtain a reconstructed power consumption data set to be detected corresponding to the power consumption data set to be detected; Based on the difference between the reconstruction error of the reconstructed power data in the power data set to be detected and the first estimated mean and the first estimated covariance, as well as the difference between the power data corresponding to the reconstructed power data and the second estimated mean and the second estimated covariance, and a preset threshold, the detection result of the power data set to be detected is determined and the detection result is output.

2. The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism according to claim 1 is characterized in that: The determining the detection result of the power consumption data set to be detected according to the difference between the reconstruction error of the reconstructed power consumption data in the power consumption data set to be detected and the first estimated mean and the first estimated covariance, and the difference between the power consumption data corresponding to the reconstructed power consumption data and the second estimated mean and the second estimated covariance, and a preset threshold, and outputting the detection result includes: Obtaining an abnormality score of the i-th dimension electricity consumption data according to a difference between a reconstruction error of the i-th dimension reconstructed electricity consumption data in the reconstructed data set in the electricity consumption data set to be detected and the first estimated mean and the first estimated covariance, and a difference between the i-th dimension electricity consumption data corresponding to the i-th dimension reconstructed electricity consumption data and the second estimated mean and the second estimated covariance; According to the relationship between the abnormal score and the preset threshold, the detection result of the i-th dimension electricity consumption data is determined.

3. The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism according to claim 2 is characterized in that: The outlier score is expressed as Get; among them, a i is the abnormal value score of the electricity consumption data of the i-th dimension in the electricity consumption data set to be detected; e i is the reconstruction error of the i-th dimension reconstructed power consumption data in the reconstructed data set of the power consumption data set to be detected; is the first estimated mean; is the first estimated covariance; T is the transpose of the matrix; γ is the element parameter; x i The i-th dimension of the power consumption data in the power consumption data set to be detected; is the second estimated mean; is the second estimated covariance.

4. The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism according to claim 2 is characterized in that: Determining the detection result of the i-th dimension electricity consumption data according to the relationship between the abnormal score and the preset threshold comprises: Pass-through Determine the detection result of the i-th dimension electricity consumption data; where y i When the value is 0, the electricity consumption data of the i-th dimension is determined to be normal data; i When the value is 1, the electricity consumption data of the i-th dimension is determined to be abnormal data.

5. The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism according to claim 1 is characterized in that: The attention-based BLSTM encoder-decoder model includes an AE model; the encoder of the AE model has a BLSTM layer; The AE model has an attention mechanism in the decoder; The BLSTM layer includes: in, For x i The state representation of the first hidden layer of the encoder; x i is the value of the i-th dimension in the input data; U and W are weight matrices, b is the bias vector, and f EN To encode the operation of the LSTM unit, It is the concatenation operation of vectors; The attention mechanism includes: For x i An estimated value of is the hidden state of the decoder at time i, f DE is an LSTM cell in the decoder, g is the softmax activation function; h j For x j The hidden layer state of Among them, h l For x l The hidden layer state of x j is the value of the jth dimension input in the encoder; x l is the value of the lth dimension input in the encoder.

6. The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism according to claim 5 is characterized in that: The objective function is: Where Θ is the parameter set of the AE model, Θ = [U, W, b], λ is the regularization parameter; D k It is a user sample data set.

7. The electricity theft detection method based on the bidirectional encoder-decoder attention mechanism according to claim 1 is characterized in that: The training method of the pre-trained attention-based BLSTM encoder-decoder model includes: Build an attention-based BLSTM encoder-decoder model; The attention-based BLSTM encoder-decoder model is trained using a historical electricity consumption data set belonging to the same user type output by the Gaussian mixture model after initial training to obtain a preliminarily trained attention-based BLSTM encoder-decoder model; Using the initially trained attention-based BLSTM encoder-decoder model to detect the historical electricity consumption data set to identify malicious electricity consumption data; Delete the malicious electricity consumption data in the historical electricity consumption data set to obtain the historical benign electricity consumption data set; The attention-based BLSTM encoder-decoder model that has been initially trained is retrained using a historical benign electricity consumption dataset belonging to the same user type output by a pre-trained Gaussian mixture model to obtain the pre-trained attention-based BLSTM encoder-decoder model training method.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

9. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 7.

10. A computer program product, comprising computer program instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 7.

Images