Method and System for Abnormal Detection of Power Internet of Things Devices Based on Federated Graph Learning

Abstract

The present invention discloses a method and system for detecting anomalies in power Internet of Things devices based on federated graph learning. The method comprises: constructing graph structure data; at the client level, using a graph neural network as a local node classifier for downstream tasks, and using an adaptive graph interpolation generator to repair subgraphs and lost cross-subgraph connections; using multiple servers as central nodes, and uploading the obtained model parameters to the central server in the region after local training until convergence; at the server level, using an autoencoder to obtain the potential global features of the covered clients, allowing model parameters to be transmitted between adjacent servers, and using an aggregation algorithm to obtain a global model and send it to each client; after each client updates the model, continuing the next round of training until the optimal detection model is obtained. The adaptive graph interpolation generator is used to mine potential connections between subgraphs to fill the gaps in the lack of cross-client topology information.

Description

Technical Field

[0001] The present invention belongs to the technical field of power grid equipment detection, and in particular relates to a method and system for detecting anomalies in power Internet of Things devices based on federated graph learning. Background Art

[0002] In the power IoT environment, there are a vast number of edge devices, each of which generates a large amount of time-series data. This data may contain sensitive information such as users' electricity usage habits and geographic location. Traditional centralized learning methods require a large amount of data input. If this data is transmitted across the network without proper encryption or security measures, it may be intercepted by malicious third parties, resulting in privacy leaks. Furthermore, most existing federated learning frameworks cannot handle heterogeneous data, and most methods that use graph neural networks as detection models do not consider neighbor nodes across client subgraphs, making it impossible to extract more comprehensive features and correlations. Summary of the Invention

[0003] The present invention provides a method and system for detecting anomalies in power Internet of Things devices based on federated graph learning, which is used to solve the technical problem that most methods using graph neural networks as detection models do not consider neighbor nodes across client subgraphs and cannot extract more comprehensive features and association relationships.

[0004] In a first aspect, the present invention provides a method for detecting anomalies in power Internet of Things devices based on federated graph learning, comprising:

[0005] Construct graph structure data, where each node represents a power IoT device and each edge represents the relationship between two power IoT devices;

[0006] At the client level, we use graph neural networks as local node classifiers for downstream tasks, and an adaptive graph interpolation generator to repair subgraphs and lost cross-subgraph connections.

[0007] Using multiple servers as central nodes, the client will upload the obtained model parameters to the central server in the region after local training until convergence;

[0008] At the server level, the autoencoder is used to obtain the potential global features of the covered clients, and model parameters are allowed to be transmitted between adjacent servers. The aggregation algorithm is used to obtain the global model and send it to each client.

[0009] After each client updates the model, it continues the next round of training until the optimal detection model is obtained;

[0010] Obtain the graph structure data to be tested, input the graph structure data to be tested into the optimal detection model, and the optimal detection model outputs the abnormal results of the power Internet of Things equipment.

[0011] In a second aspect, the present invention provides a power Internet of Things device anomaly detection system based on federated graph learning, comprising:

[0012] A construction module is configured to construct graph structure data, where each node in the graph structure data represents a power Internet of Things device, and each edge represents an association relationship between two power Internet of Things devices;

[0013] The repair module is configured to use a graph neural network as a local node classifier for downstream tasks at the client layer and an adaptive graph interpolation generator to repair subgraphs and lost cross-subgraph connections;

[0014] The upload module is configured to use multiple servers as central nodes. After the client trains locally until convergence, it uploads the obtained model parameters to the central server in the region.

[0015] The acquisition module is configured to obtain the potential global features of the covered clients based on the autoencoder at the server level, allow the model parameters to be transferred between adjacent servers, and use the aggregation algorithm to obtain the global model and send it to each client;

[0016] The training module is configured to continue the next round of training after each client updates the model until the optimal detection model is obtained;

[0017] The output module is configured to obtain the graph structure data to be tested, input the graph structure data to be tested into the optimal detection model, and the optimal detection model outputs the abnormal result of the power Internet of Things device.

[0018] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the method for detecting anomalies in power Internet of Things devices based on federated graph learning according to any embodiment of the present invention.

[0019] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the program instructions are executed by a processor, the processor executes the steps of the method for detecting anomaly of an electric power Internet of Things device based on federated graph learning in any embodiment of the present invention.

[0020] The present application discloses a method and system for detecting anomalies in power Internet of Things devices based on federated graph learning. The method and system adopt a federated graph learning structure to perform anomaly detection on power Internet of Things devices, and uses a graph neural network as the initial model to process heterogeneous data between devices. At the same time, in the process of constructing subgraphs, an adaptive graph interpolation generator is used to mine potential connections between subgraphs to fill the gap of lack of cross-client topology information. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on these drawings.

[0022] Figure 1 It is a flowchart of a method for detecting anomalies in power Internet of Things devices based on federated graph learning provided by an embodiment of the present invention;

[0023] Figure 2 It is an architecture diagram of a multi-edge server federated graph learning system provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural block diagram of a system for detecting anomalies in power Internet of Things devices based on federated graph learning provided by an embodiment of the present invention;

[0025] Figure 4 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. Specific Embodiments

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, rather than all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts based on the embodiments of the present invention fall within the scope of protection of the present invention.

[0027] Please refer to Figure 1 , which shows a flowchart of a method for detecting anomalies in power Internet of Things devices based on federated graph learning of the present application.

[0028] As Figure 1 shown, the method for detecting anomalies in power Internet of Things devices based on federated graph learning specifically includes the following steps:

[0029] Step S101: Construct graph-structured data, where each node in the graph-structured data represents a power Internet of Things device, and each edge represents the association relationship between two power Internet of Things devices.

[0030] Step S102: At the client layer, use a graph neural network as the local node classifier for downstream tasks, and use an adaptive graph imputation generator to repair subgraphs and missing cross-subgraph connections.

[0031] The current federated graph learning fails to fully consider the lack of topological information among clients in real scenarios, resulting in insufficient aggregation of features of multi-hop neighbor clients. By constructing a global topological graph and selecting the most similar nodes as potential links, this method can effectively repair the missing links between clients. And the generated potential feature vectors contribute to more effective feature propagation in local models, thus improving the training effect of the global model. At the same time, the use of autoencoders and random noise input ensures the privacy of the original data, which conforms to the principles of federated learning.

[0032] The adaptive graph imputation generator includes: an input layer, an encoding layer, a multi-granularity pooling layer, a graph matching layer, a decoding layer, and a topological regularization layer.

[0033] Input layer: Input the original graph containing the missing subgraph. Through graph collapse preprocessing, compress the high-density subgraph into multiple nodes to reduce the computational complexity.

[0034] Encoding layer: Fuse the candidate node and neighborhood features. According to the context information of the missing area of the subgraph, dynamically generate the weights of the imputation path, control the fusion ratio of the candidate node and the existing nodes, and output the enhanced features. The formula is:

[0035] ,

[0036] where, is the output gating value, is the input candidate node feature, is the input adjacent subgraph feature, represents element-wise multiplication, is the output enhanced feature. Compared with the traditional generator's method of directly concatenating or averaging neighborhood features, the gating mechanism can adaptively adjust information fusion and avoid noise interference.

[0037] Multi-granularity pooling layer: Extract local and global features from the enhanced feature . In local pooling, adopt the weighted summation method based on node attention weights, while in global pooling, adopt subgraph-level graph convolution to capture the associations of local details and global patterns respectively, and obtain multi-scale representations. The multi-granularity fusion formula is:

[0038] ,

[0039] where, is the feature after local pooling, representing the weighted aggregated feature of the candidate node set, is the feature after global pooling, representing the overall pattern of the subgraph, MLP is a multi-layer perceptron, and || is the concatenation operation, It is the multi-granularity pooling feature. Compared with the single pooling strategy used in existing methods, multi-granularity pooling enhances the modeling ability for complex topologies by jointly modeling local and global features.

[0040] Graph matching layer: Input the multi-granularity pooling feature Through the attention mechanism, calculate the similarity of nodes across subgraphs, generate adaptive weights, and guide the generation of missing connections. For subgraph repair, combine the context information of adjacent subgraphs to generate candidate node representations, calculate the association probability between candidate nodes and existing nodes, and select the optimal connection method. For cross-subgraph connection repair, use cross-graph convolution in the graph matching layer to achieve two-way heterogeneous message passing and fuse the information of the source subgraph and the target subgraph. Compared with the traditional graph convolution which only focuses on the disadvantages of single-graph message passing, the graph matching layer realizes cross-graph feature distillation.

[0041] Decoding layer: Generate the nodes and edges of the missing subgraph according to the reconstructed adjacency matrix generated by the graph matching layer.

[0042] Topological regularization layer: Constrain the degree distribution and loop structure of the graph generated by the decoding layer to improve the topological rationality of the generated subgraph. Use the KL divergence to calculate the node degree distribution loss between the generated graph and the real graph; at the same time, detect the loop structure in the generated graph through spectral analysis and punish redundant loops. Compared with the traditional generator that relies on implicit learning, topological regularization ensures the physical rationality of the generated structure through explicit topological constraints.

[0043] Step S103: Use multiple servers as central nodes. After the client locally trains to convergence, upload the obtained model parameters to the central server in this region.

[0044] Step S104: At the server layer, obtain the potential global features of the covered clients according to the autoencoder, and allow the transmission of model parameters between adjacent servers. Use the aggregation algorithm to obtain the global model and distribute it to each client.

[0045] Step S105: After each client updates the model, continue the next round of training until the optimal detection model is obtained.

[0046] Step S106: Obtain the test graph structure data, input the test graph structure data into the optimal detection model, and the optimal detection model outputs the abnormal result of the power Internet of Things device.

[0047] In a specific embodiment, the method for detecting anomalies in power Internet of Things devices based on federated graph learning is described in detail from four aspects: data processing, subgraph repair and feature extraction, model update, and anomaly detection.

[0048] I. Data processing

[0049] First, it is necessary to collect operation data from various terminal devices in the power Internet of Things. These data may include, but are not limited to, device status information, power consumption, fault records, etc. The power Internet of Things devices are divided into multiple subgraphs according to the actual application scenarios, and each subgraph corresponds to a local area or a specific functional group. Each client obtains data related to the power Internet of Things devices in various ways, extracts the data generated by the devices as the node set V, extracts the association relationships between the devices as the edge set E, and extracts the spatio-temporal characteristics of the data as the feature matrix X. A graph network is constructed as the global graph. Among them , n represents the number of nodes; is the edge set storing the connection relationship between nodes u and v, where ; represents the node feature matrix, where is the i-th node of the node feature vector, and d is the dimension of the feature vector. Suppose there are N edge servers and M clients. The edge servers cover local clients for federated graph learning training, where . The client owns a local subgraph of the global graph, which is represented by , where represents the node set of the local subgraph, represents the edge set of the local subgraph, represents the node feature matrix of the local subgraph. To simulate the real scenario of the lack of connections between clients, we assume that there are no shared nodes and connections between clients, which is represented by , and are different subgraph node sets. The subgraphs of all clients form a complete graph, which is defined as .

[0050] II. Subgraph Repair and Feature Extraction

[0051] To capture potential cross-subgraph connections, we use an adaptive graph imputation generator to repair the subgraphs to explore the learnable potential graph to repair the cross-subgraph connections, where is the cross-subgraph connection edge set of the potential subgraph, is the node feature matrix of the potential subgraph. To construct globally shared information without leaking the original data, the client uploads the processed embedding to the edge server at every K intervals of edge client communication, where the original connected nodes remain adjacent in the low-dimensional space. Next, the adaptive graph imputation generator is used to fuse the processed embeddings to obtain the globally shared information , where is the number of all covered clients, and c is the dimension of the input. Therefore, is denoted as:

[0052] ,

[0053] where is the embedded representation after being processed by the first client, is the th embedded representation after being processed by the client.

[0054] In the actual application scenario of federated graph learning, each node in the client may have potential cross-subgraph connections. If these cross-subgraph connections are missing, the client may not be sufficient to spread features among multi-hop neighbors. Therefore, the adaptive graph imputation generator uses distance to evaluate node similarity and constructs a global topology graph, denoted as where is the distance for evaluating node similarity, is the transpose of the embedded representation after being processed by the client. Then, k most similar nodes are selected from this topology graph as potential cross-subgraph connections. To generate potential feature vectors under the knowledge of global shared information, an autoencoder parameterized by is used to obtain the complete underlying representation. To protect data privacy, a random noise vector S is input into the autoencoder. Therefore, the output of the autoencoder is reconstructed as where f(·) and h(·) are the encoder and decoder respectively. And represents the potential features that the encoder expects to extract. Using the autoencoder to map the random noise vector to the same dimension as , the output of the (l + 1)th layer is defined as:

[0055] ,

[0056] where and are the weights and biases of a specific layer respectively, represents the activation function.

[0057] Since 's conditional distribution depends on and is independent of S, an evaluator parameterized by is used to supervise the quality of the decoder's reconstructed data, aiming to extract the expected underlying features tailored for node classification. Specifically, the loss function of the autoencoder is defined as:

[0058] ,

[0059] where is the expectation of the variable in denotes a sample from the distribution of and , is the global information evaluator. The loss function of the evaluator is defined as:

[0060] ,

[0061] III. Model Update

[0062] The specific architecture of the multi - center server federated graph learning system is as follows Figure 2 as shown

[0063] In the actual application scenario, as the number of clients increases, especially when the client geographical locations are dispersed, a single edge server may encounter problems such as excessive communication costs and large performance consumption. And when the central server fails, there is a risk of paralysis of the entire federated graph learning system. Therefore, we adopt multiple edge servers to extend the federated graph learning to a multi - edge environment, enabling the federated graph learning system to promote more efficient training and better load balancing in a multi - edge collaborative environment. We consider using N edge servers in this system, and the edge servers are equipped with a global node classifier parameterized by . And the clients only communicate with their nearest edge servers, which can reduce unnecessary communication costs. There is a neighbor relationship between the servers, represented by the matrix . If server and server are neighbors, then , otherwise . And parameter transfer is allowed between neighbor servers .

[0064] To enhance feature propagation in local tasks and facilitate the inference of the subsequent global model, we adopt an L - layer GNN model with a local node classifier , defined as:

[0065] ,

[0066] where GNNconv(·) is a GNN model denotes the GNN output of the i - th client covered by

[0067] .

[0068] Among them, is the vector of node u in the l-th GNN layer, is the vector of node v in the l-th GNN layer, represents the connection between nodes u and v, and AGG(·) is an aggregation function used to integrate the neighbor features of node u, and || represents the concatenation operation.

[0069] During local training, the edge server exchanges information with the covered clients in each client communication. The clients and the nearest edge server collaborate to utilize the shared information and adopt an adaptive graph imputation generator to extract potential connections. Specifically, The loss function of the i-th client under coverage is defined as:

[0070] ,

[0071] where is the loss function of the i-th client, which is used to measure the local empirical risk; is the local node classifier 's learnable weight. Each client parallelly trains the local node classifier parameterized by , and the specific formula is:

[0072] ,

[0073] where α is the learning rate, t represents the local training round, represents the parameters of the t-th round, where is the loss function of the i-th client, is the node classifier of the i-th client. After local training, aggregates the local parameters to update the global parameters , and then broadcasts to all clients on each edge.

[0074] To better explore potential cross-subgraph connections by leveraging information from other servers, we adopt the topology of the edge layer to facilitate parameter transmission between neighbor servers. Enable information to flow between clients through gradient propagation at every K intervals of edge client communication. Specifically, First, aggregate the model parameters of neighbor servers, then average the parameters and broadcast them to the covered clients. This process can be described by the following formula:

[0075] ,

[0076] where, is the edge server With edge servers Connection status; It is an edge server Clients covered; Represents the client Learnable weights for the mid-node classifiers.

[0077] 4. Anomaly Detection

[0078] After obtaining the optimal detection model based on model updates, this model is used to detect anomalies in data from power IoT devices. First, real-time data from each power device is collected and mapped into a previously constructed graph structure, with each device as a node. The trained model is then used to make predictions for these nodes, and the anomaly score output by the model is used to determine whether each device is operating normally. If a device's score exceeds a pre-set threshold, it is considered to be an anomaly.

[0079] In summary, most existing federated learning frameworks cannot handle heterogeneous data, and most methods that use graph neural networks as detection models fail to consider neighboring nodes across client subgraphs, making it impossible to extract more comprehensive features and relationships. Therefore, we use a federated graph learning architecture to detect anomalies in power IoT devices. Using a graph neural network as the initial model to process heterogeneous data between devices, we also use an adaptive graph interpolation generator to explore potential connections between subgraphs during subgraph construction, filling the gap in cross-client topology information.

[0080] Most federated learning systems use a single server as the central node. This architecture can be difficult to scale to very large client groups because the central server needs to handle an increasing number of communication requests, leading to excessive resource consumption. Furthermore, a single server failure can paralyze the entire federated learning system, impacting model performance. To address this issue, we propose multi-center federated learning. Multi-edge server federated learning uses multiple servers as central nodes, each responsible for learning a different subgraph, and model parameters are shared between adjacent central nodes. This reduces resource consumption while ensuring privacy and mitigating the risks associated with single points of failure.

[0081] See also Figure 3 , which shows a structural block diagram of a power Internet of Things device anomaly detection system based on federated graph learning in this application.

[0082] like Figure 3 As shown, the power Internet of Things device anomaly detection system 200 includes a construction module 210, a repair module 220, an upload module 230, an acquisition module 240, a training module 250 and an output module 260.

[0083] Among them, the construction module 210 is configured to construct graph structure data, where each node in the graph structure data represents a power Internet of Things device, and each edge represents the association relationship between two power Internet of Things devices; the repair module 220 is configured to use a graph neural network as a local node classifier for downstream tasks and an adaptive graph imputation generator to repair subgraphs and lost cross-subgraph connections at the client layer; the upload module 230 is configured to use multiple servers as central nodes, and after local training at the client converges, upload the obtained model parameters to the central server in this region; the acquisition module 240 is configured to obtain the potential global features of the covered clients according to an autoencoder at the server layer, allow adjacent servers to transmit model parameters, and use an aggregation algorithm to obtain a global model and distribute it to each client; the training module 250 is configured to continue the next round of training after each client updates the model until an optimal detection model is obtained; the output module 260 is configured to obtain the graph structure data to be measured, input the graph structure data to be measured into the optimal detection model, and the optimal detection model outputs the abnormal result of the power Internet of Things device.

[0084] It should be understood that Figure 3 the modules described in Figure 1 correspond to the respective steps in the method described in Figure 3 Therefore, the operations, features, and corresponding technical effects described above for the method also apply to

[0085] In some other embodiments, the embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored. When the program instructions are executed by a processor, the processor is enabled to execute the method for detecting anomalies in power Internet of Things devices based on federated graph learning in any of the above method embodiments;

[0086] As an implementation, the computer-readable storage medium of the present invention stores computer-executable instructions, and the computer-executable instructions are set as:

[0087] Construct graph structure data, where each node in the graph structure data represents a power Internet of Things device, and each edge represents the association relationship between two power Internet of Things devices;

[0088] At the client layer, use a graph neural network as a local node classifier for downstream tasks and an adaptive graph imputation generator to repair subgraphs and lost cross-subgraph connections;

[0089] Use multiple servers as central nodes, and after local training at the client converges, upload the obtained model parameters to the central server in this region;

[0090] At the server layer, the potential global features of the covered clients are obtained according to the autoencoder, and the model parameters are allowed to be transmitted between adjacent servers. The global model is obtained by using an aggregation algorithm and distributed to each client;

[0091] After each client updates the model, it continues the next round of training until the optimal detection model is obtained;

[0092] The structure data of the graph to be measured is obtained and input into the optimal detection model, and the optimal detection model outputs the abnormal results of the power Internet of Things devices.

[0093] The computer-readable storage medium may include a storage program area and a storage data area. Among them, the storage program area can store an operating system and application programs required for at least one function; the storage data area can store data created according to the use of the power Internet of Things device anomaly detection system based on federated graph learning, etc. In addition, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the computer-readable storage medium may optionally include a memory remotely set relative to the processor, and these remote memories can be connected to the power Internet of Things device anomaly detection system based on federated graph learning through a network. Examples of the above networks include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0094] Figure 4 It is a schematic structural diagram of the electronic device provided by an embodiment of the present invention, as Figure 4 shown. The device includes: a processor 310 and a memory 320. The electronic device may further include: an input device 330 and an output device 340. The processor 310, the memory 320, the input device 330, and the output device 340 may be connected through a bus or other means, Figure 4 and here, the connection through the bus is taken as an example. The memory 320 is the above-mentioned computer-readable storage medium. The processor 310 executes various functional applications and data processing of the server by running non-volatile software programs, instructions, and modules stored in the memory 320, that is, implements the power Internet of Things device anomaly detection method based on federated graph learning in the above method embodiment. The input device 330 can receive input digital or character information, and generate key signal inputs related to the user settings and function controls of the power Internet of Things device anomaly detection system. The output device 340 may include a display device such as a display screen.

[0095] The above electronic device can execute the method provided by the embodiment of the present invention, and has corresponding functional modules and beneficial effects for executing the method. For technical details not described in detail in this embodiment, reference can be made to the method provided by the embodiment of the present invention.

[0096] As an implementation, the above electronic device is applied to an abnormal detection system for power Internet of Things devices based on federated graph learning and is used for a client, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor is enabled to:

[0097] Construct graph structure data, where each node in the graph structure data represents a power Internet of Things device, and each edge represents the association relationship between two power Internet of Things devices;

[0098] At the client layer, use a graph neural network as a local node classifier for downstream tasks, and use an adaptive graph imputation generator to repair subgraphs and missing cross-subgraph connections;

[0099] Adopt multiple servers as central nodes. After the client locally trains until convergence, upload the obtained model parameters to the central server in this region;

[0100] At the server layer, obtain the potential global features of the covered clients according to the autoencoder, and allow the transmission of model parameters between adjacent servers, and use an aggregation algorithm to obtain the global model and distribute it to each client;

[0101] After each client updates the model, continue the next round of training until the optimal detection model is obtained;

[0102] Obtain the graph structure data to be measured, input the graph structure data to be measured into the optimal detection model, and the optimal detection model outputs the abnormal results of the power Internet of Things devices.

[0103] Through the description of the above implementation manners, those skilled in the art can clearly understand that each implementation manner can be realized by means of software plus a necessary general hardware platform, and of course, it can also be realized by hardware. Based on such an understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of a software product, and this computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiments. [[ID=2&5]]

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting anomalies in power Internet of Things devices based on federated graph learning, characterized in that: include: Construct graph-structured data, where each node represents the operating data generated by a power IoT device, and each edge represents the relationship between two power IoT devices. The operating data includes the status information, power consumption, and fault records of the power IoT devices. At the client layer, a graph neural network is used as a local node classifier for downstream tasks, and an adaptive graph interpolation generator is used to repair subgraphs and lost cross-subgraph connections. The adaptive graph interpolation generator includes: an input layer, an encoding layer, a multi-granularity pooling layer, a graph matching layer, a decoding layer, and a topology regularization layer. Input layer: Input the original graph containing missing subgraphs, and compress the high-density subgraphs into multiple nodes through graph collapse preprocessing; Encoding layer: Fusion of candidate nodes and neighborhood features; According to the context information of the missing area of the subgraph, the weight of the interpolation path is dynamically generated to control the fusion ratio of candidate nodes and existing nodes, and the enhanced features are output. The formula is: ， in, is the output gate value, is the input candidate node feature, is the input adjacent subgraph feature, represents element-wise multiplication, is the enhanced feature of the output; Multi-granularity pooling layer: to enhance features Perform local and global feature extraction, use a weighted summation method based on node attention weights in local pooling, and use sub-graph level graph convolution in global pooling to capture the association between local details and global patterns, respectively, and obtain multi-scale representation. The multi-granularity fusion formula is: ， in, is the feature after local pooling, which represents the weighted aggregate feature of the candidate node set. is the feature after global pooling, which represents the overall pattern of the subgraph. MLP is a multi-layer perceptron, and || is a concatenation operation. It is a multi-granularity pooling feature; Graph matching layer: multi-granularity pooling features Input, the similarity of nodes across subgraphs is calculated through the attention mechanism, adaptive weights are generated, and the generation of missing connections is guided. For subgraph repair, the contextual information of adjacent subgraphs is combined to generate candidate node representations, the association probability between candidate nodes and existing nodes is calculated, and the optimal connection method is selected. For cross-subgraph connection repair, the cross-graph convolution in the graph matching layer is used to implement bidirectional heterogeneous message passing, fusing the information of the source subgraph and the target subgraph. Decoding layer: Generates the nodes and edges of the missing subgraph based on the reconstructed adjacency matrix generated by the graph matching layer; Topology regularization layer: This layer constrains the degree distribution and ring structure of the graph generated by the decoding layer, improves the topological rationality of the generated subgraph, and uses KL divergence to calculate the node degree distribution loss between the generated graph and the real graph. It also uses spectral analysis to detect the ring structure in the generated graph and penalize redundant rings. Using multiple servers as central nodes, the client will upload the obtained model parameters to the central server in the region after local training until convergence; At the server level, the autoencoder is used to obtain the potential global features of the covered clients, and model parameters are allowed to be transmitted between adjacent servers. The aggregation algorithm is used to obtain the global model and send it to each client. After each client updates the model, it continues the next round of training until the optimal detection model is obtained; Obtain the graph structure data to be tested, input the graph structure data to be tested into the optimal detection model, and the optimal detection model outputs the abnormal results of the power Internet of Things equipment.

2. The method for detecting anomalies of power Internet of Things devices based on federated graph learning according to claim 1 is characterized in that: Building graph structure data includes: Obtain relevant data of power IoT devices and extract data generated by power IoT devices from the relevant data as a node set , extract the association relationship between power IoT devices as the edge set , extract the spatiotemporal features in the relevant data as the feature matrix ; Building a graph network As a global graph, where , Indicates the number of nodes, It is a storage node and nodes The edge set of the connection relationship between , For nodes and nodes There are edges connecting the represents the node feature matrix, is the field of real numbers, is the node feature vector of the ith node, is the dimension of the feature vector; Assume there is Edge servers and Clients, Edge Servers cover Local Clients Conduct federated graph learning training, where , client Own a local subgraph of the global graph, using To express, represents the set of nodes of the local subgraph, represents the edge set of the local subgraph, Represents the node feature matrix of the local subgraph.

3. The method for detecting anomalies of power Internet of Things devices based on federated graph learning according to claim 1 is characterized in that: The loss function of the autoencoder is: ， Where, is the loss function of the autoencoder, for The expectation of the variables in is the conditional probability distribution, For nodes The feature representation of Indicates from Sampling from the distribution of , is the global information evaluator; Among them, the loss function of the global information evaluator is: ， Where, is the loss function of the global information evaluator.

4. The method for detecting anomalies of power Internet of Things devices based on federated graph learning according to claim 1 is characterized in that: in, The expression that allows model parameters to be transmitted between adjacent servers is: ， Where, is a global parameter, is the number of edge servers, For edge servers With edge servers The connection status, For edge servers Clients covered, are the learnable weights of the node classifier in the client.

5. A power Internet of Things device anomaly detection system based on federated graph learning, characterized in that: include: A construction module is configured to construct graph structure data, wherein each node in the graph structure data represents operating data generated by a power Internet of Things device, and each edge represents an association between two power Internet of Things devices, wherein the operating data includes status information, power consumption, and fault records of the power Internet of Things devices; The repair module is configured to use a graph neural network as a local node classifier for downstream tasks at the client layer and an adaptive graph interpolation generator to repair subgraphs and lost cross-subgraph connections. The adaptive graph interpolation generator includes: an input layer, an encoding layer, a multi-granularity pooling layer, a graph matching layer, a decoding layer, and a topology regularization layer; Input layer: Input the original graph containing missing subgraphs, and compress the high-density subgraphs into multiple nodes through graph collapse preprocessing; Encoding layer: Fusion of candidate nodes and neighborhood features; According to the context information of the missing area of the subgraph, the weight of the interpolation path is dynamically generated to control the fusion ratio of candidate nodes and existing nodes, and the enhanced features are output. The formula is: ， in, is the output gate value, is the input candidate node feature, is the input adjacent subgraph feature, represents element-wise multiplication, is the enhanced feature of the output; Multi-granularity pooling layer: to enhance features Perform local and global feature extraction, use a weighted summation method based on node attention weights in local pooling, and use sub-graph level graph convolution in global pooling to capture the association between local details and global patterns, respectively, and obtain multi-scale representation. The multi-granularity fusion formula is: ， in, is the feature after local pooling, which represents the weighted aggregate feature of the candidate node set. is the feature after global pooling, which represents the overall pattern of the subgraph. MLP is a multi-layer perceptron, and || is a concatenation operation. It is a multi-granularity pooling feature; Graph matching layer: multi-granularity pooling features Input, the similarity of nodes across subgraphs is calculated through the attention mechanism, adaptive weights are generated, and the generation of missing connections is guided. For subgraph repair, the contextual information of adjacent subgraphs is combined to generate candidate node representations, the association probability between candidate nodes and existing nodes is calculated, and the optimal connection method is selected. For cross-subgraph connection repair, the cross-graph convolution in the graph matching layer is used to implement bidirectional heterogeneous message passing, fusing the information of the source subgraph and the target subgraph. Decoding layer: Generates the nodes and edges of the missing subgraph based on the reconstructed adjacency matrix generated by the graph matching layer; Topology regularization layer: This layer constrains the degree distribution and ring structure of the graph generated by the decoding layer, improves the topological rationality of the generated subgraph, and uses KL divergence to calculate the node degree distribution loss between the generated graph and the real graph. It also uses spectral analysis to detect the ring structure in the generated graph and penalize redundant rings. The upload module is configured to use multiple servers as central nodes. After the client trains locally until convergence, it uploads the obtained model parameters to the central server in the region. The acquisition module is configured to obtain the potential global features of the covered clients based on the autoencoder at the server level, allow the model parameters to be transferred between adjacent servers, and use the aggregation algorithm to obtain the global model and send it to each client; The training module is configured to continue the next round of training after each client updates the model until the optimal detection model is obtained; The output module is configured to obtain the graph structure data to be tested, input the graph structure data to be tested into the optimal detection model, and the optimal detection model outputs the abnormal result of the power Internet of Things device.

6. An electronic device, characterized in that: include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images