Audit data early warning method and system

Abstract

This invention belongs to the field of power system technology, and particularly relates to an audit data early warning method and system. It generates a raw data stream by real-time collection of voltage and current data of power supply network nodes and charging / discharging efficiency data of energy storage systems through a distributed sensor network. This raw data stream is then processed locally by edge computing nodes for cleaning and standardization format conversion. Dynamic risk assessment results and scheduling schemes are generated based on fuzzy logic reasoning and digital twin simulation. Deviations are predicted through meta-learning analysis, and closed-loop optimization is achieved using model distillation technology. The system includes a distributed sensor network, edge computing nodes, and a multi-source data fusion module. This invention improves the real-time performance of power system anomaly detection, the accuracy of risk assessment, and the economic efficiency of energy storage scheduling.

Description

Technical Field

[0001] This invention belongs to the technical field of power supply or distribution circuit devices or systems and energy storage systems, specifically relating to intelligent data monitoring and anomaly early warning technology for power systems, and in particular to an audit data early warning method and system based on multi-source data fusion and intelligent analysis. Background Technology

[0002] With the expansion of power system scale and the increasing complexity of energy structure, the demand for data monitoring and anomaly early warning in power networks is growing. In traditional power systems, energy storage, distribution control, and power supply stability management rely heavily on manual inspections or simple alarm mechanisms based on fixed thresholds, making it difficult to achieve real-time, dynamic anomaly detection and risk prediction. For example, existing technologies lack the ability to proactively analyze abnormal fluctuations in energy loss, equipment operating status, or energy storage systems, resulting in delayed responses to potential faults and affecting power supply reliability.

[0003] Furthermore, existing power system data monitoring primarily focuses on physical layer parameters (such as voltage and current), lacking the ability to conduct in-depth audits and correlation analyses of operational data. For instance, how to construct dynamic early warning models and achieve intelligent identification of abnormal power system behavior through the fusion processing of multi-source data (such as load curves, energy storage efficiency, and distribution node status) remains a pressing technical problem to be solved.

[0004] Therefore, there is an urgent need for an audit and early warning method and system that combines the characteristics of power systems with data intelligent analysis technology to improve the efficiency of anomaly detection in power supply, distribution and energy storage scenarios, and optimize the initiative and security of power management. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an audit data early warning method and system, which solves the problems of the deficiencies of existing technologies in the intelligent operation and maintenance of power systems.

[0006] To solve the above-mentioned technical problems, the specific technical solution of the present invention is as follows:

[0007] In a first aspect, the audit data early warning method provided by the present invention includes:

[0008] Step S101: Collect the node voltage, current, and load fluctuation data of the power supply network, as well as the charging and discharging efficiency and capacity decay rate data of the energy storage system in real time through a distributed sensor network, and generate the raw data stream.

[0009] Step S102: Input the raw data stream into the edge computing node for localized cleaning and standardized format conversion to generate standardized intermediate data;

[0010] Step S103: Based on the federated learning framework and knowledge graph technology, cross-domain data fusion is performed on the standardized intermediate data to extract the hidden features of the power distribution network topology and the dynamic correlation features between charging and discharging behavior and load fluctuations, and to generate a correlation feature vector.

[0011] Step S104: Use self-supervised learning to perform dynamic feature engineering on the associated feature vector to generate multi-dimensional power system operation status features, and use a lightweight anomaly detection model to pre-screen the high-dimensional features for anomaly patterns, and output a high-risk event pool.

[0012] Step S105: Based on the high-risk event pool, a hierarchical early warning model is constructed. The spatiotemporal fusion Transformer architecture is used to perform spatiotemporal feature modeling on the power supply network time series data to predict the probability of equipment-level failures. The load allocation and energy storage scheduling strategies of the power distribution network are optimized through a hybrid reinforcement learning framework to predict system-level risks.

[0013] Step S106: Based on the equipment-level failure probability and system-level risk prediction results, a dynamic risk assessment level is generated by combining fuzzy logic reasoning and evidence theory, and a real-time alarm is triggered or an energy storage scheduling suggestion and load transfer scheme are generated.

[0014] Step S107: Collect system response data after the early warning strategy is executed, analyze the model prediction deviation through the meta-learning framework and dynamically adjust the feature weights and model structure to form a closed-loop optimization link;

[0015] The original data stream is processed by the edge computing node and then flows to the data fusion module. The associated feature vector is input into the dynamic feature engineering module to generate pre-screening results. The high-risk event pool drives the training and decision-making of the hierarchical early warning model. The risk assessment results are fed back to the model optimization module.

[0016] Furthermore, in the audit data early warning method of the present invention, step S103 includes:

[0017] The vulnerability features of nodes in the topology of the power distribution network are extracted by graph embedding algorithm, and the nonlinear correlation between charging and discharging efficiency and load fluctuation is captured based on spatiotemporal attention mechanism.

[0018] By aligning the structured data from the SCADA system with the unstructured data from smart meters through federated learning, a cross-domain knowledge graph of power operation is generated.

[0019] The hidden features and dynamically associated features are input to the dynamic feature engineering module, forming a data closed loop for anomaly pattern pre-screening with the output of the anomaly detection model.

[0020] Furthermore, in the audit data early warning method of the present invention, step S104 includes: extracting harmonic distortion features from non-stationary time series data using wavelet transform, and performing data augmentation on abnormal samples using a generative adversarial network;

[0021] The enhanced features are input into the improved Isolation Forest algorithm for fast anomaly detection, and the high-risk events are stored in the event pool.

[0022] The event pool serves as an input flow-oriented hierarchical early warning model, which, together with the spatiotemporal feature modeling of the spatiotemporal fusion Transformer, forms a collaborative analysis for device-level and system-level risk assessment.

[0023] Furthermore, in the audit data early warning method of the present invention, step S105 includes:

[0024] An interpretability module is introduced into the primary model to locate the contribution of abnormal features through SHAP values, thereby assisting in the generation of device-level alarm commands.

[0025] A transfer learning module is embedded in the secondary model, and the strategy network is pre-trained using historical power grid data to accelerate the convergence of load allocation strategies in new scenarios.

[0026] The output of the primary model and the strategy optimization results of the secondary model are input into the risk assessment module to achieve the linkage between short-term fault response and medium- and long-term risk prevention and control.

[0027] Furthermore, in the audit data early warning method of the present invention, step S106 includes:

[0028] The sliding window statistical method is used to adjust the early warning threshold according to the real-time load status, and the execution effect of the energy storage scheduling strategy is simulated by combining the digital twin platform;

[0029] A multi-objective optimization algorithm is used to balance power supply reliability and economy, generate a load transfer scheme, and push it to the operation and maintenance terminal.

[0030] The simulation results and optimization strategies serve as input to the early warning execution module, forming a tamper-proof instruction transmission link with the blockchain traceability mechanism.

[0031] Furthermore, in the audit data early warning method of the present invention, step S107 includes:

[0032] The elastic weight consolidation algorithm constrains the model weight updates during incremental learning to prevent the forgetting of historical knowledge;

[0033] Model distillation technology is used to transfer knowledge from complex hybrid models to lightweight networks, adapting to the real-time inference needs of edge devices;

[0034] The model weight update and knowledge transfer results are fed back into the feature engineering module to drive the iterative optimization of dynamic feature generation and anomaly detection.

[0035] Furthermore, the audit data early warning method of the present invention, wherein the step of aligning the structured data of the SCADA system with the unstructured data of smart meters through federated learning to generate a cross-domain related power operation knowledge graph includes:

[0036] Differential privacy technology is used to protect the data security of each power subsystem during the data fusion process, and cross-domain feature sharing is achieved through gradient encrypted transmission;

[0037] The topological relationship features of the knowledge graph and the data aligned with federated learning are jointly input into the spatiotemporal attention mechanism to enhance the robustness of the correlation analysis between charging and discharging behavior and load fluctuation.

[0038] Furthermore, the audit data early warning method of the present invention, wherein the data augmentation of abnormal samples by adversarial generative network includes a generator and a discriminator, wherein the generator is used to inject adversarial perturbation simulating sensor noise into the input data, and the discriminator focuses on the classification training of high-risk samples through Focal Loss function;

[0039] Adversarial perturbations simulating sensor noise are injected into the input data, and classification training is performed by focusing on high-risk samples using the Focal Loss function;

[0040] The feature vectors trained in the adversarial manner, together with the output of the lightweight anomaly detection model, form a high-precision pre-screening result, reducing the false alarm rate of the hierarchical early warning model.

[0041] Furthermore, in the audit data early warning method of the present invention, the step of embedding a transfer learning module in the secondary model and using historical power grid data to pre-train the strategy network to accelerate the convergence of load allocation strategies in new scenarios includes:

[0042] The parameters of the reinforcement learning network are initialized using a pre-trained load allocation strategy for the distribution network, and the energy storage scheduling action is dynamically adjusted through a near-end policy optimization algorithm.

[0043] The synergistic output of transfer learning and reinforcement learning drives the policy simulation of the digital twin platform, forming a closed-loop verification link from model training to actual execution.

[0044] Secondly, the audit data early warning system provided by this invention is applied to the audit data early warning method, including:

[0045] A distributed sensor network configured to collect real-time data on node voltages and currents of the power supply network and the charging and discharging efficiency of the energy storage system;

[0046] Edge computing nodes, connected to the sensor network, are configured to perform local cleaning and standardization processing on raw data to generate standardized intermediate data;

[0047] A multi-source data fusion module, connected to the edge computing node, is configured to extract cross-domain association features through federated learning and knowledge graph technology;

[0048] The dynamic feature engineering module, connected to the multi-source data fusion module, is configured to generate multi-dimensional operating status features and perform abnormal mode pre-screening.

[0049] The hierarchical early warning model construction module is connected to the dynamic feature engineering module and configured to train a spatiotemporal fusion Transformer and a hybrid reinforcement learning framework.

[0050] The risk assessment and decision-making module is connected to the hierarchical early warning model construction module and is configured to generate dynamic risk levels and energy storage scheduling strategies.

[0051] The closed-loop optimization module, connected to the risk assessment and decision-making module, is configured to achieve adaptive updating of the early warning model through meta-learning and model distillation techniques;

[0052] In this system, the data flow of the sensor network is directed to the edge computing nodes, the standardized intermediate data is processed by the multi-source fusion module and then input into the dynamic feature engineering module, the output of the hierarchical early warning model drives the risk assessment decision, and the decision result is fed back to the closed-loop optimization module.

[0053] Beneficial effects of this invention;

[0054] The audit data early warning method and system provided by this invention collects multi-source heterogeneous data from power supply networks and energy storage systems in real time through a distributed sensor network, and performs localized cleaning and standardization processing using edge computing nodes, effectively reducing data transmission latency and improving data quality. Based on a federated learning framework and knowledge graph technology, it achieves cross-domain data fusion, extracting hidden features of the power distribution network topology and dynamic correlation features between charging / discharging behavior and load fluctuations while protecting the data privacy of each subsystem, thus enhancing the semantic correlation analysis capability of multimodal data. It utilizes self-supervised learning to perform dynamic feature engineering processing on the correlation features, extracts harmonic distortion features of non-stationary time-series data through wavelet transform, and combines adversarial generative networks to enhance the distribution of abnormal samples, thereby improving the sensitivity of the lightweight anomaly detection model in identifying hidden faults. This paper employs a spatiotemporal fusion Transformer architecture to model the spatiotemporal dependencies of power supply network time-series data, accurately locating device-level fault probabilities. Simultaneously, it optimizes load allocation and energy storage scheduling strategies through a hybrid reinforcement learning framework, and combines this with a digital twin platform to simulate strategy execution effects, achieving synergistic optimization of short-term device-level response and medium-to-long-term system-level risk prevention. Based on a meta-learning framework and an elastic weight consolidation algorithm, a closed-loop optimization link is constructed to dynamically adjust feature weights and model structure. Combined with model distillation technology, it adapts to the real-time inference needs of edge devices, forming an adaptive early warning model iteration mechanism for the dynamic operating environment of the power system. This improves the real-time performance of power supply network anomaly detection, the accuracy of risk assessment, and the economic efficiency of energy storage scheduling, meeting the technical requirements for intelligent monitoring and energy storage management of power systems under the H02J classification. Attached Figure Description

[0055] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on the accompanying drawings without creative effort.

[0056] Figure 1 A flowchart of an audit data early warning method provided in an embodiment of the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. The technical solutions provided by various embodiments of this invention will be described in detail below with reference to the accompanying drawings. To better understand the objectives of this invention, it will be described in further detail below.

[0058] Please see Figure 1 In a first aspect, the present invention provides an audit data early warning method, comprising:

[0059] Step S101: Collect the node voltage, current, and load fluctuation data of the power supply network, as well as the charging and discharging efficiency and capacity decay rate data of the energy storage system in real time through a distributed sensor network, and generate the raw data stream.

[0060] Step S102: Input the raw data stream into the edge computing node for localized cleaning and standardized format conversion to generate standardized intermediate data;

[0061] Step S103: Based on the hierarchical federated learning framework and knowledge graph technology, cross-domain data fusion is performed on the standardized intermediate data. The node vulnerability features of the power distribution network topology are extracted by graph embedding algorithm, and the nonlinear correlation between charging and discharging efficiency and load fluctuation is captured based on the spatiotemporal attention mechanism to generate the correlation feature vector.

[0062] Step S104: Use self-supervised learning to perform dynamic feature engineering on the associated feature vector to generate multi-dimensional power system operation status features, and use a lightweight anomaly detection model to pre-screen the high-dimensional features for anomaly patterns, and output a high-risk event pool.

[0063] Step S105: Based on the high-risk event pool, a hierarchical early warning model is constructed. The spatiotemporal fusion Transformer architecture is used to perform spatiotemporal feature modeling on the power supply network time series data to predict the probability of equipment-level failures. The load allocation and energy storage scheduling strategies of the power distribution network are optimized through a hybrid reinforcement learning framework to predict system-level risks.

[0064] Step S106: Based on the equipment-level failure probability and system-level risk prediction results, a dynamic risk assessment level is generated by combining fuzzy logic reasoning and evidence theory, and a real-time alarm is triggered or an energy storage scheduling suggestion and load transfer scheme are generated.

[0065] Step S107: Collect system response data after the early warning strategy is executed, analyze the model prediction deviation through the meta-learning framework and dynamically adjust the feature weights and model structure to form a closed-loop optimization link;

[0066] The original data stream is processed by the edge computing node and then flows to the data fusion module. The associated feature vector is input into the dynamic feature engineering module to generate pre-screening results. The high-risk event pool drives the training and decision-making of the hierarchical early warning model. The risk assessment results are fed back to the model optimization module.

[0067] In step S101, the distributed sensor network is deployed at key power distribution nodes of the power supply network and battery cluster monitoring points of the energy storage system, specifically including high-precision voltage transformers, Hall current sensors, and battery health status monitoring units. Edge computing nodes use a sliding window filtering algorithm to eliminate high-frequency noise interference from the collected raw voltage and current signals, and compensate for time-series data loss due to communication delays through linear interpolation. For the capacity decay rate data of the energy storage system, a state estimation algorithm based on Kalman filtering is used to correct sensor drift errors, generating a raw data stream with time synchronization markers. The data encapsulation module converts multi-source heterogeneous data into a standardized JSON format, including device identifiers, normalized values, and data quality identifier fields, providing structured input for subsequent processing.

[0068] Step S102's localized cleaning process employs a layered processing strategy: outlier detection and replacement based on interquartile range are performed on continuous data such as voltage and current; redundant node removal and adjacency matrix reconstruction are implemented on distribution network topology status data; and moving average smoothing is applied to the charging and discharging efficiency data of energy storage systems. The standardization module uniformly transforms data of different dimensions into the [-1,1] interval, where time-series data is aligned to the sampling frequency using a dynamic time warping algorithm, and unstructured data is converted into a graph structure representation. Edge nodes push standardized intermediate data to the cloud message queue via the MQTT protocol, attaching data traceability tags to support full-process auditing and traceability.

[0069] Step S103's cross-domain data fusion employs a hierarchical federated learning framework, integrating real-time monitoring data from the SCADA system and user load curves from smart meters while protecting data privacy. The graph embedding module utilizes the GraphSAGE algorithm for unsupervised learning of the distribution network topology, extracting low-dimensional vectors representing the correlation between node electrical characteristics and regional power supply. A spatiotemporal attention mechanism calculates the dynamic correlation matrix between the energy storage system's charging and discharging power sequence and the regional load curve, identifying potential overload risk propagation paths. The knowledge graph construction module integrates topological feature vectors, the spatiotemporal correlation matrix, and device metadata to generate a power operation knowledge graph containing entity relationship weights and event causal chains, providing multi-dimensional associative input for feature engineering.

[0070] Step S104's dynamic feature engineering implements a three-level processing flow: Multi-resolution analysis of non-stationary time-series data is performed using wavelet packet transform to extract energy entropy in each frequency band as harmonic distortion features; a conditional generative adversarial network is used to augment the feature space of historical anomaly samples, balancing the distribution of positive and negative samples; an improved Isolation Forest model introduces information gain to optimize feature splitting criteria, enhancing the detection sensitivity of hidden fault modes. The pre-screening module dynamically divides risk level thresholds based on anomaly scores, storing events exceeding the adaptive threshold in a priority queue to trigger incremental training of the graded early warning model.

[0071] The hierarchical early warning model in step S105 adopts a dual-channel collaborative architecture: the short-term risk prediction channel deploys a spatiotemporal fusion Transformer model, which captures the spatiotemporal dependencies of voltage and current sequences through a multi-head self-attention mechanism and uses an interpretability module to calculate feature contribution weights to locate the root cause of anomalies; the medium- and long-term risk prediction channel combines a deep deterministic policy gradient algorithm with near-end policy optimization to construct a multi-objective optimization strategy constrained by load balancing and energy storage lifetime loss. The transfer learning module uses model parameters pre-trained on other regional power grids as an initialization benchmark, and aligns feature distribution differences through a domain adaptive algorithm to accelerate policy convergence efficiency in new scenarios.

[0072] Step S106's dynamic risk assessment introduces a fuzzy Petri net model, mapping device-level failure probabilities and system-level risk indicators to a comprehensive risk level, and generating a multi-objective optimization strategy. The digital twin platform constructs a virtual mirror based on real-time topology status, simulating the impact of load transfer schemes on power supply reliability and outputting the optimal execution path. Blockchain smart contracts add timestamps and digital signatures to generated scheduling instructions, verifying instruction integrity through a decentralized node consensus mechanism, forming a tamper-proof audit trail to ensure the reliable execution of scheduling instructions.

[0073] The closed-loop optimization module in step S107 employs a two-tiered feedback mechanism: local feedback uses an elastic weight consolidation algorithm to calculate the Fisher information matrix of model parameters against historical tasks, constraining the weight update magnitude during incremental learning to prevent the model from forgetting historical knowledge; global feedback uses a meta-learning framework to analyze the statistical characteristics of prediction biases across multiple batches, dynamically adjusting feature selection weights and model hyperparameter configuration. The model distillation module transfers knowledge from complex early warning models to a lightweight TinyLSTM network, employing a temperature scaling strategy to soften the output probability distribution, adapting to the low-latency inference requirements of edge devices. The optimized model parameters are then phased through a canary release strategy to replace older versions, maintaining the high availability and stability of the early warning system.

[0074] Specifically, in the audit data early warning method of the present invention, step S103 includes:

[0075] The vulnerability features of nodes in the topology of the power distribution network are extracted by graph embedding algorithm, and the nonlinear correlation between charging and discharging efficiency and load fluctuation is captured based on spatiotemporal attention mechanism.

[0076] By aligning the structured data from the SCADA system with the unstructured data from smart meters through federated learning using differential privacy technology and the Paillier homomorphic encryption algorithm, a cross-domain knowledge graph of power operation containing equipment status, load distribution, and topological relationships is generated.

[0077] The hidden features and dynamically associated features are input to the dynamic feature engineering module, forming a data closed loop for anomaly pattern pre-screening with the output of the anomaly detection model.

[0078] In the cross-domain data fusion process, the graph embedding algorithm adopts the GraphSAGE unsupervised learning framework to hierarchically aggregate the adjacency matrix and node attribute data of the distribution network topology, extracting low-dimensional vectors representing the electrical load rate, power supply radius, and connectivity of nodes, and quantitatively evaluating the vulnerability indicators of each node. The spatiotemporal attention mechanism calculates the dynamic correlation coefficient matrix between the energy storage system's charging and discharging efficiency sequence and the regional load fluctuation curve through a multi-head self-attention layer, identifies the response delay characteristics of charging and discharging behavior to load mutations, and constructs a charging and discharging-load correlation weight graph. The federated learning framework introduces differential privacy technology to encrypt and align the structured monitoring data of the SCADA system with the unstructured load curves of smart meters. Homomorphic encryption algorithms are used to achieve cross-domain gradient sharing, generating a power operation knowledge graph containing equipment status, load distribution, and topological relationships. The entity relationship edge weights are jointly calculated by the node vulnerability vector and the spatiotemporal correlation matrix.

[0079] The knowledge graph construction module performs tensor fusion between the node vulnerability feature vectors output by the graph embedding algorithm and the dynamic association matrix generated by the spatiotemporal attention mechanism. Iterative updates of entity relationship weights are then achieved through a graph convolutional network, forming multi-dimensional association features encompassing the health status of power supply equipment, regional load association patterns, and energy storage response characteristics. The fused feature data is standardized to generate a unified-dimensional association feature vector, which is then input into the dynamic feature engineering module for anomaly pattern analysis. Simultaneously, high-risk events output by the anomaly detection model are fed back to the knowledge graph update module, triggering dynamic adjustments to entity relationship weights, thus forming a closed-loop optimization chain for cross-domain data fusion and anomaly detection.

[0080] Specifically, in the audit data early warning method of the present invention, step S104 includes: extracting harmonic distortion features from non-stationary time series data using wavelet transform, and performing data augmentation on abnormal samples using adversarial generative network;

[0081] The enhanced feature input is used to perform fast anomaly detection using the improved Isolation Forest algorithm with information gain optimization feature splitting criterion, and the high-risk events are stored in the event pool.

[0082] The event pool serves as an input flow-oriented hierarchical early warning model, which, together with the spatiotemporal feature modeling of the spatiotemporal fusion Transformer, forms a collaborative analysis for device-level and system-level risk assessment.

[0083] In dynamic feature engineering, the wavelet transform module employs a discrete wavelet packet decomposition algorithm to perform multi-scale decomposition of non-stationary time-series data such as voltage and current. Daubechies wavelet basis functions are selected to reconstruct high-frequency sub-bands, and the energy entropy of each sub-band is calculated as a quantification index of harmonic distortion features. The generator of the adversarial generative network uses a multilayer perceptron structure, inputting feature vectors of historical anomalous events and device type labels to generate synthetic anomalous samples with diverse distributions. The discriminator introduces a conditional convolutional layer, combining device operating status labels to verify the rationality of the generated samples. Adversarial training optimizes the alignment of the feature distribution of the generated samples with that of real anomalous samples. The data-augmented feature set is input into an improved IsolationForest model, employing an information gain optimization feature splitting criterion to select the feature dimension with the highest discriminative power for spatial partitioning, thereby improving the detection sensitivity for low-probability anomalous events.

[0084] The anomaly detection model calculates anomaly scores based on the path length of samples in the isolation tree, and dynamically adjusts the threshold range using a sliding window statistical method, marking events with scores higher than the adaptive threshold as high-risk events. The event pool employs a priority queue structure, storing events hierarchically according to risk level and time urgency. High-priority events trigger real-time alarms and are pushed to the hierarchical early warning model. The spatiotemporal fusion Transformer model receives high-risk event features from the event pool, captures the spatiotemporal correlation patterns of voltage and current sequences through a multi-head self-attention mechanism, and generates equipment-level fault probability prediction results. Simultaneously, the reinforcement learning module dynamically adjusts the power distribution network load allocation strategy based on system-level risk features in the event pool, optimizes the charging and discharging scheduling instructions of the energy storage system, and forms a collaborative analysis link between equipment anomaly localization and system strategy adjustment.

[0085] The data flow in the event pool and the model collaboration mechanism form a closed-loop feedback: the fault location information output by the spatiotemporal fusion Transformer is used to inversely correct the feature extraction frequency band selection strategy of the wavelet transform; the policy optimization results of the reinforcement learning module synchronously update the device state condition input of the generative adversarial network, driving the data augmentation module to focus on the generation of abnormal features of the current system's weak links. The dynamic feature engineering module and the hierarchical early warning model achieve bidirectional interaction between data and policy through the event pool, enhancing the joint perception capability of multi-dimensional operational risks of the power system.

[0086] Specifically, in the audit data early warning method of the present invention, step S105 includes:

[0087] An interpretability module is introduced into the primary model to locate the contribution of abnormal features through SHAP values, thereby assisting in the generation of device-level alarm commands.

[0088] A transfer learning module is embedded in the secondary model, and the strategy network is pre-trained using historical power grid data to accelerate the convergence of load allocation strategies in new scenarios.

[0089] The output of the primary model and the strategy optimization results of the secondary model are input into the risk assessment module to achieve the linkage between short-term fault response and medium- and long-term risk prevention and control.

[0090] In the construction of the hierarchical early warning model, the interpretability module of the first-level model adopts the SHAP value approximation method based on kernel functions to perform feature attribution analysis on the equipment-level fault probabilities output by the spatiotemporal fusion Transformer. By calculating the marginal contribution of each voltage and current time-series feature to the anomaly score, a feature importance ranking list is generated, and a visual diagnostic report is generated in combination with the distribution network topology. The alarm command generation module dynamically filters key anomaly indicators based on feature contribution thresholds, matches them with a preset equipment fault knowledge base, generates structured alarm commands containing location information and maintenance suggestions, and pushes them to the operation and maintenance terminal.

[0091] The transfer learning module of the secondary model adopts a pre-training-fine-tuning architecture: a deep reinforcement learning policy network is trained on historical power grid data to learn the global optimization pattern of load allocation and energy storage scheduling; the feature distribution differences between the old and new scenarios are aligned through a domain adaptation algorithm, and the hidden layer parameters of the policy network are adjusted using the maximum mean difference metric. In the fine-tuning stage, a course learning strategy is introduced to gradually increase the training weights of the new scenario data, accelerating the convergence speed of the policy network in the target region. The optimized load allocation strategy outputs a dynamic scheduling instruction set, including distribution line load threshold adjustment parameters and energy storage system charging and discharging power suggestions.

[0092] The device-level alarm commands from the first-level model and the system-level scheduling commands from the second-level model are jointly input into the risk assessment module, which uses a fuzzy Petri net to construct a multi-level risk inference engine. Device failure probabilities serve as input to the storage nodes, and system strategy optimization results serve as transition trigger conditions. A comprehensive risk level index is calculated using a fuzzy rule base. The risk linkage module triggers tiered responses based on index thresholds: low-risk events trigger device status tracking and monitoring; medium- and high-risk events simultaneously initiate load transfer scheme simulations and energy storage system pre-adjustments. After verifying the feasibility of the strategy through a digital twin platform, execution commands are generated. The collaborative output of the two models is encapsulated into commands via blockchain smart contracts, with timestamps and device signatures added to form an audit trail chain, achieving a data closed loop for short-term fault handling and medium- to long-term strategy optimization.

[0093] Specifically, in the audit data early warning method of the present invention, step S106 includes:

[0094] The sliding window statistical method is used to adjust the early warning threshold according to the real-time load status, and the execution effect of the energy storage scheduling strategy is simulated by combining the digital twin platform;

[0095] A multi-objective optimization algorithm is used to balance power supply reliability and economy, generate a load transfer scheme, and push it to the operation and maintenance terminal.

[0096] The simulation results and optimization strategies serve as input to the early warning execution module, forming a tamper-proof instruction transmission link with the blockchain traceability mechanism.

[0097] During dynamic risk assessment, the sliding window statistics module calculates the regional load mean and variance in real time based on a preset time window length, and dynamically adjusts the equipment-level early warning threshold range in conjunction with the power supply network topology. The window length is adaptively adjusted based on the load fluctuation cycle; a short window is used to capture rapid changes during peak hours, while a long window is used to smooth noise during off-peak hours. The digital twin platform constructs a virtual mirror of the power supply network, injects real-time topology data and energy storage system status parameters, and simulates the impact of different charging and discharging strategies on node voltage stability and line losses through a discrete event simulation engine. It outputs the load balance change curve and equipment lifespan degradation prediction values ​​after strategy execution.

[0098] The multi-objective optimization module uses the NSGA-III algorithm to solve for the Pareto front of power supply reliability, economy, and energy storage lifetime loss, generating the optimal solution set for load transfer schemes. The optimization model takes the simulation results from the digital twin as input constraints, generates candidate strategies through crossover and mutation operations using a genetic algorithm, calculates the weights of each objective using the entropy weight method, and selects the scheme with the highest comprehensive score. The generated load transfer instructions include the target line switching sequence and energy storage output adjustment parameters, and are pushed to the instruction execution queue of the operation and maintenance terminal after format standardization.

[0099] The blockchain traceability mechanism calculates hash digests of simulation results and optimization strategies, generates unique data fingerprints, and writes them to the distributed ledger. The instruction transmission link uses an asymmetric encryption algorithm to sign the load transfer scheme, and verifies the identity, permissions, and data integrity of the execution nodes through smart contracts. The early warning execution module monitors the instruction execution status in real time after the strategy is issued, feeding back the actual load transfer effect to the digital twin platform for verification, forming a closed-loop verification link of simulation-execution-feedback. Dynamically adjusted early warning thresholds and optimization strategies are traced back to their original versions using blockchain timestamp sequences, supporting full lifecycle auditing and backtracking.

[0100] Specifically, in the audit data early warning method of the present invention, step S107 includes:

[0101] The elastic weight consolidation algorithm constrains the model weight updates during incremental learning to prevent the forgetting of historical knowledge;

[0102] Model distillation technology is used to transfer knowledge from complex hybrid models to lightweight networks, adapting to the real-time inference needs of edge devices;

[0103] The model weight update and knowledge transfer results are fed back into the feature engineering module to drive the iterative optimization of dynamic feature generation and anomaly detection.

[0104] In the closed-loop optimization process, the elastic weight consolidation algorithm calculates the Fisher information matrix of model parameters from historical training tasks, identifies weight parameters with high importance to learned knowledge, and introduces regularization constraints during incremental learning to limit the update magnitude of key weights. The incremental learning module dynamically adjusts the constraint strength based on newly arrived power system operation data, employing an adaptive learning rate strategy to balance the learning weights of new and old knowledge, maintaining the model's ability to remember historical anomaly patterns.

[0105] Model distillation employs a temperature scaling strategy to smooth the output probability distribution of complex hybrid models, generating soft target labels rich in decision-making logic. A lightweight network fits the joint distribution of soft targets and true labels using a multilayer perceptron structure, and optimizes network parameters using a knowledge distillation loss function to reduce model complexity. The distilled lightweight network is deployed on edge computing nodes to parse sensor data streams in real time and output preliminary anomaly detection results, reducing communication latency for cloud-based model inference.

[0106] The feature engineering module receives updated model parameters from the elastic weight consolidation algorithm and anomaly detection results from the distillation network, dynamically adjusting the wavelet transform frequency band selection strategy and the sample generation weights of the generative adversarial network. The feature selection module ranks the weights according to their importance as fed back by the model, optimizing the combination of multi-dimensional features to improve anomaly pattern recognition accuracy. The updated feature generation strategy is then re-input into the incremental learning module for model fine-tuning, forming a two-way collaborative mechanism between feature optimization and model updating, enhancing the early warning system's adaptability to the dynamic operating environment of the power system.

[0107] Specifically, the audit data early warning method of the present invention, wherein the step of aligning the structured data of the SCADA system with the unstructured data of smart meters through federated learning to generate a cross-domain related power operation knowledge graph includes:

[0108] Differential privacy technology is used to protect the data security of each power subsystem during the data fusion process, and the gradient is encrypted and transmitted through the Paillier homomorphic encryption algorithm to achieve cross-domain feature sharing.

[0109] The topological relationship features of the knowledge graph and the data aligned with federated learning are jointly input into the spatiotemporal attention mechanism to enhance the robustness of the correlation analysis between charging and discharging behavior and load fluctuation.

[0110] In the implementation of the federated learning framework, each power subsystem, as a participant, locally trains its feature extraction model. A Laplace mechanism is used to add random noise satisfying differential privacy conditions to the model gradients, protecting the privacy of the original data. The central aggregation server uses a secure multi-party computation protocol to perform a weighted average of the encrypted gradients from each participant, generating global model update parameters. The gradient transmission process employs the Paillier homomorphic encryption algorithm, allowing the encrypted gradients uploaded by participants to be directly used for mathematical operations during the aggregation phase, avoiding the risk of data leakage during decryption.

[0111] The knowledge graph construction module receives cross-domain data aligned by federated learning and aggregates neighborhood features of distribution network topology nodes through a graph attention network to generate a topological relationship vector representing the strength of regional power supply correlation. A spatiotemporal attention mechanism concatenates the topological relationship vector with the charging and discharging efficiency features extracted by federated learning using tensors. A multi-head self-attention layer is then used to calculate the dynamic correlation matrix between the charging and discharging power sequence and the load fluctuation curve at different time scales. After Softmax normalization, the attention weight matrix generates a spatiotemporal correlation graph, revealing the causal link between energy storage response delay and load abrupt events, thus improving the robustness of abnormal correlation pattern mining.

[0112] The synergy between the federated learning framework and the knowledge graph creates a bidirectional data flow: the global model parameter updates of federated learning drive the dynamic optimization of the topological relation vectors of the knowledge graph; the spatiotemporal correlation features output by the knowledge graph in turn guide the design of the local training objective function of the federated learning participants, enhancing the feature extraction module's ability to focus on key correlation patterns. The fusion of encrypted gradients and topological features is achieved through an edge-cloud collaborative architecture. Edge nodes perform local model inference and privacy protection processing, while the cloud center completes cross-domain feature fusion and correlation analysis, constructing a secure and reliable distributed audit and early warning architecture.

[0113] Specifically, the audit data early warning method of the present invention includes a generator and a discriminator for data augmentation of abnormal samples through an adversarial generative network. The generator is used to inject adversarial perturbations that simulate sensor noise into the input data, and the discriminator focuses on the classification training of high-risk samples through the Focal Loss function.

[0114] Adversarial perturbations simulating sensor noise are injected into the input data, and classification training is performed by focusing on high-risk samples using the Focal Loss function;

[0115] The feature vectors trained in the adversarial manner, together with the output of the lightweight anomaly detection model, form a high-precision pre-screening result, reducing the false alarm rate of the hierarchical early warning model.

[0116] In the implementation of the Generative Adversarial Network (GAN), the generator module employs a conditional generative adversarial architecture, taking device type labels and normal state feature vectors as input to generate synthetic data injected with simulated sensor noise. Adversarial perturbations are modeled based on historical sensor error distributions, generating spatiotemporally correlated noise sequences through a Gaussian mixture model, which are then superimposed on the original voltage and current signals to simulate signal distortion in a real acquisition environment. The discriminator module uses a deep convolutional network structure, combined with spectral normalization techniques to stabilize the training process, and distinguishes the distribution differences between real and synthetic data through multi-layer feature extraction.

[0117] The Focal Loss function introduces a dynamic adjustment mechanism during classifier training, dynamically calculating weight factors based on the prediction confidence of outlier samples to increase the loss contribution ratio of high-risk samples. The classifier employs a dual-tower network structure, processing feature vectors generated during adversarial training and the original feature vectors separately, aligning the feature space distribution through comparative learning. A hard sample mining strategy is used during training, iteratively resampling high-risk misclassified samples to improve the discriminative power of the classification boundary.

[0118] The lightweight anomaly detection model employs knowledge distillation, transferring the decision logic of the adversarially trained deep classifier to a lightweight TinyLSTM network. During distillation, the classification probability distribution is softened by adjusting the temperature parameter, and the KL divergence loss function is used to align the output distribution features of the teacher-student model. The anomaly probability score output by the lightweight model is weighted and fused with the adversarial training feature vector to generate a comprehensive anomaly index. Before being input into the hierarchical early warning model, a sliding window mean filter is used to eliminate instantaneous false alarms.

[0119] The collaborative training of the adversarial generative network and the lightweight model forms a dynamic optimization closed loop: the false positive detection results of the lightweight model are fed back to the generator module, triggering iterative optimization of the adversarial noise pattern; the distribution features of high-risk samples output by the classifier synchronously update the weight adjustment strategy of the Focal Loss, enhancing its adaptability to novel anomaly patterns. The feature fusion module associates and stores the optimized comprehensive anomaly index with the equipment operating status label, constructing a dynamically updated anomaly pattern knowledge base to support the early warning model's continuous identification of new and old fault types.

[0120] Specifically, the audit data early warning method of the present invention, wherein embedding a transfer learning module in the secondary model and using historical power grid data to pre-train a strategy network to accelerate the convergence of load allocation strategies in new scenarios includes:

[0121] The parameters of the reinforcement learning network are initialized using a pre-trained load allocation strategy for the distribution network, and the energy storage scheduling action is dynamically adjusted through a near-end policy optimization algorithm.

[0122] The synergistic output of transfer learning and reinforcement learning drives the policy simulation of the digital twin platform, forming a closed-loop verification link from model training to actual execution.

[0123] In the implementation of the transfer learning module, the pre-training phase uses historical power distribution network load distribution data and equipment operation logs to train a deep neural network, learning load balancing distribution patterns under different topologies. The reinforcement learning network's policy network parameters are initialized with the pre-trained model weights. A domain adaptation algorithm aligns the differences in node voltage and line impedance characteristics between the old and new scenarios, and the maximum mean difference loss function is used to adjust the hidden layer feature mapping relationship. The near-end policy optimization algorithm introduces trust domain constraints during action selection, limiting the policy update step size to maintain training stability. It utilizes a generalized dominance function to evaluate the long-term benefits of energy storage charging and discharging actions, dynamically adjusting the charging and discharging power threshold and response priority.

[0124] A digital twin platform constructs a virtual mirror of the power distribution network, imports real-time topology data and energy storage system state-of-charge parameters, and simulates node voltage fluctuations and line loss changes under different scheduling strategies using a discrete event simulation engine. The simulation results are compared with the scheduling instructions output by reinforcement learning for feasibility analysis, and candidate strategy sets that meet power supply reliability constraints are selected. The course learning module dynamically adjusts the distribution of training data based on the difficulty of strategy execution, prioritizing the learning of historical scenario data with high matching degree to the current system state, thus accelerating the convergence speed of the strategy network in the target area.

[0125] The synergistic effect of transfer learning and reinforcement learning is achieved through a closed-loop verification chain: the load allocation knowledge of the pre-trained model drives the initial policy generation of the digital twin platform; the optimized policy after simulation verification iteratively updates the network parameters through a proximal policy optimization algorithm; the updated policy network output synchronously corrects the domain adaptation module parameters of the pre-trained model. Blockchain smart contracts add device digital signatures and timestamps to verified scheduling instructions, generating tamper-proof audit trail records, forming a trusted control chain from virtual simulation to physical execution.

[0126] Secondly, the audit data early warning system provided by this invention is applied to the audit data early warning method, including:

[0127] A distributed sensor network configured to collect real-time data on node voltages and currents of the power supply network and the charging and discharging efficiency of the energy storage system;

[0128] Edge computing nodes, connected to the sensor network, are configured to perform local cleaning and standardization processing on raw data to generate standardized intermediate data;

[0129] A multi-source data fusion module, connected to the edge computing node, is configured to extract cross-domain association features through federated learning and knowledge graph technology;

[0130] The dynamic feature engineering module, connected to the multi-source data fusion module, is configured to generate multi-dimensional operating status features and perform abnormal mode pre-screening.

[0131] The hierarchical early warning model construction module is connected to the dynamic feature engineering module and configured to train a spatiotemporal fusion Transformer and a hybrid reinforcement learning framework.

[0132] The risk assessment and decision-making module is connected to the hierarchical early warning model construction module and is configured to generate dynamic risk levels and energy storage scheduling strategies.

[0133] The closed-loop optimization module, connected to the risk assessment and decision-making module, is configured to achieve adaptive updating of the early warning model through meta-learning and model distillation techniques;

[0134] In this system, the data flow of the sensor network is directed to the edge computing nodes, the standardized intermediate data is processed by the multi-source fusion module and then input into the dynamic feature engineering module, the output of the hierarchical early warning model drives the risk assessment decision, and the decision result is fed back to the closed-loop optimization module.

[0135] The distributed sensor network is deployed at monitoring points of distribution transformers, line sectionalizing switches, and battery clusters in the power supply network, including Hall current sensors, voltage transformers, and wireless temperature sensors. Sensor nodes use a low-power wide-area network (LPWAN) protocol for data transmission and perform sliding window filtering on high-sampling-rate current signals to eliminate high-frequency electromagnetic interference noise. Edge computing nodes incorporate an outlier detection algorithm, establishing a voltage fluctuation confidence interval based on historical data distribution and performing linear interpolation compensation on raw data exceeding the threshold. A data encapsulation module converts multi-source heterogeneous data into a standardized JSON format, adds device geographic tags and time synchronization identifiers, and transmits it to the edge node message queue via the MQTT protocol.

[0136] The localized cleaning module for edge computing nodes uses a moving average algorithm to smooth load fluctuation data and performs Gaussian-based missing value imputation on the charging and discharging efficiency data of the energy storage system. The standardization module performs dynamic range compression on voltage and current time-series data, mapping values ​​to the [-1,1] interval; and converts unstructured topology data into adjacency matrices and node attribute tables. The time-series alignment module uses a dynamic time warping algorithm to unify the sampling frequency of multi-source data, generating an intermediate dataset with a unified time index. The data version management module adds timestamps and hash checksums to the intermediate data, supporting incremental updates and version rollback.

[0137] The federated learning framework of the multi-source data fusion module adopts a hierarchical architecture, establishing an encrypted communication channel between the SCADA system and the smart meter data source, and achieving cross-domain gradient aggregation through homomorphic encryption technology. The knowledge graph construction module applies the GraphSAGE algorithm to perform unsupervised learning of the distribution network topology, generating low-dimensional vectors representing the power supply capacity of nodes and their regional correlation. A spatiotemporal attention mechanism calculates the dynamic correlation matrix between the energy storage system's charging and discharging power sequence and the regional load curve, identifying the hysteresis effect of load mutations on the energy storage response. The fused cross-domain feature vectors are appended with device status labels and input into the dynamic feature engineering module for anomaly pattern mining.

[0138] The wavelet transform unit of the dynamic feature engineering module uses the DB4 wavelet basis to perform multi-scale decomposition of voltage harmonic data, extracting the energy entropy of each sub-band as harmonic distortion features. The generator module of the adversarial generative network generates adversarial samples based on device type labels, and the discriminator uses a spectral normalized convolutional network to verify the rationality of the samples. The improved IsolationForest model introduces a feature importance weighting mechanism and optimizes the tree structure splitting criterion, enhancing the detection sensitivity for hidden faults. Pre-screening results are stored in a priority event pool, triggering the real-time training task of the hierarchical early warning model.

[0139] The spatiotemporal fusion Transformer in the hierarchical early warning model construction module employs a multi-head self-attention layer to capture the spatiotemporal dependencies of voltage sequences, outputting device-level fault heatmaps. A reinforcement learning framework, combined with a near-end policy optimization algorithm, generates scheduling policies under constraints of load balancing and energy storage lifetime loss. The transfer learning module uses model parameters pre-trained on historical power grids as an initialization benchmark, aligning the feature distributions of new and old scenarios through domain adversarial training, thus shortening the policy convergence cycle.

[0140] The fuzzy inference engine in the risk assessment and decision-making module maps equipment failure probabilities and system policy scores to a comprehensive risk index, triggering a tiered response mechanism. The digital twin platform constructs a virtual mirror of the power supply network, injects real-time topology parameters to simulate the impact of load transfer strategies on line losses, and outputs the optimal execution path. Blockchain smart contracts perform hash digest calculations and multi-signatures on scheduling instructions, generating a tamper-proof audit trail chain.

[0141] The closed-loop optimization module's meta-learning framework analyzes multi-batch prediction bias characteristics and dynamically adjusts feature selection weights and model hyperparameter configurations. The elastic weight consolidation algorithm calculates the Fisher information matrix of model parameters against historical tasks, constraining the magnitude of weight updates during incremental learning. The model distillation module employs a temperature scaling strategy to transfer knowledge from the spatiotemporal fusion Transformer to a lightweight TinyLSTM network, adapting to the real-time inference requirements of edge nodes. The optimized model parameters are deployed in stages through a canary release mechanism to maintain system service continuity.

[0142] The data flow between modules forms a closed-loop control link: raw data collected by the sensor network is processed by edge nodes and then flows to the multi-source fusion module; cross-domain features extracted by federated learning drive dynamic feature engineering and anomaly detection; the output of the hierarchical early warning model guides risk assessment decisions; execution instructions encapsulated in blockchain are fed back to the digital twin platform for effect verification; and the closed-loop optimization module iteratively updates model parameters and feature generation strategies based on the verification results. The collaboration between federated learning and knowledge graphs achieves feature fusion under privacy protection, the linkage between adversarial training and model distillation balances detection accuracy and inference efficiency, and the combination of transfer learning and reinforcement learning accelerates the strategy optimization process. The overall architecture meets the technical requirements of intelligent monitoring and energy storage scheduling in power systems.

[0143] The specific implementation of this invention in the technical field of power supply or distribution circuit devices and energy storage systems is as follows: The distributed sensor network is deployed at transformers, sectionalizing switch nodes, and battery cluster monitoring points of the energy storage system in the power distribution network. It includes Hall current sensors, voltage transformers, and temperature sensors. The sensor nodes transmit data via a low-power wide-area network protocol, with a sampling frequency set to 1kHz. A sliding window filtering algorithm is used to eliminate high-frequency noise in the voltage and current signals, and the window length is adaptively adjusted according to the load fluctuation cycle. The edge computing nodes have a built-in interquartile range outlier detection module. This module performs linear interpolation compensation and standardization on the raw data, generating an intermediate data stream in JSON format, attaching a timestamp and device geographic tag, and pushing it to the cloud message queue via the MQTT protocol.

[0144] The multi-source data fusion module employs a hierarchical federated learning framework, establishing an encrypted communication channel between the SCADA system and the smart meter data source. Cross-domain gradient sharing is achieved through the Paillier homomorphic encryption algorithm, and a graph embedding algorithm is used to extract vulnerability feature vectors of distribution network topology nodes, with a dimension set to 128. The knowledge graph construction module applies the GraphSAGE algorithm to aggregate neighborhood node attributes, generating a topological relationship matrix representing the strength of regional power supply associations. This matrix is ​​then fused with the charging / discharging-load dynamic association matrix calculated using a spatiotemporal attention mechanism to construct a power operation knowledge graph.

[0145] In the dynamic feature engineering module, the wavelet transform unit uses the DB4 wavelet basis to perform a 5-level decomposition of the voltage harmonic data, extracting the energy entropy of each sub-band as harmonic distortion features. The generator of the adversarial generative network generates adversarial examples that inject simulated sensor noise based on device type labels, and the discriminator uses a spectral normalized convolutional network to verify the rationality of the examples. The improved Isolation Forest model introduces an information gain optimization feature splitting criterion, sets the number of trees to 100, and filters events with anomaly scores higher than a dynamic threshold to store them in a priority event pool.

[0146] In the hierarchical early warning model construction module, the spatiotemporal fusion Transformer architecture employs a 4-head self-attention layer, with an input sequence length of 60 time steps, and outputs a device-level fault heatmap. The hybrid reinforcement learning framework uses a load balancing threshold of ±5% and an energy storage lifetime decay rate of ≤0.1% / cycle as constraints, generating charging and discharging scheduling strategies through a near-end policy optimization algorithm. The transfer learning module pre-trains the strategy network parameters using historical power grid data, employs domain adversarial training to align feature distribution differences, and sets the learning rate to 1e-4 during the fine-tuning phase.

[0147] In the risk assessment and decision-making module, the fuzzy Petri net model maps the probability of equipment failure to a comprehensive risk index in the [0,1] interval. Combined with the digital twin platform, it simulates the impact of load transfer strategies on line losses, with a simulation step size set to 1 second, and outputs the optimal execution path. The blockchain smart contract performs SHA-256 hash calculations on scheduling instructions, employs a multi-signature mechanism to verify instruction integrity, and generates a tamper-proof audit trail chain.

[0148] The closed-loop optimization module calculates the Fisher information matrix of the model parameters using the elastic weight consolidation algorithm, constraining the weight update magnitude during incremental learning, with a regularization coefficient set to 0.5. The model distillation module smooths the output distribution of the spatiotemporal fusion Transformer using a temperature parameter T=2, transferring knowledge to a lightweight TinyLSTM network with the number of layers compressed to 3, adapting to the real-time inference requirements of edge computing nodes. Data flow between modules is asynchronously transmitted via a Kafka message queue, ensuring the system's high concurrency processing capabilities.

[0149] The technical features of this invention are explained below:

[0150] Distributed sensor networks:

[0151] A collection of sensors, including voltage transformers, Hall effect current sensors, and temperature sensors, is deployed at key nodes of the power supply network (such as distribution transformers and line sectionalizing switches) and monitoring points of energy storage systems. Voltage, current, load fluctuation data, and parameters such as the charging and discharging efficiency and capacity decay rate of the energy storage system are collected in real time using low-power wide-area network protocols (such as LoRaWAN) to generate raw data streams.

[0152] Function: To provide a high-precision, real-time data source for subsequent analysis, covering multi-dimensional information on the physical layer and operating status of the power system.

[0153] Edge computing nodes:

[0154] The local computing unit deployed at the data acquisition end is responsible for the preliminary processing of the raw data, including data cleaning (such as sliding window filtering to eliminate noise), outlier detection (based on interquartile range algorithm), missing value compensation (linear interpolation or Kalman filtering), and standardization (normalizing the data to the [-1,1] interval).

[0155] Purpose: To reduce cloud transmission pressure, improve data quality, and provide structured input (such as standardized intermediate data in JSON format) for subsequent analysis.

[0156] Federated learning framework: a distributed machine learning technique that allows multiple participants (such as SCADA systems and smart meters) to collaboratively train models without sharing raw data. In this invention, a hierarchical federated learning architecture is employed, using differential privacy technology (adding Laplace noise) and the Paillier homomorphic encryption algorithm (encrypting gradient transmission) to achieve cross-domain data alignment and feature sharing.

[0157] Function: While protecting the data privacy of each subsystem, it integrates the structured monitoring data of the SCADA system with the unstructured load curves of smart meters to extract cross-domain correlation features.

[0158] Knowledge graph technology: a graph-based data representation method used to construct a knowledge graph of power operation. It extracts vulnerability features (such as electrical load rate and power supply radius) of distribution network topology nodes through graph embedding algorithms (such as GraphSAGE), and utilizes a spatiotemporal attention mechanism to capture the dynamic correlation between charging / discharging efficiency and load fluctuations.

[0159] Function: To form a multi-dimensional semantic network that includes equipment status, load correlation patterns and energy storage response characteristics, thereby enhancing the ability to perform correlation analysis on cross-modal data.

[0160] Self-supervised learning: a machine learning method that does not require manual labeling and generates supervisory signals through the inherent structure of the data. In this invention, it is used for dynamic feature engineering, such as extracting harmonic distortion features from non-stationary time-series data through wavelet transform, or generating anomalous samples through generative adversarial networks (GANs) to enhance data distribution.

[0161] Function: To improve the sensitivity of anomaly detection models in identifying hidden faults and to solve the problem of sample imbalance.

[0162] Spatiotemporal Fusion Transformer Architecture: A deep learning model that combines time series and spatial dependencies. It employs a multi-head self-attention mechanism to model the spatiotemporal correlation of voltage and current sequences (such as the impact of device-level voltage fluctuations on adjacent nodes) and utilizes interpretability modules (such as SHAP values) to locate the contribution of anomalous features.

[0163] Function: Accurately predict the probability of equipment-level failures (such as transformer overload risk) and generate a visual diagnostic report.

[0164] A hybrid reinforcement learning framework combines Deep Deterministic Policy Gradient (DDPG) and Proximal Policy Optimization (PPO) algorithms to optimize load allocation and energy storage scheduling strategies in power distribution networks, with load balancing and energy storage lifetime loss as constraints. The policy network is pre-trained using a transfer learning module to accelerate policy convergence in new scenarios.

[0165] Function: To achieve system-level risk prevention and control (such as avoiding line overload) and medium- and long-term economic optimization (such as extending energy storage life).

[0166] Model distillation technique: Transferring knowledge from complex models (such as the spatiotemporal fusion Transformer) to lightweight networks (such as TinyLSTM). A temperature scaling strategy is used to soften the output probability distribution, and the decision logic of the teacher-student model is aligned using the KL divergence loss function.

[0167] Function: To compress the model size, adapt to the low-latency inference requirements of edge devices, while maintaining detection accuracy.

[0168] Meta-learning framework: a mechanism for "learning how to learn" that dynamically adjusts feature weights and model hyperparameters by analyzing the statistical characteristics of prediction bias across multiple batches. It incorporates the Elastic Weight Consolidation (EWC) algorithm to prevent the forgetting of historical knowledge during incremental learning.

[0169] Function: To enable adaptive iteration of the early warning model and adapt to the dynamic operating environment of the power system.

[0170] Digital Twin Platform: Based on real-time topology data, a virtual mirror of the power supply network is constructed. A discrete event simulation engine is used to simulate the impact of different scheduling strategies (such as load transfer schemes) on line losses and voltage stability.

[0171] Function: To verify the feasibility of the strategy, output the optimal execution path, and combine blockchain technology to achieve tamper-proof instruction traceability.

[0172] Federated learning framework: Enables secure fusion of cross-domain data, integrating heterogeneous data from multiple sources while protecting the data privacy of various subsystems (such as SCADA systems and smart meters).

[0173] Implementation method: hierarchical federated architecture: each participant (power subsystem) trains the model locally, and the central server aggregates and encrypts the gradients to generate a global model.

[0174] Privacy protection technology:

[0175] Differential privacy: Adding Laplacian noise to the model gradient to prevent the leakage of raw data.

[0176] Paillier homomorphic encryption: Encrypts gradient transmission to ensure the security of cross-domain sharing processes.

[0177] Application: Aligning structured monitoring data from SCADA systems with unstructured load curves from smart meters to generate cross-domain correlation features, supporting subsequent knowledge graph construction.

[0178] Knowledge graph technology: Constructing a knowledge graph for power operation to represent equipment status, topological relationships, and dynamic behavioral associations.

[0179] Implementation method: Graph embedding algorithm (GraphSAGE): Unsupervised learning of the power distribution network topology to extract node vulnerability features (such as electrical load rate and power supply radius).

[0180] Spatiotemporal attention mechanism: Calculate the dynamic correlation matrix between the charge / discharge efficiency sequence and the load fluctuation curve to identify risk propagation paths.

[0181] Application: Generate a multi-dimensional semantic network containing device health status and regional load correlation patterns, providing a basis for anomaly detection and risk assessment.

[0182] Self-supervised learning: Automatically extracts features from unlabeled data to solve the problem of scarce abnormal samples.

[0183] Implementation method:

[0184] Wavelet transform: performs multi-resolution decomposition on non-stationary time series data (such as voltage harmonics) and extracts the energy entropy of each frequency band as harmonic distortion features.

[0185] Generative Adversarial Networks (GANs):

[0186] Generator: Simulates sensor noise to synthesize diverse anomalous samples.

[0187] Discriminator: High-risk samples are focused on for classification training using the Focal Loss function.

[0188] Application: Enhance the data distribution of anomaly detection models and improve the sensitivity of identifying hidden faults (such as partial discharge).

[0189] Spatiotemporal fusion Transformer architecture: Models the spatiotemporal dependencies of power supply network time-series data to accurately locate device-level faults.

[0190] Implementation method: Multi-head self-attention mechanism: capturing the spatiotemporal correlation of voltage and current sequences (such as the impact of overload on adjacent lines).

[0191] Interpretability module (SHAP value): Calculates the contribution of each feature to the anomaly score and generates a visual diagnostic report.

[0192] Applications: Output device-level fault heatmaps (such as the probability of transformer insulation aging) to help maintenance personnel quickly locate the root cause of anomalies.

[0193] Hybrid reinforcement learning framework: Optimize load allocation and energy storage scheduling strategies in power distribution networks to balance power supply reliability and economy.

[0194] Implementation method: Deep Deterministic Policy Gradient (DDPG): Generates a continuous action space policy with load balancing degree and energy storage lifetime loss as constraints.

[0195] Proximity Policy Optimization (PPO): Dynamically adjusts the charging and discharging power thresholds through trust domain constraints to ensure policy stability.

[0196] Transfer learning module: Pre-trains policy networks using historical power grid data to accelerate policy convergence in new scenarios.

[0197] Applications: Generating optimal load transfer schemes (such as switching to backup lines) and energy storage scheduling instructions (such as adjusting charging and discharging power) to avoid system-level risks (such as cascading failures).

[0198] Model distillation technique: compresses the size of complex models to adapt to edge computing resources.

[0199] Implementation method: Temperature Scaling: softens the output probability distribution of the spatiotemporal fusion Transformer to generate soft target labels.

[0200] KL divergence loss function: Aligning the decision logic of teacher-student models (complex models and lightweight TinyLSTM).

[0201] Application: Deploy device-level fault prediction models to edge nodes to achieve low-latency real-time inference (such as millisecond-level anomaly detection).

[0202] Meta-learning framework: dynamically optimizes model parameters and feature weights to adapt to the dynamic operating environment of power systems.

[0203] Implementation method:

[0204] Elastic Weight Consolidation (EWC): Calculates the Fisher information matrix of model parameters with respect to historical tasks, constrains the magnitude of weight updates in incremental learning, and prevents knowledge forgetting.

[0205] Deviation analysis module: statistically analyzes the prediction error characteristics of multiple batches and dynamically adjusts the feature selection weights (such as the priority of harmonic distortion features).

[0206] Applications: Enable adaptive iteration of early warning models (such as periodic updates) and improve the generalization ability to new fault modes (such as disturbances caused by grid connection of new energy sources).

[0207] Digital twin platform: Simulates the execution effect of strategies and verifies the feasibility of scheduling instructions.

[0208] Implementation method:

[0209] Discrete event simulation engine: Based on real-time topology data, a virtual image is built to simulate the impact of load transfer on line loss and voltage stability.

[0210] Blockchain traceability mechanism: Calculate the hash digest of simulation results and optimization strategies to generate a tamper-proof audit trail chain.

[0211] Applications: Output the optimal execution path (such as phased load switching) and implement trusted execution of instructions through smart contracts.

[0212] This invention achieves efficient data acquisition and preprocessing through distributed sensor networks and edge computing, fuses multi-source heterogeneous data using federated learning and knowledge graph technologies, improves anomaly detection accuracy by combining self-supervised learning and spatiotemporal fusion Transformer, optimizes system-level scheduling strategies through hybrid reinforcement learning, and achieves model lightweighting and adaptive iteration through model distillation and meta-learning. The synergistic effect of these technical features ultimately achieves a comprehensive improvement in the real-time performance of power system anomaly detection, the accuracy of risk assessment, and the economic efficiency of energy storage scheduling.

[0213] This invention effectively addresses the lag in anomaly detection caused by the reliance on static thresholds in traditional power systems through dynamic feature engineering and incremental learning mechanisms. It employs wavelet transform to extract harmonic distortion features from non-stationary time-series data, and combines this with generative adversarial networks to enhance the diversity of anomaly sample distribution, thereby optimizing the sensitivity of the lightweight anomaly detection model. Self-supervised learning dynamically adjusts feature weights, and a meta-learning framework is used to analyze prediction biases, forming a feature generation strategy that adapts to changes in the power system's operating state, thus improving the ability to identify hidden faults under complex operating conditions.

[0214] To address the challenges of insufficient utilization and privacy protection of multi-source data, the multi-source data fusion module integrates heterogeneous data from SCADA systems, smart meters, and energy storage BMS using a federated learning framework, and employs differential privacy and homomorphic encryption technologies to achieve cross-domain gradient sharing. Knowledge graph technology integrates the vulnerability features of topological nodes with a dynamic association matrix generated by a spatiotemporal attention mechanism to construct a multi-dimensional knowledge graph containing device health status, load association patterns, and energy storage response characteristics. This enhances the semantic association analysis capabilities of cross-modal data and solves the problem of the one-sidedness of traditional single-data source analysis.

[0215] To optimize system-level risk prevention and control effectiveness, the hierarchical early warning model employs a spatiotemporal fusion Transformer architecture to capture the spatiotemporal dependencies of voltage and current sequences, accurately locating the root causes of equipment-level anomalies. A reinforcement learning framework, combined with a transfer learning pre-training strategy, dynamically optimizes load allocation and energy storage scheduling actions in the power distribution network, simulating the strategy execution effect through a digital twin platform. The closed-loop optimization module uses an elastic weight consolidation algorithm to constrain parameter updates during incremental learning, and combines model distillation technology to compress the scale of complex models, adapting to edge computing resources. This enables efficient iteration of the early warning model and real-time inference at the edge, ultimately improving the anomaly response speed of the power supply network and the economic efficiency of energy storage scheduling.

Claims

1. An audit data early warning method, characterized in that, include: Step S101: Collect node voltage, current, and load fluctuation data of the power supply network, as well as charging and discharging efficiency and capacity decay rate data of the energy storage system, and generate raw data stream; Step S102: Input the raw data stream into the edge computing node for localized cleaning and standardized format conversion to generate standardized intermediate data; Step S103: Based on the federated learning framework and knowledge graph technology, cross-domain data fusion is performed on the standardized intermediate data to extract the hidden features of the power distribution network topology and the dynamic correlation features between charging and discharging behavior and load fluctuations, and to generate a correlation feature vector. Step S103 includes: extracting node vulnerability features in the distribution network topology using a graph embedding algorithm, and capturing the nonlinear correlation between charging / discharging efficiency and load fluctuations based on a spatiotemporal attention mechanism; aligning the structured data of the SCADA system and the unstructured data of smart meters through federated learning using differential privacy technology and Paillier homomorphic encryption algorithm to generate a cross-domain correlated power operation knowledge graph containing equipment status, load distribution, and topology; the hidden features and dynamic correlation features are used as inputs to the dynamic feature engineering module, forming a data closed loop for anomaly pattern pre-screening with the output of the anomaly detection model; Step S104: Use self-supervised learning to perform dynamic feature engineering on the associated feature vector to generate multi-dimensional power system operation status features, and use a lightweight anomaly detection model to pre-screen the high-dimensional features for anomaly patterns, and output a high-risk event pool. Step S105: Based on the high-risk event pool, a hierarchical early warning model is constructed. The spatiotemporal fusion Transformer architecture is used to perform spatiotemporal feature modeling on the power supply network time series data to predict the probability of equipment-level failures. The load allocation and energy storage scheduling strategies of the power distribution network are optimized through a hybrid reinforcement learning framework to predict system-level risks. Step S106: Based on the equipment-level failure probability and system-level risk prediction results, a dynamic risk assessment level is generated by combining fuzzy logic reasoning and evidence theory, and a real-time alarm is triggered or an energy storage scheduling suggestion and load transfer scheme are generated. Step S107: Collect system response data after the early warning strategy is executed, analyze the model prediction deviation through the meta-learning framework and dynamically adjust the feature weights and model structure to form a closed-loop optimization link; The original data stream is processed by the edge computing node and then flows to the data fusion module. The associated feature vector is input into the dynamic feature engineering module to generate pre-screening results. The high-risk event pool drives the training and decision-making of the hierarchical early warning model. The risk assessment results are fed back to the model optimization module.

2. The audit data early warning method according to claim 1, characterized in that, Step S104 includes: Wavelet transform is used to extract harmonic distortion features from non-stationary time series data, and an adversarial generative network is used to augment anomalous samples. The enhanced features are input into the improved Isolation Forest algorithm for fast anomaly detection, and the high-risk events are stored in the event pool. The event pool serves as an input flow-oriented hierarchical early warning model, which, together with the spatiotemporal feature modeling of the spatiotemporal fusion Transformer, forms a collaborative analysis for device-level and system-level risk assessment.

3. The audit data early warning method according to claim 2, characterized in that, Step S105 includes: An interpretability module is introduced into the primary model to locate the contribution of abnormal features through SHAP values, thereby assisting in the generation of device-level alarm commands. A transfer learning module is embedded in the secondary model, and the strategy network is pre-trained using historical power grid data to accelerate the convergence of load allocation strategies in new scenarios. The output of the primary model and the strategy optimization results of the secondary model are input into the risk assessment module to achieve the linkage between short-term fault response and medium- and long-term risk prevention and control.

4. The audit data early warning method according to claim 3, characterized in that, Step S106 includes: The sliding window statistical method is used to adjust the early warning threshold according to the real-time load status, and the execution effect of the energy storage scheduling strategy is simulated by combining the digital twin platform; A multi-objective optimization algorithm is used to balance power supply reliability and economy, generate a load transfer scheme, and push it to the operation and maintenance terminal. The simulation results and optimization strategies serve as input to the early warning execution module, forming a tamper-proof instruction transmission link with the blockchain traceability mechanism.

5. The audit data early warning method according to claim 4, characterized in that, Step S107 includes: The elastic weight consolidation algorithm constrains the model weight updates during incremental learning to prevent the forgetting of historical knowledge; Model distillation technology is used to transfer knowledge from complex hybrid models to lightweight networks, adapting to the real-time inference needs of edge devices; The model weight update and knowledge transfer results are fed back into the feature engineering module to drive the iterative optimization of dynamic feature generation and anomaly detection.

6. The audit data early warning method according to claim 5, characterized in that, The step of aligning structured data from the SCADA system with unstructured data from smart meters through federated learning to generate a cross-domain knowledge graph of power operation includes: Differential privacy technology is used to protect the data security of each power subsystem during the data fusion process, and cross-domain feature sharing is achieved through gradient encrypted transmission; The topological relationship features of the knowledge graph and the data aligned with federated learning are jointly input into the spatiotemporal attention mechanism to enhance the robustness of the correlation analysis between charging and discharging behavior and load fluctuation.

7. The audit data early warning method according to claim 6, characterized in that, The data augmentation of anomalous samples using an adversarial generative network includes a generator and a discriminator, wherein the generator is used to inject adversarial perturbations that simulate sensor noise into the input data, and the discriminator focuses on the classification training of high-risk samples through a Focal Loss function. Adversarial perturbations simulating sensor noise are injected into the input data, and classification training is performed by focusing on high-risk samples using the Focal Loss function; The feature vectors trained adversarially and the output of the lightweight anomaly detection model form a high-precision pre-screening result, reducing the false alarm rate of the hierarchical early warning model.

8. The audit data early warning method according to claim 7, characterized in that, The step of embedding a transfer learning module into the secondary model and using historical power grid data to pre-train the policy network to accelerate the convergence of load allocation strategies in new scenarios includes: The parameters of the reinforcement learning network are initialized using a pre-trained power distribution network load allocation strategy, and the energy storage scheduling action is dynamically adjusted through a near-end policy optimization algorithm. The synergistic output of transfer learning and reinforcement learning drives the policy simulation of the digital twin platform, forming a closed-loop verification link from model training to actual execution.

9. An audit data early warning system, applied to the audit data early warning method as described in any one of claims 1 to 8, characterized in that, include: A distributed sensor network configured to collect real-time data on node voltages and currents of the power supply network and the charging and discharging efficiency of the energy storage system; Edge computing nodes, connected to the sensor network, are configured to perform local cleaning and standardization processing on raw data to generate standardized intermediate data; A multi-source data fusion module, connected to the edge computing node, is configured to extract cross-domain association features through federated learning and knowledge graph technology; The dynamic feature engineering module, connected to the multi-source data fusion module, is configured to generate multi-dimensional operating status features and perform abnormal mode pre-screening. The hierarchical early warning model construction module is connected to the dynamic feature engineering module and configured to train a spatiotemporal fusion Transformer and a hybrid reinforcement learning framework. The risk assessment and decision-making module is connected to the hierarchical early warning model construction module and is configured to generate dynamic risk levels and energy storage scheduling strategies. The closed-loop optimization module, connected to the risk assessment and decision-making module, is configured to achieve adaptive updates of the early warning model through meta-learning and model distillation techniques. In this system, the data flow of the sensor network is directed to the edge computing nodes, the standardized intermediate data is processed by the multi-source fusion module and then input into the dynamic feature engineering module, the output of the hierarchical early warning model drives the risk assessment decision, and the decision result is fed back to the closed-loop optimization module.

Images