Power monitoring system early warning method and device based on data driving, electronic equipment and storage medium

Abstract

The invention discloses an electric power monitoring system early warning method and device based on data driving, electronic equipment and a storage medium, and belongs to the technical field of electric power monitoring system early warning, and the method comprises the steps: obtaining multi-source heterogeneous data of each sampling time period in a preset time period of an electric power monitoring system to be subjected to early warning, the multi-source heterogeneous data is time sequence data of each target device; the target equipment comprises a probe, a router, a firewall, a server and a sensor; and determining the number of fault factors in each sampling period according to a preset anomaly judgment rule. And inputting the multi-source heterogeneous data of each sampling time period into an early warning multi-modal model, and generating an abnormal probability value of each sampling time period. And according to the abnormal probability value and the fault factor number, determining an abnormal trend index in a preset time period. And according to the abnormal trend index, determining an abnormal level, and generating an early warning signal of the power monitoring system. According to the invention, the problem of inaccurate early warning of an electric power monitoring system in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of power monitoring system early warning, and particularly relates to a data-driven power monitoring system early warning method, device, electronic device and storage medium. Background Art

[0002] Power monitoring systems play a crucial role in the operation of modern power networks. As the scale of the power system continues to expand and the degree of intelligence continues to increase, power monitoring systems are responsible for tasks such as real-time monitoring of power equipment and network status, fault early warning, anomaly detection, and security protection. These functions not only help ensure the safe and stable operation of the power system but also enable the early discovery of potential faults and the timely adoption of countermeasures to avoid the spread of system failures and economic losses. Especially in complex situations such as high loads, equipment aging, and external attacks in the power system, rapid and accurate early warning can effectively improve the anti-interference ability and emergency response efficiency of the system.

[0003] However, current power monitoring systems still face certain challenges in terms of early warning capabilities. Most traditional power monitoring early warning methods rely on the monitoring of a single data source. This approach often has problems such as data lag and incomplete information in the face of complex and changing power environments, fails to fully exploit and utilize the rich information from different devices and sources, and is difficult to comprehensively reflect the true operating conditions of power equipment. Summary of the Invention

[0004] Embodiments of the present invention provide a data-driven power monitoring system early warning method, device, electronic device and storage medium, which can solve the problem of insufficient early warning accuracy in existing power monitoring systems.

[0005] An embodiment of the present invention provides a data-driven power monitoring system early warning method, including:

[0006] Obtain multi-source heterogeneous data of a power monitoring system to be warned at each sampling time period within a preset time period; wherein, the multi-source heterogeneous data is time series data of each target device; the target devices include probes, routers, firewalls, servers, and sensors;

[0007] According to the multi-source heterogeneous data at each sampling time period and a preset anomaly determination rule, determine the number of fault factors corresponding to each sampling time period;

[0008] Input the multi-source heterogeneous data at each sampling time period into a preset early warning multi-modal model in sequence, so that the early warning multi-modal model generates an anomaly probability value corresponding to each sampling time period according to the multi-source heterogeneous data;

[0009] Determine the abnormal trend index within a preset time period according to the abnormal probability values of each sampling period and the number of fault factors corresponding to each sampling period;

[0010] Determine the abnormal level within the preset time period according to the abnormal trend index;

[0011] Generate an early warning signal for the power monitoring system according to the abnormal level.

[0012] Further, train the early warning multi-modal model in the following way:

[0013] Obtain the training data set of the power monitoring system; wherein, the training of the power monitoring system includes a number of multi-source heterogeneous data groups and corresponding labels for characterizing the presence or absence of abnormalities; the multi-source heterogeneous data groups include the data of each target device at the same moment;

[0014] Randomly divide the training data set of the power monitoring system into several batches of training samples according to a preset quantity; input each batch of training samples into the early warning multi-modal model in turn, so that after the early warning multi-modal model receives each batch of training samples, according to the current batch of training samples, output the corresponding abnormal probability value; calculate the loss function value through the loss function according to the abnormal probability value and the corresponding label; use the optimizer to update the early warning multi-modal model according to the loss function value.

[0015] Further, after obtaining the multi-source heterogeneous data of the power monitoring system to be warned at each sampling period within the preset time period, it further includes:

[0016] Perform data cleaning processing on the multi-source heterogeneous data at each sampling period, and generate a cleaned multi-source heterogeneous data set by removing invalid fields and error data;

[0017] Perform multi-protocol data normalization processing and time dimension synchronization processing on each multi-source heterogeneous data in the cleaned multi-source heterogeneous data set, and generate a multi-source heterogeneous data set with spatio-temporal alignment;

[0018] Update the multi-source heterogeneous data at each sampling period according to the multi-source heterogeneous data set with spatio-temporal alignment.

[0019] Further, performing multi-protocol data normalization processing and time dimension synchronization processing on each multi-source heterogeneous data in the cleaned multi-source heterogeneous data set to generate a multi-source heterogeneous data set with spatio-temporal alignment includes:

[0020] Parse each multi-source heterogeneous data in the cleaned multi-source heterogeneous data set according to the protocol type of the target device, and generate a number of original data fields corresponding to each multi-source heterogeneous data;

[0021] Normalize a number of original data fields corresponding to each multi-source heterogeneous data to generate a number of standard fields corresponding to each multi-source heterogeneous data;

[0022] Combine the number of standard fields corresponding to each multi-source heterogeneous data into the normalized multi-source heterogeneous data;

[0023] Extract the timestamp of each normalized multi-source heterogeneous data, and sort each normalized multi-source heterogeneous data according to the timestamp to generate a set of spatio-temporally aligned multi-source heterogeneous data.

[0024] Further, determine the abnormal trend index within a preset time period through the following formula:

[0025]

[0026] where Θ is the abnormal trend index; T is the total number of sampling periods within the preset time period; p t is the abnormal probability value of the sampling period t; p t-1 is the abnormal probability value of the sampling period t-1; α is the weight coefficient of the abnormal probability value; β is the weight coefficient of the number of fault factors; N is the maximum number of fault factors; f t is the number of fault factors in the sampling period t.

[0027] Further, after generating the early warning signal of the power monitoring system according to the abnormal level, it further includes:

[0028] Display the abnormal trend index and the abnormal level in the first display area of the preset multi-dimensional visualization interface;

[0029] Display the early warning signal generated based on the abnormal level in the second display area of the multi-dimensional visualization interface; wherein, the first display area and the second display area are independently distributed on the multi-dimensional visualization interface.

[0030] Based on the above method item embodiments, the present invention correspondingly provides device item embodiments.

[0031] An embodiment of the present invention provides a data-driven power monitoring system early warning device, including: a multi-source data acquisition module, a fault factor identification module, an abnormal probability value generation module, an abnormal trend index determination module, and an early warning signal generation module;

[0032] The multi-source data acquisition module is used to obtain multi-source heterogeneous data of the power monitoring system to be warned at each sampling period within a preset time period; wherein, the multi-source heterogeneous data is the time series data of each target device; the target devices include probes, routers, firewalls, servers, and sensors;

[0033] The fault factor identification module is used to determine the number of fault factors corresponding to each sampling period according to the multi-source heterogeneous data in each sampling period and the preset abnormal determination rules;

[0034] The abnormal probability value generation module is used to sequentially input the multi-source heterogeneous data in each sampling period into a preset early warning multi-modal model, so that the early warning multi-modal model generates an abnormal probability value corresponding to each sampling period according to the multi-source heterogeneous data;

[0035] The abnormal trend index determination module is used to determine the abnormal trend index within a preset time period according to the abnormal probability values of each sampling period and the number of fault factors corresponding to each sampling period;

[0036] The early warning signal generation module is used to determine the abnormal level within the preset time period according to the abnormal trend index; and generate an early warning signal for the power monitoring system according to the abnormal level.

[0037] Further, the data-driven power monitoring system early warning device further includes: a model training module;

[0038] The model training module is used to obtain a power monitoring system training data set; wherein, the power monitoring system training includes a number of multi-source heterogeneous data groups and corresponding labels for characterizing whether an abnormality exists; the multi-source heterogeneous data groups include the data of each target device at the same moment; randomly divide the power monitoring system training data set into several batches of training samples according to a preset quantity; sequentially input each batch of training samples into the early warning multi-modal model, so that after the early warning multi-modal model receives each batch of training samples, it outputs a corresponding abnormal probability value according to the current batch of training samples; calculate the loss function value through a loss function according to the abnormal probability value and the corresponding label; and use an optimizer to update the early warning multi-modal model according to the loss function value.

[0039] Based on the above method item embodiments, the present invention correspondingly provides an electronic device item embodiment.

[0040] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the data-driven power monitoring system early warning method according to any one of the above method item embodiments.

[0041] Based on the above method item embodiments, the present invention correspondingly provides a storage medium item embodiment.

[0042] An embodiment of the present invention provides a storage medium with a computer program stored thereon. When the computer program runs, it controls the device where the storage medium is located to execute the data-driven power monitoring system warning method described in any one of the above method item embodiments.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] An embodiment of the present invention provides a data-driven power monitoring system warning method, device, electronic device, and storage medium. The method obtains multi-source heterogeneous data at each sampling period within a preset time period. The data is sourced from multiple target devices including probes, routers, firewalls, servers, and sensors, ensuring comprehensive collection of system operation status information. Combining preset anomaly determination rules, the number of corresponding fault factors is determined based on the data of each sampling period, thereby achieving explicit quantification of potential anomaly signals before model calculation. The multi-source heterogeneous data of each sampling period is input into a multi-modal warning model configured with an attention mechanism module, which can model the characteristic correlation relationships between various device data and output the anomaly probability value for each sampling period. Further, based on the anomaly probability value and the number of fault factors, an anomaly trend index within the preset time period is constructed, and the anomaly level is determined accordingly, finally generating a warning signal for the power monitoring system.

[0045] By obtaining multi-source heterogeneous data and inputting it into the warning multi-modal model, the time-series data from different devices can be fully integrated, effectively solving the problem that traditional power monitoring systems rely only on a single data source. Using the preset anomaly determination rules to extract the number of fault factors from the multi-source heterogeneous data of each sampling period can directly reflect the anomalies existing in the target device at the physical level. At the same time, a warning multi-modal model is constructed. By modeling the time-series data of various target devices and introducing an attention mechanism, the anomaly probability value corresponding to the sampling period is generated to reflect the anomaly tendency of the system operation state at the data pattern level. These two types of data respectively depict the system anomaly state from different perspectives and are integrated in the calculation of the anomaly trend index, which not only enhances the anomaly recognition ability of the warning mechanism for devices but also improves the perception ability of potential anomaly trends, thus achieving a more robust and forward-looking warning effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a schematic flowchart of a data-driven power monitoring system warning method provided by an embodiment of the present invention.

[0047] Figure 2 is a schematic structural diagram of a multi-dimensional visualization interface provided by an embodiment of the present invention.

[0048] Figure 3It is a schematic structural diagram of an early warning device for a data-driven power monitoring system provided by an embodiment of the present invention. Detailed implementation manners

[0049] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0050] As Figure 1 shown, to solve the problem that the early warning of the power monitoring system in the prior art is not accurate enough, an embodiment of the present invention provides a data-driven early warning method for a power monitoring system, which at least includes the following steps:

[0051] Step S1: Obtain multi-source heterogeneous data of the power monitoring system to be warned at each sampling period within a preset time period; wherein, the multi-source heterogeneous data is time series data of each target device; the target devices include probes, routers, firewalls, servers, and sensors;

[0052] In an optional embodiment, during the early warning process of the power monitoring system, it is necessary to collect and analyze the time series data of probes, routers, firewalls, servers, and sensors to achieve comprehensive perception and anomaly detection of network security, device status, and environmental changes.

[0053] The time series data of the probe mainly includes network traffic statistics, protocol analysis, connection relationships, and abnormal traffic detection information, which are usually collected in real time through traffic mirroring technology (Port Mirroring) or network probe devices, and the content of data packets is analyzed using deep packet inspection (DPI), and combined with a traffic feature library to identify abnormal behaviors. The probe also records indicators such as throughput, packet loss rate, latency change, and TCP / UDP connection status in each time segment to evaluate the network operation status.

[0054] The time series data of the router involves operating parameters such as port status, forwarding table update, routing change, CPU load, memory usage, and device temperature. These data are usually obtained by regular polling through SNMP (Simple Network Management Protocol), or the router actively sends Syslog logs to the management platform. Some intelligent routers support the NetFlow or sFlow protocol and can directly provide detailed traffic analysis data, including source IP, destination IP, traffic size, and duration information, for tracking the source of abnormal traffic.

[0055] Firewall time series data includes access control records, policy matching status, interception logs, attack detection information, abnormal connection counts, and application layer traffic statistics. Access events are primarily recorded through Syslog logs and combined with IDS / IPS (Intrusion Detection and Prevention Systems) for threat identification. Furthermore, the firewall can identify abnormal behaviors such as port scans, denial of service (DDoS) attacks, and malware communications through in-depth log analysis, and report detected security incidents in real time.

[0056] Server time series data covers CPU load, memory usage, disk I / O, network bandwidth usage, process status, user login records, abnormal process detection, and more. This data is typically collected locally using the operating system's built-in monitoring tools (such as Sysstat in Linux and Perfmon in Windows), and remotely pulled through WMI (Windows Management Instrumentation) or Prometheus. Servers also use log analysis tools (such as ELKStack) to parse system and application logs and extract security events such as error reports, abnormal crashes, and unauthorized access.

[0057] Sensor time series data, including environmental parameters such as temperature, humidity, voltage, current, and gas concentration, is typically collected through IoT (Internet of Things) devices and regularly uploaded to data centers using the MQTT or Modbus protocols. Some sensors feature local storage and edge computing capabilities, proactively triggering alarms when they detect sudden environmental changes (such as excessive temperature or abnormal voltage). These data are then transmitted to monitoring systems via wireless communications such as LoRa, Zigbee, and Wi-Fi, enabling remote environmental monitoring and intelligent, coordinated control.

[0058] Understandably, the time-series data from these target devices encompasses information at multiple levels, including network, system, security, and environment. Data acquisition involves various technologies, including traffic mirroring, SNMP polling, Syslog analysis, NetFlow statistics, WMI remote queries, and MQTT IoT communication. By collecting, storing, and analyzing this data, the power monitoring system can achieve comprehensive awareness of the equipment's operating status, providing a solid data foundation for anomaly detection and early warning.

[0059] In a preferred embodiment, after obtaining multi-source heterogeneous data of the power monitoring system to be warned in each sampling period within a preset time period, the method further includes:

[0060] Perform data cleaning on the multi-source heterogeneous data in each sampling period, and generate a cleaned multi-source heterogeneous data set by eliminating invalid fields and erroneous data;

[0061] Perform multi-protocol data normalization and time dimension synchronization on each multi-source heterogeneous data set after cleaning to generate a multi-source heterogeneous data set aligned in time and space;

[0062] Based on the spatiotemporally aligned multi-source heterogeneous data set, the multi-source heterogeneous data in each sampling period is updated.

[0063] Specifically, multi-protocol data normalization and time dimension synchronization are performed on each multi-source heterogeneous data set after cleaning to generate a spatiotemporally aligned multi-source heterogeneous data set, including:

[0064] Parsing each multi-source heterogeneous data in the cleaned multi-source heterogeneous data set according to the protocol type of the target device to generate a number of original data fields corresponding to each multi-source heterogeneous data;

[0065] Normalize several original data fields corresponding to each multi-source heterogeneous data to generate several standard fields corresponding to each multi-source heterogeneous data;

[0066] Combine several standard fields corresponding to each multi-source heterogeneous data into normalized multi-source heterogeneous data;

[0067] The timestamp of each normalized multi-source heterogeneous data is extracted, and each normalized multi-source heterogeneous data is sorted according to the timestamp to generate a spatiotemporally aligned multi-source heterogeneous data set.

[0068] In a specific embodiment, first, data cleaning is performed on the multi-source heterogeneous data in each sampling period. Regular expressions are used to eliminate invalid fields and erroneous data, remove duplicate records, and verify data integrity to generate a cleaned multi-source heterogeneous data set. In addition, the NTP (Network Time Protocol) is used to unify the time format, and the timestamps of different devices are converted to UTC format to eliminate time deviations and ensure data consistency in the time dimension.

[0069] Subsequently, the cleaned multi-source heterogeneous data set is subjected to multi-protocol data normalization processing and time dimension synchronization processing to generate a multi-source heterogeneous data set that is time-space aligned.

[0070] First, it is necessary to parse the data protocols of different devices to extract the original fields. According to the data collection protocols of the target devices, such as Kafka, SNMP, Syslog, MQTT, etc., respectively parse the data formats from probes, routers, firewalls, servers, and sensors. Specifically, for the network traffic data collected by Kafka Producer, extract fields such as packet content, source IP address, destination IP address, port, traffic rate, etc.; for the network device status data collected by SNMP Agent, extract key parameters such as CPU usage, memory occupancy, network throughput, etc.; for the firewall log data received by Syslog Server, it is necessary to parse information such as log level, timestamp, attack type, source IP address, and destination IP address; while the sensor data collected by MQTT Broker contains environmental monitoring data such as temperature, humidity, current, voltage, vibration, etc., and supports data transmission in low-bandwidth scenarios.

[0071] After the extraction of the original fields is completed, data normalization processing is required to unify the data structure. For the parsed original data fields in different formats, use DFDL (Data Format Description Language) to convert data in different formats such as JSON, XML, CSV, etc. into a standardized XML Schema format. In this process, use Ontology Mapping to semantically unify the data fields to ensure the consistency of the logical meanings of data fields between different devices and different protocols. For example, the two fields "CPU Load" and "Processor Utilization" can be unified into the standard field "CPU usage rate" through mapping, thus eliminating the ambiguity between different source data fields.

[0072] Subsequently, time synchronization and sorting are performed on each normalized multi-source heterogeneous data. Extract the timestamp in each piece of data, and use NTP (Network Time Protocol) to convert the timestamps of all data into UTC format to ensure the cross-device data time consistency. Through this operation, synchronization problems caused by time deviations of different devices can be eliminated. Finally, all data will be sorted according to the timestamp to generate a multi-source heterogeneous data set that is spatio-temporally aligned. Through this process, the time continuity of the data stream is guaranteed, and at the same time, the causal relationship of events can be traced in data analysis, further improving the accuracy of the data and the reliability of the analysis.

[0073] After completing the above steps, based on the spatio-temporal aligned multi-source heterogeneous data set, the data for each sampling period is dynamically updated to ensure the integrity, timeliness, and consistency of the data. At the same time, with the cooperation of AES-256 static data encryption and TLS / SSL transmission encryption, the security of the data during storage and transmission is guaranteed. Finally, high-quality time-series data is available for the power monitoring system for anomaly detection, trend analysis, and intelligent early warning, improving the response ability and accuracy of the monitoring system.

[0074] It can be understood that obtaining the multi-source heterogeneous data of the power monitoring system to be warned at each sampling period within a preset time period can achieve all-round real-time monitoring of the power system. By collecting time-series data from multiple target devices such as probes, routers, firewalls, servers, and sensors, the system can comprehensively capture multi-dimensional information such as network traffic, device status, security logs, and environmental parameters, avoiding the monitoring blind spots brought by a single data source. This process significantly improves the timeliness and accuracy of the data, providing a solid data foundation for subsequent anomaly detection and early warning analysis, ensuring that the dynamic changes of the power system can be quickly and accurately captured and fed back. Through the collection of multi-source data, the system can build a comprehensive monitoring index system, enhance the ability to identify abnormal patterns, and thus reduce false alarms and missed alarms, providing an important basis for the intelligent early warning and refined management of the power monitoring system.

[0075] Step S2: According to the multi-source heterogeneous data for each sampling period and the preset anomaly determination rules, determine the number of fault factors corresponding to each sampling period;

[0076] In a preferred embodiment, after obtaining the multi-source heterogeneous data of each target device in the power monitoring system at each sampling period, based on the preset anomaly determination rules, the collected multi-source heterogeneous data is parsed and analyzed to automatically identify whether there is a device-level anomaly in the current sampling period. For example, when there are abnormal phenomena such as abnormal packet reporting frequency of the probe device, continuous CPU utilization of the server exceeding the threshold, drastic mutation of sensor data, or router port connection failure, it can be determined that there are one or more abnormal items for the relevant device in this sampling period.

[0077] If the multi-source heterogeneous data of a certain device meets any anomaly determination rule in the current sampling period, it is regarded that the device has one fault factor. Further, count the number of devices with fault factors in the current sampling period as the "number of fault factors" index corresponding to this period, which is used to calculate the anomaly trend index in combination with the anomaly probability value later.

[0078] Specifically, for probe devices, conditions such as data reporting interruption, abnormal message structure, and excessive response delay are set as the basis for anomaly determination; for router and firewall devices, judgment rules such as port blocking, abnormal packet loss rate, and excessive number of connection establishment failures are set; for server devices, determination conditions such as long-term CPU utilization exceeding the limit, abnormal memory occupancy, and abnormal keywords included in the system log are set; for sensor devices, abnormal behavior rules such as sudden change in monitoring values, data sampling interruption, and large difference in readings from neighboring nodes are set.

[0079] Through the above method, based on the static rule analysis of multi-source heterogeneous data, the fault factor information reflecting device anomalies can be effectively extracted, providing a basic support for subsequent anomaly trend assessment and warning level division.

[0080] Step S3: Input the multi-source heterogeneous data in each sampling period into a preset early warning multi-modal model in sequence, so that the early warning multi-modal model generates an anomaly probability value corresponding to each sampling period according to the multi-source heterogeneous data.

[0081] In an optional embodiment, the early warning multi-modal model is trained in the following way:

[0082] Obtain a power monitoring system training dataset; wherein, the power monitoring system training includes a number of multi-source heterogeneous data groups and corresponding labels for indicating whether an anomaly exists; the multi-source heterogeneous data groups include the data of each target device at the same moment.

[0083] Randomly divide the power monitoring system training dataset into several batches of training samples according to a preset quantity; input each batch of training samples into the early warning multi-modal model in sequence, so that after the early warning multi-modal model receives each batch of training samples, it outputs a corresponding anomaly probability value according to the current batch of training samples; calculate the loss function value through the loss function according to the anomaly probability value and the corresponding label; use the optimizer to update the early warning multi-modal model according to the loss function value.

[0084] Optionally, this multi-modal model usually adopts a deep neural network structure, including a feature extraction layer and a fusion layer, and processes spatial and temporal features by combining a convolutional neural network (CNN) and a recurrent neural network (RNN), so as to effectively capture potential anomaly patterns in the data.

[0085] First, obtain the training dataset of the power monitoring system. This dataset consists of several multi-source heterogeneous data groups and corresponding labels used to characterize the presence or absence of anomalies. Each data group reflects the status of each target device at the same moment. Subsequently, according to the preset batch size, randomly divide the training dataset into several batches of training samples. For each batch of data, the system sequentially inputs it into the early warning multi-modal model. After receiving the current batch of samples, the model calculates the corresponding anomaly probability value through forward propagation.

[0086] To measure the prediction error, the system uses the cross-entropy loss function (or other suitable loss functions) to calculate the difference between the anomaly probability value output by the model and the true label, and updates the model parameters through the backpropagation algorithm. To improve the stability and convergence speed of training, the optimizer (such as Adam or SGD) combines techniques such as learning rate decay, regularization, and Dropout to iteratively update the model. Through this process of batch training and continuous parameter adjustment, the model gradually improves its ability to identify anomaly patterns in multi-source heterogeneous data, thereby achieving more accurate and real-time power monitoring early warning.

[0087] Step S4: Determine the anomaly trend index within the preset time period according to the anomaly probability values of each sampling period and the number of fault factors corresponding to each sampling period;

[0088] Specifically, determine the anomaly trend index within the preset time period through the following formula:

[0089]

[0090] where Θ is the anomaly trend index; T is the total number of sampling periods within the preset time period; p t is the anomaly probability value of sampling period t; p t-1 is the anomaly probability value of sampling period t - 1; α is the weight coefficient of the anomaly probability value; β is the weight coefficient of the number of fault factors; N is the maximum number of fault factors; f t is the number of fault factors in sampling period t.

[0091] It can be understood that by combining the anomaly probability value and the number of fault factors, the anomaly trend index within the preset time period can be comprehensively evaluated. This index will reflect the abnormal development of the power monitoring system to be warned within a certain time range, and provide an important reference for subsequent fault warning and response according to the change trend of the index.

[0092] Step S5: Determine the anomaly level within the preset time period according to the anomaly trend index;

[0093] According to the abnormal trend index, through a preset threshold classification rule, the state of the power monitoring system in each sampling period is classified and evaluated to determine the abnormal level. In the specific implementation process, the system first sets a series of threshold parameters based on historical data and statistical analysis results to divide different abnormal level intervals. For example, the period when the abnormal trend index is lower than the first threshold is determined as the normal state, the period when the abnormal trend index is between the first threshold and the second threshold is classified as the low-level abnormal state, and the period when it is higher than the second threshold is classified as the high-level abnormal state. Through this classification method based on the abnormal trend index, different degrees of abnormal risks can be effectively distinguished, providing clear and operable support for subsequent early warning responses.

[0094] Step S6: Generate a warning signal for the power monitoring system according to the abnormal level;

[0095] After generating the warning signal for the power monitoring system according to the abnormal level, it further includes:

[0096] In a specific embodiment, a multi-dimensional visualization interface such as Figure 2 shown, includes: a first display area 101 and a second display area 102;

[0097] Display the abnormal trend index and the abnormal level in the first display area 101 of the preset multi-dimensional visualization interface;

[0098] Display the warning signal generated based on the abnormal level in the second display area 103 of the multi-dimensional visualization interface; wherein, the first display area 101 and the second display area 102 are independently distributed on the multi-dimensional visualization interface.

[0099] In an alternative embodiment, a multi-dimensional visualization interface is constructed to achieve all-round monitoring of the abnormal state through a sub-region independent rendering and interactive linkage mechanism. The visualization interface includes two display areas: the first display area dynamically displays the abnormal trend index and the corresponding level of the current sampling period in a circular dashboard, using red, orange, and green color coding to intuitively distinguish low-risk (0 - 0.3), medium-risk (0.3 - 0.7), and high-risk (0.7 - 1) states. When the abnormal trend index breaks through the threshold, a dynamic warning animation is triggered; the second display area centrally displays the generated warning signals, presented in the form of a hierarchical signal light combined with a dynamic icon. The high-risk warning signal is attached with a red pulse animation (frequency 2Hz) and a buzzer alarm prompt, and the medium- and low-risk signals are respectively identified by orange flashing and green constant lighting.

[0100] It is understandable that based on the abnormal level division mapped by the abnormal trend index, an early warning signal of the power monitoring system is generated to realize the quantitative evaluation and hierarchical response of risk events, enabling the operation and maintenance personnel to quickly match the emergency response plan according to the early warning level. For example, in the high-risk level, equipment isolation and standby system switching are immediately triggered, while in the low-risk level, only enhanced monitoring needs to be started, significantly improving the efficiency of emergency resource allocation.

[0101] Based on the above method item embodiments, the present invention correspondingly provides device item embodiments.

[0102] As Figure 3 shown, an embodiment of the present invention provides a data-driven early warning device for a power monitoring system, including: a multi-source data acquisition module, a fault factor identification module, an abnormal probability value generation module, an abnormal trend index determination module, and an early warning signal generation module;

[0103] The multi-source data acquisition module is used to obtain multi-source heterogeneous data of the power monitoring system to be warned at each sampling period within a preset time period; wherein, the multi-source heterogeneous data is the time series data of each target device; the target devices include probes, routers, firewalls, servers, and sensors;

[0104] The fault factor identification module is used to determine the number of fault factors corresponding to each sampling period according to the multi-source heterogeneous data at each sampling period and a preset abnormal determination rule;

[0105] The abnormal probability value generation module is used to sequentially input the multi-source heterogeneous data at each sampling period into a preset early warning multi-modal model, so that the early warning multi-modal model generates an abnormal probability value corresponding to each sampling period according to the multi-source heterogeneous data;

[0106] The abnormal trend index determination module is used to determine the abnormal trend index within a preset time period according to the abnormal probability values of each sampling period and the number of fault factors corresponding to each sampling period;

[0107] The early warning signal generation module is used to determine the abnormal level within the preset time period according to the abnormal trend index; and generate an early warning signal of the power monitoring system according to the abnormal level.

[0108] Specifically, the data-driven early warning device for the power monitoring system further includes: a model training module;

[0109] The model training module is used to obtain a training dataset for the power monitoring system. Among them, the training of the power monitoring system includes several multi-source heterogeneous data groups and corresponding labels for characterizing the presence or absence of anomalies. The multi-source heterogeneous data groups include the data of each target device at the same moment. The power monitoring system training dataset is randomly divided into several batches of training samples according to a preset quantity. Each batch of training samples is sequentially input into the early warning multi-modal model, so that after the early warning multi-modal model receives each batch of training samples, it outputs a corresponding anomaly probability value according to the current batch of training samples. According to the anomaly probability value and the corresponding label, the loss function value is calculated through the loss function. The optimizer is used to update the early warning multi-modal model according to the loss function value.

[0110] It should be noted that the embodiments of the device described above correspond to the above embodiments of the present invention and can implement the data-driven power monitoring system early warning method described in any one of the above of the present invention. In addition, the embodiments of the above device are merely illustrative. The modules described as separate components may or may not be physically separated. The components shown as modules may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art can understand and implement without creative work.

[0111] Based on the above method embodiment of the present invention, a corresponding embodiment of an electronic device is provided.

[0112] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the data-driven power monitoring system early warning method described in any one of the present invention, or when the processor executes the computer program, it implements the functions of each module in the above device embodiments.

[0113] Exemplarily, the computer program can be divided into one or more modules. The one or more modules are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of completing specific functions, and these instruction segments are used to describe the execution process of the computer program in the terminal device.

[0114] The terminal device may be a computing device such as a desktop computer, a notebook, a palm computer, and a cloud server. The terminal device may include, but is not limited to, a processor and a memory.

[0115] The so-called processor may be a Central Processing Unit (CPU), or may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The processor is the control center of the terminal device, connecting various parts of the entire terminal device through various interfaces and lines.

[0116] The memory may be used to store the computer program and / or module. The processor realizes various functions of the terminal device by running or executing the computer program and / or module stored in the memory, and by calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. Among them, the program storage area may store an operating system, application programs required for at least one function, etc.; the data storage area may store data created according to the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0117] Based on the above method item embodiments, the present invention correspondingly provides storage medium item embodiments;

[0118] Another embodiment of the present invention provides a storage medium. The storage medium includes a stored computer program. When the computer program runs, it controls the device where the storage medium is located to execute any one of the above-mentioned data-driven power monitoring system warning methods of the present invention.

[0119] Among them, the above storage medium is a computer-readable storage medium, and the computer program includes computer program code, which can be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disc, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0120] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0121] The above is the preferred embodiment of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements are also regarded as the protection scope of the present invention.

Claims

1. A data-driven early warning method for a power monitoring system, characterized in that include: Acquire multi-source heterogeneous data of the power monitoring system to be warned at each sampling period within a preset time period; wherein the multi-source heterogeneous data is time series data of each target device; the target devices include probes, routers, firewalls, servers, and sensors; Determine the number of fault factors corresponding to each sampling period based on multi-source heterogeneous data in each sampling period and preset anomaly judgment rules; Inputting the multi-source heterogeneous data in each sampling period into a preset early warning multimodal model in sequence, so that the early warning multimodal model generates an abnormal probability value corresponding to each sampling period based on the multi-source heterogeneous data; Determine the abnormal trend index within the preset time period based on the abnormal probability value of each sampling period and the number of fault factors corresponding to each sampling period; Determining the abnormality level within the preset time period based on the abnormal trend indicator; According to the abnormality level, an electric power monitoring system warning signal is generated.

2. The early warning method for the data-driven power monitoring system according to claim 1, wherein, The early warning multimodal model is trained in the following ways: Obtaining a power monitoring system training data set; wherein the power monitoring system training includes a plurality of multi-source heterogeneous data sets and corresponding labels for characterizing whether an anomaly exists; the multi-source heterogeneous data sets include data of each target device at the same time; The power monitoring system training data set is randomly divided into several batches of training samples according to a preset number; the training samples of each batch are input into the early warning multimodal model in sequence, so that the early warning multimodal model outputs the corresponding abnormality probability value according to the training samples of the current batch after receiving each batch of training samples; the loss function value is calculated by the loss function according to the abnormality probability value and the corresponding label; and the early warning multimodal model is updated according to the loss function value using an optimizer.

3. The early warning method for a data-driven power monitoring system according to claim 2, wherein After obtaining the multi-source heterogeneous data of the power monitoring system to be warned in each sampling period within a preset time period, the method further includes: Perform data cleaning on the multi-source heterogeneous data in each sampling period, and generate a cleaned multi-source heterogeneous data set by eliminating invalid fields and erroneous data; Perform multi-protocol data normalization and time dimension synchronization on each multi-source heterogeneous data set after cleaning to generate a multi-source heterogeneous data set aligned in time and space; Based on the spatiotemporally aligned multi-source heterogeneous data set, the multi-source heterogeneous data in each sampling period is updated.

4. The early warning method of the data-driven power monitoring system according to claim 3, characterized in that, Perform multi-protocol data normalization and time dimension synchronization on each multi-source heterogeneous data set after cleaning to generate a spatiotemporally aligned multi-source heterogeneous data set, including: Parsing each multi-source heterogeneous data in the cleaned multi-source heterogeneous data set according to the protocol type of the target device to generate a number of original data fields corresponding to each multi-source heterogeneous data; Normalize several original data fields corresponding to each multi-source heterogeneous data to generate several standard fields corresponding to each multi-source heterogeneous data; Combine several standard fields corresponding to each multi-source heterogeneous data into normalized multi-source heterogeneous data; Extract the timestamps of each normalized multi-source heterogeneous data, and sort each normalized multi-source heterogeneous data according to the timestamps to generate a set of spatio-temporally aligned multi-source heterogeneous data.

5. The early warning method of the data-driven power monitoring system according to claim 4, wherein Determine the abnormal trend index within a preset time period through the following formula: Among them, Θ is the abnormal trend index; T is the total number of sampling periods within the preset time period; p t is the abnormal probability value of the sampling period t; p t-1 is the abnormal probability value of the sampling period t - 1; α is the weight coefficient of the abnormal probability value; β is the weight coefficient of the number of fault factors; N is the maximum number of fault factors; f t is the number of fault factors in the sampling period t.

6. The early warning method for a data-driven power monitoring system according to claim 5, characterized in that, After generating the warning signal of the power monitoring system according to the abnormal level, it further includes: Display the abnormal trend index and the abnormal level in the first display area of a preset multi-dimensional visualization interface; Display the warning signal generated based on the abnormal level in the second display area of the multi-dimensional visualization interface; wherein, the first display area and the second display area are independently distributed on the multi-dimensional visualization interface.

7. An early warning device for a data-driven power monitoring system, characterized in that, It includes: A multi-source data acquisition module, a fault factor identification module, an abnormal probability value generation module, an abnormal trend index determination module, and a warning signal generation module; The multi-source data acquisition module is used to obtain multi-source heterogeneous data of the power monitoring system to be warned at each sampling time period within a preset time period; wherein, the multi-source heterogeneous data is the time series data of each target device; the target devices include probes, routers, firewalls, servers, and sensors; The fault factor identification module is used to determine the number of fault factors corresponding to each sampling time period according to the multi-source heterogeneous data at each sampling time period and a preset abnormal determination rule; The abnormal probability value generation module is used to sequentially input the multi-source heterogeneous data at each sampling time period into a preset warning multi-modal model, so that the warning multi-modal model generates an abnormal probability value corresponding to each sampling time period according to the multi-source heterogeneous data; The abnormal trend index determination module is used to determine the abnormal trend index within a preset time period according to the abnormal probability values of each sampling time period and the number of fault factors corresponding to each sampling time period; The warning signal generation module is used to determine the abnormal level within the preset time period according to the abnormal trend index; and generate a warning signal of the power monitoring system according to the abnormal level.

8. The early warning device of the data-driven power monitoring system according to claim 7, characterized in that, It further includes: A model training module; The model training module is used to obtain a power monitoring system training data set; wherein, the power monitoring system training includes a number of multi-source heterogeneous data groups and corresponding labels for indicating whether an abnormality exists; the multi-source heterogeneous data groups include the data of each target device at the same moment; randomly divide the power monitoring system training data set into several batches of training samples according to a preset quantity; sequentially input each batch of training samples into the warning multi-modal model, so that after the warning multi-modal model receives each batch of training samples, it outputs a corresponding abnormal probability value according to the current batch of training samples; Calculate the loss function value through the loss function according to the abnormal probability value and the corresponding label; use the optimizer to update the warning multi-modal model according to the loss function value.

9. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the data-driven power monitoring system warning method according to any one of claims 1 to 6.

10. A storage medium, characterized in that, The storage medium includes a stored computer program, wherein when the computer program runs, it controls the device where the storage medium is located to execute the data-driven power monitoring system warning method according to any one of claims 1 to 6.

Images