Method for detecting abnormal operation of intelligent metering box

Abstract

The invention discloses an intelligent metering box operation anomaly detection method, and particularly relates to the technical field of electric power informationization, a behavior context information group is constructed based on metering box operation data, and a historical behavior evolution template is matched to judge whether an anomaly intention evaluation process is activated or not; if so, generating a behavior chain sequence and calculating an intention rationality credibility index; extracting electrical characteristics and environment variables to calculate a context offset aggregation index; inputting the two indexes into a pre-training model, outputting an intention deviation grade score, and executing response strategies such as behavior feature freezing, risk label annotation, access permission limitation or abnormal early warning according to a risk interval to which the score belongs; according to the method, abnormal intention recognition and risk grade scoring of the operation behaviors of the intelligent metering box are realized by constructing the behavior context information group, establishing the behavior chain sequence and performing context state modeling and combining with the pre-training intention recognition model, so that the response strategy is executed in a graded manner, and the accuracy, intelligence and response efficiency of abnormal recognition are improved.

Description

Technical Field

[0001] The present invention relates to the field of power information technology, and more specifically, to a method for detecting abnormal operation of a smart meter box. Background Art

[0002] With the continuous development of smart grids and digital power distribution and utilization systems, smart meter boxes, serving as data collection and control terminals connecting the user and distribution sides, have become critical equipment for monitoring the operation of low-voltage distribution networks. Integrating functions such as energy metering, data communication, switch control, and status sensing, these smart meter boxes enable real-time monitoring and remote management of electricity usage, playing a vital role in refined grid operation and maintenance, user-side energy efficiency management, power theft prevention, and fault warning.

[0003] In actual operation, smart meter boxes face various types of anomaly risks, including natural anomalies caused by electrical system fluctuations, communication interruptions, and hardware failures, as well as unnatural anomalies caused by human behavior such as illegal access, operation tampering, and parameter falsification. To address these risks, existing technologies have proposed a variety of rule-based and model-based anomaly detection methods: On the one hand, rule-based detection methods rely on manually set thresholds for indicators, such as upper and lower limits for physical quantities like voltage, current, and power factor, to determine whether they have crossed the threshold. While simple to implement and responsive, these methods struggle to adapt to the multi-dimensional data linkage characteristics of complex scenarios and are highly sensitive to changes in abnormal patterns, leading to false positives and missed detections.

[0004] On the other hand, detection methods based on statistical analysis or shallow learning models attempt to identify anomalies by mining time series features, trend changes, or outlier behaviors in electrical data. These methods are more generalizable than rule-based approaches, and some studies have also incorporated auxiliary information such as communication behavior, cover opening status, and environmental sensors, increasing the dimensionality and granularity of detection. However, these methods generally rely on the assumption that the observed data deviates from a normal distribution. Essentially, they remain at the level of monitoring behavioral outcomes and fail to provide a deeper understanding of the motivations, intentions, or context behind operational behaviors.

[0005] More importantly, most current technologies handle operational behaviors in an isolated or linear manner, ignoring the evolutionary paths of user behavior in different scenarios, the causal logic between behavioral chains, and the dynamic relationship between behavior and its context. In other words, even if a behavior is not numerically abnormal, it may still pose an abnormality risk because it appears "irrational" in the current context. These "non-obvious anomalies" are often difficult to identify using traditional technology systems. Therefore, this paper proposes a method for detecting operational anomalies in smart meter boxes to address this issue. Summary of the Invention

[0006] To achieve the above object, the present invention provides the following technical solutions: The method for detecting abnormal operation of a smart meter box includes the following steps: Build a behavior context information group based on the meter box operation data, and then determine whether to activate the abnormal intention assessment process based on the comparison results of the current behavior context information group and the historical behavior evolution template; After activating the abnormal intention assessment process, a behavior chain sequence is generated based on the context information group. The current operation behavior is progressively modeled along the time dimension. The behavior causal tensor encoding method is used to represent the semantic dependency relationship between behavior nodes. The intention rationality credibility index is calculated by comparing the behavior path structure. It is used to measure the strategic consistency between the current behavior and the historical expected behavior sequence. Based on the context information group, the coupling distribution pattern between behavior triggering time, electrical operation characteristics and environmental variables is extracted, and a high-order feature offset structure is constructed. The context offset aggregation index is calculated through the context state modeling method to quantify the offset degree of the current behavior in the comprehensive spatiotemporal operation environment. The intention rationality credibility index and context deviation aggregation index are input into the pre-trained intention recognition learning model for comprehensive deconstruction analysis, and the intention deviation level score is output to quantify the degree of cognitive difference between the current behavior and the system's internal policy model. The behavioral response strategy is then executed based on the risk range to which the intention deviation level score belongs.

[0007] In a preferred embodiment, the historical behavior evolution template is a preset record sequence of multidimensional behavior data that is consistent with the current behavior context information group. The record sequence is derived from the long-term operation data of the meter box. After being vectorized through behavior semantic labels, operation timing, and electrical change characteristics, it is clustered using a multi-center behavior evolution clustering method. Each clustering result corresponds to a group of behavior evolution expressions with similar context features and similar behavior trajectories.

[0008] In a preferred embodiment, determining whether to activate the abnormal intention assessment process includes: matching the current behavior context information group with the closest clustering result in the clustering result, and calculating the context structure deviation value and the behavior sequence deviation index respectively; The context structure deviation value is the deviation amplitude reflected by the cosine similarity or Euclidean distance between the current behavior context vector and the cluster center vector, which measures whether the semantic structure of the behavior context deviates from the core feature of the cluster; The behavior sequence deviation index is the dynamic time-warping distance between the current behavior chain sequence and the standard behavior path in the historical trajectory, which measures the synchronization of the behavior sequence and rhythm with historical expectations; When the context structure deviation value is greater than the preset deviation judgment threshold and the behavior sequence offset index exceeds the preset path similarity limit, it is considered that the current behavior deviates significantly from the historical behavior evolution template, meeting the judgment conditions for activating the abnormal intention assessment process.

[0009] In a preferred embodiment, the generation of the intention rationality credibility index includes the following processing: For each operation behavior in the behavior chain sequence, a behavior node representation vector is constructed in chronological order. Each representation vector is composed of a timestamp, electrical state characteristics, and event type code combination, which is used to express the semantic position of the behavior in the behavior chain sequence. By constructing a behavior causal relationship tensor to represent the semantic dependency between any two behavior nodes, this tensor is based on the inner product between the behavior node representation vectors and sets a decay factor based on the node time interval to reflect the dynamic change characteristics of the behavior causal relationship in the time dimension. Perform a structured comparison between the current behavior causal relationship tensor and the standard behavior tensor constructed from the historical expected behavior sequence. Calculate the strategic path deviation score based on the cumulative difference between all valid behavior pairs in the tensor to reflect the overall structural deviation between the current behavior chain sequence and the historical expected behavior sequence. The strategy path deviation score is input into the confidence mapping function, and the structural deviation is mapped into a confidence score using a nonlinear compression mechanism. This score is the credibility index of intention rationality. The closer the value is to the upper limit of the interval, the stronger the strategy consistency between the current behavior chain sequence and the historical expected behavior sequence, thereby achieving a quantitative assessment of whether the operational behavior conforms to the behavior evolution logic.

[0010] In a preferred embodiment, the generation of the context offset aggregation index includes the following processing: The behavior triggering time, electrical operation characteristics and environmental variables are uniformly extracted at each time node and combined into a context response vector sequence; Based on the context response vector sequence, a multi-source behavior response distribution under the current operating state is constructed through multi-kernel density mapping to represent the structural distribution of behavioral, electrical and environmental characteristics in the joint feature space. The current multi-source behavior response distribution is structurally compared with a reference distribution constructed from historical stable operation data to obtain an offset feature tensor. Based on this, two key quantitative indicators are extracted from the offset feature tensor: the directional variation intensity, which reflects the degree of disturbance of the current context state in the temporal dimension; and the coupling aggregation degree, which characterizes the offset aggregation trend between features. Based on the nonlinear combination of directional variation intensity and coupling aggregation degree, the exponential compression and logarithmic fusion method is used to perform a weighted evaluation of the relationship between disturbance intensity and structural coupling, and the contextual offset aggregation index is calculated. The output value is used to measure the global offset degree of the current behavior in the comprehensive spatiotemporal operating environment.

[0011] In a preferred embodiment, the intention rationality credibility index and the context deviation aggregation index are input into the pre-trained intention recognition learning model for comprehensive deconstruction analysis, including: based on the joint feature combination of the two indexes, fuzzy membership matching and strategy deviation evaluation are performed in the rule knowledge base through the fuzzy logic reasoning mechanism, and the intention deviation level score of the current behavior in the semantic cognitive space is output to reflect the behavioral intention of the current operation behavior relative to the system internal strategy model. Figure 1 The intention recognition learning model establishes a multi-dimensional input fuzzy rule matrix based on the historical behavior intention decision boundary extracted in the training phase, and performs rule fusion, weight adjustment and output layer clarity conversion operations in the model reasoning process, thereby realizing intelligent judgment on whether the current behavior has potential abnormal intentions.

[0012] In a preferred embodiment, the behavioral response strategy is executed according to the risk interval to which the intention deviation grade score belongs, including the following behavioral response strategies: Behavioral feature freezing, risk label annotation, access permission restriction and abnormal warning.

[0013] The technical effects and advantages of the present invention are as follows: This invention enables dynamic contextual awareness and intelligent risk assessment of smart meter box operational behavior. By constructing behavioral context information groups based on meter box operational data and comparing them with historical behavioral evolution templates, the invention achieves structured expression and dynamic assessment of the current operational state of the operating behavior. When the current behavior exhibits characteristics that significantly deviate from historical patterns, the system automatically determines whether to activate the subsequent abnormal intent assessment process, thereby establishing a linkage mechanism from behavioral scenario perception to anomaly detection, improving the system's proactive identification and responsiveness to potential abnormal behavior.

[0014] The present invention can quantify the consistency of behavioral strategies based on behavioral chain modeling, and enhance the ability to judge the rationality of operations. After activating the abnormal intention assessment process, the present invention constructs the evolutionary structure of operational behaviors by modeling the behavioral chain sequence in the time dimension, and uses the behavioral causal tensor encoding method to extract the semantic dependency between behavioral nodes, thereby realizing the structured abstraction of the operational strategy execution path. By comparing the current behavioral path structure with the historical expected behavioral sequence and calculating the intention rationality credibility index, the system can quantify whether the current behavior conforms to the known strategy pattern, thereby providing a clear structural basis for the judgment of behavioral rationality and significantly improving the accuracy of identifying strategy deviation operations.

[0015] The present invention can integrate the dual indicators of behavioral structure and contextual state for intelligent analysis, and realize hierarchical response control of behavioral risk levels. On the basis of completing the behavioral structure modeling, the present invention further extracts the coupling relationship between behavior trigger time, electrical operation characteristics and environmental variables, establishes a high-order feature offset structure, and calculates the context offset aggregation index based on this. Subsequently, the system uses the intention rationality credibility index and the context offset aggregation index as input, feeds them into the pre-trained intention recognition learning model, and outputs the intention deviation level score of the current behavior. Based on the risk interval to which the score belongs, the system can execute the behavioral response strategy, from behavioral feature control, risk isolation to abnormal warning, to realize dynamic response of behavioral risk level, and effectively enhance the safety management and control capabilities during the operation of the smart meter box. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings; Figure 1 This is a schematic diagram of the principle of the method for detecting abnormal operation of the smart meter box in the present invention. DETAILED DESCRIPTION

[0017] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0018] Reference Figure 1 The following examples were obtained: Example 1: A method for detecting abnormal operation of a smart meter box, comprising the following steps: Step 1: Construction and evaluation of the behavior context information group trigger judgment. During the operation of the smart meter box, the system first constructs the behavior context information group at the current moment through real-time collection and processing of the meter box operation data. This information group comprehensively reflects multiple dimensions such as user operation behavior, electrical operation status, communication activity status and environmental conditions, and constitutes the semantic expression basis of the operating environment in which the current behavior is located. In order to determine whether the current behavior has potential abnormal intentions, the system performs a structured comparison of the behavior context information group with the historical behavior evolution template generated based on historical stable operation data, and combines the context structure deviation and the degree of behavior timing offset to conduct a preliminary screening of the normality of the behavior. When the comparison results show that there is an obvious structural or rhythm deviation between the current behavior and the historical behavior evolution path, the system will actively activate the abnormal intention evaluation process to provide a data input basis for subsequent deeper intention recognition.

[0019] Step 2: Behavior chain sequence modeling and intention rationality credibility index generation. After the abnormal intention assessment process is activated, the system further mines key behavioral data from the behavior context information group, progressively models the current operation behavior based on the time dimension, and constructs a behavior chain sequence. Each behavior node is represented by multiple feature dimensions such as timestamp, electrical state, and operation type. The semantic dependencies between nodes are identified through the behavior causal tensor encoding method, thereby constructing a structural representation that reflects the behavior evolution logic. The system then compares the causal relationship structure formed by the current behavior chain sequence with the historical expected behavior sequence, calculates its policy path deviation, and generates an intention rationality credibility index based on a nonlinear mapping function. This index reflects whether the current behavior conforms to the policy pattern accumulated during the long-term operation of the system, and is used to characterize the policy consistency and behavioral compliance of user operations.

[0020] Step 3: Context state modeling and offset aggregation index calculation. The system further extracts behavior trigger time, electrical operation characteristics, and environmental variables from the behavior context information group, and constructs these multi-source features into a context response vector set in the time series to form a multi-dimensional joint state expression. In order to evaluate whether the current context state is within a reasonable boundary, the system constructs a high-order feature offset structure through kernel density mapping and tensor transformation, and uses this as a basis to analyze the degree of distribution offset of the behavior context in the joint feature space. In this process, the system extracts two indicators: directional variation intensity and coupling aggregation degree, which are used to characterize the disturbance characteristics of the behavior context state in the time series and the offset coordination between different features, respectively. Finally, the system nonlinearly combines these two indicators to calculate the context offset aggregation index, which is used to measure whether the current behavior is within the expected operating environment coupling boundary.

[0021] Step 4: Combine the inputs into the intent recognition model and output an intent deviation rating. To further quantify the degree of deviation of the current behavior from the policy model, the system uses the intent rationality credibility index and the context deviation aggregation index as joint input variables and feeds them into the pre-trained intent recognition learning model for comprehensive deconstruction analysis. This model uses fuzzy logic as its core reasoning mechanism, combining the rule base constructed from historical behavior data training with the policy deviation boundary. It performs membership matching and fuzzy rule reasoning on the current input and outputs an intent deviation rating for the current behavior. This rating comprehensively reflects the dual considerations of behavior policy consistency and contextual rationality, and is an important basis for the system to identify potential abnormal intentions and determine the risk level of the behavior.

[0022] Step 5: Execute a response strategy based on the score to implement behavioral intervention control. Based on the aforementioned intention deviation level score results, the system implements a corresponding behavioral response strategy based on the risk range of the score to ensure the behavioral compliance and operational stability of the smart meter box. At a low risk level, the system records the current behavior trajectory and maintains its behavioral state unchanged; at a medium to high score level, the system can freeze behavioral characteristics or attach risk tags to observe and track behavior; and when the score reaches a high risk level, the system will restrict access rights for the current behavior in future operations and, if necessary, trigger a remote abnormality warning mechanism to transmit alarm information to the operation and maintenance management center, achieving intelligent control and intervention of potential non-obvious abnormal behaviors in the operation of the smart meter box.

[0023] The historical behavior evolution template is a preset sequence of multidimensional behavioral data records that is consistent with the current behavioral context information group. The behavioral context information group refers to a set of time-related data collected by the meter box during operation, consisting of user operating behaviors, electrical operating status, and related environmental variables. It is used to characterize the occurrence conditions and status characteristics of a certain behavior in a specific operating context. The so-called "consistent with the current behavioral context information group" means that these record sequences have the same data structure and expression method as the context information group used for the current behavior to be detected in terms of feature dimensions, semantic structure, and sampling standards, making comparative analysis feasible.

[0024] This record sequence is derived from the long-term operating data of the meter box. This refers to the historical user behavior data, electrical parameter change information, and external environmental change records accumulated in a time series format during the system's normal operating cycle, forming a data sample set with temporal evolution properties. To improve representation accuracy, the system first annotates these data samples with behavioral semantic labels. Behavioral semantic labels are abstract expressions of the meaning of user operation behaviors, such as "meter reading request," "remote tripping," and "unpacking inspection." Secondly, the system extracts the operation sequence, normalizing or periodizing the relative occurrence time of each behavioral event in the sequence to reflect the rhythm of behavioral evolution. Electrical change features are then extracted, referring to physical quantities such as voltage, current, and active power that occur simultaneously with the behavior, representing the actual state of the behavior in the power system. This multi-dimensional information is fused to form a behavior vector. Through feature concatenation and normalization, a multidimensional vector representation is constructed for modeling. Subsequently, the system uses a multi-center behavioral evolution clustering method for clustering. This clustering method is an unsupervised learning method based on feature space distance calculation. Specifically, it selects multiple initial clustering centers and iteratively converges to generate clusters in the multi-dimensional behavior vector space. Each cluster represents a set of historical behavior sequences that are similar in behavioral semantics, time rhythm, and electrical response.

[0025] Each clustering result corresponds to a set of behavioral evolution expressions with similar contextual features and similar behavioral trajectories. "Similar contextual features" means that the overall feature combination of each behavior vector in the cluster is highly consistent across time, electrical, and environmental dimensions; "similar behavioral trajectories" indicate that these behaviors exhibit consistent trends or patterns in their occurrence sequence and evolutionary paths, such as the recurrence of the "operation-current fluctuation-communication request" sequence within a specific time period. This structure provides a standard comparison template for subsequent intent assessment, allowing you to determine whether the current behavior deviates from the historical regular evolutionary path.

[0026] For example, in a specific implementation, if the meter box exhibits the "communication wake-up - data reading - sleep" behavior sequence in multiple night cycles, the system can cluster the sequence into a behavior cluster representing normal nighttime inspections. If the current behavior is "communication wake-up - current surge - remote tripping", the context structure obviously deviates from the normal pattern of this cluster, which can be used as one of the judgment bases for triggering the abnormal intention assessment process.

[0027] The process for determining whether to activate abnormal intent assessment involves matching the current behavioral context information group with the closest clustering result, and calculating the context structure deviation value and behavior sequence deviation index, respectively. A behavioral context information group refers to a set of data directly related to a behavior, collected by the meter box before and after it occurs. This set includes multi-source features such as the operational behavior itself, electrical operating status, and environmental information. This information group maintains consistency with the record sequence in the historical behavior evolution template in terms of feature dimensions, data structure, and representation. A clustering result is a set of results generated by performing unsupervised cluster analysis on a large number of historical behavioral context information groups. It has a partitioning structure based on similarities in behavioral semantics, operational modes, and operating characteristics. A cluster represents a set of behavioral data belonging to a specific category in the cluster analysis. This cluster has a center vector representing the core expression pattern of the behavioral context features of that category. The "closest cluster" refers to the category cluster that is closest to the current behavioral context information group in the joint feature space among all clusters. The matching process is implemented through vector space distance or similarity function, with the aim of finding the historical behavior paradigm to which the current behavior is most likely to belong, and making deviation judgments based on this.

[0028] The context structure deviation value is the cosine similarity or Euclidean distance between the current behavior context vector and the cluster center vector, reflecting the deviation magnitude. The behavior context vector is a high-dimensional vector formed by numerically expressing various features (such as time, electrical status, and environmental data) within the behavior context information group. The cluster center vector is the weighted average of all historical behavior vectors within the cluster, representing the structural center of gravity of that behavior. Cosine similarity primarily measures the directional consistency of two vectors, while Euclidean distance reflects their geometric distance in feature space. Combined, the two provide a multi-dimensional characterization of the structural deviation between the current behavior and historical behavior clusters. The larger the context structure deviation value, the more the semantic structure of the current behavior deviates from the core expression of the cluster.

[0029] The behavior sequence offset indicator is the dynamic time warping distance between the current behavior chain sequence and the standard behavior path in the historical trajectory. A behavior chain sequence refers to a series of operational behaviors arranged in chronological order before and after the current operation, which is used to express the temporal evolution of the behavior. A standard behavior path is a type of behavior chain in the historical trajectory that appears frequently and has a stable structure in this type of behavior cluster. Dynamic Time Warping (DTW) is a method for measuring the similarity between two time series under different time alignment methods. It can handle situations where the sequence lengths are different or the execution rhythm is inconsistent. This indicator measures the synchronization of the current behavior sequence and rhythm with historical expectations, and is a precise quantification of the behavior evolution path in the time dimension.

[0030] When the context structure deviation value is greater than the preset deviation judgment threshold, and the behavior sequence deviation index exceeds the preset path similarity limit, the current behavior is considered to have significantly deviated from the historical behavior evolution template, and the judgment conditions for activating the abnormal intention assessment process are met. Here, the "preset deviation judgment threshold" and "path similarity limit" are both identification boundaries set by the system based on a large amount of historical data experience, which are used to distinguish between normal behavior fluctuations and abnormal behavior deviations. When both indicators meet the deviation conditions at the same time, it means that the current behavior cannot reasonably match the historical evolution pattern in terms of semantic structure and behavior rhythm, and has potential abnormal intentions. The system will immediately activate the abnormal intention assessment process and enter the subsequent more in-depth behavior rationality assessment link.

[0031] For example, in a certain smart meter box operation, the user's operation time was significantly earlier than his usual time period, and the accompanying voltage and current states were statistically different from previous operations. The behavior path showed a jumping pattern that did not conform to the conventional "operation-reading-recovery" sequence. At this time, the system comparison found that its context structure deviation value exceeded 0.6 and the sequence offset index exceeded the reasonable tolerance limit, that is, it was judged as an atypical operation, triggering subsequent intention recognition processing.

[0032] The generation of the intention rationality credibility index includes the following processing steps: For each operation behavior in the behavior chain sequence, a behavior node representation vector is constructed in chronological order. Each representation vector is composed of a timestamp, electrical state characteristics, and event type code combination, which is used to express the semantic position of the behavior in the behavior chain sequence. By constructing a behavior causal relationship tensor to represent the semantic dependency between any two behavior nodes, this tensor is based on the inner product between the behavior node representation vectors and sets a decay factor based on the node time interval to reflect the dynamic change characteristics of the behavior causal relationship in the time dimension. Perform a structured comparison between the current behavior causal relationship tensor and the standard behavior tensor constructed from the historical expected behavior sequence. Calculate the strategic path deviation score based on the cumulative difference between all valid behavior pairs in the tensor to reflect the overall structural deviation between the current behavior chain sequence and the historical expected behavior sequence. The strategy path deviation score is input into the confidence mapping function, and the structural deviation is mapped into a confidence score using a nonlinear compression mechanism. This score is the credibility index of intention rationality. The closer the value is to the upper limit of the interval, the stronger the strategy consistency between the current behavior chain sequence and the historical expected behavior sequence, thereby achieving a quantitative assessment of whether the operational behavior conforms to the behavior evolution logic.

[0033] The generation of the intention rationality credibility index specifically includes the following processing steps: Behavior node representation vector generation: for each behavior node in the behavior chain sequence Constructing semantic representation vectors , consists of the following three parts: ; : Normalized timestamp (0-1 scale) of when behavior i occurred. : event type encoding corresponding to behavior i (one-hot or embedding vector); : The electrical state characteristics (current, voltage, power, etc.) at the time behavior i occurs. "Concat" is short for "concatenate," commonly used for concatenating vectors or features. This operation concatenates data from multiple dimensions into a longer vector in a specific order. This step "semantically structures" discrete behaviors, paving the way for subsequent causal modeling.

[0034] Causal tensor construction: Construct a three-dimensional tensor C to represent the causal dependency between behavioral nodes: ; Respectively The representation of a behavior node, is the time interval difference (normalized), It is a semantic dependency function with the following structure: ; : inner product operation, : A learnable alignment matrix, initialized to the identity matrix, : Sigmoid activation function, used to map to dependent probability, : Time decay coefficient, discovers the nonlinear time-dependent logical relationship between behavior nodes through syntactic graph modeling, and is suitable for complex behavior evolution chains.

[0035] Policy path consistency comparison (structural distribution reconstruction): using a benchmark tensor obtained from historical expected behavior sequences , the current behavior tensor Compare the structure consistency with it and calculate the path structure consistency score : ; : The total number of valid non-zero behavior pairs in the tensor, the path structure consistency score The smaller it is, the more consistent the structural path is. i, j: represent the index of the behavior node in the behavior chain sequence, such as: the first behavior node, the second behavior node. In this context, k is used as the "semantic dependency type dimension" or "behavior causal feature dimension index", which represents the characterization of a certain type of causal dependency relationship. The first dimension: behavior node i; the second dimension: behavior node j; the third dimension: k, which represents the various dependency attributes that may exist between each pair of i and j (such as time sequence, state transition, behavior co-occurrence, etc.). For example: k=1: represents "time priority" dependency; k=2: represents "state-driven" dependency; k=3: represents "frequency linkage" dependency, which enables the three-dimensional structure of the tensor C to not only represent "whether there is a causal relationship between nodes", but also distinguish different semantic dimensions of causal relationships.

[0036] Generate intention rationality credibility index: ; is the credibility index of intention rationality, path structure consistency score That is the strategy path deviation value (previous step output), The preset sensitivity coefficient (empirically set, such as 2-5) is introduced to nonlinearly map the difference in behavioral structure to "confidence decay" and limit it to the interval [0,1). Different from the anti-abnormal transactions in financial scenarios, here we emphasize the confidence in the consistency of behavior and strategy.

[0037] The generation of the context offset aggregation index includes the following processing steps: The behavior triggering time, electrical operation characteristics and environmental variables are uniformly extracted at each time node and combined into a context response vector sequence; Based on the context response vector sequence, a multi-source behavior response distribution under the current operating state is constructed through multi-kernel density mapping to represent the structural distribution of behavioral, electrical and environmental characteristics in the joint feature space. The current multi-source behavior response distribution is structurally compared with a reference distribution constructed from historical stable operation data to obtain an offset feature tensor. Based on this, two key quantitative indicators are extracted from the offset feature tensor: the directional variation intensity, which reflects the degree of disturbance of the current context state in the temporal dimension; and the coupling aggregation degree, which characterizes the offset aggregation trend between features. Based on the nonlinear combination of directional variation intensity and coupling aggregation degree, the exponential compression and logarithmic fusion method is used to perform a weighted evaluation of the relationship between disturbance intensity and structural coupling, and the contextual offset aggregation index is calculated. The output value is used to measure the global offset degree of the current behavior in the comprehensive spatiotemporal operating environment.

[0038] The multi-source behavior response distribution is used to characterize the density pattern of coordinated changes in behavior trigger time, electrical operating characteristics, and environmental variables in a joint space, reflecting the global distribution of the current behavior context in a multidimensional dynamic feature field. Its construction process includes the following steps: Based on the behavior context information group, contextual features corresponding to each time node are extracted one by one, including the behavior trigger time, a set of electrical parameters (such as voltage, current, and active power), and a set of environmental variables (such as temperature, humidity, and cabinet vibration level). These three types of features are then concatenated at the vector level in a fixed order to form a set of contextual feature vectors with a unified structure. This set of feature vectors is then normalized to ensure that all features have a uniform scale in the numerical space, providing a basis for comparison and clustering. The normalized set of contextual feature vectors is then projected onto a set of preset kernel mapping functions to obtain their probability density distribution in a low-dimensional embedding space. The kernel mapping function can be selected based on the application scenario to provide high smoothness and robustness, thereby characterizing the nonlinear coupling relationship between contextual features in the joint space. During the density estimation process, a local neighborhood search mechanism is used to identify similar context clusters, and an overall joint distribution map is constructed based on the local distribution density trend of the point set. This joint density map is structured into a high-dimensional probabilistic response representation, which is the multi-source behavior response distribution. This representation is used to compare the difference with the historical stable state distribution in the subsequent context shift assessment to identify the context shift trend and intensity. The specific explanation is as follows: Construct a standardized context response vector set and define the context vector at each time point: ; is the standardized timestamp of the triggering moment of the i-th behavior, is the electrical characteristic vector (including current, voltage, power, etc.) at the time of triggering the i-th behavior, is the environmental variable feature (such as temperature, humidity, vibration) at the time of triggering the i-th behavior, all context vectors Constitute the sequence U.

[0039] Construct a multi-source behavior response distribution: take U as input and use the distribution mapping function based on kernel density estimation , generate the context perturbation field distribution: ; Based on the Gaussian kernel density function, we learn the joint distribution structure of various features in U in the low-dimensional mapping space. It is a multi-source behavior response distribution body, which represents the density area change map of the current context feature set in the joint space.

[0040] Compare with the historical reference distribution and calculate the structural offset tensor: Extracting reference distribution from historical stable operation data , calculate the structure offset tensor : ; Then the offset tensor Perform the following two tensor feature transformations: Directional variation intensity : ; Directional variation intensity Used to measure whether the distribution of offset varies dramatically over time. Represents the first feature dimension index in the joint context vector dimension, such as a specific indicator dimension of time, environment, or electricity; Represents the second feature dimension index in the joint context vector dimension, which is used to form the second axis of the stereo feature tensor (i.e. corresponding feature pair combinations); The time window index representing the current moment or current behavior segment, such as a sliding time slice divided by the behavior timing window; Indicates the current time window Structural offset value for feature dimension; Indicates the value of the historical average offset strength on the dimension pair, which is used to provide a "static structure benchmark"; directional variation strength The essential function of is to measure the intensity of the change trend between the joint feature dimensions of the behavior process in different time windows.

[0041] Coupling degree : ; Coupling degree Used to measure the intrinsic aggregation between all feature dimensions under offset conditions. It is the structure offset tensor, which is processed into a two-dimensional matrix form (behavior dimension × joint feature dimension after expansion) in the simplified expression; is the transposed matrix of the offset tensor, that is, the feature dimension and the behavior dimension are swapped; is the trace of the matrix, that is, the sum of the main diagonal elements of the product matrix; in mathematical statistics, the matrix trace is used to measure the overall energy or information aggregation of the matrix. What is actually measured is the aggregation strength and correlation of the joint context structure offset in each feature dimension. The larger the value, the more concentrated the offset structure and the more prominent the abnormal coupling feature.

[0042] Generate context-shifted aggregate index: Introduce an index synthesis method based on "double-factor entropy compression" to obtain the final index: ; λ1 and λ2 control the parameters of the two offset dimensions affecting the weight (which can be adjusted according to different application requirements), δ is the preset nonlinear exponential suppression factor (such as 1.2-1.5), is the context offset aggregation index.

[0043] The intention rationality credibility index and context deviation aggregation index are input into the pre-trained intention recognition learning model for comprehensive deconstruction analysis, including: based on the joint feature combination of the two indexes, fuzzy membership matching and strategy deviation evaluation are performed in the rule knowledge base through the fuzzy logic reasoning mechanism, and the intention deviation level score of the current behavior in the semantic cognitive space is output to reflect the behavioral intention of the current operation behavior relative to the system internal strategy model. Figure 1 The degree of consistency. Among them, the intention rationality credibility index is a scoring indicator used to measure whether the current behavior chain sequence follows the law of historical behavior evolution. It has been generated through the behavior path structure comparison in the previous step; the context offset aggregation index is used to reflect the degree of global coupling offset between the current operating behavior and the normal state under the electrical state, environmental variables and timing background. As key variables in behavioral intention identification, the two describe the current behavior from the two dimensions of consistency of the strategy execution path and rationality of the external operating environment. In order to integrate the two more effectively, the system combines the two indices into a joint feature input to describe the comprehensive performance of the current behavior in multidimensional space.

[0044] The fuzzy logic reasoning mechanism is an intelligent judgment system based on "human analogical reasoning". Its essence is to use fuzzy sets and fuzzy rules to replace traditional hard judgment logic, thereby improving the system's ability to distinguish uncertain and boundary behaviors. In the present invention, the fuzzy logic reasoning mechanism relies on a rule knowledge base, which is constructed during the model training phase. Its core is a set of fuzzy rules that reflect the evolution of user behavior intentions. Each rule is based on a large number of historical behavior samples to extract the fuzzy membership range and the corresponding policy deviation level. For example: "If the intention credibility index is high and the deviation index is low, the behavior is a high consistency intention"; "If the credibility index is low and the deviation index is high, the behavior is a deviation intention."

[0045] Fuzzy membership matching converts the two input exponential values into membership values on multiple fuzzy sets, which are then used to match matching rules within the rule knowledge base. Policy deviation assessment synthesizes the results of all matching rules and outputs a score for the current behavior's deviation from the semantic cognitive space. The semantic cognitive space here refers to the system's internal, abstract cognitive representation of the three-way relationship between behavioral structure, motivation, and outcome. A higher score indicates that the behavior is more difficult to fit into the known paradigm of the system's policy model, and the more inconsistent the intention is.

[0046] The intent recognition learning model builds a multi-dimensional input fuzzy rule matrix based on the historical behavioral intention decision boundaries extracted during the training phase. During the training phase, the system clusters and summarizes the labeled historical behavioral data according to their behavioral intention levels, extracting a set of nonlinear fuzzy correspondences between inputs and outputs. It then divides the input space into multiple fuzzy decision intervals, each of which represents the strategic recognition characteristics of a type of intent pattern.

[0047] During the model inference process, the system sequentially performs rule fusion, weight adjustment, and output layer clarity conversion operations. Rule fusion refers to the weighted integration of multiple activated fuzzy rules at the result level to form a unified fuzzy output; weight adjustment is the dynamic correction of each activated rule based on its confidence level and historical matching accuracy; output layer clarity conversion, also known as "defuzzification," uses methods such as the centroid method and the maximum membership method to convert the fuzzy output into a single score value, that is, the intention deviation grade score.

[0048] For example, in practice, if a behavioral operation has an intentional legitimacy confidence index of 0.65 and a deviation aggregation index of 0.72, the system inputs this into the model and matches three medium-deviation rules and one high-risk rule. After rule fusion and weight adjustment, the system outputs a score of 0.83, falling into the "high deviation" range. This score is the system's quantitative judgment that the current behavior "may have illegal intent," providing a basis for decision-making in selecting subsequent behavioral response strategies.

[0049] Behavioral response strategies are implemented based on the risk range assigned to the intent deviation level score, including the following: freezing behavioral features, annotating risk labels, restricting access rights, and providing anomaly warnings. The intent deviation level score, generated during the aforementioned model inference process, is a scoring metric output by the intent recognition learning model that quantifies the difference in cognitive consistency between the current behavior and the system's internal policy model. This score is generally a continuous value and can be divided into multiple risk ranges based on the application scenario, with each risk range corresponding to a level of behavioral intent deviation. Risk ranges are divided based on the system's statistical analysis of historical behavioral data and security policy settings. For example, they can be divided into four levels: "low risk range" (highly consistent intent), "medium risk range" (acceptable but fluctuating intent), "medium-high risk range" (possible out-of-bounds behavior), and "high risk range" (highly suspicious intent).

[0050] A behavioral response strategy refers to the specific operational mechanisms the system employs to control the execution of an action, record its characteristics, or issue an intervention warning when it detects a potential risk. The goal of this strategy system is to achieve safety protection, risk recording, and proactive control at the behavioral level of smart meter boxes.

[0051] Behavior feature freezing means that after identifying a behavior as being within a suspicious range, the system structurally freezes the contextual information associated with that behavior. This locks all characteristic data for that behavior (including time, electrical status, environmental information, and operational commands), preventing it from being updated or overwritten by subsequent behavior training models. This facilitates traceability analysis, risk verification, or model optimization. For example, if a behavior's deviation score reaches a medium- or high-risk threshold, the system stores its context as "read-only data" to prevent it from being obscured by other behaviors.

[0052] Risk labeling refers to the process of attaching a risk-labeled information structure to a behavior instance after the system identifies a specific behavior as exhibiting certain risk characteristics. This structure identifies its risk status within the behavior chain, facilitating the rapid identification and screening of suspicious operations within the subsequent behavior sequence. This label can include metadata such as risk level, hit rule number, and trigger time. For example, if an operation scores 0.78, the system will label it "Medium Risk - Sequence Inconsistency" and store it in the log system.

[0053] Access restriction involves the system partially blocking, delaying, or freezing the user identities or operational permissions associated with behaviors identified as potentially anomalous. This prevents potential risky behaviors from further impacting the system. This restriction can take the form of blacklist and whitelist controls, behavior rate limits, and command range limits. For example, if a user's three operations are all marked as "significant deviation from intent," the system will restrict their remote closing and opening permissions to read-only and notify operations and maintenance personnel for manual review.

[0054] Abnormal warning means that when the intention deviation level score reaches the high-risk range, the system automatically triggers the sending of structured warning information to the remote operation and maintenance platform, monitoring center or security management console, and can be accompanied by operations such as record solidification, event reporting and active blocking. The warning information includes: operating user identification, behavioral feature summary, score value, corresponding rule trigger record, current risk level recommended disposal plan and other content. For example, a remote tripping operation score during non-working hours in the early morning was as high as 0.91. The system immediately issued a "level one risk behavior alarm" to the background security console and froze the behavior execution request to prevent the system from being illegally interfered with. Through the hierarchical execution of the above-mentioned behavioral response strategies, the system can respond appropriately and actively defend in different levels of behavioral risk scenarios, realize full-process risk control and policy intervention of the operation behavior of the smart meter box, and ensure the stability, security and policy consistency of the metering device operation.

[0055] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0056] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0057] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0058] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0059] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for detecting abnormal operation of a smart meter box, characterized in that: The following steps are involved: Build a behavior context information group based on the meter box operation data, and then determine whether to activate the abnormal intention assessment process based on the comparison results of the current behavior context information group and the historical behavior evolution template; After activating the abnormal intention assessment process, a behavior chain sequence is generated based on the context information group. The current operation behavior is progressively modeled along the time dimension. The behavior causal tensor encoding method is used to represent the semantic dependency relationship between behavior nodes. The intention rationality credibility index is calculated by comparing the behavior path structure. It is used to measure the strategic consistency between the current behavior and the historical expected behavior sequence. Based on the context information group, the coupling distribution pattern between behavior triggering time, electrical operation characteristics and environmental variables is extracted, and a high-order feature offset structure is constructed. The context offset aggregation index is calculated through the context state modeling method to quantify the offset degree of the current behavior in the comprehensive spatiotemporal operation environment. The intention rationality credibility index and context deviation aggregation index are input into the pre-trained intention recognition learning model for comprehensive deconstruction analysis, and the intention deviation level score is output to quantify the degree of cognitive difference between the current behavior and the system's internal policy model. The behavioral response strategy is then executed based on the risk range to which the intention deviation level score belongs.

2. The method for detecting abnormal operation of a smart meter box according to claim 1, characterized in that: The historical behavior evolution template is a preset record sequence of multidimensional behavior data that is consistent with the current behavior context information group. This record sequence is derived from the long-term operation data of the meter box. After being expressed in vector form through behavioral semantic labels, operation timing, and electrical change characteristics, it is clustered using a multi-center behavior evolution clustering method. Each clustering result corresponds to a group of behavior evolution expressions with similar context features and similar behavior trajectories.

3. The method for detecting abnormal operation of a smart meter box according to claim 2, characterized in that: The process of determining whether to activate abnormal intention assessment includes: matching the current behavior context information group with the closest clustering result in the clustering results, and calculating the context structure deviation value and behavior sequence deviation index respectively; The context structure deviation value is the deviation amplitude reflected by the cosine similarity or Euclidean distance between the current behavior context vector and the cluster center vector, which measures whether the semantic structure of the behavior context deviates from the core feature of the cluster; The behavior sequence deviation index is the dynamic time-warping distance between the current behavior chain sequence and the standard behavior path in the historical trajectory, which measures the synchronization of the behavior sequence and rhythm with historical expectations; When the context structure deviation value is greater than the preset deviation judgment threshold and the behavior sequence offset index exceeds the preset path similarity limit, it is considered that the current behavior deviates significantly from the historical behavior evolution template, meeting the judgment conditions for activating the abnormal intention assessment process.

4. The method for detecting abnormal operation of a smart meter box according to claim 3, characterized in that: The generation of the intention rationality credibility index includes the following processing steps: For each operation behavior in the behavior chain sequence, a behavior node representation vector is constructed in chronological order. Each representation vector is composed of a timestamp, electrical state characteristics, and event type code combination, which is used to express the semantic position of the behavior in the behavior chain sequence. By constructing a behavior causal relationship tensor to represent the semantic dependency between any two behavior nodes, this tensor is based on the inner product between the behavior node representation vectors and sets a decay factor based on the node time interval to reflect the dynamic change characteristics of the behavior causal relationship in the time dimension. Perform a structured comparison between the current behavior causal relationship tensor and the standard behavior tensor constructed from the historical expected behavior sequence. Calculate the strategic path deviation score based on the cumulative difference between all valid behavior pairs in the tensor to reflect the overall structural deviation between the current behavior chain sequence and the historical expected behavior sequence. The strategy path deviation score is input into the confidence mapping function, and a nonlinear compression mechanism is used to map the structural deviation into a confidence score, which is the intention rationality credibility index.

5. The method for detecting abnormal operation of a smart meter box according to claim 4, characterized in that: The generation of the context offset aggregation index includes the following processing steps: The behavior triggering time, electrical operation characteristics and environmental variables are uniformly extracted at each time node and combined into a context response vector sequence; Based on the context response vector sequence, a multi-source behavior response distribution under the current operating state is constructed through multi-kernel density mapping to represent the structural distribution of behavioral, electrical and environmental characteristics in the joint feature space. The current multi-source behavior response distribution is structurally compared with a reference distribution constructed from historical stable operation data to obtain an offset feature tensor. Based on this, two key quantitative indicators are extracted from the offset feature tensor: the directional variation intensity, which reflects the degree of disturbance of the current context state in the temporal dimension; and the coupling aggregation degree, which characterizes the offset aggregation trend between features. Based on the nonlinear combination of directional variation intensity and coupling aggregation degree, the exponential compression and logarithmic fusion method is used to perform a weighted evaluation of the relationship between disturbance intensity and structural coupling, and the contextual offset aggregation index is calculated. The output value is used to measure the global offset degree of the current behavior in the comprehensive spatiotemporal operating environment.

6. The method for detecting abnormal operation of a smart meter box according to claim 5, characterized in that: The intention rationality credibility index and context deviation aggregation index are input into the pre-trained intention recognition learning model for comprehensive deconstruction analysis, including: based on the joint feature combination of the two indices, fuzzy membership matching and policy deviation evaluation are performed in the rule knowledge base through the fuzzy logic reasoning mechanism, and the intention deviation level score of the current behavior in the semantic cognitive space is output to reflect the degree of consistency of the current operation behavior with the behavior intention of the system internal policy model.

7. The method for detecting abnormal operation of a smart meter box according to claim 6, characterized in that: Execute behavioral response strategies based on the risk range to which the intention deviation level score belongs, including the following behavioral response strategies: Behavioral feature freezing, risk label annotation, access permission restriction and abnormal warning.

Images