Intelligent meter box operation anomaly detection method

Abstract

The application discloses a smart meter box operation anomaly detection method, in particular to the electric power information technology field, based on the meter box operation data to construct the behavior context information group, match the historical behavior evolution template to judge whether to activate the abnormal intention evaluation process; if activated, generate the behavior chain sequence and calculate the intention rationality credibility index; extract the electrical characteristics and environmental variables to calculate the context offset aggregation index; input the two indexes into the pre-training model, output the intention deviation grade score, and execute the behavior characteristic freezing, risk label annotation, access permission restriction or abnormal early warning and other response strategies according to the risk interval to which the score belongs; the application realizes the abnormal intention recognition and risk grade scoring of the smart meter box operation behavior by constructing the behavior context information group, establishing the behavior chain sequence and the context state modeling, combining the pre-training intention recognition model, and then executing the response strategy in stages, which improves the accuracy, intelligence and response efficiency of the abnormal recognition.

Description

Technical Field

[0001] This invention relates to the field of power information technology, and more specifically, to a method for detecting abnormal operation of intelligent metering boxes. Background Technology

[0002] With the continuous development of smart grids and digital power distribution systems, smart metering boxes, as data acquisition and control terminals connecting the user side and the distribution side, have become key equipment in the operation and monitoring of low-voltage power distribution networks. Smart metering boxes integrate functions such as energy metering, data communication, switch control, and status sensing, enabling real-time monitoring and remote management of electricity consumption behavior. They play a vital role in scenarios such as refined grid operation and maintenance, user-side energy efficiency management, anti-theft electricity use, and fault early warning.

[0003] In actual operation, smart metering boxes face various types of anomaly risks, including natural anomalies caused by electrical system fluctuations, communication interruptions, and hardware failures, as well as non-natural anomalies caused by human actions such as unauthorized access, operational tampering, and parameter forgery. To address these risks, existing technologies have proposed several rule-based and model-based anomaly detection methods:

[0004] On the one hand, rule-based detection methods rely on manually set threshold values, such as upper and lower limits for physical quantities like voltage, current, and power factor, to determine whether values ​​have exceeded the limits. These methods are simple to implement and respond quickly, but they are difficult to adapt to the multi-dimensional data linkage characteristics in complex scenarios and are highly sensitive to abnormal pattern changes, easily leading to false alarms or missed alarms.

[0005] On the other hand, detection methods based on statistical analysis or shallow learning models attempt to identify anomalies by mining time-series features, trend changes, or outlier behaviors in electrical data. These methods have greater generalization ability than rule-based methods, and some studies have also integrated auxiliary information such as communication behavior, lid opening status, and environmental sensors to improve the dimensionality and granularity of detection. However, these methods generally rely on the assumption of "whether the observed data deviates from the normal distribution," and essentially remain at the level of monitoring behavioral outcomes, unable to gain a deep understanding of the motivations, intentions, or contextual environments behind the operational behavior.

[0006] More importantly, most current technologies process operational behavior in an "isolated" or "linear" manner, ignoring the evolutionary path of user behavior in different scenarios, the causal logic between behavioral chains, and the dynamic relationship between behavior and its context. In other words, even if a behavior is numerically normal, it may still pose an anomaly risk because it appears "illogical" in its current context. Such "non-obvious anomalies" are often difficult to identify using traditional technologies. Therefore, this invention proposes a method for detecting operational anomalies in intelligent metering boxes to address the aforementioned problems. Summary of the Invention

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] The method for detecting abnormal operation of intelligent metering boxes includes the following steps:

[0009] A behavioral context information group is constructed based on the metering box operation data. Then, based on the comparison results between the current behavioral context information group and the historical behavioral evolution template, it is determined whether to activate the abnormal intent assessment process.

[0010] After activating the abnormal intent assessment process, a behavior chain sequence is generated based on the context information group. The current operation behavior is progressively modeled according to the time dimension. The semantic dependency relationship between behavior nodes is represented by the behavior causal tensor encoding method. The intent rationality credibility index is obtained by comparing the behavior path structure and used to measure the strategy consistency between the current behavior and the historical expected behavior sequence.

[0011] Based on the context information group, the coupling distribution pattern between behavior trigger time, electrical operation characteristics and environmental variables is extracted, a high-order feature offset structure is constructed, and the context offset aggregation index is calculated by the context state modeling method to quantify the degree of offset of the current behavior in the comprehensive spatiotemporal operation environment;

[0012] The intent rationality credibility index and the context offset aggregation index are input into the pre-trained intent recognition learning model for comprehensive deconstruction analysis, and the intent deviation level score is output to quantify the degree of cognitive difference between the current behavior and the internal strategy model of the system. Then, the behavior response strategy is executed according to the risk range to which the intent deviation level score belongs.

[0013] In a preferred embodiment, the historical behavior evolution template is a pre-defined sequence of multi-dimensional behavior data that is consistent with the current behavior context information group. This sequence of data is derived from the long-term operation data of the metering box. After being expressed as a vector by behavior semantic labels, operation timing, and electrical change characteristics, it is clustered using a multi-center behavior evolution clustering method. Each clustering result corresponds to a set of behavior evolution expressions with similar context features and similar behavior trajectories.

[0014] In a preferred embodiment, determining whether the abnormal intent assessment process is activated includes: matching the current behavioral context information group with the cluster result that is closest to the cluster result, and calculating the context structure deviation value and the behavioral sequence offset index respectively.

[0015] The context structure deviation value is the magnitude of the deviation reflected by the cosine similarity or Euclidean distance between the current behavior context vector and the cluster center vector, which measures whether the semantic structure of the behavior context deviates from the core features of the cluster.

[0016] The behavior sequence offset index is the dynamic time warping distance between the current behavior chain sequence and the standard behavior path in the historical trajectory, which measures the synchronicity between the order and rhythm of behavior occurrence and historical expectations.

[0017] When the context structure deviation value is greater than the preset deviation judgment threshold and the behavior sequence offset index exceeds the preset path similarity limit, it is considered that the current behavior deviates significantly from the historical behavior evolution template, thus meeting the judgment conditions of the activation abnormal intent assessment process.

[0018] In a preferred embodiment, the generation of the intent rationality credibility index includes the following processing steps:

[0019] For each operation in the action chain sequence, a action node representation vector is constructed in chronological order. Each representation vector is composed of a timestamp, electrical state features and event type encoding, which is used to express the semantic position of the action in the action chain sequence.

[0020] By constructing a behavior causality tensor, the semantic dependency between any two behavior nodes is represented. This tensor is based on the inner product between the behavior node representation vectors and combines the node time interval to set a decay factor to reflect the dynamic change characteristics of behavior causality in the time dimension.

[0021] The current behavior causal relationship tensor is structurally compared with the standard behavior tensor constructed from the historical expected behavior sequence. The strategy path deviation score is calculated based on the cumulative difference between all valid behavior pairs in the tensor, which is used to reflect the overall structural deviation between the current behavior chain sequence and the historical expected behavior sequence.

[0022] The strategy path deviation score is input into the confidence mapping function, and the structural deviation is mapped to a confidence score using a nonlinear compression mechanism. This score is the credibility index of intention rationality. The closer the value is to the upper limit of the interval, the stronger the strategy consistency between the current behavior chain sequence and the historical expected behavior sequence, thereby realizing a quantitative assessment of whether the operation behavior conforms to the logic of behavior evolution.

[0023] In a preferred embodiment, the generation of the context offset aggregation index includes the following process:

[0024] The behavior trigger time, electrical operation characteristics, and environmental variables are uniformly extracted at each time point and combined into a sequence of context response vectors;

[0025] Based on this context response vector sequence, a multi-source behavioral response distribution body under the current operating state is constructed through multi-kernel density mapping, which is used to represent the structural distribution of behavioral, electrical and environmental features in the joint feature space;

[0026] The current multi-source behavioral response distribution is structurally compared with the reference distribution constructed from historical stable operating data to obtain the offset feature tensor. Based on this, two key quantitative indicators are extracted from the offset feature tensor: one is the direction variation intensity, which reflects the degree of perturbation of the current context state in the temporal dimension; the other is the coupling aggregation degree, which characterizes the offset aggregation trend between features.

[0027] Based on the nonlinear combination of directional variation intensity and coupling aggregation degree, an exponential compression and logarithmic fusion method is used to weight the evaluation of the disturbance intensity and structural coupling relationship, calculate the context offset aggregation index, and the output value is used to measure the global offset degree of the current behavior in the integrated spatiotemporal operating environment.

[0028] In a preferred embodiment, the intent rationality credibility index and the context offset aggregation index are input into a pre-trained intent recognition learning model for comprehensive deconstruction analysis. This includes: based on the joint feature combination of the two indices, performing fuzzy membership matching and policy deviation evaluation in a rule knowledge base through a fuzzy logic reasoning mechanism, and outputting an intent deviation level score of the current behavior in the semantic cognitive space, which reflects the behavioral intent of the current operation relative to the system's internal policy model. Figure 1 The consistency level of the intent recognition learning model is based on the historical behavioral intent decision boundary extracted during the training phase. It establishes a multi-dimensional input fuzzy rule matrix and performs rule fusion, weight adjustment and output layer clarification transformation operations during the model inference process, thereby realizing intelligent judgment on whether the current behavior has potential abnormal intent.

[0029] In a preferred embodiment, behavioral response strategies are executed based on the risk range to which the intention deviates from the rating score, including the following behavioral response strategies:

[0030] Behavioral characteristics freezing, risk label annotation, access restriction, and abnormal warning.

[0031] The technical effects and advantages of this invention are as follows:

[0032] This invention enables dynamic contextual awareness and intelligent risk assessment of the operational behavior of smart metering boxes. By constructing a behavioral context information group based on metering box operation data and comparing it with historical behavior evolution templates, this invention achieves a structured expression and dynamic evaluation of the current operational state. When the current behavior exhibits characteristics that significantly deviate from historical patterns, the system can automatically determine whether to activate the subsequent abnormal intent assessment process, thereby establishing a linkage mechanism from behavioral scenario awareness to anomaly detection, improving the system's proactive identification and responsiveness to potential abnormal behaviors.

[0033] This invention quantifies the consistency of behavioral strategies based on behavioral chain modeling, enhancing the ability to determine the rationality of operations. After activating the abnormal intent assessment process, this invention constructs the evolutionary structure of operational behavior by modeling the behavioral chain sequence over time, and extracts the semantic dependencies between behavioral nodes using the behavioral causal tensor encoding method, achieving a structured abstraction of the operational strategy execution path. By comparing the current behavioral path structure with historical expected behavioral sequences and calculating the intent rationality credibility index, the system can quantify whether the current behavior conforms to a known strategy pattern, thus providing a clear structural basis for judging the rationality of behavior and significantly improving the accuracy of identifying deviations from the strategy.

[0034] This invention integrates behavioral structure and contextual state indicators for intelligent analysis, enabling graded response control based on behavioral risk levels. Building upon behavioral structure modeling, the invention further extracts the coupling relationships between behavioral triggering time, electrical operating characteristics, and environmental variables, establishing a high-order feature offset structure and calculating a context offset aggregation index. Subsequently, the system inputs the intent rationality and credibility index and the context offset aggregation index into a pre-trained intent recognition learning model, outputting an intent deviation level score for the current behavior. Based on the risk range to which this score belongs, the system can execute behavioral response strategies, from behavioral feature control and risk isolation to anomaly warnings, achieving dynamic response to behavioral risk levels and effectively enhancing the safety management capabilities of intelligent metering boxes during operation. Attached Figure Description

[0035] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0036] Figure 1 This is a schematic diagram of the intelligent metering box operation anomaly detection method in this invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0038] Reference Figure 1 The following examples were obtained:

[0039] Example 1: A method for detecting abnormal operation of a smart metering box, comprising the following steps:

[0040] Step 1: Construction and Evaluation of Behavioral Context Information Group. During the operation of the smart metering box, the system first constructs a behavioral context information group for the current moment by collecting and processing the metering box's operational data in real time. This information group comprehensively reflects multiple dimensions such as user operation behavior, electrical operating status, communication activities, and environmental conditions, forming the semantic expression basis of the current behavior's operating environment. To determine whether the current behavior has potential abnormal intent, the system performs a structured comparison of this behavioral context information group with a historical behavior evolution template generated based on historical stable operating data. Combining the context structure deviation and the degree of behavior temporal offset, the system performs a preliminary screening for the normality of the behavior. When the comparison results show that the current behavior deviates significantly from the historical behavior evolution path in terms of structure or rhythm, the system will actively activate the abnormal intent evaluation process, providing a data input basis for subsequent deeper intent recognition.

[0041] Step Two: Behavioral Chain Sequence Modeling and Intent Rationality Credibility Index Generation. After the abnormal intent assessment process is activated, the system further mines key behavioral data in the behavioral context information group, progressively models the current operation behavior based on the time dimension, and constructs a behavioral chain sequence. Each behavioral node is represented by multiple feature dimensions such as timestamp, electrical state, and operation type, and the semantic dependencies between nodes are identified through the behavioral causal tensor encoding method, thereby constructing a structural representation that reflects the logic of behavioral evolution. The system then compares the causal relationship structure formed by the current behavioral chain sequence with the historical expected behavioral sequence to calculate its strategy path deviation, and generates an intent rationality credibility index based on a nonlinear mapping function. This index reflects whether the current behavior conforms to the strategy patterns accumulated by the system over long-term operation, and is used to characterize the consistency of user operation strategies and the compliance of behavior.

[0042] Step 3: Context State Modeling and Offset Aggregation Index Calculation. The system further extracts behavior trigger time, electrical operation characteristics, and environmental variables from the behavior context information group, and constructs a set of context response vectors on the time series of these multi-source features, forming a multi-dimensional joint state representation. To assess whether the current context state is within reasonable boundaries, the system constructs a high-order feature offset structure through kernel density mapping and tensor transformation, and analyzes the degree of distribution offset of the behavior context in the joint feature space based on this. In this process, the system extracts two indicators: direction variation intensity and coupling aggregation degree, which are used to characterize the perturbation characteristics of the behavior context state on the time series and the offset coordination between different features, respectively. Finally, the system nonlinearly combines these two indicators to calculate and generate a context offset aggregation index, which is used to measure whether the current behavior is within the expected operating environment coupling boundary range.

[0043] Step 4: Jointly input the intent recognition model and output an intent deviation level score. To further quantify the degree of deviation of the current behavior under the policy model, the system uses the intent rationality credibility index and the context offset aggregation index as joint input variables, which are then input into the pre-trained intent recognition learning model for comprehensive deconstruction and analysis. This model uses fuzzy logic as its core reasoning mechanism, combining a rule base and policy deviation boundaries built during training with historical behavior data to perform membership matching and fuzzy rule reasoning on the current input, outputting an intent deviation level score for the current behavior. This score comprehensively reflects both the consistency of the behavioral strategy and the rationality of the context environment, serving as an important basis for the system to identify potential abnormal intents and determine the risk level of the behavior.

[0044] Step 5: Implement response strategies based on the scoring to achieve behavioral intervention and control. Based on the aforementioned intention deviation level scoring results, the system implements corresponding behavioral response strategies according to the risk range of the score to ensure the compliance and stability of the smart meter box's operation. At a low risk level, the system records the current behavioral trajectory and maintains its behavioral state unchanged; at a medium to high risk level, the system can freeze behavioral features or attach risk tags for behavioral observation and tracking; and when the score reaches a high risk level, the system will restrict the current behavior's access permissions in future operations and, if necessary, trigger a remote anomaly warning mechanism to transmit alarm information to the operation and maintenance management center, thereby achieving intelligent control and intervention of potential non-obvious abnormal behaviors in the operation of the smart meter box.

[0045] The historical behavior evolution template is a pre-defined sequence of multi-dimensional behavioral data records that are consistent with the current behavioral context information set. The behavioral context information set refers to a time-related set of data collected by the metering box during operation, comprising user operation behavior, electrical operating status, and related environmental variables, used to characterize the occurrence conditions and state characteristics of a certain behavior under a specific operating background. "Consistent with the current behavioral context information set" means that these record sequences have the same data structure and expression method as the context information set used by the current behavior to be detected in terms of feature dimensions, semantic structure, and sampling standards, thus enabling comparative analysis.

[0046] This record sequence originates from long-term operational data of the metering box, specifically historical user behavior data, electrical parameter changes, and external environmental changes accumulated in a time-series manner during the system's normal operation cycle, forming a data sample set with time-evolution attributes. To improve representation accuracy, the system first annotates these data samples with behavioral semantic tags. These tags are abstract expressions of the meaning of user operations, such as "meter reading request," "remote tripping," and "box opening detection." Secondly, it extracts the operation timing, normalizing or periodically encoding the relative occurrence time of each behavioral event in the sequence to reflect the rhythm of behavioral evolution. Thirdly, it extracts electrical change features, referring to physical quantities such as voltage, current, and active power that occur simultaneously with the behavior, representing the actual state of the behavior within the power system. The information from these multiple dimensions is fused to form a behavioral vector, which, through feature concatenation and standardization, constitutes a multi-dimensional vector representation suitable for modeling. Subsequently, the system uses a multi-center behavioral evolution clustering method for clustering. This clustering method is an unsupervised learning approach based on feature space distance calculation. Specifically, it selects multiple initial cluster centers and iteratively converges to generate clusters in a multi-dimensional behavioral vector space. Each cluster represents a set of historical behavioral sequences that are similar in behavioral semantics, temporal rhythm, and electrical response.

[0047] Each cluster corresponds to a set of behavioral evolution expressions with similar contextual features and approximate behavioral trajectories. "Similar contextual features" indicates that the overall feature combination of each behavioral vector in the cluster has a high degree of consistency across the temporal, electrical, and environmental dimensions; "approximate behavioral trajectories" indicates that these behaviors exhibit consistent trends or patterns in their occurrence sequence and evolutionary paths, such as a recurring sequence of "operation—current fluctuation—communication request" within a specific time period. This structure provides a standard comparison template for subsequent intent assessment and can be used to determine whether the current behavior deviates from the historical evolutionary path.

[0048] For example, in specific implementation, if the meter box exhibits a "communication wake-up - data reading - hibernation" behavior sequence in multiple nighttime cycles, the system can cluster the sequence into a behavior cluster representing normal nighttime inspection. If the current behavior is "communication wake-up - current surge - remote tripping", the context structure deviates significantly from the normal pattern of this cluster, which can be used as one of the judgment criteria for triggering the abnormal intent assessment process.

[0049] The process for determining whether an abnormal intent has been activated includes: matching the current behavioral context information set with the closest cluster result in the clustering results, and calculating the context structure deviation value and behavioral sequence offset index respectively. The behavioral context information set refers to the data set directly related to a behavior collected by the metering box before and after a certain behavior occurs, including multi-source features such as the operational behavior itself, electrical operating status, and environmental information. This information set maintains consistency with the record sequence in the historical behavior evolution template in terms of feature dimensions, data structure, and representation. The clustering result is a set of results formed by unsupervised clustering analysis of a large number of historical behavioral context information sets, possessing a similarity partitioning structure in behavioral semantics, operational patterns, and operational characteristics. A cluster result represents the set of behavioral data contained in a specific category in the clustering analysis. This cluster has a central vector, representing the core expression pattern of the behavioral context features of that category. The "closest cluster result" refers to the category cluster that is closest to the current behavioral context information set in the joint feature space among all clusters. The matching process is achieved through vector space distance or similarity function, with the aim of finding the historical behavioral paradigm to which the current behavior is most likely to belong and making deviation judgments accordingly.

[0050] The context structure deviation value reflects the magnitude of the deviation between the current behavior context vector and the cluster center vector, either by cosine similarity or Euclidean distance. The behavior context vector is a high-dimensional vector formed by concatenating various features (such as time, electrical state, and environmental data) from the behavior context information group after numerical representation. The cluster center vector is the weighted average of all historical behavior vectors within the cluster, representing the structural centroid of that behavior type. Cosine similarity primarily measures the directional consistency between two vectors, while Euclidean distance reflects their geometric distance in the feature space. Using both together allows for a multi-dimensional characterization of the structural deviation between the current behavior and historical behavior clusters. A larger context structure deviation value indicates that the semantic structure of the current behavior deviates more from the core expression of that cluster.

[0051] The behavior sequence offset metric is the dynamic time warping distance between the current behavior chain sequence and the standard behavior path in the historical trajectory. A behavior chain sequence refers to a series of actions arranged chronologically before and after the current operation, used to express the temporal evolution of behavior. A standard behavior path is a type of behavior chain in the historical trajectory that appears frequently and has a stable structure within that behavior cluster. Dynamic time warping (DTW) is a method for measuring the similarity between two time series under different time alignment methods, capable of handling situations with different sequence lengths or inconsistent execution rhythms. This metric measures the synchronicity between the current behavior's order and rhythm and the historical expectation, providing a precise quantification of the temporal evolution path of behavior.

[0052] When the context structure deviation value exceeds the preset deviation judgment threshold and the behavior sequence offset index exceeds the preset path similarity limit, the current behavior is considered to have significantly deviated from the historical behavior evolution template, meeting the judgment conditions for activating the abnormal intent assessment process. Here, both the "preset deviation judgment threshold" and the "path similarity limit" are identification boundaries set by the system based on extensive historical data experience, used to distinguish between normal behavior fluctuations and abnormal behavior deviations. When both indicators simultaneously meet the deviation conditions, it indicates that the current behavior cannot reasonably match the historical evolution pattern in terms of semantic structure and behavioral rhythm, possessing a potential abnormal intent. The system will immediately activate the abnormal intent assessment process, proceeding to a more in-depth behavior rationality assessment stage.

[0053] For example, in a certain smart meter box operation, the user's operation time was significantly earlier than their usual time period, and the accompanying voltage and current states showed statistical differences from previous operations. The behavior path showed a jumping pattern that did not conform to the conventional "operation-reading-recovery" sequence. At this time, the system comparison found that its context structure deviation value exceeded 0.6 and the sequence offset index exceeded the reasonable tolerance limit, thus determining it to be an atypical operation and triggering subsequent intent recognition processing.

[0054] The generation of the intent rationality credibility index includes the following processing steps:

[0055] For each operation in the action chain sequence, a action node representation vector is constructed in chronological order. Each representation vector is composed of a timestamp, electrical state features and event type encoding, which is used to express the semantic position of the action in the action chain sequence.

[0056] By constructing a behavior causality tensor, the semantic dependency between any two behavior nodes is represented. This tensor is based on the inner product between the behavior node representation vectors and combines the node time interval to set a decay factor to reflect the dynamic change characteristics of behavior causality in the time dimension.

[0057] The current behavior causal relationship tensor is structurally compared with the standard behavior tensor constructed from the historical expected behavior sequence. The strategy path deviation score is calculated based on the cumulative difference between all valid behavior pairs in the tensor, which is used to reflect the overall structural deviation between the current behavior chain sequence and the historical expected behavior sequence.

[0058] The strategy path deviation score is input into the confidence mapping function, and the structural deviation is mapped to a confidence score using a nonlinear compression mechanism. This score is the credibility index of intention rationality. The closer the value is to the upper limit of the interval, the stronger the strategy consistency between the current behavior chain sequence and the historical expected behavior sequence, thereby realizing a quantitative assessment of whether the operation behavior conforms to the logic of behavior evolution.

[0059] The generation of the intent rationality credibility index specifically includes the following processing steps:

[0060] Behavior node representation vector generation: For each behavior node in the behavior chain sequence Constructing semantic representation vectors It consists of the following three parts: ; : The standardized timestamp (0-1 scaling) of the occurrence of behavior i; : Event type encoding (one-hot or embedded vector) corresponding to behavior i; : Electrical state characteristics (current, voltage, power, etc.) when behavior i occurs; concat is short for concatenate, often used for vector or feature concatenation operations, that is, concatenating data from multiple dimensions into a longer vector in a certain order. This step is to "semantically structure" discrete behaviors, preparing for subsequent causal relationship modeling.

[0061] Causal Tensor Construction: Constructing a 3D tensor C to represent the causal dependencies between behavioral nodes:

[0062] ; The first Representation of each behavioral node, This represents the time interval difference (standardized). For semantic dependency functions, the following structure is adopted:

[0063] ; Inner product operation A learnable alignment matrix, initialized as an identity matrix. The sigmoid activation function is used to map to dependency probabilities. Time decay coefficient: It is used to discover the nonlinear time-dependent logical relationship between behavioral nodes through syntactic graph modeling and is applicable to complex behavioral evolution chains.

[0064] Policy path consistency comparison (structural distribution reconstruction): using a baseline tensor obtained from historical expected behavior sequences. , the current behavior tensor Instead of comparing structural consistency, calculate the path structural consistency score. :

[0065] ; The total number of valid non-zero pairs in a tensor, and the path structure consistency score. The smaller the value, the more consistent the structural path. `i` and `j` represent the indices of the behavior nodes in the behavior chain sequence, such as the first behavior node and the second behavior node. In this context, `k` is used as the "semantic dependency type dimension" or "behavioral causal feature dimension index," representing a characterization of a certain type of causal dependency. First dimension: behavior node `i`; second dimension: behavior node `j`; third dimension: `k`, representing the various dependency attributes that may exist between each pair of `i` and `j` (such as temporal order, state transition, behavior co-occurrence, etc.). For example: `k=1` represents "time-first" dependency; `k=2` represents "state-driven" dependency; `k=3` represents "frequency-linked" dependency. This allows the three-dimensional structure of tensor C to not only represent "whether there is a causal relationship between nodes" but also to distinguish different semantic dimensions of causal relationships.

[0066] Generate Intent Reasonableness and Credibility Index: ; The index represents the credibility of intent and the consistency score of path structure. This is the strategy path deviation value (previous step output). The purpose of introducing tanh is to nonlinearly map the behavioral structure difference into "confidence decay" and limit it to the interval [0,1). Unlike combating abnormal transactions in financial scenarios, this emphasizes the consistency confidence between behavior and strategy.

[0067] The generation of the context offset aggregation index includes the following processing steps:

[0068] The behavior trigger time, electrical operation characteristics, and environmental variables are uniformly extracted at each time point and combined into a sequence of context response vectors;

[0069] Based on this context response vector sequence, a multi-source behavioral response distribution body under the current operating state is constructed through multi-kernel density mapping, which is used to represent the structural distribution of behavioral, electrical and environmental features in the joint feature space;

[0070] The current multi-source behavioral response distribution is structurally compared with the reference distribution constructed from historical stable operating data to obtain the offset feature tensor. Based on this, two key quantitative indicators are extracted from the offset feature tensor: one is the direction variation intensity, which reflects the degree of perturbation of the current context state in the temporal dimension; the other is the coupling aggregation degree, which characterizes the offset aggregation trend between features.

[0071] Based on the nonlinear combination of directional variation intensity and coupling aggregation degree, an exponential compression and logarithmic fusion method is used to weight the evaluation of the disturbance intensity and structural coupling relationship, calculate the context offset aggregation index, and the output value is used to measure the global offset degree of the current behavior in the integrated spatiotemporal operating environment.

[0072] A multi-source behavioral response distribution is used to characterize the coordinated change density pattern of behavioral trigger time, electrical operating characteristics, and environmental variables in a joint space, reflecting the global distribution state of the current behavioral context in a multi-dimensional dynamic feature field. Its construction process includes the following steps: Based on the behavioral context information set, context features corresponding to each time node are extracted one by one, including behavioral trigger time, electrical parameter set (e.g., voltage, current, active power), and environmental variable set (e.g., temperature, humidity, enclosure vibration level, etc.). These three types of features are then concatenated in a fixed order to form a context feature vector set with a unified structure. Subsequently, this feature vector set is standardized to ensure that all features have a uniform scale in the numerical space, thus providing a basis for comparison and clustering. The standardized context feature vector set is projected onto a set of preset kernel mapping functions to obtain its probability density distribution state in a low-dimensional embedding space. The kernel mapping function can be selected based on the current application scenario, choosing a kernel function form with high smoothness and robustness to characterize the nonlinear coupling relationship between context features in the joint space. During density estimation, a local neighborhood search mechanism is used to identify regions with clustered similar contexts, and an overall joint distribution map is constructed based on the local distribution density variation trend of the point set. This joint density map is structured into a high-dimensional probabilistic response representation, which is the multi-source behavioral response distribution. This distribution is used to compare the differences with the historical stable state distribution in subsequent context shift assessments to identify the context shift trend and intensity. Specifically:

[0073] Construct a standardized set of context response vectors and define the context vector for each time point:

[0074] ; Let be the standardized timestamp of the moment when the i-th action is triggered. Let i be the electrical feature vector (including current, voltage, power, etc.) at the trigger time of the i-th action. For the environmental variable features (such as temperature, humidity, vibration) at the time of the i-th action trigger, all context vectors This constitutes sequence U.

[0075] Constructing a multi-source behavioral response distribution: Taking U as input, a distribution mapping function based on kernel density estimation is used. Generate context perturbation field distribution:

[0076] ; Based on the Gaussian kernel density function, we learn the joint distribution structure of various features in U in the low-dimensional mapping space, which is a multi-source behavioral response distribution, representing the density region change map of the current context feature set in the joint space.

[0077] Calculate the structure offset tensor by comparing it with the historical reference distribution:

[0078] Extracting reference distribution from historical stable operating data Calculate the structural offset tensor :

[0079] Subsequently, the offset tensor was constructed. Perform the following two tensor feature transformations:

[0080] Directional variation intensity : ; Intensity of directional variation It is used to measure whether the distribution of offset changes drastically over time. This represents the index of the first feature dimension in the joint context vector dimension, such as a specific indicator dimension of time, environment, or electrical. This represents the index of the second feature dimension in the joint context vector dimension, used to construct the second axis of the 3D feature tensor (i.e., Corresponding feature pair combination); The index of the time window representing the current moment or the current action segment, such as a sliding time slice used to divide the action time sequence window; Indicates the number of times within the current time window. Structural offset values ​​for feature dimensions; This represents the historical average offset intensity along this dimension, used to provide a "static structural baseline"; directional variation intensity. Its essential function is to measure the degree of change in the joint feature dimensions of a behavioral process under different time windows.

[0081] Coupling degree : Degree of Coupling Used to measure the inherent clustering among all feature dimensions under offset states. The structural offset tensor is processed into a two-dimensional matrix form in the simplified representation (after expansion of behavioral dimension × joint feature dimension). This is the transpose of the offset tensor, which swaps the feature dimension and the behavior dimension. The trace of a matrix is ​​the sum of the elements along the main diagonal of a product matrix. In mathematical statistics, the trace is used to measure the overall energy or information concentration of a matrix. Coupling and aggregation degree. What is actually measured is the aggregation strength and correlation of the joint context structure offset across each feature dimension. The larger the value, the more concentrated the offset structure and the more prominent the anomalous coupling features.

[0082] Generating the context offset aggregation index: An index synthesis method based on "two-factor entropy compression" is introduced to obtain the final index: λ1 and λ2 control the parameters that affect the weights of the two offset dimensions (which can be adjusted according to different application requirements), and δ is a preset nonlinear exponential suppression factor (such as 1.2-1.5). This is the aggregate index for context offset.

[0083] The intent rationality and credibility index and the context offset aggregation index are input into a pre-trained intent recognition learning model for comprehensive deconstruction analysis. This includes: based on the joint feature combination of the two indices, fuzzy membership matching and policy deviation evaluation are performed in the rule knowledge base through a fuzzy logic reasoning mechanism, outputting the intent deviation level score of the current behavior in the semantic cognitive space, which reflects the behavioral intent of the current operation relative to the system's internal policy model. Figure 1 Consistency level. The intent rationality credibility index, a scoring metric used to measure whether the current behavioral chain sequence follows historical behavioral evolution patterns, has already been generated through behavioral path structure comparison in the preceding steps. The context offset aggregation index reflects the degree of global coupling offset between the current operational behavior and the normal state under electrical conditions, environmental variables, and temporal context. These two indices, as key variables in behavioral intent recognition, describe the current behavior from two dimensions: consistency of the strategy execution path and rationality of the external operating environment. To more effectively integrate these two indices, the system combines them into a joint feature input to describe the comprehensive performance of the current behavior in a multi-dimensional space.

[0084] Fuzzy logic reasoning is an intelligent judgment system based on "human analogical reasoning." Its essence lies in replacing traditional hard-decision logic with fuzzy sets and fuzzy rules, thereby improving the system's ability to discriminate uncertain and boundary-oriented behaviors. In this invention, the fuzzy logic reasoning mechanism relies on a rule knowledge base, which is constructed during the model training phase. Its core is a set of fuzzy rules reflecting the evolution of user behavioral intentions. Each rule is based on a large number of historical behavior samples, extracting a fuzzy membership range and a corresponding strategy deviation level. For example: "If the intention credibility index is high and the deviation index is low, then the behavior is a highly consistent intention"; "If the credibility index is low and the deviation index is high, then the behavior deviates from the intention."

[0085] Fuzzy membership matching converts the two input index values ​​into membership values ​​on multiple fuzzy sets, which are then used to match matching rule items in the rule knowledge base. Policy deviation evaluation, on the other hand, integrates the results of all matching rules and outputs a deviation score for the current behavior in the semantic cognitive space. Here, the semantic cognitive space refers to the system's internal abstract cognitive expression of the ternary relationship between behavioral structure, motivation, and outcome. A higher score indicates that the behavior is more difficult to categorize into known paradigms in the system's policy model, and the stronger the inconsistency of intent.

[0086] The intent recognition learning model establishes a multi-dimensional input fuzzy rule matrix based on the historical behavioral intent decision boundaries extracted during the training phase. During the training phase, the system clusters and summarizes the labeled historical behavioral data according to their behavioral intent levels, extracts a set of nonlinear fuzzy correspondences between inputs and outputs, and divides the input space into multiple fuzzy decision intervals. Each decision boundary represents the strategy recognition feature of a class of intent patterns.

[0087] During model inference, the system sequentially performs rule fusion, weight adjustment, and output layer defuzzification. Rule fusion refers to the weighted integration of multiple activated fuzzy rules at the result level to form a unified fuzzy output. Weight adjustment dynamically corrects each activated rule based on its confidence level and historical matching accuracy. Output layer defuzzification, or "defuzzification," uses methods such as centroid method and maximum membership degree method to transform the fuzzy output into a single score value, i.e., the intent deviation level score.

[0088] For example, in practical implementation, if the credibility index of the intent of a behavioral action is 0.65 and the deviation aggregation index is 0.72, after the system inputs it into the model, it matches three rules with moderate deviation and one rule with high risk. After rule fusion and weight correction, the system outputs a score of 0.83, falling into the "high deviation" range. This score is the quantitative judgment result of the system identifying the current behavior as "potentially having illegal intent," providing a decision-making basis for subsequent behavioral response strategy selection.

[0089] Based on the risk range corresponding to the intent deviation level score, behavioral response strategies are implemented, including: behavior feature freezing, risk label annotation, access restriction, and anomaly warning. The intent deviation level score is a rating indicator output by the intent recognition learning model, used to quantify the difference in cognitive consistency between the current behavior and the system's internal strategy model, and has already been generated during the aforementioned model inference process. This score is generally a continuous numerical value and can be divided into multiple risk ranges according to the application scenario, with each risk range corresponding to a type of behavioral intent deviation level. The division of risk ranges is based on the system's statistical analysis of historical behavioral data and the setting results of security policies; for example, it can be divided into four levels: "low-risk range" (highly consistent intent), "medium-risk range" (fluctuating but acceptable intent), "medium-high-risk range" (potential for out-of-bounds behavior), and "high-risk range" (highly suspicious intent).

[0090] A behavioral response strategy refers to the specific operational mechanisms a system employs to control the execution of an action, record its characteristics, or provide early warnings when it detects a potentially risky intent in that action. The goal of this strategy system design is to achieve safety protection, risk recording, and proactive management at the behavioral level for smart metering boxes.

[0091] Behavioral feature freezing refers to the system's structural freezing of the contextual information related to a behavior after it has been identified as falling into a suspicious range. This involves locking all feature data of the behavior (including time, electrical status, environmental information, and operational commands) to prevent it from being updated or overwritten by subsequent behavior training models. This freezing is then used for subsequent source tracing analysis, risk verification, or model optimization. For example, once a behavior's deviation score reaches a medium-to-high risk threshold, the system stores its behavioral context as "read-only data" to prevent it from being obscured or interfered with by other behaviors.

[0092] Risk labeling refers to the process by which a system, after identifying certain risk characteristics in a specific behavior, attaches a risk-labeled information structure to that behavior instance. This information identifies the risk status within the behavior chain, facilitating the rapid identification and screening of suspicious operations in the subsequent behavior sequence. The label may include metadata such as risk level, rule number, and trigger time. For example, in a real-world scenario, if an operation has a score of 0.78, the system would label it "Medium Risk - Sequence Inconsistency" and store it in the log system.

[0093] Access control restrictions refer to the system's partial blocking, delayed execution, or function freeze of user identities or operational permissions associated with behaviors identified as potentially abnormal, in order to prevent possible risky behaviors from further impacting the system. These restrictions can take the form of blacklists / whitelists, behavior rate limits, or instruction range restrictions. For example, if a user's three actions are all marked as "significantly deviating from the intended purpose," the system may restrict their remote power switch access to read-only and notify maintenance personnel for manual review.

[0094] Anomaly warnings refer to the system automatically sending structured warning information to remote operation and maintenance platforms, monitoring centers, or security management consoles when an intent deviates from the risk level score and reaches the high-risk range. This can be accompanied by actions such as record freezing, event reporting, and proactive blocking. The warning information includes: the user identifier, a summary of the behavior characteristics, the score, the corresponding rule trigger record, and a suggested handling plan for the current risk level. For example, if a remote tripping operation during non-working hours in the early morning scores as high as 0.91, the system immediately issues a "Level 1 Risk Behavior Alarm" to the backend security console and freezes the execution request of that behavior to prevent unauthorized system intervention. Through the layered execution of the above-mentioned behavior response strategies, the system can respond appropriately and proactively defend against different levels of behavioral risk scenarios, achieving full-process risk control and policy intervention for the operation of smart metering boxes, ensuring the stability, security, and policy consistency of the metering device operation.

[0095] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0096] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0097] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0098] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0099] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting abnormal operation of an intelligent metering box, characterized in that, Includes the following steps: A behavioral context information group is constructed based on the metering box operation data. Then, based on the comparison results between the current behavioral context information group and the historical behavioral evolution template, it is determined whether to activate the abnormal intent assessment process. After activating the abnormal intent assessment process, a behavior chain sequence is generated based on the context information group. The current operation behavior is progressively modeled according to the time dimension. The semantic dependency relationship between behavior nodes is represented by the behavior causal tensor encoding method. The intent rationality credibility index is obtained by comparing the behavior path structure and used to measure the strategy consistency between the current behavior and the historical expected behavior sequence. Based on the context information group, the coupling distribution pattern between behavior trigger time, electrical operation characteristics and environmental variables is extracted, a high-order feature offset structure is constructed, and the context offset aggregation index is calculated by the context state modeling method to quantify the degree of offset of the current behavior in the comprehensive spatiotemporal operation environment; The intention rationality credibility index and the context offset aggregation index are input into the pre-trained intention recognition learning model for comprehensive deconstruction analysis, and the intention deviation level score is output to quantify the degree of cognitive difference between the current behavior and the internal strategy model of the system. Then, the behavior response strategy is executed according to the risk range to which the intention deviation level score belongs. The generation of the intent rationality credibility index includes the following processing steps: For each operation in the action chain sequence, a action node representation vector is constructed in chronological order. Each representation vector is composed of a timestamp, electrical state features and event type encoding, which is used to express the semantic position of the action in the action chain sequence. By constructing a behavior causality tensor, the semantic dependency between any two behavior nodes is represented. This tensor is based on the inner product between the behavior node representation vectors and combines the node time interval to set a decay factor to reflect the dynamic change characteristics of behavior causality in the time dimension. The current behavior causal relationship tensor is structurally compared with the standard behavior tensor constructed from the historical expected behavior sequence. The strategy path deviation score is calculated based on the cumulative difference between all valid behavior pairs in the tensor, which is used to reflect the overall structural deviation between the current behavior chain sequence and the historical expected behavior sequence. The strategy path deviation score is input into the confidence mapping function, and a nonlinear compression mechanism is used to map the structural deviation into a confidence score, which is the credibility index of the intention rationality.

2. The method for detecting abnormal operation of an intelligent metering box according to claim 1, characterized in that, The historical behavior evolution template is a pre-defined sequence of multi-dimensional behavior data that is consistent with the current behavior context information group. This sequence of data comes from the long-term operation data of the metering box. After being expressed as a vector by behavior semantic labels, operation time sequence and electrical change characteristics, it is clustered by a multi-center behavior evolution clustering method. Each clustering result corresponds to a set of behavior evolution expressions with similar context features and similar behavior trajectories.

3. The method for detecting abnormal operation of an intelligent metering box according to claim 2, characterized in that, The process for determining whether an abnormal intent has been activated includes: matching the current behavioral context information group with the cluster result that is closest to the cluster result, and calculating the context structure deviation value and the behavioral sequence offset index respectively; The context structure deviation value is the magnitude of the deviation reflected by the cosine similarity or Euclidean distance between the current behavior context vector and the cluster center vector, which measures whether the semantic structure of the behavior context deviates from the core features of the cluster. The behavior sequence offset index is the dynamic time warping distance between the current behavior chain sequence and the standard behavior path in the historical trajectory, which measures the synchronicity between the order and rhythm of behavior occurrence and historical expectations. When the context structure deviation value is greater than the preset deviation judgment threshold and the behavior sequence offset index exceeds the preset path similarity limit, it is considered that the current behavior deviates significantly from the historical behavior evolution template, thus meeting the judgment conditions of the activation abnormal intent assessment process.

4. The method for detecting abnormal operation of an intelligent metering box according to claim 3, characterized in that, The generation of the context offset aggregation index includes the following processing steps: The behavior trigger time, electrical operation characteristics, and environmental variables are uniformly extracted at each time point and combined into a sequence of context response vectors; Based on this context response vector sequence, a multi-source behavioral response distribution body under the current operating state is constructed through multi-kernel density mapping, which is used to represent the structural distribution of behavioral, electrical and environmental features in the joint feature space; The current multi-source behavioral response distribution is structurally compared with the reference distribution constructed from historical stable operating data to obtain the offset feature tensor. Based on this, two key quantitative indicators are extracted from the offset feature tensor: one is the direction variation intensity, which reflects the degree of perturbation of the current context state in the temporal dimension; the other is the coupling aggregation degree, which characterizes the offset aggregation trend between features. Based on the nonlinear combination of directional variation intensity and coupling aggregation degree, an exponential compression and logarithmic fusion method is used to weight the evaluation of the disturbance intensity and structural coupling relationship, calculate the context offset aggregation index, and the output value is used to measure the global offset degree of the current behavior in the integrated spatiotemporal operating environment.

5. The method for detecting abnormal operation of an intelligent metering box according to claim 4, characterized in that, The intent rationality credibility index and the context offset aggregation index are input into the pre-trained intent recognition learning model for comprehensive deconstruction analysis. This includes: based on the joint feature combination of the two indices, fuzzy membership degree matching and policy deviation degree evaluation are performed in the rule knowledge base through fuzzy logic reasoning mechanism, and the intent deviation level score of the current behavior in the semantic cognitive space is output to reflect the degree of consistency between the current operation behavior and the behavioral intent of the system's internal policy model.

6. The method for detecting abnormal operation of an intelligent metering box according to claim 5, characterized in that, Based on the risk range corresponding to the intention deviation rating, behavioral response strategies are implemented, including the following behavioral response strategies: Behavioral characteristics freezing, risk label annotation, access restriction, and abnormal warning.

Images