Power grid data anomaly detection method and system based on hybrid deep learning model

Abstract

The present invention provides a method and system for detecting anomalies in power grid data based on a hybrid deep learning model, which belongs to the technical field of power grid data processing. The method performs hybrid modeling by combining a convolutional neural network with a recursive neural network, a gated recurrent unit, a long short-term memory network, and an attention model to obtain an initial detection model. At the same time, a model collaborative optimization mechanism is used to perform distributed parallel training on the initial detection model, and an adaptive optimizer is constructed through an adaptive optimization algorithm. The optimizer and a dynamic training mechanism are used to dynamically update the model parameters and model structure to obtain a hybrid detection model. The real-time data stream of the power system is input into the hybrid detection model for anomaly detection. At the same time, according to a preset defense strategy, active security protection operations are performed on the power system for the detected abnormal data and potential attack behaviors. The present invention can accurately detect and provide real-time warnings for complex abnormal behaviors of the power system.

Description

Technical Field

[0001] The present invention relates to the field of power grid data processing technology, and in particular to a power grid data anomaly detection method and system based on a hybrid deep learning model. Background Art

[0002] The stable operation and optimized dispatch of power systems are inseparable from accurate data analysis. Traditional power system data analysis primarily relies on commercial software and mathematical models generated by a hybrid of data analysis, control theory, and statistical methods. With the continuous expansion of the power grid and the increasing demand for more efficient and sustainable energy systems, increasing attention is turning to the integration of artificial intelligence (AI) into traditional power grid systems, making their upgrade imperative. In this context, AI-based anomaly detection and prevention methods are becoming an important means of ensuring power system security. In particular, AI technology has demonstrated great potential for data anomaly detection and prevention in power systems. Real-time anomaly prediction and detection using AI can effectively enhance the power system's response capabilities to cyberattacks and abnormal events.

[0003] Currently, when AI is used to detect power systems, a single model is often used to perform feature analysis on power system data. Although this analysis method can effectively detect abnormal data in the power system, it has poor adaptability to some complex abnormal patterns, such as transient faults, chronic degradation, periodic fluctuations, and random interference. Single models require further adjustment of model parameters to improve detection accuracy, making it difficult to meet the real-time monitoring and early warning needs of power systems. Summary of the Invention

[0004] In view of this, the present invention provides a power grid data anomaly detection method and system based on a hybrid deep learning model to solve the problem that the current power system detection technology has poor adaptability and low accuracy in detecting complex abnormal behaviors of the power system.

[0005] The technical solution adopted in the present invention is:

[0006] In a first aspect, the present invention provides a method for detecting anomalies in power grid data based on a hybrid deep learning model, comprising:

[0007] Obtain historical power system operation data, label the attack types and divide the data into different categories to obtain a training data set.

[0008] A convolutional neural network is combined with a recurrent neural network, a gated recurrent unit, a long short-term memory network, and a Transformer attention model for hybrid modeling to obtain an initial detection model; the initial detection model includes a first sub-model using a CNN-RNN architecture, a second sub-model using a CNN-GRU architecture, and a third sub-model using a CNN-LSTM architecture;

[0009] Based on the training data set, a model collaborative optimization mechanism is used to perform distributed parallel training on each sub-model of the initial detection model. An adaptive optimizer is constructed through an adaptive optimization algorithm. The adaptive optimizer and dynamic training mechanism are used to dynamically update the model parameters and model structure to obtain a hybrid detection model.

[0010] The hybrid detection model is deployed in the power system, and the real-time data stream of the power system is input into the hybrid detection model for anomaly detection, identifying abnormal data and marking potential attack behaviors. At the same time, according to the preset defense strategy, active security protection operations are performed on the power system for abnormal data and potential attack behaviors.

[0011] Furthermore, the convolutional neural network is combined with a recurrent neural network, a gated recurrent unit, a long short-term memory network, and a Transformer attention model to perform hybrid modeling to obtain an initial detection model, including:

[0012] A nonlinear activation function is added to the convolutional neural network to obtain a CNN module; the CNN module includes a convolutional layer, a pooling layer and a fully connected layer, the output end of the convolutional layer is connected to the input end of the pooling layer through a nonlinear activation function, and the output end of the pooling layer is connected to the fully connected layer;

[0013] Constructing an RNN module according to the network structure of the recursive neural network, connecting the output end of the CNN module with the input end of the RNN module, and obtaining a first sub-model with a CNN-RNN architecture;

[0014] A GRU module is constructed based on the network structure of the gated recurrent unit, and the output of the CNN module is connected to the input of the GRU module to obtain a second sub-model with a CNN-GRU architecture;

[0015] An LSTM module is constructed according to the network structure of the long short-term memory network, and a Transformer attention module is established according to the Transformer attention model. The output end of the CNN module is connected to the input end of the LSTM module and the input end of the Transformer attention module respectively, to obtain a third sub-model with a CNN-LSTM architecture.

[0016] Furthermore, the distributed parallel training of each sub-model of the initial detection model is performed based on the training data set using a model collaborative optimization mechanism, including:

[0017] Input the training data set into the first sub-model, the second sub-model, and the third sub-model in the initial detection model respectively, perform model parallel training on each sub-model, and obtain the local calculation gradients of the first sub-model, the second sub-model, and the third sub-model through the distributed scheduling structure;

[0018] Aggregate the local calculated gradients of the first, second, and third sub-models to obtain a global gradient, and synchronously feed the global gradient back to the first, second, and third sub-models through a distributed scheduling structure to update the model parameters.

[0019] An attention weight allocation module and a graph neural network are embedded at the output end of the initial hybrid model. The attention weight allocation module is used to adjust the output weight of each sub-model in the initial hybrid model, and the graph neural network is used to model the relationship between different power system nodes through a message passing mechanism.

[0020] Furthermore, the step of inputting the training data set into the first sub-model, the second sub-model, and the third sub-model in the initial detection model respectively and performing model parallel training on each sub-model includes:

[0021] Batch normalization units are set after the CNN modules of the first, second, and third sub-models in the initial detection model respectively;

[0022] The training data set is input into the first, second and third sub-models respectively, and the spatial feature vectors are extracted using the CNN modules of the first, second and third sub-models respectively. The output of the CNN module is randomly deactivated, and the output of some neurons in the CNN module is randomly set to zero.

[0023] The preset feature selection criteria are used to screen out spatial feature vectors that are highly correlated with abnormal behavior from the spatial feature vectors, and the batch normalization unit is used to normalize the spatial feature vectors that are highly correlated with abnormal behavior. The normalized feature fusion vectors are input into the RNN module of the first sub-model, the GRU module of the second sub-model, and the LSTM module of the third sub-model for abnormal behavior recognition training.

[0024] Furthermore, the adaptive optimizer is constructed by the adaptive optimization algorithm, and the model parameters and model structure are dynamically updated by the adaptive optimizer and the dynamic training mechanism to obtain the hybrid detection model, including:

[0025] An adaptive optimizer is constructed using the RMSProp optimization algorithm, and the mean square gradient value of the sub-model in the initial detection model training and the data feature distribution of the training data set are obtained;

[0026] During the training of the initial hybrid model, the learning rate and gradient update step size of the initial detection model are dynamically adjusted using an adaptive optimizer based on a preset dynamic training mechanism.

[0027] A joint loss function including the spatial feature extraction error term and the time series prediction error term is constructed, and the joint loss function is used to jointly optimize the sub-models in the initial detection model. After training is completed, the hybrid detection model is output.

[0028] Furthermore, the power grid data anomaly detection method further includes:

[0029] Detect whether the data proportion of abnormal data and potential attack behaviors in the real-time data stream of the power system exceeds the preset data drift threshold. If the data proportion exceeds the preset data distribution threshold, the learning rate of the hybrid detection model is increased, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system; if the data proportion does not exceed the preset data distribution threshold, the learning rate of the hybrid detection model is reduced, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system.

[0030] In a second aspect, the present invention provides a power grid data anomaly detection system based on a hybrid deep learning model, comprising:

[0031] A dataset construction module is used to obtain historical power system operation data, label the attack types and divide the data into different categories to obtain a training dataset.

[0032] A hybrid model building module for combining a convolutional neural network with a recurrent neural network, a gated recurrent unit, a long short-term memory network, and a Transformer attention model to perform hybrid modeling to obtain an initial detection model; the initial detection model includes a first sub-model using a CNN-RNN architecture, a second sub-model using a CNN-GRU architecture, and a third sub-model using a CNN-LSTM architecture;

[0033] The model parallel training module is used to perform distributed parallel training on each sub-model of the initial detection model based on the training data set using a model collaborative optimization mechanism. An adaptive optimizer is constructed through an adaptive optimization algorithm. The model parameters and model structure are dynamically updated using the adaptive optimizer and a dynamic training mechanism to obtain a hybrid detection model.

[0034] The abnormal behavior detection module is used to deploy the hybrid detection model into the power system, input the real-time data stream of the power system into the hybrid detection model for anomaly detection, identify abnormal data, and mark potential attack behaviors. At the same time, according to the preset defense strategy, active security protection operations are performed on the power system for abnormal data and potential attack behaviors.

[0035] Furthermore, the power grid data anomaly detection system also includes a model online fine-tuning module, which is used to detect whether the data proportion of abnormal data and potential attack behaviors in the real-time data stream of the power system exceeds a preset data drift threshold. If the data proportion exceeds the preset data distribution threshold, the learning rate of the hybrid detection model is increased, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system; if the data proportion does not exceed the preset data distribution threshold, the learning rate of the hybrid detection model is reduced, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system.

[0036] In summary, the beneficial effects of the present invention are as follows:

[0037] The power grid data anomaly detection method based on the hybrid deep learning model provided by the present invention combines a convolutional neural network with a recursive neural network, a gated recurrent unit, a long short-term memory network and a Transformer attention model for hybrid modeling. By integrating the advantages of CNN and RNN / GRU / LSTM, the model obtained by the hybrid modeling has the ability to quickly extract local features of power signals and accurately capture dynamic changes over a long period of time. At the same time, during the model training process, the present invention adopts a model collaborative optimization mechanism to perform distributed parallel training on the constructed model. Gradient sharing and synchronous training can be performed between the various sub-models of the hybrid detection model, so that the parameter updates of each part remain consistent. Through gradient sharing, the sub-models can learn from each other's learning information, thereby achieving collaborative evolution during the training process, greatly improving the model's global capture capability of abnormal patterns in the power system. In addition, the present invention also adopts an adaptive optimization algorithm to construct an adaptive optimizer, and uses the adaptive optimizer and dynamic training mechanism to dynamically update the model parameters and model structure to realize dynamic adjustment of the model parameters. By introducing the dynamic training mechanism and adaptive optimizer strategy in the model training process, the model's adaptability to emerging patterns can be further improved, and various complex abnormal patterns can be effectively identified, thereby improving the detection efficiency of abnormal data and abnormal attack behaviors, and providing strong technical support for the stable operation of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work, and these are all within the scope of protection of the present invention.

[0039] Figure 1 This is a flow chart of the power grid data anomaly detection method based on a hybrid deep learning model of the present invention;

[0040] Figure 2 This is a diagram of the power grid data anomaly detection framework of the present invention;

[0041] Figure 3 This is a timing diagram of the CNN-RNN architecture of the present invention;

[0042] Figure 4 This is a timing diagram of the CNN-GRU architecture of the present invention;

[0043] Figure 5 This is a timing diagram of the CNN-LSTM architecture of the present invention;

[0044] Figure 6 This is a diagram of the model collaborative optimization mechanism architecture of the present invention;

[0045] Figure 7 This is a diagram of the dynamic training and adaptive optimization framework of the present invention;

[0046] Figure 8 This is a functional module block diagram of the power grid data anomaly detection system based on the hybrid deep learning model of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. If there is no conflict, the various features of the present invention and the embodiments can be combined with each other and are all within the scope of protection of the present invention.

[0048] The detailed implementation process of the present invention is shown in the following examples.

[0049] Example 1: Reference Figure 1 As shown, Figure 1 This is a flow chart of the method for detecting abnormality in power grid data based on a hybrid deep learning model of the present invention. Figure 1 As shown, the method of the embodiment of the present invention includes:

[0050] Obtain historical power system operation data, label the attack types and divide the data into groups to obtain a training data set.

[0051] The initial detection model is constructed by combining a convolutional neural network with a recurrent neural network, a gated recurrent unit, a long short-term memory network, and a Transformer attention model. The initial detection model consists of a first sub-model using a CNN-RNN architecture, a second sub-model using a CNN-GRU architecture, and a third sub-model using a CNN-LSTM architecture.

[0052] Based on the training data set, the model collaborative optimization mechanism is used to perform distributed parallel training on the sub-models of the initial detection model, and an adaptive optimizer is constructed through an adaptive optimization algorithm. The model parameters and model structure are dynamically updated using the adaptive optimizer and dynamic training mechanism to obtain a hybrid detection model.

[0053] The hybrid detection model is deployed in the power system, and the real-time data stream of the power system is input into the hybrid detection model for anomaly detection, identifying abnormal data and marking potential attack behaviors. At the same time, according to the preset defense strategy, active security protection operations are performed on the power system for abnormal data and potential attack behaviors.

[0054] To accurately detect complex abnormal behaviors in power systems, this paper proposes a multi-model fusion deep learning strategy that combines convolutional neural networks (CNNs) with recurrent neural networks (RNNs) and their variants—gated recurrent units (GRUs) and long short-term memory networks (LSTMs)—to conduct in-depth analysis of power system time series data. This hybrid model design leverages the advantages of CNNs in extracting spatial features and the powerful capabilities of RNNs, GRUs, and LSTMs in capturing time-dependent data, thereby improving the accuracy and real-time performance of anomaly detection.

[0055] Specifically, the embodiment of the present invention uses the CNN-GRU architecture, CNN-LSTM architecture, and CNN-RNN architecture of the hybrid machine learning model to detect abnormal behavior in the power system. The CNN convolution module of the model is responsible for extracting spatial features from the power system data, while the GRU module, LSTM module, or RNN module is used to capture abnormal changes in the time dimension. Figure 2 As shown in the power grid data anomaly detection framework diagram, the overall process of power grid data anomaly detection in an embodiment of the present invention is divided into attack detection stage, attack type classification, defense strategy design, and real-time data response and model update.

[0056] During the attack detection phase, the attack type annotation is performed on the power system's operating data. The data is then divided into training sets based on the annotated data. The training sets include training sets, test sets, and validation sets. The specific process of attack type annotation is as follows:

[0057] Establishing a normal behavior baseline: By collecting various data on the power system under normal operating conditions, the model learns the normal fluctuation characteristics of time series data such as voltage, power, and frequency.

[0058] Anomaly detection: Monitors input data in real time, compares it to a normal baseline, identifies unusual fluctuations or significant changes in characteristics, and flags potential attacks.

[0059] In the attack type classification stage, after an anomaly is detected, hybrid models such as CNN-GRU, CNN-LSTM, and CNN-RNN are used to classify abnormal behaviors into different attack types. The attack types include:

[0060] Data tampering attack: Detects whether current or voltage measurements have been tampered with.

[0061] DoS attacks (Denial of Service attacks): Identify behaviors that interfere with communications and control signals, resulting in interrupted system response.

[0062] Control signal tampering: Detects control signal anomalies that may lead to incorrect load scheduling or equipment failure.

[0063] By labeling training data on attack types, the embodiment of the present invention enables the model to achieve refined classification, quickly identify attack types, and take corresponding measures.

[0064] During the defense strategy design phase, upon detecting an attack, the system automatically or semi-automatically protects the power system by incorporating real-time response mechanisms, leveraging the model's predictive capabilities to formulate and execute safety and security actions. These defense strategies ensure grid stability and security through continuous monitoring, rapid response, and preventive measures to abnormal behavior in the power system. Safety and security actions include automated response actions and predictive and preventive actions.

[0065] Automated response actions include:

[0066] Isolating Attacked Nodes: When the system detects abnormal behavior and identifies the source of an attack, it automatically generates a network topology map and isolates the affected area to prevent the attack from spreading. Isolation is performed based on real-time network information and uses models to predict potential consequences, ensuring no unnecessary disruption to other critical grid areas. This isolation not only protects the normal operation of the remaining grid but also provides more time for subsequent recovery operations.

[0067] Dynamic parameter adjustment: When voltage or frequency anomalies are detected, the system promptly adjusts relevant parameters based on the model's predictions. The model monitors voltage and frequency data in real time, combines historical data with current operating status, and determines appropriate adjustment strategies, which it then feeds back to the control center. For example, based on this real-time feedback, the system adjusts voltage compensation mechanisms or performs frequency corrections to mitigate the impact of the anomaly on power system operations. This process optimizes adjustment strategies by combining multiple monitoring indicators (such as load fluctuations and environmental changes) to ensure optimal dynamic response.

[0068] Predictive and preventive operations include:

[0069] Predicting Attacks in Advance: By continuously monitoring multiple key indicators of the power system (such as voltage, current, and communication latency), the model can identify potential attack indicators in advance. For example, when the system detects that the frequency of data transmission delays or signal interruptions exceeds a certain threshold, the model predicts a potential DoS (Denial of Service) attack and automatically takes defensive measures, such as enabling redundant communication paths or adjusting the priority of control signals, before serious consequences occur.

[0070] Preventive measures: Based on the output of the predictive model, the system proactively implements a series of security measures to mitigate the potential threat of an attack. These measures may include restricting access to critical systems, enabling firewall rules to prevent external malicious traffic from entering the system, increasing system redundancy to ensure the continued operation of critical equipment, and adjusting control policies to respond to impending attacks. Furthermore, the system regularly updates security policies to address evolving attack patterns and ensure the effectiveness and durability of defenses.

[0071] Through the output and feedback mechanism of the real-time prediction model, the system can continuously optimize the defense strategy according to the latest operating status, respond to potential attacks and abnormal behaviors in advance, and reduce the impact on power grid operations.

[0072] During the real-time data response and model update phase, specific operations include:

[0073] Data stream monitoring and feedback: The hybrid model continuously learns real-time data from the power system, generates attack behavior labels, and updates the model to respond to new attack patterns.

[0074] Online learning and adaptive models: Through streaming data training (such as online GRU), the model can adapt to changing attack behaviors and system characteristics during operation, improving defense capabilities.

[0075] By continuously monitoring the system status, the model can continuously adapt to changing attack patterns and improve defense capabilities.

[0076] Furthermore, in an embodiment of the present invention, a convolutional neural network is combined with a recurrent neural network, a gated recurrent unit, a long short-term memory network, and a Transformer attention model to perform hybrid modeling to obtain an initial detection model, including:

[0077] Adding a nonlinear activation function to a convolutional neural network to obtain a CNN module; wherein the CNN module includes a convolutional layer, a pooling layer, and a fully connected layer, wherein the output of the convolutional layer is connected to the input of the pooling layer via a nonlinear activation function, and the output of the pooling layer is connected to the fully connected layer;

[0078] Constructing an RNN module according to the network structure of the recursive neural network, connecting the output end of the CNN module with the input end of the RNN module, and obtaining a first sub-model with a CNN-RNN architecture;

[0079] A GRU module is constructed based on the network structure of the gated recurrent unit, and the output of the CNN module is connected to the input of the GRU module to obtain a second sub-model with a CNN-GRU architecture;

[0080] An LSTM module is constructed according to the network structure of the long short-term memory network, and a Transformer attention module is established according to the Transformer attention model. The output end of the CNN module is connected to the input end of the LSTM module and the input end of the Transformer attention module respectively, to obtain a third sub-model with a CNN-LSTM architecture.

[0081] Specifically, convolutional neural networks (CNNs) are a key technology for anomaly detection and prevention in power systems. The core concept of CNNs is to extract spatial features through a series of convolutional layers. This makes them particularly well-suited for processing time-series data in power systems (such as voltage, current, and frequency signals). When this data is attacked (such as by data tampering or denial-of-service attacks), its behavior deviates from normal fluctuation patterns. Therefore, extracting these features through convolutional layers can effectively detect these abnormal changes. The convolution operation is as follows:

[0082]

[0083] in, is the input power signal, It is a convolution kernel used to extract local features from the input signal. f For the monitored object, the model needs to identify whether there are deviations caused by abnormal disturbances or attacks from these original waveforms. g As the feature extractor, f Perform sliding convolution to capture local waveform patterns, thereby providing high-order representations for subsequent layers to identify anomalies.

[0084] When convolutional layers are applied to time-series data from power systems, they can capture the spatial characteristics of abnormal behavior. For example, by detecting abnormal fluctuations in voltage or current, the model can identify the presence of attack signals. When convolutional layers are applied to time-series data from power systems, they can capture the spatial characteristics of abnormal behavior. For example, by detecting abnormal fluctuations in voltage or current, the model can identify the presence of attack signals.

[0085] Attacks and abnormal behaviors in power systems often have complex patterns that are difficult to capture using linear relationships. Therefore, it is crucial for the present invention to apply a nonlinear activation function, ReLU, after the convolutional layer of the CNN module. f ( x ) is as follows:

[0086]

[0087] x This activation function, which represents the input signal, helps the model ignore irrelevant negative signals and focus only on significant positive fluctuations in the power system. This nonlinear processing step allows the model to better learn the complex behavioral patterns in the power system, thereby improving its ability to identify abnormal and aggressive behavior.

[0088] Pooling layer dimensionality reduction. The output of the convolutional layer is further processed by the pooling layer to reduce the spatial dimension of the feature map. y i The mathematical representation of is as follows:

[0089]

[0090] in, Represents a set of activation values ​​within the pooling window, that is, all sampling points of the convolutional layer feature map that fall into the pooling window at position i. This operation enables the model to process large-scale power system data more efficiently by retaining the most important features while reducing the amount of data without losing key information.

[0091] Finally, after processing in the convolutional and pooling layers, the power system features are flattened and fed into the fully connected layer. The fully connected layer uses the extracted feature vectors for classification or regression tasks, identifying and classifying different types of attack behaviors (such as data tampering or DoS attacks). Mathematically, the output can be expressed as follows:

[0092]

[0093] in, is the weight matrix, is the input feature vector, is the bias term, y Represents the output feature vector. Through this fully connected operation, the model can accurately classify abnormal behaviors in the power system into different attack types and take corresponding defensive measures.

[0094] Specifically, in the anomaly detection of power systems, it is crucial to process time series data, because many anomalies in power systems (such as voltage or current fluctuations, network attacks, etc.) are usually time-dependent. Recurrent neural networks (RNNs) are a suitable tool that can predict future inputs by saving information about previous inputs. Although traditional RNNs perform better in short-term time dependencies, for longer time dependencies, variants such as LSTM and GRU better solve the gradient vanishing problem through "memory units", enabling them to accumulate and utilize historical data more effectively. This feature enables them to detect potential abnormal behaviors by analyzing historical data when applied in power systems, thereby improving the accuracy and real-time performance of detection, such as Figure 3 The CNN-RNN architecture timing diagram shown in the figure further demonstrates that this embodiment of the present invention further combines a hybrid model of CNN and RNN. The CNN first extracts local patterns from the spatial feature vectors of the power system, and then the RNN detects anomalies by analyzing the temporal evolution of these patterns. The CNN processes local feature changes in the power system, such as sudden voltage fluctuations, while the RNN captures the temporal evolution of these fluctuations. This approach improves the accuracy of detecting power system attacks. The RNN's ability to model time-dependent data is particularly important when processing large-scale, complex power data.

[0095] In RNN, each unit is connected not only to the current input, but also to the hidden state of the previous moment. This "loop-feedback" structure allows the network to process the current input at each time step while integrating the state of the previous time step to form a comprehensive understanding of the entire input sequence. In the power system, this means that RNNs can detect abnormal behaviors such as data tampering and denial of service (DoS) attacks in real time by combining the characteristics of current power data (such as voltage and frequency) with changes in historical data. RNN operations are described by the following equation:

[0096]

[0097] in, Indicates time The hidden state of and the current input Come update. Represents the weight matrix from hidden state to hidden state, used to capture temporal dependencies. The weight matrix input to the hidden state is used to map the current input features. Bias vector for hidden state updates. The element-wise Sigmoid activation function compresses the linear combination to the (0, 1) interval, providing a gating effect for subsequent nonlinear modeling. is the weight matrix from hidden state to output. The hyperbolic tangent activation function maps the value to the (−1,1) interval and is often used for nonlinear transformation of the output layer or internal state. At the same time, the output of the current time step Based on the current hidden state Calculated.

[0098] In an embodiment of the present invention, RNNs are used to capture the time-dependent characteristics of power systems. Under normal circumstances, fluctuations in power signals such as voltage and frequency are relatively stable. However, during attacks or anomalies, signal fluctuations can become anomalous. By continuously updating its hidden state, RNNs can effectively identify underlying pattern changes in this time series data and capture abnormal characteristics of the system. Using its limited "memory" function, RNNs can compare current data with historical data to identify potential anomalous behavior. They are particularly well-suited for processing complex data with time series characteristics. Power system time series data often contains a wealth of historical information, which helps identify small but potentially dangerous anomalous fluctuations. The RNN's recursive feedback mechanism recursively combines the hidden state of the previous time step with the current input, effectively capturing anomalies in the time series, such as data tampering and control signal interference. The RNN's hidden state accumulates input information at each time step, enabling detection of potential attacks in the power system. For data requiring long-term dependencies, the model's prediction accuracy can be further improved using LSTM or GRU.

[0099] Ultimately, by integrating RNNs with CNNs, the proposed power system anomaly detection model possesses superior time series analysis capabilities, effectively capturing complex, time-dependent attack behaviors. Furthermore, by leveraging the CNN's advantage in extracting spatial features, the model can more comprehensively address power system anomalies, providing a faster and more accurate response and defense mechanism. This intelligent defense strategy, through advance prediction and real-time detection, not only enhances system security but also improves its resilience to cyberattacks.

[0100] Specifically, a hybrid model was formed by combining a network variant with a convolutional neural network (CNN) to better handle the combined characteristics of spatial and temporal series data in power systems. The CNN-GRU architecture has fewer parameters, making it more lightweight than a long short-term memory (LSTM) network, making it suitable for power system applications with high real-time requirements.

[0101] like Figure 4 The CNN-GRU architecture timing diagram shown in the figure shows a convolutional neural network (CNN) that extracts key spatial features from the power system. The convolutional layer uses sliding convolution kernels to extract local variation patterns in power signals such as voltage, current, and frequency. The pooling layer then reduces the dimensionality of the output features, preserving the most significant features while reducing the amount of data processing. The pooling layer further processes these features to reduce computational complexity, making the model more efficient for real-time data stream processing. These convolutional and pooling layer operations enable the model to extract key features from large amounts of power data.

[0102] The extracted spatial features are then flattened through a fully connected layer and input into the GRU module. The GRU captures the temporal dependencies of data through its unique gating mechanism. Compared to traditional RNNs, the GRU effectively handles long-term dependencies and vanishing gradients through update and reset gates. The update gate determines the degree of retention of previous memories and the importance of new inputs, while the reset gate controls the impact of previous information on the current output, enabling the GRU to more flexibly handle abnormal characteristics in power systems. This process is described by the following mathematical formula:

[0103]

[0104] in, To reset the gate, control the previous hidden state How much to keep and based on the current input Reset how much. Determines the previous hidden state for the update gate How many should be the new candidate hidden states renew. Is the candidate hidden state, representing the current input and the previous hidden state modified by resetting the gate The next hidden state candidate value of . is the hidden state, representing the output of the LSTM unit at time t, which is based on the previous hidden state of the update gate and the new candidate hidden state combination. is the input of the LSTM unit at time t. is the previous hidden state of the LSTM unit at time t-1. is the candidate hidden state, which is based on the current input and old memory adjusted by the reset gate Potential new memories. To map the old hidden state or current input to the reset gate The weight matrix of . To map the old hidden state or current input to the update gate The weight matrix of . To generate candidate hidden states When, right and The weight matrix to apply. is the fill gate value of the update gate, which indicates the proportion of the old memory retained.

[0105] Compared to the CNN-RNN architecture, the CNN-GRU architecture excels at capturing subtle changes in long-term data series, particularly when responding to unusual behaviors such as emergencies, data tampering, and denial-of-service attacks. By combining the strengths of CNN and GRU, the model can automatically extract and classify features from power system data, enabling rapid detection and defensive measures when attacks occur.

[0106] Overall, the CNN-GRU model is designed to improve the stability and security of power systems through real-time detection and response, particularly when dealing with complex and diverse anomaly patterns. The GRU's gating structure enables the model to improve prediction accuracy while maintaining computational efficiency, effectively addressing abnormal fluctuations and potential attacks in the power system.

[0107] In the task of detecting and preventing anomalies in power systems, the long short-term memory network (LSTM) is used as a key time series analysis tool due to its excellent ability to capture time dependencies. It is combined with the convolutional neural network (CNN) to form a CNN-LSTM hybrid model to effectively extract and analyze spatial and temporal features in power system data. Compared with traditional recurrent neural networks (RNNs), LSTM solves the problem of vanishing gradients with long-term dependencies through its unique memory unit and gating mechanism, making it particularly suitable for processing anomaly data with long-term dependencies in power systems.

[0108] like Figure 5The CNN-LSTM architecture timing diagram shown in the figure above shows a CNN-LSTM architecture. First, the CNN component is used to extract spatial features from power system signals. Leveraging the local perception capabilities of the convolutional layers, the model can capture local patterns in power signals (such as voltage, current, and frequency). These features are further processed by pooling layers to reduce the spatial dimensionality of the feature map, thereby lowering computational complexity and retaining the most important features. These steps enable the model to more efficiently extract significant features when processing complex time series data from power systems, facilitating subsequent time series model processing.

[0109] Next, the extracted spatial features are flattened and fed into the LSTM layer. The LSTM uses its input gate, forget gate, and output gate to determine how to update its internal state (i.e., memory cell) and output the new state based on the current input and past memory. This gating mechanism enables the LSTM to retain relevant information over long periods of time when faced with complex and volatile electricity data, thereby better detecting abnormal behavior. The working principle of the LSTM is described by the following mathematical formula:

[0110]

[0111] in, is the hidden state at time t-1, which is a vector that summarizes the previous input sequence to time t-1. is the input to the LSTM network at time t. is the forget gate at time t, which determines how much of the previous cell state should be retained and how much should be forgotten. is the input gate at time t, which determines how much new input should be added to the cell state. is the candidate cell state at time t, representing the candidate new value that can be added to the cell state. is the cell state at time t, which represents the memory of the LSTM network at time t. is the output gate at time t, which determines how much of the cell state should be output as a hidden state. is the hyperbolic tangent function applied to the cell state at time t. is the output or hidden state at time t, which is the final output of the LSTM network at time t. are the weight matrices that determine the influence of each input and hidden state element on the forget gate, input gate, candidate cell state, and output gate, respectively. is the forget gate, which is hidden in the previous step and the current input Through the weight matrix Obtained by Sigmoid after linear mapping. is the input gate, based on With weight Obtained after linear transformation and Sigmoid.

[0112] The above formula controls the flow of information to retain or forget past memories, ensuring that the model can accurately accumulate useful historical information to detect abnormal events in the power system.

[0113] Compared to CNN-RNN and CNN-GRU architectures, the CNN-LSTM architecture is better at handling complex, long-term dependencies, particularly when dealing with long-lasting abnormal behaviors, such as slow data drift in power systems and persistent cyberattacks. By combining the spatial feature extraction of CNN with the time series modeling capabilities of LSTM, the CNN-LSTM hybrid model can effectively identify and classify different types of abnormal behaviors.

[0114] In summary, the CNN-LSTM model, which extracts spatial features through a convolutional neural network and captures temporal characteristics through a long short-term memory network, performs particularly well in detecting anomalies in power systems. Its design aims to improve the robustness and security of power systems, particularly in the face of attacks and abnormal behaviors with long-term dependencies. It can quickly detect and implement effective defensive measures, ensuring efficient and stable operation of the power system.

[0115] Furthermore, in an embodiment of the present invention, based on the training data set, a model collaborative optimization mechanism is used to perform distributed parallel training on each sub-model of the initial detection model, including:

[0116] Input the training data set into the first sub-model, the second sub-model, and the third sub-model in the initial detection model respectively, perform model parallel training on each sub-model, and obtain the local calculation gradients of the first sub-model, the second sub-model, and the third sub-model through the distributed scheduling structure;

[0117] Aggregate the locally calculated gradients of the first, second, and third sub-models to obtain a global gradient. Synchronously feed the global gradient back to the first, second, and third sub-models through a distributed scheduling structure to update model parameters. Gradient aggregation specifically involves calculating the average gradient.

[0118] An attention weight allocation module and a graph neural network are embedded at the output end of the initial hybrid model. The attention weight allocation module is used to adjust the output weight of each sub-model in the initial hybrid model, and the graph neural network is used to model the relationship between different power system nodes through a message passing mechanism.

[0119] Specifically, within the distributed parallel training architecture, embodiments of the present invention further propose a model collaborative optimization mechanism. This mechanism achieves consistent parameter updates across multiple sub-models (including CNN, RNN / GRU / LSTM modules, or multiple hybrid model instances) by implementing gradient sharing and a synchronous training strategy. In each iteration, each sub-model first calculates gradients in parallel on its own computing node. The gradients are then aggregated across nodes through communication (the present invention employs the average gradient method), and the aggregated global gradients are synchronously fed back to each sub-model for parameter updates. This synchronous update strategy ensures that all sub-models are optimized in a globally consistent direction, avoiding performance degradation caused by each component acting independently. Through gradient sharing, the sub-models can draw on each other's learning information, thereby achieving collaborative evolution during training and significantly improving the model's ability to globally capture abnormal power system patterns.

[0120] To effectively support the above collaborative training process, refer to Figure 6 As shown in the model collaborative optimization mechanism architecture diagram, this invention designs a distributed scheduling structure to coordinate computation and communication across multiple nodes. Using a parameter server architecture, a central scheduling node is responsible for aggregating gradients uploaded by each compute node and issuing global parameter updates. This distributed scheduling mechanism ensures synchronization of the training process while minimizing communication bottlenecks and latency, ensuring the feasibility and efficiency of collaborative optimization for large-scale power system data training. This architecture enables stable and efficient training even with large power system data volumes and high model complexity. Furthermore, the introduction of novel network structures such as the attention mechanism in model collaborative optimization can further enhance coordination between sub-models. When integrating the decisions of multiple hybrid models (CNN-RNN, CNN-GRU, and CNN-LSTM), an attention-based weight allocation module is implemented to dynamically adjust the output weights of each sub-model based on their importance to anomaly detection, achieving collaborative optimization at the result level. Similarly, targeting the unique characteristics of power system topology, the fused graph neural network (GNN) can model the relationships between different nodes and share key information between regional detection models through a message passing mechanism. This topology-aware collaborative approach enables the model to simultaneously consider temporal features, local characteristics, and the interactions between grid nodes, thereby improving the comprehensiveness and accuracy of anomaly detection. The attention mechanism and GNN embedding are carefully designed to integrate seamlessly with the existing CNN-RNN / GRU / LSTM architecture. This approach maintains the core parameters of the original model while enhancing the efficiency and effectiveness of the model's collaborative work.

[0121] Furthermore, in an embodiment of the present invention, the training data set is input into the first sub-model, the second sub-model, and the third sub-model in the initial detection model respectively, and each sub-model is trained in parallel, including:

[0122] Batch normalization units are set after the CNN modules of the first sub-model, the second sub-model and the third sub-model in the initial detection model respectively.

[0123] The training data set is input into the first sub-model, the second sub-model, and the third sub-model respectively. The spatial feature vectors are extracted using the CNN modules of the first sub-model, the second sub-model, and the third sub-model respectively. The output of the CNN module is randomly deactivated, and the output of some neurons in the CNN module is randomly set to zero. In order to prevent overfitting of the model during training and improve its generalization ability, the embodiment of the present invention adopts the random deactivation (Dropout) technology. This technology forces the model to learn more robust features by randomly setting the output of some neurons to zero. The mathematical expression of random deactivation is as follows:

[0124]

[0125] Where r is a random mask containing 0 and 1, is the input vector, In power system defense strategies, this approach helps models effectively respond to unknown attacks and improves the system's robustness against cyberattacks or data anomalies.

[0126] The preset feature selection criteria are used to screen out spatial feature vectors that are highly correlated with abnormal behavior from the spatial feature vectors, and the batch normalization unit is used to normalize the spatial feature vectors that are highly correlated with abnormal behavior. The normalized feature fusion vectors are input into the RNN module of the first sub-model, the GRU module of the second sub-model, and the LSTM module of the third sub-model for abnormal behavior recognition training.

[0127] This embodiment of the present invention addresses the high dimensionality and complexity of power system data (such as voltage, current, and frequency) by utilizing a CNN to extract spatial features. By sliding convolution kernels over the input data, CNNs can capture local patterns and subtle fluctuations in power signals, information crucial for distinguishing normal from abnormal operating states. Through multiple layers of convolution and pooling, the spatial features of the data are gradually abstracted, reduced to high-level feature maps, and ultimately flattened into a one-dimensional feature vector.

[0128] During feature transfer, these extracted spatial feature vectors are fed into an RNN or its variants (GRU or LSTM). By flattening the spatial features, the invention ensures that the time series model can effectively handle the temporal dependencies of the input data. Through their recurrent structure, RNN and its variants are able to capture both short-term and long-term temporal dependencies in the data, enabling comprehensive modeling of the dynamic behavior of power systems.

[0129] To ensure that the spatial features extracted by CNNs are fully utilized when passed to the time series model, this embodiment of the present invention introduces batch normalization and attention weighting mechanisms during the feature fusion process. Batch normalization helps alleviate internal covariate shift, stabilizes the model training process, and improves convergence speed. The attention-weighted output strategy dynamically adjusts feature weights based on their importance in the anomaly detection task, avoiding feature redundancy and information loss.

[0130] In addition, embodiments of the present invention employ feature selection techniques to establish preset feature selection criteria. Using metrics such as information gain, mutual information, or model-based feature importance scores, features highly correlated with abnormal behavior are prioritized. This pre-set feature selection criteria filters out features that contribute most to model performance, reducing interference from irrelevant or noisy features and further improving the model's efficiency and accuracy. This process ensures the integrity of key information in subsequent processing and enhances the model's ability to generalize to complex data.

[0131] Furthermore, in an embodiment of the present invention, an adaptive optimizer is constructed by an adaptive optimization algorithm, and the model parameters and model structure are dynamically updated using the adaptive optimizer and a dynamic training mechanism to obtain a hybrid detection model, including:

[0132] An adaptive optimizer is constructed using the RMSProp optimization algorithm, and the mean square gradient value of the sub-model in the initial detection model training and the data feature distribution of the training data set are obtained;

[0133] During the training of the initial hybrid model, the learning rate and gradient update step size of the initial detection model are dynamically adjusted using an adaptive optimizer based on a preset dynamic training mechanism.

[0134] A joint loss function including the spatial feature extraction error term and the time series prediction error term is constructed, and the joint loss function is used to jointly optimize the sub-models in the initial detection model. After training is completed, the hybrid detection model is output.

[0135] Specifically, during the model training phase, the embodiment of the present invention adopts a collaborative optimization strategy to jointly train the CNN module with the RNN module, GRU module, and LSTM module. A comprehensive loss function is designed, which includes the spatial feature extraction error term and the time series prediction error term. The loss function form is as follows:

[0136]

[0137] in, and is the weight coefficient, Represents the loss of the CNN part, Denotes the loss of the RNN module, GRU module, and LSTM module. By minimizing these two error terms simultaneously, the model achieves optimal performance in both spatial and temporal dimensions.

[0138] To adapt to the model's needs at different training stages, the invention introduces a dynamic learning rate adjustment mechanism (i.e., dynamic training mechanism) and a phased training strategy. Initially, the model focuses on optimizing CNN parameters to ensure accurate extraction of spatial features; at this stage, the learning rate for the CNN component is higher. As training progresses, the focus gradually shifts to optimizing the parameters of the time series model to enhance its ability to capture long-term temporal dependencies. Accordingly, the learning rate for the RNN, GRU, and LSTM modules is increased. This collaborative optimization strategy enables the model to fully learn complex spatial and temporal patterns, thereby enhancing its ability to detect abnormal power system behavior.

[0139] Specifically, refer to Figure 7 The dynamic training and adaptive optimization framework diagram shown in the figure illustrates that, in response to the dynamic changes in the power system operating environment, the present invention introduces a dynamic training mechanism and adaptive optimizer strategy to improve the model's adaptability to emerging patterns. During the model parameter update process, an adaptive optimization algorithm (in this case, the RMSProp algorithm) is employed to dynamically adjust the learning rate and gradient update step size. The RMSProp algorithm adjusts the step size for each parameter based on the mean square value of recent gradients to avoid training instability caused by gradient oscillation. Utilizing these optimizers, the model can adjust the learning rate in real time based on changes in data features. Without manual intervention, the model can adopt the optimal update strategy for different stages and parameters during training, thereby maintaining efficient convergence. The dynamic training mechanism enables the model to continuously digest the latest data distribution and update itself to address potential operating condition drift or attack pattern evolution in the power system.

[0140] Furthermore, in an embodiment of the present invention, the power grid data anomaly detection method further includes:

[0141] Detect whether the data proportion of abnormal data and potential attack behaviors in the real-time data stream of the power system exceeds the preset data drift threshold. If the data proportion exceeds the preset data distribution threshold, the learning rate of the hybrid detection model is increased, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system; if the data proportion does not exceed the preset data distribution threshold, the learning rate of the hybrid detection model is reduced, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system.

[0142] Specifically, after the model is deployed, the power system can periodically or in real time fine-tune the model online using newly collected data. During this process, the adaptive optimizer automatically adjusts the parameter update amplitude based on feedback from the new data. This allows the model to quickly learn from changes in power load characteristics, network communication status, or attack behavior patterns, and update its internal representation, ensuring that anomaly detection and defense decisions remain relevant to the current system state. When significant shifts in the statistical distribution of certain features are detected, the dynamic training mechanism increases the learning rate of the relevant parameters to more quickly adapt to the new pattern. For features that remain stable, the update amplitude is kept small to prevent over-adjustment that could lead to the forgetting of existing knowledge.

[0143] To further enhance the robustness of the model in dynamic environments, the embodiments of the present invention also incorporate attention models such as Transformer into the training process to form a Transformer attention module, which is used to capture dependencies and global pattern changes over long time spans. The Transformer attention module can process time series data in parallel and focus on key time periods and features in the power system data stream through a self-attention mechanism, allowing it to accurately locate abnormal signals even when the environment undergoes drastic changes. Embedding the Transformer architecture into the time series processing of the original CNN-LSTM model provides the model with another perspective on characterizing temporal relationships without destroying the function of the original network memory unit, complementing the LSTM model. Under the dual effects of the adaptive optimizer and dynamic training strategy, the new hybrid model with the attention mechanism can more flexibly update parameters and model structure, calmly respond to changes in the power grid operating environment, and significantly improve the long-term effectiveness and intelligence level of the anomaly detection and defense system.

[0144] The hybrid detection model constructed in this embodiment demonstrates excellent performance in a variety of power system application scenarios. By integrating the strengths of CNN and RNN / GRU / LSTM, the model is able to rapidly extract local features of power signals and accurately capture dynamic changes over long periods of time, which is particularly critical for power systems requiring real-time monitoring and early warning.

[0145] In practical applications, the model can effectively identify a variety of complex anomaly patterns, such as transient faults, chronic degradation, periodic fluctuations, and random disturbances, providing strong technical support for the stable operation of power systems. Furthermore, the model framework is highly scalable and adaptable, allowing it to be adjusted to suit the characteristics and needs of different power systems. For example, feature extraction and fusion strategies can be customized for specific fault types or anomaly patterns to further enhance detection effectiveness.

[0146] Example 2: Reference Figure 8 As shown, an embodiment of the present invention further provides a power grid data anomaly detection system based on a hybrid deep learning model, comprising:

[0147] A dataset construction module is used to obtain historical power system operation data, label the attack types and divide the data into different categories to obtain a training dataset.

[0148] A hybrid model building module for combining a convolutional neural network with a recurrent neural network, a gated recurrent unit, a long short-term memory network, and a Transformer attention model to perform hybrid modeling to obtain an initial detection model; the initial detection model includes a first sub-model using a CNN-RNN architecture, a second sub-model using a CNN-GRU architecture, and a third sub-model using a CNN-LSTM architecture;

[0149] The model parallel training module is used to perform distributed parallel training on each sub-model of the initial detection model based on the training data set using a model collaborative optimization mechanism. An adaptive optimizer is constructed through an adaptive optimization algorithm. The model parameters and model structure are dynamically updated using the adaptive optimizer and a dynamic training mechanism to obtain a hybrid detection model.

[0150] The abnormal behavior detection module is used to deploy the hybrid detection model into the power system, input the real-time data stream of the power system into the hybrid detection model for anomaly detection, identify abnormal data, and mark potential attack behaviors. At the same time, according to the preset defense strategy, active security protection operations are performed on the power system for abnormal data and potential attack behaviors.

[0151] Furthermore, the power grid data anomaly detection system of an embodiment of the present invention also includes a model online fine-tuning module, which is used to detect whether the data proportion of abnormal data and potential attack behaviors in the real-time data stream of the power system exceeds a preset data drift threshold. If the data proportion exceeds the preset data distribution threshold, the learning rate of the hybrid detection model is increased, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system; if the data proportion does not exceed the preset data distribution threshold, the learning rate of the hybrid detection model is reduced, and the model parameters of the hybrid detection model are online fine-tuned based on the real-time data stream of the current power system.

[0152] Specifically, the present invention integrates multiple models and optimizes feature fusion strategies to achieve accurate detection and real-time early warning of complex abnormal behaviors in power systems. This not only improves the safety and reliability of power systems but also provides new technical paths and inventive directions for the development of smart grids.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting anomalies in power grid data based on a hybrid deep learning model, characterized in that: include: Obtain historical power system operation data, label the attack types and divide the data into different categories to obtain a training data set. Combining a convolutional neural network with a recurrent neural network, a convolutional neural network with a gated recurrent unit, and a convolutional neural network with a long short-term memory network and a Transformer attention model to perform hybrid modeling to obtain an initial detection model; the initial detection model includes a first sub-model using a CNN-RNN architecture, a second sub-model using a CNN-GRU architecture, and a third sub-model using a CNN-LSTM architecture combined with Transformer attention; Based on the training data set, a model collaborative optimization mechanism is used to perform distributed parallel training on each sub-model of the initial detection model, and an adaptive optimizer is constructed through an adaptive optimization algorithm, and the model parameters and model structure are dynamically updated using the adaptive optimizer and the dynamic training mechanism to obtain a hybrid detection model; based on the training data set, the model collaborative optimization mechanism is used to perform distributed parallel training on each sub-model of the initial detection model, including: inputting the training data set into the first sub-model, the second sub-model and the third sub-model in the initial detection model respectively, performing model parallel training on each sub-model, and obtaining the local calculation gradients of the first sub-model, the second sub-model and the third sub-model through a distributed scheduling structure; performing gradient aggregation on the local calculation gradients of the first sub-model, the second sub-model and the third sub-model to obtain a global gradient, and synchronously feeding back the global gradient to the first sub-model, the second sub-model and the third sub-model through a distributed scheduling structure to update the model parameters; embedding an attention weight allocation module and a graph neural network at the output end of the initial hybrid model, wherein the attention weight allocation module is used to adjust the output weight of each sub-model in the initial hybrid model, and the graph neural network is used to model the relationship between different power system nodes through a message passing mechanism; The hybrid detection model is deployed in the power system, and the real-time data stream of the power system is input into the hybrid detection model for anomaly detection, identifying abnormal data and marking potential attack behaviors. At the same time, according to the preset defense strategy, active security protection operations are performed on the power system for abnormal data and potential attack behaviors.

2. The power grid data anomaly detection method based on a hybrid deep learning model according to claim 1 is characterized in that: The convolutional neural network is combined with a recurrent neural network, a convolutional neural network is combined with a gated recurrent unit, and a convolutional neural network is combined with a long short-term memory network and a Transformer attention model to perform hybrid modeling to obtain an initial detection model, including: A nonlinear activation function is added to the convolutional neural network to obtain a CNN module; the CNN module includes a convolutional layer, a pooling layer and a fully connected layer, the output end of the convolutional layer is connected to the input end of the pooling layer through a nonlinear activation function, and the output end of the pooling layer is connected to the fully connected layer; Constructing an RNN module according to the network structure of the recursive neural network, connecting the output end of the CNN module with the input end of the RNN module, and obtaining a first sub-model with a CNN-RNN architecture; A GRU module is constructed based on the network structure of the gated recurrent unit, and the output of the CNN module is connected to the input of the GRU module to obtain a second sub-model with a CNN-GRU architecture; An LSTM module is constructed according to the network structure of the long short-term memory network, and a Transformer attention module is established according to the Transformer attention model. The output end of the CNN module is connected to the input end of the LSTM module and the input end of the Transformer attention module respectively, to obtain a third sub-model with a CNN-LSTM architecture.

3. The method for detecting anomalies in power grid data based on a hybrid deep learning model according to claim 1, wherein: The step of inputting the training data set into the first sub-model, the second sub-model, and the third sub-model in the initial detection model respectively, and performing model parallel training on each sub-model includes: Batch normalization units are set after the CNN modules of the first, second, and third sub-models in the initial detection model respectively; The training data set is input into the first, second and third sub-models respectively, and the spatial feature vectors are extracted using the CNN modules of the first, second and third sub-models respectively. The output of the CNN module is randomly deactivated, and the output of some neurons in the CNN module is randomly set to zero. The preset feature selection criteria are used to screen out spatial feature vectors that are highly correlated with abnormal behavior from the spatial feature vectors, and the batch normalization unit is used to normalize the spatial feature vectors that are highly correlated with abnormal behavior. The normalized feature fusion vectors are input into the RNN module of the first sub-model, the GRU module of the second sub-model, and the LSTM module of the third sub-model for abnormal behavior recognition training.

4. The method for detecting anomalies in power grid data based on a hybrid deep learning model according to claim 1, wherein: The method constructs an adaptive optimizer through an adaptive optimization algorithm, dynamically updates model parameters and model structure using the adaptive optimizer and a dynamic training mechanism, and obtains a hybrid detection model, including: An adaptive optimizer is constructed using the RMSProp optimization algorithm, and the mean square gradient value of the sub-model in the initial detection model training and the data feature distribution of the training data set are obtained; During the training of the initial hybrid model, the learning rate and gradient update step size of the initial detection model are dynamically adjusted using an adaptive optimizer based on a preset dynamic training mechanism. A joint loss function including the spatial feature extraction error term and the time series prediction error term is constructed, and the joint loss function is used to jointly optimize the sub-models in the initial detection model. After training is completed, the hybrid detection model is output.

5. The method for detecting anomalies in power grid data based on a hybrid deep learning model according to claim 1, wherein: Also includes: Detect whether the proportion of abnormal data and potential attack behaviors in the real-time data stream of the power system exceeds a preset data drift threshold. If the data proportion exceeds the preset data distribution threshold, increase the learning rate of the hybrid detection model and perform online fine-tuning of the model parameters of the hybrid detection model based on the current real-time data stream of the power system; If the data ratio does not exceed the preset data distribution threshold, the learning rate of the hybrid detection model is reduced, and the model parameters of the hybrid detection model are fine-tuned online based on the real-time data stream of the current power system.

6. A power grid data anomaly detection system based on a hybrid deep learning model, characterized in that: include: A dataset construction module is used to obtain historical power system operation data, label the attack types and divide the data into different categories to obtain a training dataset. A hybrid model building module is used to combine a convolutional neural network with a recurrent neural network, a convolutional neural network with a gated recurrent unit, and a convolutional neural network with a long short-term memory network and a Transformer attention model to perform hybrid modeling to obtain an initial detection model; the initial detection model includes a first sub-model using a CNN-RNN architecture, a second sub-model using a CNN-GRU architecture, and a third sub-model using a CNN-LSTM architecture combined with Transformer attention; A model parallel training module is used to perform distributed parallel training on each sub-model of the initial detection model based on the training data set using a model collaborative optimization mechanism, and to construct an adaptive optimizer through an adaptive optimization algorithm, and to dynamically update the model parameters and model structure using the adaptive optimizer and the dynamic training mechanism to obtain a hybrid detection model; the distributed parallel training of each sub-model of the initial detection model based on the training data set using the model collaborative optimization mechanism includes: inputting the training data set into the first sub-model, the second sub-model and the third sub-model in the initial detection model respectively, performing model parallel training on each sub-model, and obtaining the local calculation gradients of the first sub-model, the second sub-model and the third sub-model through a distributed scheduling structure; performing gradient aggregation on the local calculation gradients of the first sub-model, the second sub-model and the third sub-model to obtain a global gradient, and synchronously feeding back the global gradient to the first sub-model, the second sub-model and the third sub-model through a distributed scheduling structure to update the model parameters; an attention weight allocation module and a graph neural network are embedded at the output end of the initial hybrid model, the attention weight allocation module is used to adjust the output weight of each sub-model in the initial hybrid model, and the graph neural network is used to model the relationship between different power system nodes through a message passing mechanism; The abnormal behavior detection module is used to deploy the hybrid detection model into the power system, input the real-time data stream of the power system into the hybrid detection model for anomaly detection, identify abnormal data, and mark potential attack behaviors. At the same time, according to the preset defense strategy, active security protection operations are performed on the power system for abnormal data and potential attack behaviors.

7. The power grid data anomaly detection system based on a hybrid deep learning model according to claim 6, characterized in that: The system further includes a model online fine-tuning module, which is used to detect whether the proportion of abnormal data and potential attack behaviors in the real-time data stream of the power system exceeds a preset data drift threshold. If the data proportion exceeds the preset data distribution threshold, the learning rate of the hybrid detection model is increased, and the model parameters of the hybrid detection model are online fine-tuned based on the current real-time data stream of the power system; If the data ratio does not exceed the preset data distribution threshold, the learning rate of the hybrid detection model is reduced, and the model parameters of the hybrid detection model are fine-tuned online based on the real-time data stream of the current power system.

Images