Data security situation intelligent monitoring method and system based on power business chain

Abstract

The invention discloses a data security situation intelligent monitoring method and system based on a power service chain. The method comprises the following steps: S1, forming a power service chain data set; s2, forming a preprocessed power business chain data set; s3, extracting a key feature vector reflecting the running state and the abnormal feature of each link; s4, identifying and marking a power business chain data sample with potential abnormal behaviors; s5, using a power business chain data sample with potential abnormal behaviors as verification data, constructing an anomaly detection performance evaluation index, and performing global optimization on key hyper-parameters in the improved isolated forest model by using a simulated annealing algorithm; and S6, applying the optimized improved isolated forest model to the power service chain data flow acquired in real time, and performing anomaly detection on the newly acquired power service chain data. According to the method, the recognition sensitivity of the model to the key power abnormal signal can be remarkably improved, so that the path division of the abnormal behavior better fits the business risk reality.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and system for intelligently monitoring data security status based on an electric power business chain. Background Art

[0002] As power systems continue to evolve toward intelligence and informatization, the operational structure of the power business chain is becoming increasingly complex, encompassing multiple links including power generation, transmission, transformation, distribution, and consumption. This is accompanied by the rapid development of equipment automation, diversified data collection, and refined business processes. The operational data, business logs, and environmental parameters generated in each link exhibit multi-source heterogeneity, high-dimensional time series, and dynamic changes, posing significant technical challenges to identifying and warning of abnormal behavior.

[0003] Currently, the most widely used anomaly detection methods in the power industry include rule-based expert systems, statistical analysis methods, and some machine learning-based detection algorithms. For example, traditional rule-based methods rely on manually defined fault characteristics, which can easily lead to underreporting if abnormal behavior is not covered by the rules. Statistical methods often assume that data follows a known distribution during modeling. However, data in the power business chain is often complex and locally volatile, resulting in poor model fitting. Some studies have introduced isolation forest and support vector machine unsupervised learning methods for data-driven anomaly identification. However, isolation forest algorithms are prone to high false positive rates and reliance on empirically set model parameters when processing high-dimensional dynamic data. This is especially true when faced with drastic periodic changes in the power business chain or abnormal data from edge devices. Detection sensitivity and accuracy are insufficient, making it difficult to meet the power system's dual requirements for reliability and real-time performance.

[0004] Furthermore, most current anomaly detection systems rely solely on static model training, lacking a global optimization mechanism for model parameters. This makes them incapable of adapting to the complex scenario differences and dynamic characteristics of the power supply chain. Furthermore, existing isolation forest algorithms often overlook the multi-stage, hierarchical data structure of the power supply chain during modeling, failing to incorporate stage-specific sensitivity and the upstream and downstream coupling characteristics of the power supply chain. This results in a lack of structural awareness when determining abnormal behavior. Furthermore, detection results are difficult to feed back to the operation and maintenance system in real time, impacting emergency response efficiency.

[0005] In summary, there is an urgent need to propose an intelligent detection method that is oriented towards the characteristics of the power business chain, can improve the accuracy of anomaly identification, and has parameter optimization and structure perception capabilities, so as to effectively cope with the high requirements and high complexity of power system operation and maintenance scenarios. Summary of the Invention

[0006] One purpose of the present invention is to propose a method and system for intelligent monitoring of data security situation based on the power business chain. The present invention can significantly improve the model's recognition sensitivity to key power abnormal signals, making the path division of abnormal behavior more in line with actual business risks.

[0007] According to an embodiment of the present invention, a data security situation intelligent monitoring method based on a power business chain includes the following steps:

[0008] S1. Collect multi-source data from each link in the power business chain to form a power business chain dataset;

[0009] S2 preprocesses the power business chain data set to form a preprocessed power business chain data set;

[0010] S3. Construct a power business chain feature vector space based on the preprocessed power business chain data set and extract key feature vectors reflecting the operating status and abnormal characteristics of each link;

[0011] S4. Constructing an improved isolation forest model using the power business chain feature vector space, performing anomaly scoring on the power business chain data set based on the improved isolation forest model, and identifying and marking power business chain data samples with potential abnormal behavior;

[0012] S5. Using data samples from the power business chain with potential abnormal behavior as verification data, construct anomaly detection performance evaluation indicators and use a simulated annealing algorithm to globally optimize the key hyperparameters in the improved isolation forest model, with the optimization objective being to improve the accuracy of detecting potential abnormal behavior.

[0013] S6. Apply the optimized improved isolation forest model to the real-time collected power business chain data stream, perform anomaly detection on the newly collected power business chain data, and identify and mark the final power business chain data samples with potential abnormal behavior.

[0014] Optionally, the S1 includes the following steps:

[0015] S11. Set the data collection scope of the power business chain to cover all business stages of the power system, including power generation, transmission, transformation, distribution and consumption. Collect equipment operation data, business processing data and environmental parameter data from each business stage to form the original power business chain multi-source data set. ;

[0016] S12. Classify the original power business chain multi-source data according to the stage Group and construct phased sub-datasets ;

[0017] S13. For each stage of sub-dataset Perform unified time synchronization and format conversion processing, remap all data to a unified time axis and attribute space, and form a multi-dimensional time series power business chain data set :

[0018]

[0019] in, Indicates the stage number of the power business chain, corresponding to the power generation, transmission, transformation, distribution and consumption stages. Indicates the Stages in time Power business chain data sample, is the eigenvalue vector collected at that moment, is the corresponding device number, It is the label of the business chain stage. Indicates the data time interval corresponding to this stage.

[0020] Optionally, the S2 includes the following steps:

[0021] S21. Power business chain dataset Each power business chain data sample in Perform data integrity checks, remove abnormal samples containing illegal values ​​or unrecognizable codes, and obtain a cleaned preliminary power business chain data set;

[0022] S22. For sample data with missing eigenvalues ​​in the preliminary power business chain dataset, use a temporal proximity interpolation method to fill in the missing eigenvalues ​​and construct a power business chain dataset with missing value filling;

[0023] S23. Normalize all eigenvalue vectors in the completed power business chain data set and uniformly map them to the specified interval , and obtain the preprocessed power business chain dataset .

[0024] Optionally, S3 includes the following steps:

[0025] S31. The normalized power business chain dataset Each data sample in is mapped to the feature construction space, and the corresponding statistical features, structural features and change trend features are extracted to form the initial feature set :

[0026] ;

[0027] in, Indicates the Stages in time The mean of the characteristic values ​​is used to characterize the central trend of the power state at that moment. Represents the standard deviation of the eigenvalue, which is used to describe the fluctuation range of the data in this stage. Indicates the rate of change of features at adjacent moments, which is used to measure the speed of feature change. It represents the linear slope of the time series trend of the fitted power business chain characteristic value, which is used to reflect the long-term change direction;

[0028] S33. Unify the initial feature sets of all moments and all business stages to construct a complete power business chain feature vector space ,The feature vector space of the power business chain represents the set of feature ,expressions of the power business chain at each stage and each time point.

[0029] Optionally, the S4 includes the following steps:

[0030] S41. Based on the characteristic vector space of power business chain , build a training sample set for the improved isolation forest model, and calculate each sample Stage sensitivity weight :

[0031] ;

[0032] in, For the The proportion of historical anomalies in the stage, is the current characteristic standard deviation, is the stage operation stability coefficient, To adjust the weight, used to characterize abnormal sensitivity;

[0033] S42. Sample-based stage sensitivity weights Calculate the feature selection probability based on the degree of deviation of the features in each dimension , and in the process of building the isolated tree, dimension partitioning and selection are performed according to the feature selection probability:

[0034] ;

[0035] in, Represents the jth characteristic component of the kth stage in the power business chain at time t, which is used to characterize the local state information of the business at that moment. It represents the mean value of the jth characteristic dimension in all samples in the kth stage of the power business chain, reflecting the long-term stable reference value of the characteristic in this stage. M represents the average value of each sample. The total number of feature dimensions in ;

[0036] S43. Select probability based on features , according to the power business chain stage number Group the feature sample set to generate phased subsets , and when building each isolated tree, it samples from different stage subsets in proportion to retain the hierarchical characteristics of the power business chain structure;

[0037] S44. For each stage subset Calculate feature distribution density , used to dynamically control the maximum tree depth of this stage , and set a depth limit when constructing the isolation tree:

[0038] ;

[0039] ;

[0040] in, Represents the k-th stage subset The mean vector of all eigenvectors in , Indicates the basic tree depth of all stages, which is the lower limit baseline value of the isolated tree depth and determines the minimum tree depth framework. Indicates the adjustment coefficient between distribution density and tree depth;

[0041] Maximum tree depth Directly used as a tree construction parameter to control the structural complexity of each isolated tree at different stages;

[0042] S45. After all isolated trees are constructed, for each sample Calculate the average path length in all trees and weight it according to its stage sensitivity weight to obtain the sample weighted path length :

[0043]

[0044] in, is the total number of isolated trees, Indicates the The path length calculation value of each tree, T is the total number of isolated trees constructed in the improved isolation forest model;

[0045] S46. Using sample weighted path length Construct the final anomaly scoring function with the standard normalization function to form an anomaly score :

[0046]

[0047] in, is the normalization coefficient, and the subset size related;

[0048] S47. Based on anomaly scoring Setting business scenario thresholds , extract samples with anomaly scores greater than the business scenario threshold, identify and mark power business chain data samples with potential abnormal behavior .

[0049] Optionally, the S5 includes the following steps:

[0050] S51. Based on a collection of power business chain data samples with potential abnormal behavior Extract the labeled or manually verified samples to build a validation set ;

[0051] S52. Define anomaly detection performance evaluation indicator function , where the parameter set , respectively represent the number of isolated trees in the improved isolation forest model, the sampling subset size of each tree, and the depth of the tree base:

[0052] ;

[0053] in, Indicates parameter configuration The recognition accuracy of the following model is represents the recall rate, Indicates that the anomaly score is in the validation set The variance on is the corresponding score set, is a non-negative weighting coefficient;

[0054] S53. Use simulated annealing algorithm to set the parameter Perform global optimization and initialize the parameters to , the initial temperature is , in each iteration the following steps are performed:

[0055] Generate current parameter solution Neighborhood candidate solutions ;

[0056] Calculate the current evaluation value and candidate evaluation values ;

[0057] like , accept the new solution; otherwise, with probability:

[0058] ;

[0059] Accept new interpretations, among which, is the current temperature, Indicates that in the i-th iteration, from the current parameter New candidate parameter solutions generated in the neighborhood, Indicates that the current parameter configuration Under this circumstance, the objective function value calculated based on the power business chain anomaly detection performance evaluation function is: Indicates that the candidate parameter solution The objective function value under is used to compare with the current value to determine whether to adopt the new model configuration. If the performance of a candidate solution degrades, the acceptance probability is used to decide whether to accept the candidate solution.

[0060] S54. After each iteration, the temperature Make updates;

[0061] S55. Repeat the simulated annealing iteration process until the maximum number of iterations or the anomaly detection performance evaluation index function is met Convergence, output optimal parameter solution ;

[0062] S56. Solve the optimal parameters It is applied to the improved isolation forest model to replace the original default parameter configuration and form an optimized improved isolation forest model structure.

[0063] A data security situation intelligent monitoring system based on the power business chain is used to implement a data security situation intelligent monitoring method based on the power business chain, including the following modules:

[0064] The data acquisition module is used to collect multi-source data from various links in the power business chain and form a power business chain data set;

[0065] A data preprocessing module, configured to perform data cleaning, missing value filling, and normalization on the power business chain data set, and construct a preprocessed power business chain data set;

[0066] A feature construction module is used to construct a power business chain feature vector space based on the preprocessed power business chain data set, and extract key feature vectors reflecting the operating status and abnormal behavior characteristics of each business link;

[0067] An improved isolation forest modeling module is used to construct an improved isolation forest model based on the power business chain feature vector space, the model integrating a feature weighting mechanism, a stage sensitivity sampling mechanism, and a depth control strategy, and performing anomaly scoring on the power business chain data set to identify and mark power business chain data samples with potential abnormal behavior;

[0068] A model optimization module is used to construct anomaly detection performance evaluation indicators using power business chain data samples with potential abnormal behavior as verification data, and to globally optimize key hyperparameters in the improved isolation forest model using a simulated annealing algorithm;

[0069] The real-time detection module is used to deploy the optimized improved isolation forest model in the real-time data stream of the power business chain, perform anomaly detection on the newly collected power business chain data, and output the power business chain data samples with potential abnormal behavior that are finally identified and marked.

[0070] The beneficial effects of the present invention are:

[0071] (1) Based on the isolation forest algorithm, the present invention combines the historical abnormal proportions, operational volatility and stability indicators of each stage of the power business chain to construct a sample-level sensitivity weight, and multiplies it with the feature deviation degree to construct a dynamic feature selection probability, realizing a feature partitioning dimension sampling strategy driven by stage risk + feature mutation. This mechanism can significantly improve the model's recognition sensitivity to key power abnormal signals, making the path division of abnormal behavior more in line with the actual business risk.

[0072] (2) In view of the fact that data at different stages of the power business chain present uneven density and large distribution differences, the present invention introduces a dynamic depth adjustment strategy based on subset feature density estimation. During the tree construction process, the maximum depth of the tree construction is adaptively adjusted according to the distribution sparsity of the sub-chain data at each stage. This mechanism can avoid the problems of overfitting in dense areas and underfitting in sparse areas, while ensuring the accuracy of local modeling and controlling the overall model complexity, significantly improving the robustness of the model in a cross-stage and multi-distribution sample environment.

[0073] (3) The present invention uses verification samples with potential abnormal behaviors to construct a performance objective function that integrates accuracy, recall rate, and anomaly score stability, and globally optimizes the core hyperparameters of the isolation forest based on the simulated annealing algorithm, breaking away from the limitations of traditional manual parameter adjustment or local search. During the model training process, the optimization strategy guides the parameters to gradually converge toward the direction of optimal detection accuracy and strongest score consistency, thereby significantly improving the overall detection capability and generalization performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0075] Figure 1 This is a flow chart of a data security situation intelligent monitoring method and system based on the power business chain proposed by the present invention. DETAILED DESCRIPTION

[0076] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0077] refer to Figure 1 , a data security situation intelligent monitoring method based on the power business chain, comprising the following steps:

[0078] S1. Collect multi-source data from each link in the power business chain to form a power business chain dataset;

[0079] S2. Preprocess the power business chain data set to form a preprocessed power business chain data set;

[0080] S3. Construct a power business chain feature vector space based on the preprocessed power business chain data set and extract key feature vectors reflecting the operating status and abnormal characteristics of each link;

[0081] S4. Utilize the power business chain feature vector space to construct an improved isolation forest model. Based on the improved isolation forest model, perform anomaly scoring on the power business chain data set, identifying and marking power business chain data samples with potential abnormal behavior.

[0082] S5. Using data samples from the power business chain with potential abnormal behavior as verification data, we construct anomaly detection performance evaluation index. We also employ a simulated annealing algorithm to globally optimize key hyperparameters in the improved isolation forest model, with the optimization objective being to improve the accuracy of detecting potential abnormal behavior.

[0083] S6. Apply the optimized improved isolation forest model to the real-time collected power business chain data stream, perform anomaly detection on the newly collected power business chain data, and identify and mark the final power business chain data samples with potential abnormal behavior.

[0084] In this embodiment, S1 includes the following steps:

[0085] S11. Set the data collection scope of the power business chain to cover all business stages of the power system, including power generation, transmission, transformation, distribution and consumption. Collect equipment operation data, business processing data and environmental parameter data from each business stage to form the original power business chain multi-source data set. ;

[0086] S12. Classify the original power business chain multi-source data according to the stage Group and construct phased sub-datasets ;

[0087] S13. For each stage of sub-dataset Perform unified time synchronization and format conversion processing, remap all data to a unified time axis and attribute space, and form a multi-dimensional time series power business chain data set :

[0088]

[0089] in, Indicates the stage number of the power business chain, corresponding to the power generation, transmission, transformation, distribution and consumption stages. Indicates the Stages in time Power business chain data sample, is the eigenvalue vector collected at that moment, is the corresponding device number, It is the label of the business chain stage. Indicates the data time interval corresponding to this stage.

[0090] In this embodiment, S2 includes the following steps:

[0091] S21. Power business chain dataset Each power business chain data sample in Perform data integrity checks, remove abnormal samples containing illegal values ​​or unrecognizable codes, and obtain a cleaned preliminary power business chain data set;

[0092] S22. For sample data with missing eigenvalues ​​in the preliminary power business chain dataset, use the temporal proximity interpolation method to fill in the missing eigenvalues ​​and construct a power business chain dataset with missing value filling.

[0093] S23. Normalize all eigenvalue vectors in the completed power business chain data set and uniformly map them to the specified interval , and obtain the preprocessed power business chain dataset .

[0094] In this embodiment, S3 includes the following steps:

[0095] S31. The normalized power business chain dataset Each data sample in is mapped to the feature construction space, and the corresponding statistical features, structural features and change trend features are extracted to form the initial feature set :

[0096] ;

[0097] in, Indicates the Stages in time The mean of the characteristic values ​​is used to characterize the central trend of the power state at that moment. Represents the standard deviation of the eigenvalue, which is used to describe the fluctuation range of the data in this stage. Indicates the rate of change of features at adjacent moments, which is used to measure the speed of feature change. It represents the linear slope of the time series trend of the fitted power business chain characteristic value, which is used to reflect the long-term change direction;

[0098] S33. Unify the initial feature sets of all moments and all business stages to construct a complete power business chain feature vector space ,The feature vector space of the power business chain represents the set of feature ,expressions of the power business chain at each stage and each time point.

[0099] In this embodiment, S4 includes the following steps:

[0100] S41. Based on the characteristic vector space of power business chain , build a training sample set for the improved isolation forest model, and calculate each sample Stage sensitivity weight :

[0101] ;

[0102] in, For the The proportion of historical anomalies in the stage, is the current characteristic standard deviation, is the stage operation stability coefficient, To adjust the weight, used to characterize abnormal sensitivity;

[0103] S42. Sample-based stage sensitivity weights Calculate the feature selection probability based on the degree of deviation of the features in each dimension , and in the process of building the isolated tree, dimension partitioning and selection are performed according to the feature selection probability:

[0104] ;

[0105] in, Represents the jth characteristic component of the kth stage in the power business chain at time t, which is used to characterize the local state information of the business at that moment. It represents the mean value of the jth characteristic dimension in all samples in the kth stage of the power business chain, reflecting the long-term stable reference value of the characteristic in this stage. M represents the average value of each sample. The total number of feature dimensions in ;

[0106] S43. Select probability based on features , according to the power business chain stage number Group the feature sample set to generate phased subsets , and when building each isolated tree, it samples from different stage subsets in proportion to retain the hierarchical characteristics of the power business chain structure;

[0107] S44. For each stage subset Calculate feature distribution density , used to dynamically control the maximum tree depth of this stage , and set a depth limit when constructing the isolation tree:

[0108] ;

[0109] ;

[0110] in, Represents the k-th stage subset The mean vector of all eigenvectors in , Indicates the basic tree depth of all stages, which is the lower limit baseline value of the isolated tree depth and determines the minimum tree depth framework. Indicates the adjustment coefficient between distribution density and tree depth;

[0111] Maximum tree depth Directly used as a tree construction parameter to control the structural complexity of each isolated tree at different stages;

[0112] S45. After all isolated trees are constructed, for each sample Calculate the average path length in all trees and weight it according to its stage sensitivity weight to obtain the sample weighted path length :

[0113]

[0114] in, is the total number of isolated trees, Indicates the The path length calculation value of each tree, T is the total number of isolated trees constructed in the improved isolation forest model;

[0115] S46. Using sample weighted path length Construct the final anomaly scoring function with the standard normalization function to form an anomaly score :

[0116]

[0117] in, is the normalization coefficient, and the subset size related;

[0118] S47. Based on anomaly scoring Setting business scenario thresholds , extract samples with anomaly scores greater than the business scenario threshold, identify and mark power business chain data samples with potential abnormal behavior .

[0119] In this embodiment, S5 includes the following steps:

[0120] S51. Based on a collection of power business chain data samples with potential abnormal behavior Extract the labeled or manually verified samples to build a validation set ;

[0121] S52. Define anomaly detection performance evaluation indicator function , where the parameter set , respectively represent the number of isolated trees in the improved isolation forest model, the sampling subset size of each tree, and the depth of the tree base:

[0122] ;

[0123] in, Indicates parameter configuration The recognition accuracy of the following model is represents the recall rate, Indicates that the anomaly score is in the validation set The variance on is the corresponding score set, is a non-negative weighting coefficient;

[0124] S53. Use simulated annealing algorithm to set the parameter Perform global optimization and initialize the parameters to , the initial temperature is , in each iteration the following steps are performed:

[0125] Generate current parameter solution Neighborhood candidate solutions ;

[0126] Calculate the current evaluation value and candidate evaluation values ;

[0127] like , accept the new solution; otherwise, with probability:

[0128] ;

[0129] Accept new interpretations, among which, is the current temperature, Indicates that in the i-th iteration, from the current parameter New candidate parameter solutions generated in the neighborhood, Indicates that the current parameter configuration Under this circumstance, the objective function value calculated based on the power business chain anomaly detection performance evaluation function is: Indicates that the candidate parameter solution The objective function value under is used to compare with the current value to determine whether to adopt the new model configuration. If the performance of a candidate solution degrades, the acceptance probability is used to decide whether to accept the candidate solution.

[0130] S54. After each iteration, the temperature Make updates;

[0131] S55. Repeat the simulated annealing iteration process until the maximum number of iterations or the anomaly detection performance evaluation index function is met Convergence, output optimal parameter solution ;

[0132] S56. Solve the optimal parameters It is applied to the improved isolation forest model to replace the original default parameter configuration and form an optimized improved isolation forest model structure.

[0133] A data security situation intelligent monitoring system based on the power business chain is used to implement a data security situation intelligent monitoring method based on the power business chain, including the following modules:

[0134] The data acquisition module is used to collect multi-source data from various links in the power business chain and form a power business chain data set;

[0135] The data preprocessing module is used to perform data cleaning, missing value filling, and normalization on the power business chain data set, and to construct a preprocessed power business chain data set;

[0136] A feature construction module is used to construct a power business chain feature vector space based on the preprocessed power business chain data set, and extract key feature vectors that reflect the operating status and abnormal behavior characteristics of each business link;

[0137] Improved Isolation Forest Modeling Module, used to construct an improved isolation forest model based on the power business chain feature vector space. The model integrates feature weighting mechanism, stage sensitivity sampling mechanism and deep control strategy, and performs anomaly scoring on the power business chain data set, identifying and marking power business chain data samples with potential abnormal behavior;

[0138] The model optimization module is used to construct anomaly detection performance evaluation indicators using power business chain data samples with potential abnormal behavior as verification data, and to globally optimize the key hyperparameters in the improved isolation forest model through the simulated annealing algorithm;

[0139] The real-time detection module is used to deploy the optimized improved isolation forest model in the real-time data stream of the power business chain, perform anomaly detection on the newly collected power business chain data, and output the power business chain data samples with potential abnormal behavior that are finally identified and marked.

[0140] Example 1:

[0141] This embodiment is based on the power business chain operation data of a provincial dispatching center from August 2024 to October 2024, constructs a practical application scenario, and verifies the practical feasibility and effectiveness of the present invention.

[0142] The dispatch center is responsible for real-time monitoring and dispatching of the operating status of 12 power stations, three main transmission lines, eight substations, five distribution lines, and power nodes in multiple industrial parks within its jurisdiction. Business chain data is uploaded to the central database every minute via the SCADA system, metering terminals, and edge sensing devices. This data includes 97 multi-source features, including voltage, current, frequency, phase angle, active power, reactive power, circuit breaker status, fault signals, alarm records, business dispatch command execution results, and related environmental temperature and humidity data.

[0143] Around 3:15 AM on August 25, 2024, the center received a series of alarms indicating frequent fluctuations in power transmission channels. However, after initial investigation using traditional rule-based models, on-duty personnel determined these to be "non-critical disturbances" and did not trigger further action. At 4:08 AM, a busbar overload occurred at Substation #3, affecting downstream distribution lines and triggering regional power outages. Subsequent event review revealed that signs of this abnormal behavior had actually been present as early as an hour prior. However, due to the low sensitivity of traditional methods and their lack of comprehensive analysis of signals from various links, this "chain-related anomaly" was not promptly identified.

[0144] To verify the recognition capability of the proposed method in such complex abnormal behavior scenarios, we constructed a real training and test dataset based on the center's business chain data from August 1 to October 31, 2024, which includes:

[0145] Multi-source original samples of the power business chain: a total of 122,880 (minute-level), covering 36 key nodes;

[0146] Manually annotated historical abnormal events: 85 in total, including load jump, voltage sag, short-term voltage loss, frequency oscillation, and harmonic anomalies;

[0147] Normal operation samples: Randomly select equal number of normal samples to ensure sample balance.

[0148] In the data preprocessing stage, data cleaning, normalization, missing value filling are completed, and key indicators are extracted based on the feature construction space to construct the sample feature vector Then, the characteristic vector space of the power business chain was constructed, and the statistical mean, standard deviation, change rate and trend characteristics of each sample were calculated.

[0149] During the model training phase, the improved isolation forest method was used to build the model. The stage sensitivity weight was calculated for each sample. Feature deviation values ​​were used to guide feature partitioning, and distribution density was introduced to control the tree depth structure to model data differences at different stages. During the anomaly scoring phase, the model comprehensively considered path length and stage sensitivity to generate the final anomaly score.

[0150] In the parameter optimization stage, a simulated annealing optimization process was designed to optimize the number of isolated trees. , subset size and build foundation depth The three key parameters are globally tuned, and the objective function integrates the three indicators of accuracy, recall rate and scoring stability, and finally the optimal parameter configuration is selected 、 、 .

[0151] To compare the performance of the proposed method with the traditional isolation forest method, we trained and tested the two models using a unified dataset and evaluation criteria. The comparison is as follows:

[0152]

[0153] In a specific sample, the traditional method failed to detect the sudden bus frequency oscillation signal at substation #6 at 10:27 on September 14, 2024. However, the method of the present invention successfully scored the signal as 0.932 (the abnormality threshold is 0.82) through the stage sensitivity weighting mechanism, and marked the sudden increase in load trend of its upstream power supply node 3 minutes before the abnormality, providing sufficient data support for subsequent analysis.

[0154] Further comparison of the scoring output shows that in the continuous samples from 10 minutes before the abnormal event to 5 minutes after the event:

[0155]

[0156] It can be seen from the above that the method of the present invention gives a high score in the early stage of abnormal trend formation, and has stronger foresight and linkage judgment capabilities.

[0157] In summary, this embodiment systematically demonstrates the entire process of data preprocessing, model construction, parameter optimization, and anomaly identification by applying the method of the present invention to real data from a provincial dispatching center. It also verifies the significant advantages of the present invention in terms of accuracy, recall rate, scoring stability, and response timeliness through comparative experiments, fully illustrating the practical application value and engineering feasibility of this method in intelligent monitoring of abnormal behaviors in complex power business chains.

[0158] Based on the isolation forest algorithm, the present invention combines the historical anomaly ratio, operation volatility and stability indicators of each stage of the power business chain to construct sample-level sensitivity weights, and multiplies them with the feature deviation degree to construct dynamic feature selection probability, realizing a feature partitioning dimension sampling strategy driven by stage risk + feature mutation. This mechanism can significantly improve the model's recognition sensitivity for key power anomaly signals, making the path division of abnormal behavior more in line with actual business risks.

[0159] In view of the uneven density and large distribution differences of data in different stages of the power business chain, the present invention introduces a dynamic depth adjustment strategy based on subset feature density estimation. During the tree construction process, the maximum depth of the tree construction is adaptively adjusted according to the distribution sparsity of the sub-chain data in each stage. This mechanism can avoid the problems of overfitting in dense areas and underfitting in sparse areas, while ensuring the local modeling accuracy and controlling the overall model complexity, significantly improving the robustness of the model in a cross-stage and multi-distribution sample environment.

[0160] The present invention uses verification samples with potential abnormal behaviors to construct a performance objective function that integrates accuracy, recall rate and anomaly score stability, and globally optimizes the core hyperparameters of the isolation forest based on the simulated annealing algorithm, breaking away from the limitations of traditional manual parameter adjustment or local search. During the model training process, the optimization strategy guides the parameters to gradually converge towards the direction of optimal detection accuracy and strongest score consistency, thereby significantly improving the overall detection capability and generalization performance.

[0161] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A data security situation intelligent monitoring method based on the power business chain, characterized in that: The steps include: S1. Collect multi-source data from each link in the power business chain to form a power business chain dataset; S2 preprocesses the power business chain data set to form a preprocessed power business chain data set; S3. Construct a power business chain feature vector space based on the preprocessed power business chain data set and extract key feature vectors reflecting the operating status and abnormal characteristics of each link; S4. Constructing an improved isolation forest model using the power business chain feature vector space, performing anomaly scoring on the power business chain data set based on the improved isolation forest model, and identifying and marking power business chain data samples with potential abnormal behavior; S5. Using data samples from the power business chain with potential abnormal behavior as verification data, construct anomaly detection performance evaluation indicators and use a simulated annealing algorithm to globally optimize the key hyperparameters in the improved isolation forest model, with the optimization objective being to improve the accuracy of detecting potential abnormal behavior. S6. Apply the optimized improved isolation forest model to the real-time collected power business chain data stream, perform anomaly detection on the newly collected power business chain data, and identify and mark the final power business chain data samples with potential abnormal behavior.

2. The method for intelligent monitoring of data security situation based on the power business chain according to claim 1 is characterized in that: Said S1 comprises the following steps: S11. Set the data collection scope of the power business chain to cover all business stages of the power system, including power generation, transmission, transformation, distribution and consumption. Collect equipment operation data, business processing data and environmental parameter data from each business stage to form the original power business chain multi-source data set. ; S12. Classify the original power business chain multi-source data according to the stage Group and construct phased sub-datasets ; S13. For each stage of sub-dataset Perform unified time synchronization and format conversion processing, remap all data to a unified time axis and attribute space, and form a multi-dimensional time series power business chain data set :

3. Among them, Indicates the stage number of the power business chain, corresponding to the power generation, transmission, transformation, distribution and consumption stages. Indicates the Stages in time Power business chain data sample, is the eigenvalue vector collected at that moment, is the corresponding device number, It is the label of the business chain stage. Indicates the data time interval corresponding to this stage.

4. The method for intelligently monitoring data security situation based on the power business chain according to claim 1 is characterized in that: The S2 comprises the following steps: S21. Power business chain dataset Each power business chain data sample Perform data integrity checks, remove abnormal samples containing illegal values ​​or unrecognizable codes, and obtain a cleaned preliminary power business chain data set; S22. For sample data with missing eigenvalues ​​in the preliminary power business chain dataset, use a temporal proximity interpolation method to fill in the missing eigenvalues ​​and construct a power business chain dataset with missing value filling; S23. Normalize all eigenvalue vectors in the completed power business chain data set and uniformly map them to the specified interval , and obtain the preprocessed power business chain dataset .

5. The method for intelligent monitoring of data security situation based on the power business chain according to claim 1 is characterized in that: The S3 includes the following steps: S31. The normalized power business chain dataset Each data sample in is mapped to the feature construction space, and the corresponding statistical features, structural features and change trend features are extracted to form the initial feature set : ； in, Indicates the Stages in time The mean of the characteristic values ​​is used to characterize the central trend of the power state at that moment. Represents the standard deviation of the eigenvalue, which is used to describe the fluctuation range of the data in this stage. Indicates the rate of change of features at adjacent moments, which is used to measure the speed of feature change. It represents the linear slope of the time series trend of the fitted power business chain characteristic value, which is used to reflect the long-term change direction; S33. Unify the initial feature sets of all moments and all business stages to construct a complete power business chain feature vector space ,The feature vector space of the power business chain represents the set of feature ,expressions of the power business chain at each stage and each time point.

6. The method for intelligent monitoring of data security situation based on the power business chain according to claim 1 is characterized in that: The S4 comprises the following steps: S41. Based on the characteristic vector space of power business chain , build a training sample set for the improved isolation forest model, and calculate each sample Stage sensitivity weight : ； in, For the The proportion of historical anomalies in the stage, is the current characteristic standard deviation, is the stage operation stability coefficient, To adjust the weight, used to characterize abnormal sensitivity; S42. Sample-based stage sensitivity weights Calculate the feature selection probability based on the degree of deviation of the features in each dimension , and in the process of building the isolated tree, dimension partitioning and selection are performed according to the feature selection probability: ； in, Represents the jth characteristic component of the kth stage in the power business chain at time t, which is used to characterize the local state information of the business at that moment. It represents the mean value of the jth characteristic dimension in all samples in the kth stage of the power business chain, reflecting the long-term stable reference value of the characteristic in this stage. M represents the average value of each sample. The total number of feature dimensions in ; S43. Select probability based on features , according to the power business chain stage number Group the feature sample set to generate phased subsets , and when building each isolated tree, it samples from different stage subsets in proportion to retain the hierarchical characteristics of the power business chain structure; S44. For each stage subset Calculate feature distribution density , used to dynamically control the maximum tree depth of this stage , and set a depth limit when constructing the isolation tree: ； ； in, Represents the k-th stage subset The mean vector of all eigenvectors in , Indicates the basic tree depth of all stages, which is the lower limit baseline value of the isolated tree depth and determines the minimum tree depth framework. Indicates the adjustment coefficient between distribution density and tree depth; Maximum tree depth Directly used as a tree construction parameter to control the structural complexity of each isolated tree at different stages; S45. After all isolated trees are constructed, for each sample Calculate the average path length in all trees and weight it according to its stage sensitivity weight to obtain the sample weighted path length :

7. Among them, is the total number of isolated trees, Indicates the The path length calculation value of each tree, T is the total number of isolated trees constructed in the improved isolation forest model; S46. Using sample weighted path length Construct the final anomaly scoring function with the standard normalization function to form an anomaly score :

8. Among them, is the normalization coefficient, and the subset size related; S47. Based on anomaly scoring Setting business scenario thresholds , extract samples with anomaly scores greater than the business scenario threshold, identify and mark power business chain data samples with potential abnormal behavior .

9. The method for intelligent monitoring of data security situation based on the power business chain according to claim 1 is characterized in that: The S5 comprises the following steps: S51. Based on a collection of power business chain data samples with potential abnormal behavior Extract the labeled or manually verified samples to build a validation set ; S52. Define anomaly detection performance evaluation indicator function , where the parameter set , respectively represent the number of isolated trees in the improved isolation forest model, the sampling subset size of each tree, and the depth of the tree base: ； in, Indicates parameter configuration The recognition accuracy of the following model is represents the recall rate, Indicates that the anomaly score is in the validation set The variance on is the corresponding score set, is a non-negative weighting coefficient; S53. Use simulated annealing algorithm to set the parameter Perform global optimization and initialize the parameters to , the initial temperature is , in each iteration the following steps are performed: Generate current parameter solution Neighborhood candidate solutions ; Calculate the current evaluation value and candidate evaluation values ; like , accept the new solution; otherwise, with probability: ； Accept new interpretations, among which, is the current temperature, Indicates that in the i-th iteration, from the current parameter New candidate parameter solutions generated in the neighborhood, Indicates that the current parameter configuration Under this circumstance, the objective function value calculated based on the power business chain anomaly detection performance evaluation function is: Indicates that the candidate parameter solution The objective function value under is used to compare with the current value to determine whether to adopt the new model configuration. If the performance of a candidate solution degrades, the acceptance probability is used to decide whether to accept the candidate solution. S54. After each iteration, the temperature Make updates; S55. Repeat the simulated annealing iteration process until the maximum number of iterations or the anomaly detection performance evaluation index function is met Convergence, output optimal parameter solution ; S56. Solve the optimal parameters It is applied to the improved isolation forest model to replace the original default parameter configuration and form an optimized improved isolation forest model structure.

10. A data security situation intelligent monitoring system based on a power business chain, used to execute a data security situation intelligent monitoring method based on a power business chain according to any one of claims 1 to 6, characterized in that: Includes the following modules: The data acquisition module is used to collect multi-source data from various links in the power business chain and form a power business chain data set; A data preprocessing module, configured to perform data cleaning, missing value filling, and normalization on the power business chain data set, and construct a preprocessed power business chain data set; A feature construction module is used to construct a power business chain feature vector space based on the preprocessed power business chain data set, and extract key feature vectors reflecting the operating status and abnormal behavior characteristics of each business link; An improved isolation forest modeling module is used to construct an improved isolation forest model based on the power business chain feature vector space, the model integrating a feature weighting mechanism, a stage sensitivity sampling mechanism, and a depth control strategy, and performing anomaly scoring on the power business chain data set to identify and mark power business chain data samples with potential abnormal behavior; A model optimization module is used to construct anomaly detection performance evaluation indicators using power business chain data samples with potential abnormal behavior as verification data, and to globally optimize key hyperparameters in the improved isolation forest model using a simulated annealing algorithm; The real-time detection module is used to deploy the optimized improved isolation forest model in the real-time data stream of the power business chain, perform anomaly detection on the newly collected power business chain data, and output the power business chain data samples with potential abnormal behavior that are finally identified and marked.

Images