Abnormality detection model selection method and system based on index portrait

Abstract

The invention discloses an anomaly detection model selection method and system based on index portraits, and relates to the technical field of intelligent operation and maintenance of power systems. The method comprises the following steps: collecting historical data of a target monitoring index, extracting multi-dimensional features to construct an index portrait, and classifying the index portrait; screening candidate anomaly detection models from the matching rule base, performing adaptation degree scoring in combination with a model compatibility evaluation mechanism, determining an optimal anomaly detection model to perform anomaly detection, and outputting an anomaly judgment result; when a plurality of models exist, generating a final abnormal result through a confidence-driven arbitration mechanism; for multi-index abnormity, causal reasoning is carried out in combination with an electric power knowledge graph, main alarm indexes are determined, and secondary indexes are processed according to a delay strategy; meanwhile, incremental updating of index portrait features, adaptive adjustment of model parameters and dynamic optimization of matching rules are supported, and a whole-process closed-loop mechanism covering'portrait construction-model matching-result fusion-alarm decision-feedback updating 'is constructed.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent operation and maintenance of power systems, and in particular to an abnormality model selection method and system based on indicator profiling. Background Art

[0002] With the accelerated digital transformation of traditional industries like electricity, large power companies are increasingly building integrated digital platforms to enable data-driven intelligent decision-making. Within complex and extensive digital operations and maintenance systems, effective monitoring and anomaly alerting of numerous indicators are required to ensure high system availability and stability.

[0003] However, existing technologies face two common challenges. First, fixed thresholds or single-algorithm detection methods struggle to adapt to diverse indicators. Monitoring indicators exhibit diverse data types (e.g., stationarity, periodicity, and trending). A single fixed upper and lower threshold strategy cannot cover all types of anomalies, and manually setting thresholds is both time-consuming and inefficient. Even with machine learning models, different models have their own strengths, making it difficult for a single model to deliver optimal performance in all scenarios. Second, there is a lack of adaptive model selection and optimization mechanisms. Currently, many intelligent O&M solutions rely on O&M experts to statically specify detection algorithms for different indicators based on their experience. For example, statistical thresholds are used for stationary indicators, while time series predictions are used for periodic indicators. However, this manual mapping approach lacks objective evidence and is difficult to adapt to changing data characteristics in real time. When the environment changes or model performance degrades, manual intervention is required to reselect or adjust parameters, resulting in a low level of intelligence. Summary of the Invention

[0004] Regarding how to automatically select and optimize anomaly detection models based on the various characteristics of indicators in the power digital operation and maintenance system to improve the accuracy and adaptability of anomaly identification, the present invention proposes an anomaly detection model selection method and system based on indicator portraits. By integrating indicator portrait construction, model automatic matching, multi-model fusion detection and adaptive optimization technologies, an intelligent anomaly detection solution is realized.

[0005] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0006] A method for selecting an anomaly detection model based on indicator profiling, the method comprising:

[0007] Collect historical data of target monitoring indicators, extract periodic characteristics, trend characteristics, stability characteristics, distribution morphology characteristics, historical anomaly incidence rates, business scenario labels and health scores, build indicator portraits for feature vectorization, and classify the target monitoring indicators into preset indicator types based on similarity;

[0008] Establish a matching rule library between indicator types and anomaly detection models, and combine the model compatibility evaluation mechanism to score the fitness of candidate anomaly detection models. Based on the matching rules and fitness scores, comprehensively determine the optimal anomaly detection model and parameter configuration corresponding to the indicator profile;

[0009] The anomaly detection model is used to perform anomaly detection on the actual data of the target monitoring indicator, output an anomaly score and compare it with the model threshold to obtain an anomaly determination result; when there are multiple anomaly detection models, the final anomaly determination result is generated by weighted fusion or arbitration decision-making based on the anomaly score, anomaly determination result and confidence level output by each anomaly detection model;

[0010] When the abnormality determination result shows that the target monitoring indicator is abnormal and meets the alarm condition, an abnormality alarm is generated and sent according to the preset strategy; if multiple different target monitoring indicators of the same device are abnormal successively within a predetermined time window, the abnormal information is integrated to perform fault correlation analysis, and the alarm sequence is adjusted or secondary alarms are suppressed;

[0011] Based on the performance of the anomaly detection model and manual handling feedback, the indicator portrait features and the indicator types to which they belong are updated, the newly added features are incrementally added to the indicator portrait and the version changes are stored; and according to the actual false alarm rate and missed alarm rate changes of the anomaly detection model, the model selection strategy and parameter configuration in the matching rule library are automatically adjusted.

[0012] As a preferred solution of the present invention, the business scenario tag is used to indicate the power business category to which the target monitoring indicator belongs, including substation monitoring, transmission and distribution load, power quality and safety alarm;

[0013] The calculation formula of the health score is: ;

[0014] Where, represents the health score; is the historical failure rate of the target monitoring indicator, is the failure rate weight factor; is the average repair time, is the weight factor of the average repair time.

[0015] As a preferred solution of the present invention, the combined model compatibility evaluation mechanism performs fitness scoring on the candidate anomaly detection models, and comprehensively determines the optimal anomaly detection model and parameter configuration corresponding to the indicator profile based on the matching rules and the fitness score, specifically including:

[0016] According to the indicator type classified by the target monitoring indicator, the corresponding candidate anomaly detection model is selected from the matching rule library and the rule priority weight is marked. ;

[0017] Calculates the difference measure between the hypothesized distribution of the candidate anomaly detection model and the actual distribution of the target monitoring indicator , and converted into a basic fitness score ;

[0018] The basic fitness is scored using the model compatibility evaluation mechanism Perform dynamic corrections, including calculating dynamic correction fitness scores based on reinforcement learning and automatic machine learning-based calculation of supplementary fitness scores ;

[0019] Calculate the comprehensive score of matching rules and fitness score : ;

[0020] Where, 、 、 is the weight factor, and ;

[0021] Select comprehensive rating Highest or overall score The top N candidate anomaly detection models are used as the optimal anomaly detection model, and the parameter configuration corresponding to the optimal anomaly detection model is searched in the matching rule library.

[0022] As a preferred solution of the present invention, the difference metric value The calculation formula is: ;

[0023] Where, The actual data of the target monitoring indicator is The probability distribution value at The probability distribution assumed for the candidate anomaly detection model is The value at is the value index;

[0024] Difference metric Convert to basic fitness score : ;

[0025] When the difference metric Greater than the preset threshold When the basic fitness score Decay .

[0026] As a preferred embodiment of the present invention, the reinforcement learning is scored based on the basic fitness , distance threshold confidence and confidence in prediction consistency The state input is the action of selecting any candidate anomaly detection model; the reward is calculated based on the candidate anomaly detection model's detection accuracy and missed alarm penalty for historical data, and Q learning or deep Q network is trained to maximize the cumulative reward, outputting a dynamically corrected fitness score. ;

[0027] The distance threshold confidence The calculation formula is: ;

[0028] Where, is the anomaly score of the current candidate anomaly detection model, is the anomaly determination threshold of the current candidate anomaly detection model;

[0029] The prediction consistency confidence The calculation formula is: ;

[0030] Where, is the number of candidate anomaly detection models that are consistent with the anomaly judgment results of the current candidate anomaly detection model, is the total number of candidate anomaly detection models;

[0031] award Calculate as follows: ;

[0032] Where, To correctly detect the number of anomalies, To correctly detect the normal number of times, is the number of false positives, is the number of missed reports;

[0033] Dynamically corrected fitness score The calculation formula is: ;

[0034] Where, is the normalized reward, is the balance factor.

[0035] As a preferred solution of the present invention, the automatic machine learning is obtained by training a meta-learning model on a synthetic abnormal data training set. The input of the meta-learning model is the indicator portrait, and the output is the optimal matching probability of each candidate abnormality detection model as a supplementary fitness score. ;

[0036] The synthetic abnormal data training set includes spike anomalies, and the injection formula is as follows:

[0037] ;

[0038] Where, is the original time series at time The value of The time series after the injection of anomaly at time The value of is a Bernoulli distributed random variable used to determine the direction of the spike; is the spike amplitude random variable; is the empirical standard deviation of the original time series.

[0039] As a preferred solution of the present invention, using the anomaly detection model to perform anomaly detection on the actual data of the target monitoring indicator includes:

[0040] When the determined anomaly detection model is unique, each target monitoring indicator is input into the final anomaly detection model according to the time window segmentation method, an anomaly score is output, and the anomaly score is compared with the corresponding model threshold to generate a first judgment result vector directly as the final anomaly judgment result;

[0041] When there are multiple anomaly detection models, the anomaly scores, first judgment result vectors, and corresponding confidence values ​​output by each anomaly detection model are collected to construct a confidence weighted matrix. Each first judgment result vector is weighted and fused moment by moment to form a second judgment result vector as the final anomaly judgment result.

[0042] When there are two or more anomaly detection models that output inconsistent first judgment result vectors for the target monitoring indicator at the same time, and the difference between the corresponding confidence values ​​exceeds the set threshold, the arbitration processing flow is executed.

[0043] As a preferred solution of the present invention, the arbitration process specifically includes:

[0044] Based on the business scenario labels corresponding to the target monitoring indicators, the power failure mode library is searched for fault modes with the same business scenario labels and the same abnormal mode types. An anomaly detection model with business relevance in the fault mode is determined, and the anomaly score output by the anomaly detection model is multiplied by the priority coefficient to enhance the proportion of the anomaly detection model in the subsequent weighted fusion.

[0045] Performing denoising preprocessing on the time period data where the first determination result vector conflict occurs, and inputting the denoised target monitoring indicator data into a preset verification model to generate a recalculated anomaly score, and further calculating the score correction factor corresponding to each anomaly detection model;

[0046] Multiply the anomaly score of each anomaly detection model by the score correction factor in turn to form a corrected score;

[0047] Based on the modified scores and confidence values, weighted fusion is performed to form the final abnormality determination result of the target monitoring indicator in the corresponding time period.

[0048] As a preferred solution of the present invention, if multiple different target monitoring indicators of the same device are abnormal in succession within a predetermined time window, the abnormal information is integrated to perform fault correlation analysis, and the alarm sequence is adjusted or minor alarms are suppressed, including:

[0049] Based on the structural mapping relationship between target monitoring indicators and equipment, each target monitoring indicator with an abnormality and the corresponding anomaly score confidence level are input into a pre-established power knowledge graph. Utilizing the equipment component hierarchy, indicator association path, and fault causal chain in the power knowledge graph, causal reasoning is performed in a confidence-weighted manner to output the fault location or cause that is causally associated with the current multi-indicator abnormal pattern.

[0050] Based on the causal reasoning results, the target monitoring indicator with the highest cumulative confidence weight in the causal path is identified, marked as the main fault-related indicator, and a high-level alarm is immediately triggered for any abnormality in the main fault-related indicator;

[0051] For other target monitoring indicators that are not marked as major fault-related indicators, the delay trigger parameters are dynamically adjusted in combination with the current equipment operating status, load level and historical alarm records, and the alarm delay time is set according to the updated delay strategy. If no higher priority alarm events are added within the alarm delay time, they are merged into a single secondary alarm, or the alarm is not triggered when the cancellation conditions are met.

[0052] A system for selecting an anomaly detection model based on indicator profiling, the system comprising:

[0053] Data collection module, used to collect historical data of target monitoring indicators;

[0054] A feature extraction module is used to extract periodic features, trend features, stationary features, distribution morphology features, historical anomaly incidence rates, business scenario labels, and health scores based on the historical data, and to construct an indicator profile for feature vectorization.

[0055] The indicator type classification module is used to classify the target monitoring indicators into preset indicator types based on the similarity between indicator profiles;

[0056] The model matching module is used to establish a matching rule library between indicator types and anomaly detection models, and to perform fitness scores on candidate anomaly detection models in combination with the model compatibility evaluation mechanism. The optimal anomaly detection model and parameter configuration corresponding to the indicator profile are comprehensively determined based on the matching rules and fitness scores.

[0057] An anomaly detection module, configured to perform anomaly detection on the actual data of the target monitoring indicator using the optimal anomaly detection model, output an anomaly score and compare it with the model threshold to obtain an anomaly determination result;

[0058] The fusion decision module is used to generate the final anomaly detection result by weighted fusion or arbitration decision-making based on the anomaly scores, anomaly judgment results and confidence levels output by each anomaly detection model when there are multiple anomaly detection models;

[0059] The alarm processing module is used to generate an abnormal alarm and send the alarm according to a preset strategy when the target monitoring indicator is judged to be abnormal and the alarm conditions are met. In addition, when multiple different target monitoring indicators of the same device are abnormal one after another within a predetermined time window, the module integrates the abnormal information to perform fault correlation analysis, adjust the alarm sequence, or suppress secondary alarms.

[0060] The portrait update module is used to update the indicator portrait features and their corresponding indicator types based on the performance of the anomaly detection model and manual handling feedback, incrementally add new features to the indicator portrait, and record version changes;

[0061] The rule optimization module is used to automatically adjust the model selection strategy and parameter configuration in the matching rule library according to the actual false alarm rate and false negative rate changes of the anomaly detection model.

[0062] The beneficial effects of the present invention are: by constructing indicator portraits and linking them with the model matching rule library, automatic model selection is achieved; when there are differences in the outputs of multiple models, the system performs weighted fusion or hierarchical arbitration based on anomaly scores, judgment results and confidence levels to ensure the stability of the final anomaly judgment results; by utilizing device-indicator structure mapping and knowledge graph reasoning, key fault indicators are identified and alarm strategies are dynamically adjusted to effectively reduce redundant alarms caused by simultaneous anomalies of multiple indicators; based on online feature extraction and feature drift judgment mechanisms, important feature changes are automatically incorporated into the portrait version management library to achieve dynamic evolution of model matching and detection logic; by continuously monitoring false alarm rates and missed alarm rates, manual feedback is incorporated into the rule library optimization process to establish a dynamic closed-loop feedback mechanism between model selection and detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be derived from these drawings without inventive effort. Among them: Figure 1 is a flow chart of the method of the present invention; Figure 2Schematic diagram of the modular structure of the system in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the described embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of the present invention.

[0065] like Figure 1 As shown, this is an embodiment of the present invention, which provides an anomaly detection model selection method based on indicator portrait. By constructing indicator portraits of target monitoring indicators, establishing a mapping relationship between indicator types and anomaly detection models, and combining model compatibility evaluation and dynamic update mechanisms, automatic selection and continuous optimization of the optimal anomaly detection model in a variable power scenario are achieved.

[0066] In this embodiment, the method mainly includes the following steps:

[0067] S1: Data collection and indicator portrait construction

[0068] Historical data of target monitoring indicators are collected from the power system. Data sources include but are not limited to substation operation monitoring systems, transmission and distribution load monitoring systems, energy quality detection systems and safety early warning systems.

[0069] For each target monitoring indicator, extract multidimensional features including the following:

[0070] Periodicity (calculating the main frequency components and their amplitudes through Fast Fourier Transformation to capture the implicit periodicity of the indicator's historical data);

[0071] Trend characteristics (linear trend is calculated by recursive least squares method, the historical trend slope is increased if it is greater than 0, and decreased if it is less than 0; nonlinear trend uses ARIMA model);

[0072] Stationary characteristics (indicated by the ADF test statistic, the presence of a unit root indicates non-stationary; the absence of a unit root indicates stationary);

[0073] Distribution shape characteristics (described by skewness and kurtosis);

[0074] Historical anomaly incidence rate (counting the percentage of points exceeding the threshold, calculating anomaly frequency, duration, etc.);

[0075] Business scenario labels (labeled manually to indicate the power business category to which the target monitoring indicator belongs, such as substation monitoring, transmission and distribution load, power quality, and safety alarms);

[0076] The health score (used to reflect the health status of the device with the current monitoring indicators) is calculated as follows:

[0077] ;

[0078] Where, represents the health score; The historical failure rate of the target monitoring indicator is calculated by taking the ratio of the number of failures in the recent statistical period (e.g., the last three months) to the total number of monitoring times; is the failure rate weight factor, which is set according to different business scenarios (for example, a larger value is assigned to the main equipment of the substation with extremely high safety requirements); The average repair time is the average fault repair time of the equipment during the statistical period. The weight factor for average repair time can also be customized according to the business scenario;

[0079] This health score, as part of the indicator profile vector, contributes to the weight allocation for subsequent anomaly detection model selection. When prioritizing anomaly detection models, indicators with low health scores are assigned higher sensitivity weights to ensure timely anomaly identification of high-risk devices.

[0080] These multi-dimensional features form an indicator profile, which is then normalized to form a feature vector. The system categorizes the target monitoring indicator into pre-set indicator types (e.g., "cyclically stable" or "highly sensitive to mutation") based on vector similarity (e.g., cosine similarity or Euclidean distance).

[0081] S2: Selection of anomaly detection model

[0082] Establish a matching rule base between indicator types and anomaly detection models. The matching rule base consists of two parts: an indicator type and candidate anomaly detection model priority mapping table and a parameter recommendation table. The indicator type and candidate anomaly detection model priority mapping table presets the priority relationship between different indicator types and each candidate anomaly detection model, such as:

[0083] Strong periodicity and high stability → Prioritize matching statistical models (such as SARIMA);

[0084] Nonlinearity and strong volatility → Prioritize deep learning models (such as LSTM);

[0085] Sparse anomaly → prioritizes density-based models such as isolation forests.

[0086] The parameter recommendation table presets the initial parameter ranges for each anomaly detection model (such as the seasonal parameter of SARIMA and the time step of LSTM).

[0087] According to the indicator type classified by the target monitoring indicator, the corresponding candidate anomaly detection model is selected from the matching rule library and the rule priority weight is marked. ;

[0088] For each candidate anomaly detection model obtained from the matching rule base, the system calculates a difference metric based on the difference in probability distribution between its model assumptions and the historical data of the target monitoring indicator. (Kullback-Leibler divergence), calculated as: ;

[0089] Where, The actual data of the target monitoring indicator is The probability distribution value at The probability distribution assumed for the candidate anomaly detection model is The value at is the value index;

[0090] The larger the difference metric value, the worse the match between the candidate model's hypothesis and the actual data. Convert to basic fitness score : ;

[0091] To enhance robustness, a threshold , when the difference measure Greater than the preset threshold When the basic fitness score Decay .

[0092] The basic fitness is scored using the model compatibility evaluation mechanism Perform dynamic corrections, including calculating dynamic correction fitness scores based on reinforcement learning and automatic machine learning-based calculation of supplementary fitness scores ;

[0093] Among them, reinforcement learning is scored based on basic fitness , distance threshold confidence and confidence in prediction consistency The state input is the action of selecting any candidate anomaly detection model; the reward is calculated based on the candidate anomaly detection model's detection accuracy and missed alarm penalty for historical data, and Q learning or deep Q network is trained to maximize the cumulative reward, outputting a dynamically corrected fitness score. ;

[0094] Distance threshold confidence The calculation formula is: ;

[0095] Where, is the anomaly score of the current candidate anomaly detection model, is the anomaly determination threshold of the current candidate anomaly detection model;

[0096] Prediction consistency confidence The calculation formula is: ;

[0097] Where, is the number of candidate anomaly detection models that are consistent with the anomaly judgment results of the current candidate anomaly detection model, is the total number of candidate anomaly detection models;

[0098] award Calculate as follows: ;

[0099] Where, To correctly detect the number of anomalies, To correctly detect the normal number of times, is the number of false positives, is the number of missed reports;

[0100] Dynamically corrected fitness score The calculation formula is: ;

[0101] Where, is the normalized reward, is the balance factor, recommended initial value This mechanism enables the fitness score to not only consider static difference matching, but also integrate actual detection performance for dynamic optimization.

[0102] Automatic machine learning is obtained by training a meta-learning model on a synthetic anomaly data training set. By mapping the historical model performance to the indicator profile, the optimal matching probability of each candidate model is predicted. The input of the meta-learning model is the indicator profile, and the output is the optimal matching probability of each candidate anomaly detection model, which serves as a supplementary fitness score. ;

[0103] Based on the existing time series data, spike anomalies are injected into the abnormal data training set. The injection formula is as follows:

[0104] ;

[0105] Where, is the original time series at time The value of The time series after the injection of anomaly at time The value of is a Bernoulli distributed random variable used to determine the direction of the spike; is the spike amplitude random variable; is the empirical standard deviation of the original time series;

[0106] Abnormal sample label training: GBDT, Meta-LSTM and other methods are used to train the model, taking the indicator profile as input and outputting the matching probability of each candidate model , .

[0107] Combine the matching rule weights with the scoring results to calculate the comprehensive score :

[0108] ;

[0109] Where, 、 、 is the weight factor, and ; It can be set to (0.4, 0.4, 0.2) according to the actual task or dynamically learned through Bayesian optimization.

[0110] Select comprehensive rating The highest candidate anomaly detection model is selected as the optimal anomaly detection model, or a comprehensive score is selected The top N candidate anomaly detection models (several models with better performance are retained for fusion reasoning) are combined for prediction. Their corresponding parameters can be based on: the recommended parameter table in the matching rule library; or the optimal parameter configuration vector output by the AutoML module.

[0111] In this embodiment, all scoring modules ( 、 、 ) need to be normalized (MinMaxScaler) to ensure the same dimension; the matching rule base can be constructed with the assistance of expert labeling + unsupervised clustering; the model training and scoring process is recommended to use a distributed task queue (such as Kafka + Spark) to meet the concurrent processing of high-frequency indicators; Q-learning and meta-learning models need to be updated regularly, and it is recommended to set a daily batch offline training window (such as 23:00~04:00).

[0112] This specific implementation introduces three types of fitness scoring mechanisms (static distribution matching, dynamic reinforcement feedback, and meta-learning prediction) and combines them with rule priority weights to form a structurally closed-loop and logically reasonable optimal model selection process, which is suitable for dynamic anomaly detection of high-frequency, highly heterogeneous, and highly sensitive indicators in power monitoring systems.

[0113] S3: Anomaly Detection and Result Fusion

[0114] The anomaly detection model is used to detect anomalies in the actual data of the target monitoring indicator, output anomaly scores and compare them with the model threshold to obtain the anomaly judgment results, specifically:

[0115] When the determined anomaly detection model is unique, each target monitoring indicator is input into the final anomaly detection model according to the time window segmentation method, and the anomaly score is output. The anomaly score is compared with the corresponding model threshold to generate a first judgment result vector which is directly used as the final anomaly judgment result;

[0116] When there are multiple anomaly detection models, the anomaly scores, first judgment result vectors, and corresponding confidence values ​​output by each anomaly detection model are collected to construct a confidence weighted matrix. Each first judgment result vector is weighted and fused moment by moment to form a second judgment result vector as the final anomaly judgment result.

[0117] In the specific implementation of this invention, a confidence-driven hierarchical arbitration mechanism is introduced to improve the accuracy of judgment when the outputs of multiple anomaly detection models are inconsistent. When at least two anomaly detection models produce different first judgment result vectors for the target monitoring indicator at the same time, and the difference between the corresponding confidence levels exceeds a set threshold, the arbitration process is automatically initiated, specifically including:

[0118] According to the business scenario label corresponding to the target monitoring indicator, the fault mode with the same business scenario label and the same abnormal mode type in the power fault mode library is queried, the abnormality detection model with the business corresponding relationship with the fault mode is extracted, and the abnormality score output by the abnormality detection model is compared with the priority coefficient. Multiply to enhance the weight of the anomaly detection model in subsequent weighted fusion; priority coefficient It can be obtained through training settings or scene presets.

[0119] Perform denoising preprocessing on the original indicator data corresponding to the time period where the first judgment result vector conflict occurs, and input the denoised target monitoring indicator data into the preset verification model. The verification model can be an LSTM network or support vector machine trained with historical data. The output result is used to compare with the initial anomaly score and calculate the score correction factor of each anomaly detection model. ;

[0120] Multiply the anomaly score of each anomaly detection model by the score correction factor in turn to form a corrected score, that is:

[0121] For the association model, the modified score is calculated as ;

[0122] For the non-correlated model, the modified score is calculated as ;

[0123] All anomaly detection model correction scores are weighted and fused according to confidence to form the final anomaly judgment result of the target monitoring indicator in the corresponding time period.

[0124] S4: Alarm Generation and Optimization

[0125] When the abnormal judgment result shows that the target monitoring indicator is abnormal and meets the alarm conditions, an abnormal alarm is generated and sent according to the preset strategy; if multiple different target monitoring indicators of the same device are abnormal one after another within the predetermined time window, the abnormal information is integrated to perform fault correlation analysis, and the alarm sequence is adjusted or secondary alarms are suppressed.

[0126] In this embodiment of the present invention, a multi-indicator collaborative alarm mechanism based on knowledge graph reasoning and alarm priority adjustment is introduced to avoid a large number of repeated alarms or redundant alarm information caused by multiple target monitoring indicators of the same device being abnormal in a short period of time. Specifically, it includes:

[0127] 1) Abnormal indicator classification and structure mapping

[0128] When multiple target monitoring indicators under the same device are abnormal within a predetermined time window, the system uses the device as the central node, extracts its structural configuration, identifies all abnormal target monitoring indicators, and maps them to the corresponding indicator nodes in the power knowledge graph. Each indicator node carries the anomaly score and confidence value output by its latest anomaly detection model. ,in , indicating the credibility of the abnormal judgment of the indicator;

[0129] 2) Fault causal reasoning based on confidence weighting

[0130] The system uses the device as the root node and performs forward reasoning based on the causal chain in the power knowledge graph starting from the abnormal indicators. During the reasoning process, for each indicator path that may cause equipment failure, the confidence weighted value of each abnormal indicator in the path is accumulated. ,in Indicates the graph correlation strength between the indicator node and the target fault node in the path. The final weighted cumulative value is selected The largest causal path is taken as the main fault path, and the indicator node with the largest weight contribution on the main fault path is identified as the main fault correlation indicator;

[0131] 3) Alarm priority determination and main alarm triggering

[0132] For the identified major fault-related indicators, a high-level alarm event is immediately triggered and directly pushed to the alarm center or power grid monitoring platform, marked as a "level 1 major alarm";

[0133] 4) Secondary indicator alarm delay and suppression strategy

[0134] For other abnormal indicator nodes that are inconsistent with the main fault path or have a low weight contribution, the system handles them according to the following strategies:

[0135] Dynamically generate delay time based on the current equipment operating status (such as load rate, temperature, voltage fluctuation), historical alarm frequency and other parameters , such as under high load conditions Set to 10 seconds, which can be increased to 60 seconds under low load;

[0136] If the delay time If no new primary alarm event is detected or the triggered primary alarm is not updated, the system will combine the secondary abnormal indicators and trigger a secondary alarm according to the default policy, or:

[0137] When the anomaly score is lower than the suppression threshold , or when the system is already in a high-density alarm state, directly suppress the alarm reporting;

[0138] 5) Status recording and alarm behavior tracking

[0139] All reasoning processes, alarm adjustment behaviors and results are recorded in the alarm strategy behavior library for subsequent system training, decision backtracking or operation and maintenance audits.

[0140] S5: Dynamic Update and Adaptive Optimization

[0141] Based on the performance of the anomaly detection model and manual handling feedback, the indicator portrait features and the indicator types to which they belong are updated, the newly added features are incrementally added to the indicator portrait and the version changes are stored; and according to the actual false alarm rate and missed alarm rate changes of the anomaly detection model, the model selection strategy and parameter configuration in the matching rule library are automatically adjusted.

[0142] Optionally, the incremental update of indicator portrait features is achieved through an online algorithm, including: using streaming Fourier transform or time domain filtering to update the main periodic components in real time for periodic features, using a sliding window to calculate the standard deviation or coefficient of variation for volatility features, and using recursive linear regression to calculate the latest slope for trend features; fusing and comparing the updated feature vector with the original portrait, and generating a new portrait version when the feature change exceeds a preset threshold and storing it in the portrait version management library, and using it for the next round of indicator type classification and model matching.

[0143] The anomaly detection model parameters are adaptively adjusted based on real-time data. Its adjustment mechanism includes a dual-loop tuning mechanism: the outer loop adjusts the global parameters of the model, including anomaly thresholds, detection sensitivity, and contamination rate, based on the seasonal patterns of the power system or special calendar events; the inner loop continuously fine-tunes the internal parameters of the model based on the online learning algorithm, including but not limited to the number of leaves in the decision tree model, the subsampling size in the isolation forest model, and the learning rate of the neural network model; and the adjustment range of each parameter is constrained through a pre-established parameter impact assessment matrix to ensure stable improvement in model performance.

[0144] The feedback optimization mechanism of the matching rules includes: continuously monitoring the anomaly detection performance indicators of each indicator. When the false alarm rate or missed alarm rate of a certain indicator is higher than the preset value within a given period, the optimization process of the corresponding entry of the indicator type in the rule library is triggered; the optimization process adjusts its model matching scheme according to the latest portrait characteristics of the indicator, including replacing it with a detection model that is more suitable for the new features, adding pre-data transformation or post-processing steps, adjusting model fusion weights, etc., and using historical data playback to verify the effectiveness of the optimized scheme. After verification, the new rules will be applied to subsequent model selection.

[0145] like Figure 2 As shown in FIG, another embodiment of the present invention provides an anomaly detection model selection system based on indicator profiling. The system is deployed in an industrial monitoring master station or an edge intelligent operation and maintenance platform, and performs adaptive selection and dynamic optimization of anomaly detection models for key monitoring indicators in the operating status of power equipment. It mainly includes:

[0146] The data acquisition module is used to collect historical data of target monitoring indicators from data sources such as SCADA systems, substation monitoring systems, and transmission line sensing terminals. The collected data includes a time-stamp-aligned monitoring value sequence and auxiliary information such as the device identifier and service type identifier.

[0147] The feature extraction module is used to extract periodic features, trend features, stationary features, distribution morphology features, historical anomaly rates, business scenario labels, and health scores based on historical data, and to construct indicator profiles for feature vectorization.

[0148] The indicator type classification module is used to classify the target monitoring indicators into preset indicator types based on the similarity between indicator profiles;

[0149] The model matching module is used to build a matching rule library between indicator types and anomaly detection models, and integrate a model compatibility evaluation mechanism to score the fitness of candidate anomaly detection models. Based on the matching rules and fitness scores, the optimal anomaly detection model and parameter configuration corresponding to the indicator profile are comprehensively determined;

[0150] The anomaly detection module is used to take the real-time or recent data of the current target monitoring indicator as input, use the optimal anomaly detection model to perform anomaly detection, output anomaly scores (such as probability values ​​or standardized deviation scores), and compare them with the model threshold to obtain anomaly determination results;

[0151] The fusion decision module is used to generate the final anomaly detection result through weighted fusion or arbitration decision-making based on the anomaly scores, anomaly determination results, and confidence levels output by each anomaly detection model when there are multiple anomaly detection models (for example, when the AutoML strategy retains multiple models with high scores).

[0152] The alarm processing module is used to generate an abnormal alarm and send the alarm according to a preset strategy when the target monitoring indicator is judged to be abnormal and the alarm conditions are met. In addition, when multiple different target monitoring indicators of the same device are abnormal one after another within a predetermined time window, the module integrates the abnormal information to perform fault correlation analysis, adjust the alarm sequence, or suppress secondary alarms.

[0153] The portrait update module is used to update the indicator portrait features and their corresponding indicator types based on the performance of the anomaly detection model and manual handling feedback, incrementally add new features to the indicator portrait, and record version changes;

[0154] The rule optimization module is used to automatically adjust the model selection strategy and parameter configuration in the matching rule library according to the actual false alarm rate and false negative rate changes of the anomaly detection model.

[0155] In summary, the present invention has constructed a full-process closed-loop mechanism covering "portrait construction - model matching - result fusion - alarm decision-making - feedback update", which can accurately characterize the behavior pattern of monitoring indicators based on multi-dimensional features, automatically match the most adaptable anomaly detection model and dynamically configure parameters; when there are differences in the outputs of multiple models, the confidence-driven weighted fusion and hierarchical arbitration mechanism are used to effectively improve the reliability of anomaly judgment; in the multi-indicator anomaly scenario of equipment, knowledge graphs are combined for causal reasoning to realize the identification of primary and secondary alarms and the optimization of response rhythm, significantly reducing redundant alarms; at the same time, it supports real-time incremental update of portrait features and online parameter tuning of detection models, and dynamically optimizes model matching rules in combination with false positive and missed negative data feedback, thereby improving the intelligence level, response efficiency and long-term operation stability of the anomaly detection system, and is suitable for large-scale, highly dynamic industrial monitoring and operation and maintenance scenarios.

[0156] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any other combination. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the present application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0157] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the aforementioned integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium. The storage medium may be a read-only memory, a magnetic disk, or an optical disk, etc.

[0158] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various modifications or substitutions within the technical scope disclosed in this application, and such modifications or substitutions should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for selecting anomaly detection models based on indicator profiling, characterized in that: The method comprises: Collect historical data of target monitoring indicators, extract periodic characteristics, trend characteristics, stability characteristics, distribution morphology characteristics, historical anomaly incidence rates, business scenario labels and health scores, build indicator portraits for feature vectorization, and classify the target monitoring indicators into preset indicator types based on similarity; Establish a matching rule library between indicator types and anomaly detection models, and combine the model compatibility evaluation mechanism to score the fitness of candidate anomaly detection models. Based on the matching rules and fitness scores, comprehensively determine the optimal anomaly detection model and parameter configuration corresponding to the indicator profile; The anomaly detection model is used to perform anomaly detection on the actual data of the target monitoring indicator, output an anomaly score and compare it with the model threshold to obtain an anomaly determination result; when there are multiple anomaly detection models, the final anomaly determination result is generated by weighted fusion or arbitration decision-making based on the anomaly score, anomaly determination result and confidence level output by each anomaly detection model; When the abnormality determination result shows that the target monitoring indicator is abnormal and meets the alarm condition, an abnormality alarm is generated and sent according to the preset strategy; if multiple different target monitoring indicators of the same device are abnormal successively within a predetermined time window, the abnormal information is integrated to perform fault correlation analysis, and the alarm sequence is adjusted or secondary alarms are suppressed; Based on the performance of the anomaly detection model and manual handling feedback, the indicator portrait features and the indicator types to which they belong are updated, the newly added features are incrementally added to the indicator portrait and the version changes are stored; and according to the actual false alarm rate and missed alarm rate changes of the anomaly detection model, the model selection strategy and parameter configuration in the matching rule library are automatically adjusted.

2. The method for selecting an anomaly detection model based on indicator profiling according to claim 1, characterized in that: The business scenario tag is used to indicate the power business category to which the target monitoring indicator belongs, including substation monitoring, transmission and distribution load, power quality, and safety alarm; The calculation formula of the health score is: ; Where, represents the health score; is the historical failure rate of the target monitoring indicator, is the failure rate weight factor; is the average repair time, is the weight factor of the average repair time.

3. The method for selecting an anomaly detection model based on indicator profiling according to claim 1, characterized in that: The combined model compatibility evaluation mechanism performs fitness scoring on the candidate anomaly detection models, and comprehensively determines the optimal anomaly detection model and parameter configuration corresponding to the indicator profile based on the matching rules and fitness scores, specifically including: According to the indicator type classified by the target monitoring indicator, the corresponding candidate anomaly detection model is selected from the matching rule library and the rule priority weight is marked. ; Calculates the difference measure between the hypothesized distribution of the candidate anomaly detection model and the actual distribution of the target monitoring indicator , and converted into a basic fitness score ; The basic fitness is scored using the model compatibility evaluation mechanism Perform dynamic corrections, including calculating dynamic correction fitness scores based on reinforcement learning and automatic machine learning-based calculation of supplementary fitness scores ; Calculate the comprehensive score of matching rules and fitness score : ; Where, 、 、 is the weight factor, and ; Select comprehensive rating Highest or overall score The top N candidate anomaly detection models are used as the optimal anomaly detection model, and the parameter configuration corresponding to the optimal anomaly detection model is searched in the matching rule library.

4. The method for selecting an anomaly detection model based on indicator profiling according to claim 3, characterized in that: The difference metric The calculation formula is: ; Where, The actual data of the target monitoring indicator is The probability distribution value at The probability distribution assumed for the candidate anomaly detection model is The value at is the value index; Difference metric Convert to basic fitness score : ; When the difference metric Greater than the preset threshold When the basic fitness score Decay .

5. The method for selecting an anomaly detection model based on indicator profiling according to claim 4, characterized in that: The reinforcement learning is scored based on the basic fitness , distance threshold confidence and confidence in prediction consistency The state input is the action of selecting any candidate anomaly detection model; the reward is calculated based on the candidate anomaly detection model's detection accuracy and missed alarm penalty for historical data, and Q learning or deep Q network is trained to maximize the cumulative reward, outputting a dynamically corrected fitness score. ; The distance threshold confidence The calculation formula is: ; Where, is the anomaly score of the current candidate anomaly detection model, is the anomaly determination threshold of the current candidate anomaly detection model; The prediction consistency confidence The calculation formula is: ; Where, is the number of candidate anomaly detection models that are consistent with the anomaly judgment results of the current candidate anomaly detection model, is the total number of candidate anomaly detection models; award Calculate as follows: ; Where, To correctly detect the number of anomalies, To correctly detect the normal number of times, is the number of false positives, is the number of missed reports; Dynamically corrected fitness score The calculation formula is: ; Where, is the normalized reward, is the balance factor.

6. The method for selecting an anomaly detection model based on indicator profiling according to claim 4, characterized in that: The automatic machine learning is obtained by training a meta-learning model on a synthetic anomaly data training set. The input of the meta-learning model is the indicator portrait, and the output is the optimal matching probability of each candidate anomaly detection model as a supplementary fitness score. ; The synthetic abnormal data training set includes spike anomalies, and the injection formula is as follows: ； Where, is the original time series at time The value of The time series after the anomaly is injected at time The value of is a Bernoulli distributed random variable used to determine the direction of the spike; is the spike amplitude random variable; is the empirical standard deviation of the original time series.

7. The method for selecting an anomaly detection model based on indicator profiling according to claim 1, characterized in that: Performing anomaly detection on the actual data of the target monitoring indicator using the anomaly detection model includes: When the determined anomaly detection model is unique, each target monitoring indicator is input into the final anomaly detection model according to the time window segmentation method, an anomaly score is output, and the anomaly score is compared with the corresponding model threshold to generate a first judgment result vector directly as the final anomaly judgment result; When there are multiple anomaly detection models, the anomaly scores, first judgment result vectors, and corresponding confidence values ​​output by each anomaly detection model are collected to construct a confidence weighted matrix. Each first judgment result vector is weighted and fused moment by moment to form a second judgment result vector as the final anomaly judgment result. When there are two or more anomaly detection models that output inconsistent first judgment result vectors for the target monitoring indicator at the same time, and the difference between the corresponding confidence values ​​exceeds the set threshold, the arbitration processing flow is executed.

8. The method for selecting an anomaly detection model based on indicator profiling according to claim 7, characterized in that: The arbitration process specifically includes: Based on the business scenario labels corresponding to the target monitoring indicators, the power failure mode library is searched for fault modes with the same business scenario labels and the same abnormal mode types. An anomaly detection model with business relevance in the fault mode is determined, and the anomaly score output by the anomaly detection model is multiplied by the priority coefficient to enhance the proportion of the anomaly detection model in the subsequent weighted fusion. Performing denoising preprocessing on the time period data where the first determination result vector conflict occurs, and inputting the denoised target monitoring indicator data into a preset verification model to generate a recalculated anomaly score, and further calculating the score correction factor corresponding to each anomaly detection model; Multiply the anomaly score of each anomaly detection model by the score correction factor in turn to form a corrected score; Based on the modified scores and confidence values, weighted fusion is performed to form the final abnormality determination result of the target monitoring indicator in the corresponding time period.

9. The method for selecting an anomaly detection model based on indicator profiling according to claim 1, characterized in that: If multiple different target monitoring indicators of the same device are abnormal in succession within a predetermined time window, the abnormal information is integrated to perform fault correlation analysis, and the alarm sequence is adjusted or minor alarms are suppressed, including: Based on the structural mapping relationship between target monitoring indicators and equipment, each target monitoring indicator with an abnormality and the corresponding anomaly score confidence level are input into a pre-established power knowledge graph. Utilizing the equipment component hierarchy, indicator association path, and fault causal chain in the power knowledge graph, causal reasoning is performed in a confidence-weighted manner to output the fault location or cause that is causally associated with the current multi-indicator abnormal pattern. Based on the causal reasoning results, the target monitoring indicator with the highest cumulative confidence weight in the causal path is identified, marked as the main fault-related indicator, and a high-level alarm is immediately triggered for any abnormality in the main fault-related indicator; For other target monitoring indicators that are not marked as major fault-related indicators, the delay trigger parameters are dynamically adjusted in combination with the current equipment operating status, load level and historical alarm records, and the alarm delay time is set according to the updated delay strategy. If no higher priority alarm events are added within the alarm delay time, they are merged into a single secondary alarm, or the alarm is not triggered when the cancellation conditions are met.

10. A system for selecting an anomaly detection model based on an indicator profile, applied to the method for selecting an anomaly detection model based on an indicator profile according to any one of claims 1 to 9, characterized in that: The system comprises: Data collection module, used to collect historical data of target monitoring indicators; A feature extraction module is used to extract periodic features, trend features, stationary features, distribution morphology features, historical anomaly incidence rates, business scenario labels, and health scores based on the historical data, and to construct an indicator profile for feature vectorization. The indicator type classification module is used to classify the target monitoring indicators into preset indicator types based on the similarity between indicator profiles; The model matching module is used to establish a matching rule library between indicator types and anomaly detection models, and to perform fitness scores on candidate anomaly detection models in combination with the model compatibility evaluation mechanism. The optimal anomaly detection model and parameter configuration corresponding to the indicator profile are comprehensively determined based on the matching rules and fitness scores. An anomaly detection module, configured to perform anomaly detection on the actual data of the target monitoring indicator using the optimal anomaly detection model, output an anomaly score and compare it with the model threshold to obtain an anomaly determination result; The fusion decision module is used to generate the final anomaly detection result by weighted fusion or arbitration decision-making based on the anomaly scores, anomaly judgment results and confidence levels output by each anomaly detection model when there are multiple anomaly detection models; The alarm processing module is used to generate an abnormal alarm and send the alarm according to a preset strategy when the target monitoring indicator is judged to be abnormal and the alarm conditions are met. In addition, when multiple different target monitoring indicators of the same device are abnormal one after another within a predetermined time window, the module integrates the abnormal information to perform fault correlation analysis, adjust the alarm sequence, or suppress secondary alarms. The portrait update module is used to update the indicator portrait features and their corresponding indicator types based on the performance of the anomaly detection model and manual handling feedback, incrementally add new features to the indicator portrait, and record version changes; The rule optimization module is used to automatically adjust the model selection strategy and parameter configuration in the matching rule library according to the actual false alarm rate and false negative rate changes of the anomaly detection model.

Images