A Method and System for Selecting Anomaly Detection Models Based on Indicator Profiles

Abstract

This invention discloses a method and system for selecting anomaly detection models based on indicator profiling, relating to the field of intelligent operation and maintenance technology for power systems. The method includes: collecting historical data of target monitoring indicators, extracting multi-dimensional features to construct indicator profiles and classifying them; screening candidate anomaly detection models from a matching rule base, and combining a model compatibility evaluation mechanism to perform fit scoring, determining the optimal anomaly detection model for anomaly detection, and outputting the anomaly judgment result; when multiple models exist, generating the final anomaly result through a confidence-driven arbitration mechanism; for multi-indicator anomalies, performing causal reasoning based on a power knowledge graph to determine the primary alarm indicators, and handling secondary indicators according to a delay strategy; simultaneously, supporting incremental updates of indicator profile features, adaptive adjustment of model parameters, and dynamic optimization of matching rules, constructing a closed-loop mechanism covering the entire process of "profile construction—model matching—result fusion—alarm decision—feedback update".

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology for power systems, and in particular to an anomaly model selection method and system based on indicator profiling. Background Technology

[0002] With the accelerated digital transformation of traditional industries such as power, large power companies are increasingly building integrated digital platforms to achieve data-driven intelligent decision-making. In complex and massive digital operation and maintenance systems, effective monitoring and anomaly alerts are required for a vast number of monitoring indicators to ensure high system availability and stability.

[0003] However, existing technologies generally face two challenges: First, fixed thresholds or single-algorithm detection struggle to adapt to diverse indicators. Monitoring indicators exhibit rich data formats (such as stability, periodicity, and trends), and a single fixed upper and lower threshold strategy cannot cover all types of anomalies. Manually setting thresholds one by one is both time-consuming and difficult to justify. Even with machine learning models, different models have different strengths, making it difficult for a single model to perform optimally in all scenarios. Second, there is a lack of adaptive model selection and optimization mechanisms. Currently, many intelligent operation and maintenance solutions still rely on operation and maintenance experts to statically specify detection algorithms for different indicators based on experience, such as using statistical thresholding for stable indicators and time series forecasting for periodic indicators. However, this manual mapping method lacks objective basis and is difficult to adjust in real time as data characteristics change. When the environment changes or model performance deteriorates, manual intervention is required to reselect or adjust parameters, resulting in a low level of intelligence. Summary of the Invention

[0004] To improve the accuracy and adaptability of anomaly identification by automatically selecting and optimizing anomaly detection models based on various characteristics of indicators in the digital operation and maintenance system of power, this invention proposes an anomaly detection model selection method and system based on indicator profiling. By integrating technologies such as indicator profiling construction, automatic model matching, multi-model fusion detection, and adaptive optimization, an intelligent anomaly detection scheme is achieved.

[0005] The present invention achieves the above objectives through the following technical solutions:

[0006] A method for selecting anomaly detection models based on indicator profiling, the method comprising:

[0007] Historical data of target monitoring indicators are collected, and periodic features, trend features, stability features, distribution pattern features, historical anomaly incidence rate, business scenario tags and health scores are extracted. Indicator profiles are constructed and feature vectorization is performed. The target monitoring indicators are classified into preset indicator types based on similarity.

[0008] Establish a matching rule base between indicator types and anomaly detection models, and combine it with a model compatibility evaluation mechanism to score the fit of candidate anomaly detection models. Based on the matching rules and the fit score, determine the optimal anomaly detection model and parameter configuration corresponding to the indicator profile.

[0009] The anomaly detection model is used to detect anomalies in the actual data of the target monitoring indicator, and an anomaly score is output and compared with the model threshold to obtain the anomaly judgment result. When there are multiple anomaly detection models, the final anomaly judgment result is generated by weighted fusion or arbitration decision based on the anomaly score, anomaly judgment result and confidence level output by each anomaly detection model.

[0010] When the anomaly determination result indicates that the target monitoring indicator is abnormal and meets the alarm conditions, an anomaly alarm is generated and sent according to a preset strategy; if multiple different target monitoring indicators of the same device are successively abnormal within a predetermined time window, the anomaly information is merged to perform fault correlation analysis, and the alarm order is adjusted or secondary alarms are suppressed.

[0011] Based on the performance of the anomaly detection model and feedback from manual handling, the indicator profile features and their respective indicator types are updated. The newly added feature increments are added to the indicator profile and the version changes are stored. Furthermore, based on the actual false positive rate and false negative rate changes of the anomaly detection model, the model selection strategy and parameter configuration in the matching rule base are automatically adjusted.

[0012] As a preferred embodiment of the present invention, the business scenario label is used to indicate the power business category to which the target monitoring indicator belongs, including substation monitoring, transmission and distribution load, power quality and safety alarm;

[0013] The formula for calculating the health score is as follows: ;

[0014] In the formula, Indicates health score; The historical failure rate of the target monitoring indicator. This is the failure rate weighting factor; For average repair time, This is the weighting factor for average repair time.

[0015] As a preferred embodiment of the present invention, the step of combining a model compatibility evaluation mechanism to score the suitability of candidate anomaly detection models, and comprehensively determining the optimal anomaly detection model and parameter configuration corresponding to the indicator profile based on the matching rules and the suitability score, specifically includes:

[0016] Based on the categorized indicator types according to the target monitoring indicators, corresponding candidate anomaly detection models are selected from the matching rule base, and rule priority weights are labeled. ;

[0017] Calculate the difference between the hypothesis distribution of the candidate anomaly detection model and the actual distribution of the target monitoring indicator. And convert it into a basic fit score. ;

[0018] The basic fit is scored using a model compatibility evaluation mechanism. Dynamic adjustments are made, including dynamically adjusting the fitness score based on reinforcement learning computation. And supplemental fit scores calculated based on automated machine learning ;

[0019] Calculate the combined score of matching rules and fit score. : ;

[0020] In the formula, , , As a weighting factor, and ;

[0021] Choose overall rating Highest or overall score The top N candidate anomaly detection models are selected as the optimal anomaly detection model, and the parameter configuration corresponding to the optimal anomaly detection model is searched in the matching rule base.

[0022] As a preferred embodiment of the present invention, the difference measurement value The calculation formula is: ;

[0023] In the formula, For the target monitoring indicators, the actual data is in The probability distribution value at that location. The probability distribution assumed for the candidate anomaly detection model is in The value at; For value index;

[0024] Difference measure Convert to basic fit rating : ;

[0025] When the difference metric value Greater than the preset threshold At that time, the basic fit score will be used. Attenuation to .

[0026] As a preferred embodiment of the present invention, the reinforcement learning uses a base fitness score. Distance threshold confidence and prediction consistency confidence The state is the input, and the action is to select any candidate anomaly detection model. The reward is calculated based on the detection accuracy and missed alarm penalty of the candidate anomaly detection model on historical data. Q-learning or deep Q-network is trained to maximize the cumulative reward, and the dynamically adjusted fitness score is output. ;

[0027] The distance threshold confidence level The calculation formula is: ;

[0028] In the formula, This is the anomaly score for the current candidate anomaly detection model. This is the anomaly detection threshold for the current candidate anomaly detection model;

[0029] The prediction consistency confidence level The calculation formula is: ;

[0030] In the formula, The number of candidate anomaly detection models that are consistent with the anomaly judgment results of the current candidate anomaly detection model. This represents the total number of candidate anomaly detection models.

[0031] award Calculate using the following formula: ;

[0032] In the formula, To accurately detect the number of anomalies, To ensure accurate detection of normal frequency, Number of false alarms This represents the number of missed reports;

[0033] Dynamically corrected fit score The calculation formula is: ;

[0034] In the formula, To normalize rewards, It is a balancing factor.

[0035] In a preferred embodiment of the present invention, the automatic machine learning is trained on a synthetic anomaly data training set using a meta-learning model. The input of the meta-learning model is the indicator profile, and the output is the optimal matching probability of each candidate anomaly detection model, serving as a supplementary fit score. ;

[0036] The synthetic anomaly training set includes spike anomalies, and the injection formula is as follows:

[0037] ;

[0038] In the formula, For the original time series at time... The value; For the time series after the injection of anomalies at time 10:00 The value; Let be a Bernoulli distributed random variable used to determine the direction of the peak; For the peak amplitude random variable; This represents the empirical standard deviation of the original time series.

[0039] As a preferred embodiment of the present invention, the anomaly detection model is used to perform anomaly detection on the actual data of the target monitoring indicator, including:

[0040] When the determined anomaly detection model is unique, each target monitoring indicator is input into the finally determined anomaly detection model according to the time window segmentation method, anomaly score is output, and the anomaly score is compared with the corresponding model threshold to generate a first judgment result vector, which is directly used as the final anomaly judgment result.

[0041] When multiple anomaly detection models exist, the anomaly score, first judgment result vector and corresponding confidence value output by each anomaly detection model are collected, a confidence weighting matrix is ​​constructed, and each first judgment result vector is weighted and fused at each time step to form a second judgment result vector as the final anomaly judgment result.

[0042] When two or more anomaly detection models output inconsistent first judgment result vectors for the target monitoring indicator at the same time, and the difference between the corresponding confidence values ​​exceeds a set threshold, an arbitration process is executed.

[0043] As a preferred embodiment of the present invention, the arbitration process specifically includes:

[0044] Based on the business scenario tags corresponding to the target monitoring indicators, query the power fault mode library for fault modes with the same business scenario tags and consistent anomaly mode types, determine the anomaly detection model with business relevance in the fault mode, and multiply the anomaly score output by the anomaly detection model by the priority coefficient to enhance the weight of the anomaly detection model in the subsequent weighted fusion.

[0045] Denoising preprocessing is performed on the time period data where the first judgment result vector conflict occurs, and the denoised target monitoring index data is input into the preset verification model to generate a recalculated anomaly score. The score correction factor corresponding to each anomaly detection model is further calculated.

[0046] The anomaly score of each anomaly detection model is multiplied by the score correction factor in turn to form the corrected score;

[0047] Based on the corrected score and confidence value, a weighted fusion is performed to form the final anomaly judgment result of the target monitoring indicator in the corresponding time period.

[0048] As a preferred embodiment of the present invention, if multiple different target monitoring indicators of the same device successively become abnormal within a predetermined time window, the abnormal information is fused for fault correlation analysis, and the alarm order is adjusted or secondary alarms are suppressed, including:

[0049] Based on the structural mapping relationship between target monitoring indicators and equipment, the target monitoring indicators that have anomalies and their corresponding anomaly scores and confidence levels are input into a pre-established power knowledge graph. Using the equipment component level, indicator association path and fault causal chain in the power knowledge graph, causal reasoning is performed in a confidence-weighted manner, and the fault location or cause that has a causal relationship with the current multi-indicator anomaly pattern is output.

[0050] Based on the causal reasoning results, the target monitoring indicator with the highest accumulated confidence weight in the causal path is identified, marked as the main fault-related indicator, and a high-level alarm is immediately triggered for any anomaly of the main fault-related indicator.

[0051] For other target monitoring indicators that are not marked as primary fault-related indicators, the delay trigger parameters are dynamically adjusted in combination with the current equipment operating status, load level and historical alarm records. The alarm delay time is set according to the updated delay strategy. If no new alarm event with higher priority is added within the alarm delay time, it is merged into a single secondary alarm, or the alarm is not triggered when the cancellation conditions are met.

[0052] An anomaly detection model selection system based on indicator profiling, the system comprising:

[0053] The data acquisition module is used to collect historical data of the target monitoring indicators;

[0054] The feature extraction module is used to extract periodic features, trend features, stationary features, distribution pattern features, historical anomaly rates, business scenario tags, and health scores based on the historical data, and to construct an indicator profile for feature vectorization representation.

[0055] The indicator type classification module is used to classify target monitoring indicators into preset indicator types based on the similarity between indicator profiles;

[0056] The model matching module is used to establish a matching rule library between indicator types and anomaly detection models, and to score the suitability of candidate anomaly detection models in conjunction with a model compatibility evaluation mechanism. Based on the matching rules and the suitability score, the optimal anomaly detection model and parameter configuration corresponding to the indicator profile are determined.

[0057] An anomaly detection module is used to perform anomaly detection on the actual data of the target monitoring indicator using the optimal anomaly detection model, output an anomaly score and compare it with the model threshold to obtain an anomaly judgment result.

[0058] The fusion decision module is used to generate the final anomaly determination result by weighted fusion or arbitration decision based on the anomaly score, anomaly determination result and confidence level output by each anomaly detection model when multiple anomaly detection models exist.

[0059] The alarm processing module is used to generate an abnormal alarm and send the alarm according to a preset strategy when the target monitoring indicator is determined to be abnormal and the alarm conditions are met; and when multiple different target monitoring indicators of the same device are abnormal in succession within a predetermined time window, the module integrates the abnormal information to perform fault correlation analysis, adjusts the alarm order or suppresses secondary alarms.

[0060] The profile update module is used to update the features and types of indicators in the profile based on the performance of the anomaly detection model and feedback from manual handling. New features are added to the indicator profile incrementally and version changes are recorded.

[0061] The rule optimization module is used to automatically adjust the model selection strategy and parameter configuration in the matching rule base according to the actual false positive rate and false negative rate changes of the anomaly detection model.

[0062] The beneficial effects of this invention are as follows: By constructing indicator profiles and linking them with the model matching rule base, automated model selection is achieved; when there are differences in the outputs of multiple models, the system performs weighted fusion or hierarchical arbitration based on anomaly scores, judgment results, and confidence levels to ensure the stability of the final anomaly judgment result; by utilizing device-indicator structure mapping and knowledge graph reasoning, key fault indicators are identified and alarm strategies are dynamically adjusted, effectively reducing redundant alarms caused by simultaneous anomalies in multiple indicators; based on online feature extraction and feature drift judgment mechanisms, important feature changes are automatically included in the profile version management library, realizing the dynamic evolution of model matching and detection logic; by continuously monitoring false alarm rates and false negative rates, manual feedback is incorporated into the rule base optimization process, establishing a dynamic closed-loop feedback mechanism between model selection and detection performance. Attached Figure Description

[0063] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0064] Figure 1 This is a flowchart of the method of the present invention;

[0065] Figure 2 This is a schematic diagram of the modular structure of the system in an embodiment of the present invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0067] like Figure 1 As shown, this is an embodiment of the present invention. This embodiment provides an anomaly detection model selection method based on indicator profiling. By constructing indicator profiling of target monitoring indicators, establishing a mapping relationship between indicator types and anomaly detection models, and combining model compatibility evaluation and dynamic update mechanisms, the optimal anomaly detection model can be automatically selected and continuously optimized under variable power scenarios.

[0068] In this embodiment, the method mainly includes the following steps:

[0069] S1: Data Collection and Indicator Profile Construction

[0070] Historical data on target monitoring indicators are collected from the power system. Data sources include, but are not limited to, substation operation monitoring systems, power transmission and distribution load monitoring systems, energy quality detection systems, and safety early warning systems.

[0071] For each target monitoring metric, extract multidimensional features including the following:

[0072] Periodic characteristics (by calculating the main frequency components and their amplitudes using Fast Fourier Transform to capture the implicit periodicity of historical index data).

[0073] Trend characteristics (linear trends are calculated using the recursive least squares method to determine the historical trend slope; a slope greater than 0 indicates an upward trend, and a slope less than 0 indicates a downward trend; non-linear trends are modeled using the ARIMA model).

[0074] Stationarity characteristics (represented by the ADF test statistic: the presence of a unit root indicates non-stationarity; the absence of a unit root indicates stationarity).

[0075] Distribution morphology characteristics (described by skewness and kurtosis);

[0076] Historical anomaly occurrence rate (statistics on the percentage of points exceeding the threshold, calculation of anomaly frequency, duration, etc.);

[0077] Business scenario tags (tagged manually to indicate the power business category to which the target monitoring indicator belongs, such as substation monitoring, transmission and distribution load, power quality, safety alarms, etc.);

[0078] The health score (used to reflect the current operational health status of equipment based on monitored indicators) is calculated using the following formula:

[0079] ;

[0080] In the formula, Indicates health score; The historical failure rate of the target monitoring indicator is the ratio of the number of failures in a recent statistical period (such as the last 3 months) to the total number of monitoring times. The failure rate weighting factor is set according to different business scenarios (e.g., a larger value is assigned to the main equipment of the substation with extremely high safety requirements). The average repair time is the average time taken for the equipment to repair a fault within the aforementioned statistical period. The average repair time weighting factor can also be customized according to the business scenario;

[0081] This health score, as part of the indicator profile vector, participates in the weighting of subsequent anomaly detection model selection. When prioritizing anomaly detection models, indicators with lower health scores are assigned higher sensitivity weights to ensure timely anomaly identification of high-risk devices.

[0082] The above multidimensional features constitute the indicator profile, and after standardization, they form feature vectors. The system classifies the target monitoring indicators into preset indicator types (such as "periodic stable type" and "mutation highly sensitive type") based on vector similarity (such as cosine similarity or Euclidean distance).

[0083] S2: Selection of Anomaly Detection Model

[0084] A matching rule base for indicator types and anomaly detection models is established. This base consists of two parts: a mapping table between indicator types and priority of candidate anomaly detection models, and a parameter recommendation table. The mapping table pre-defines the priority relationships between different indicator types and various candidate anomaly detection models, such as:

[0085] Strong periodicity and high stability → preferential matching of statistical models (such as SARIMA);

[0086] Nonlinear and highly volatile characteristics → preferentially match deep learning models (such as LSTM);

[0087] Sparse anomalies → preferentially match density-based models such as isolated forests.

[0088] The parameter recommendation table pre-sets the initial parameter ranges for each anomaly detection model (such as the seasonal parameters of SARIMA, the time step of LSTM, etc.).

[0089] Based on the categorized indicator types according to the target monitoring indicators, corresponding candidate anomaly detection models are selected from the matching rule base, and rule priority weights are labeled. ;

[0090] For each candidate anomaly detection model obtained from the matching rule base, the system calculates a difference metric based on the difference between its model assumptions and the probability distribution of historical data of the target monitoring indicator. (Kullback-Leibler divergence), calculated using the following formula: ;

[0091] In the formula, For the target monitoring indicators, the actual data is in The probability distribution value at that location. The probability distribution assumed for the candidate anomaly detection model is in The value at; For value index;

[0092] A larger difference measure value indicates a worse fit between the candidate model's assumptions and the actual data. Convert to basic fit rating : ;

[0093] To enhance robustness, a threshold is set. When the difference measure Greater than the preset threshold At that time, the basic fit score will be used. Attenuation to .

[0094] The basic fit is scored using a model compatibility evaluation mechanism. Dynamic adjustments are made, including dynamically adjusting the fitness score based on reinforcement learning computation. And supplemental fit scores calculated based on automated machine learning ;

[0095] Among them, reinforcement learning uses basic fit scoring. Distance threshold confidence and prediction consistency confidence The state is the input, and the action is to select any candidate anomaly detection model. The reward is calculated based on the detection accuracy and missed alarm penalty of the candidate anomaly detection model on historical data. Q-learning or deep Q-network is trained to maximize the cumulative reward, and the dynamically adjusted fitness score is output. ;

[0096] Distance threshold confidence The calculation formula is: ;

[0097] In the formula, This is the anomaly score for the current candidate anomaly detection model. This is the anomaly detection threshold for the current candidate anomaly detection model;

[0098] Predictive consistency confidence The calculation formula is: ;

[0099] In the formula, The number of candidate anomaly detection models that are consistent with the anomaly judgment results of the current candidate anomaly detection model. This represents the total number of candidate anomaly detection models.

[0100] award Calculate using the following formula: ;

[0101] In the formula, To accurately detect the number of anomalies, To ensure accurate detection of normal frequency, Number of false alarms This represents the number of missed reports;

[0102] Dynamically corrected fit score The calculation formula is: ;

[0103] In the formula, To normalize rewards, Recommended initial value for the balance factor. This mechanism allows the fit score to not only consider static difference matching, but also to be dynamically optimized by incorporating actual detection performance.

[0104] Automated machine learning is achieved by training a meta-learning model on a synthetic anomaly data training set. It predicts the optimal matching probability of each candidate model based on the mapping relationship between historical model performance and indicator profiles. The meta-learning model takes the indicator profile as input and outputs the optimal matching probability of each candidate anomaly detection model, serving as a supplementary fitness score. ;

[0105] An anomalous data training set is constructed by injecting spike anomalies into existing time series data. The injection formula is as follows:

[0106] ;

[0107] In the formula, For the original time series at time... The value; For the time series after the injection of anomalies at time 10:00 The value; Let be a Bernoulli distributed random variable used to determine the direction of the peak; For the peak amplitude random variable; The empirical standard deviation of the original time series;

[0108] Abnormal sample labeled training: The model is trained using methods such as GBDT and Meta-LSTM, taking the index profile as input and outputting the matching probability of each candidate model. , .

[0109] The matching rule weights are weighted and combined with each scoring result to calculate the comprehensive score. :

[0110] ;

[0111] In the formula, , , As a weighting factor, and The value can be set to (0.4, 0.4, 0.2) or optimized dynamically using Bayesian methods, depending on the actual task.

[0112] Choose overall rating The candidate anomaly detection model with the highest score is selected as the optimal anomaly detection model, or a comprehensive score can be chosen. The top N candidate anomaly detection models (with multiple high-performing models retained for fusion inference) are combined for prediction. Their corresponding parameters can be based on: the recommended parameter table in the matching rule base; or the optimal parameter configuration vector output by the AutoML module.

[0113] In this embodiment, all scoring modules ( , , Normalization (MinMaxScaler) is required to ensure consistent dimensions; the matching rule base can be constructed with the assistance of expert annotation and unsupervised clustering; it is recommended to use a distributed task queue (such as Kafka + Spark) for the model training and scoring process to meet the concurrent processing of high-frequency indicators; Q-learning and meta-learning models need to be updated regularly, and it is recommended to set a daily batch offline training window (such as 23:00~04:00).

[0114] This specific implementation introduces three types of fit scoring mechanisms (static distribution matching, dynamic reinforcement feedback, and meta-learning prediction) and combines them with rule priority weights to form a closed-loop, logically sound optimal model selection process, which is suitable for dynamic anomaly detection of high-frequency, highly heterogeneous, and highly sensitive indicators in power monitoring systems.

[0115] S3: Anomaly Detection and Result Fusion

[0116] An anomaly detection model is used to detect anomalies in the actual data of the target monitoring indicators. An anomaly score is output and compared with the model threshold to obtain the anomaly determination result. Specifically:

[0117] When the determined anomaly detection model is unique, each target monitoring indicator is input into the finally determined anomaly detection model according to the time window segmentation method, the anomaly score is output, and the anomaly score is compared with the corresponding model threshold to generate the first judgment result vector, which is directly used as the final anomaly judgment result.

[0118] When multiple anomaly detection models exist, the anomaly score, first judgment result vector and corresponding confidence value output by each anomaly detection model are collected, a confidence weighting matrix is ​​constructed, and each first judgment result vector is weighted and fused at each time step to form a second judgment result vector as the final anomaly judgment result.

[0119] In a specific implementation of this invention, to improve the accuracy of judgment when multiple anomaly detection models output inconsistent results, a confidence-driven hierarchical arbitration mechanism is introduced. When at least two anomaly detection models provide different first judgment result vectors for the target monitoring indicator at the same time, and the difference between the corresponding confidence scores exceeds a set threshold, the arbitration process is automatically initiated, specifically including:

[0120] Based on the business scenario tags corresponding to the target monitoring indicators, query the power fault mode library for fault modes with the same business scenario tags and consistent anomaly mode types. Extract the anomaly detection model that has a business correspondence with the fault mode, and combine the anomaly score and priority coefficient output by the anomaly detection model. Multiplication to enhance the weight of the anomaly detection model in subsequent weighted fusion; priority coefficient It can be obtained through training settings or scenario presets.

[0121] The original indicator data corresponding to the time period in which the first judgment result vector conflict occurs is subjected to denoising preprocessing. The denoised target monitoring indicator data is then input into a preset validation model, which can be an LSTM network or support vector machine trained on historical data. Its output is used to compare with the initial anomaly score, and a score correction factor for each anomaly detection model is calculated. ;

[0122] The anomaly score for each anomaly detection model is multiplied sequentially by a score correction factor to form the corrected score, i.e.:

[0123] For the correlation model, the corrected score is calculated as follows: ;

[0124] For the non-associative model, the corrected score is calculated as follows: ;

[0125] All anomaly detection model correction scores are weighted and fused according to confidence level to form the final anomaly judgment result of the target monitoring indicator in the corresponding time period.

[0126] S4: Alarm Generation and Optimization

[0127] When the anomaly determination result indicates that the target monitoring indicator is abnormal and meets the alarm conditions, an anomaly alarm is generated and sent according to the preset strategy; if multiple different target monitoring indicators of the same device are abnormal in succession within a predetermined time window, the anomaly information is merged to perform fault correlation analysis, and the alarm order is adjusted or secondary alarms are suppressed.

[0128] In this embodiment of the invention, to avoid a large number of duplicate or redundant alarms caused by multiple target monitoring indicators of the same device becoming abnormal in a short period of time, a multi-indicator collaborative alarm mechanism based on knowledge graph reasoning and alarm priority adjustment is introduced. Specifically, it includes:

[0129] 1) Classification of abnormal indicators and structural mapping

[0130] When multiple target monitoring indicators for the same device exhibit abnormalities within a predetermined time window, the system uses that device as a central node, extracts its structural configuration, identifies all abnormal target monitoring indicators, and maps them to corresponding indicator nodes in the power knowledge graph. Each indicator node carries the anomaly score and confidence value output by its latest anomaly detection model. ,in This indicates the reliability of the anomaly detection of the indicator;

[0131] 2) Fault causal reasoning based on confidence weighting

[0132] The system uses devices as root nodes and performs forward reasoning based on causal chains within the power knowledge graph, starting from abnormal indicators. During the reasoning process, for each indicator path that may lead to device failure, the confidence weights of each abnormal indicator in that path are accumulated. ,in This indicates the strength of the graph association between the indicator node and the target fault node in the path. The final weighted cumulative value is selected. The longest causal path is taken as the main fault path, and the indicator node with the largest weight contribution on the main fault path is identified as the main fault correlation indicator.

[0133] 3) Alarm priority determination and main alarm triggering

[0134] For the identified major fault-related indicators, a high-level alarm event is immediately triggered and directly pushed to the alarm center or power grid monitoring platform, marked as "Level 1 Major Alarm";

[0135] 4) Strategies for delaying and suppressing alarms for secondary indicators

[0136] For other abnormal indicator nodes that are inconsistent with the main failure path or have a low weight contribution, the system handles them according to the following strategy:

[0137] Based on the current operating status of the equipment (such as load rate, temperature, and voltage fluctuations) and historical alarm frequency, the delay time is dynamically generated. For example, under high load conditions Set to 10 seconds, which can be increased to 60 seconds under low load;

[0138] If the delay time If no new primary alarm event is detected or a primary alarm that has been triggered has not been updated, the system will merge the secondary abnormal indicator and trigger a secondary alarm according to the default policy, or:

[0139] When the abnormal score is below the suppression threshold If the system is already in a high-density alarm state, directly suppress alarm reporting;

[0140] 5) Status logging and alarm behavior tracking

[0141] All reasoning processes, alarm adjustment behaviors, and results are recorded in the alarm strategy behavior library for subsequent system training, decision backtracking, or operation and maintenance auditing.

[0142] S5: Dynamic Updates and Adaptive Optimization

[0143] Based on the performance of the anomaly detection model and feedback from manual handling, the indicator profile features and their respective indicator types are updated. The newly added feature increments are added to the indicator profile and the version changes are stored. Furthermore, based on the actual false positive rate and false negative rate changes of the anomaly detection model, the model selection strategy and parameter configuration in the matching rule base are automatically adjusted.

[0144] Optionally, the incremental update of indicator profile features is achieved through online algorithms, including: using streaming Fourier transform or time-domain filtering to update the main periodic components in real time for periodic features, using a sliding window to calculate the standard deviation or coefficient of variation for volatility features, and using recursive linear regression to calculate the latest slope for trend features; the updated feature vector is fused and compared with the original profile, and when the feature change exceeds a preset threshold, a new profile version is generated and stored in the profile version management library, and used for the next round of indicator type classification and model matching.

[0145] The anomaly detection model parameters are adaptively adjusted based on real-time data. The adjustment mechanism includes a dual-loop optimization: the outer loop adjusts the model's global parameters, including anomaly threshold, detection sensitivity, and contamination rate, based on the seasonal patterns of the power system or special calendar events; the inner loop continuously fine-tunes the model's internal parameters based on online learning algorithms, including but not limited to the number of leaves in the decision tree model, the subsampling size in the isolated forest model, and the learning rate in the neural network model; and the adjustment range of each parameter is constrained by a pre-established parameter impact evaluation matrix to ensure stable improvement in model performance.

[0146] The feedback optimization mechanism for matching rules includes: continuously monitoring the anomaly detection performance of each indicator; when the false alarm rate or missed alarm rate of a certain indicator exceeds the preset value within a certain period, triggering the optimization process of the corresponding entry for that indicator type in the rule base; the optimization process adjusts its model matching scheme according to the latest profile features of the indicator, including replacing it with a detection model that is more suitable for the new features, adding pre-data transformation or post-processing steps, adjusting the model fusion weights, etc., and using historical data playback to verify the effectiveness of the optimized scheme. After verification, the new rules are applied to subsequent model selection.

[0147] like Figure 2 As shown, another embodiment of the present invention provides an anomaly detection model selection system based on indicator profiling. This system is deployed at an industrial monitoring master station or edge intelligent operation and maintenance platform, and adaptively selects and dynamically optimizes anomaly detection models for key monitoring indicators in the operating status of power equipment. It mainly includes:

[0148] The data acquisition module is used to collect historical data of target monitoring indicators from data sources such as SCADA system, substation monitoring system, and transmission line sensing terminal. The collected data includes timestamp-aligned monitoring value sequences and auxiliary information such as the identification of the equipment to which they belong and the identification of the service type.

[0149] The feature extraction module is used to extract periodic features, trend features, stationary features, distribution pattern features, historical anomaly rates, business scenario tags, and health scores based on historical data, and to construct indicator profiles for feature vectorization representation.

[0150] The indicator type classification module is used to classify target monitoring indicators into preset indicator types based on the similarity between indicator profiles;

[0151] The model matching module is used to build a matching rule library between indicator types and anomaly detection models, and integrates a model compatibility evaluation mechanism to score the suitability of candidate anomaly detection models. Based on the matching rules and suitability scores, the optimal anomaly detection model and parameter configuration corresponding to the indicator profile are determined.

[0152] The anomaly detection module is used to take real-time or recent data of the current target monitoring indicators as input, use the optimal anomaly detection model to perform anomaly detection, output an anomaly score (such as probability value or standardized deviation score) and compare it with the model threshold to obtain the anomaly judgment result.

[0153] The fusion decision module is used to generate the final anomaly determination result by weighted fusion or arbitration decision based on the anomaly score, anomaly determination result and confidence level output by each anomaly detection model when there are multiple anomaly detection models (such as AutoML strategy retaining multiple high-scoring models).

[0154] The alarm processing module is used to generate an abnormal alarm and send the alarm according to a preset strategy when the target monitoring indicator is determined to be abnormal and the alarm conditions are met; and when multiple different target monitoring indicators of the same device are abnormal in succession within a predetermined time window, the module integrates the abnormal information to perform fault correlation analysis, adjusts the alarm order or suppresses secondary alarms.

[0155] The profile update module is used to update the features and types of indicators in the profile based on the performance of the anomaly detection model and feedback from manual handling. New features are added to the indicator profile incrementally and version changes are recorded.

[0156] The rule optimization module is used to automatically adjust the model selection strategy and parameter configuration in the matching rule base based on the actual false positive rate and false negative rate changes of the anomaly detection model.

[0157] In summary, this invention constructs a closed-loop mechanism covering the entire process of "profile construction—model matching—result fusion—alarm decision-making—feedback update," which can accurately characterize the behavior patterns of monitoring indicators from multi-dimensional features, automatically match the most adaptive anomaly detection model, and dynamically configure parameters. When there are differences in the outputs of multiple models, the reliability of anomaly judgment is effectively improved through confidence-driven weighted fusion and hierarchical arbitration mechanisms. In scenarios with multiple anomalies in equipment indicators, causal reasoning is performed using knowledge graphs to achieve the identification of primary and secondary alarms and optimize the response rhythm, significantly reducing redundant alarms. At the same time, it supports real-time incremental updates of profile features and online parameter tuning of detection models, and dynamically optimizes model matching rules based on false alarm and missed alarm data feedback, thereby improving the intelligence level, response efficiency, and long-term operational stability of the anomaly detection system. It is suitable for large-scale, highly dynamic industrial monitoring and maintenance scenarios.

[0158] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any other combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0159] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0160] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for selecting anomaly detection models based on indicator profiling, characterized in that, The method includes: Historical data of target monitoring indicators are collected, and periodic features, trend features, stability features, distribution pattern features, historical anomaly rates, business scenario tags, and health scores are extracted. Indicator profiles are constructed and feature vectorization is performed. The target monitoring indicators are classified into preset indicator types based on similarity. The business scenario tags are used to indicate the power business category to which the target monitoring indicators belong, including substation monitoring, transmission and distribution load, power quality, and safety alarms. A matching rule base for indicator types and anomaly detection models is established, and a model compatibility evaluation mechanism is used to score the suitability of candidate anomaly detection models. Based on the matching rules and suitability scores, the optimal anomaly detection model and parameter configuration corresponding to the indicator profile are determined. Specifically, this includes: Based on the categorized indicator types according to the target monitoring indicators, corresponding candidate anomaly detection models are selected from the matching rule base, and rule priority weights are labeled. ; Calculate the difference between the hypothesis distribution of the candidate anomaly detection model and the actual distribution of the target monitoring indicator. And convert it into a basic fit score. ; The basic fit is scored using a model compatibility evaluation mechanism. Dynamic adjustments are made, including dynamically adjusting the fitness score based on reinforcement learning computation. And supplemental fit scores calculated based on automated machine learning ; Calculate the combined score of matching rules and fit score. : ; In the formula, , , As a weighting factor, and ; Choose overall rating Highest or overall score The top N candidate anomaly detection models are selected as the optimal anomaly detection model, and the parameter configuration corresponding to the optimal anomaly detection model is searched in the matching rule base. The anomaly detection model is used to detect anomalies in the actual data of the target monitoring indicator, and an anomaly score is output and compared with the model threshold to obtain the anomaly judgment result. When there are multiple anomaly detection models, the final anomaly judgment result is generated by weighted fusion or arbitration decision based on the anomaly score, anomaly judgment result and confidence level output by each anomaly detection model. When the anomaly determination result indicates that the target monitoring indicator is abnormal and meets the alarm conditions, an anomaly alarm is generated and sent according to a preset strategy; if multiple different target monitoring indicators of the same device are successively abnormal within a predetermined time window, the anomaly information is merged to perform fault correlation analysis, and the alarm order is adjusted or secondary alarms are suppressed. Based on the performance of the anomaly detection model and feedback from manual handling, the indicator profile features and their respective indicator types are updated. The newly added feature increments are added to the indicator profile and the version changes are stored. Furthermore, based on the actual false positive rate and false negative rate changes of the anomaly detection model, the model selection strategy and parameter configuration in the matching rule base are automatically adjusted.

2. The anomaly detection model selection method based on indicator profiling according to claim 1, characterized in that, The formula for calculating the health score is as follows: ; In the formula, Indicates health score; The historical failure rate of the target monitoring indicator. This is the failure rate weighting factor; For average repair time, This is the weighting factor for average repair time.

3. The anomaly detection model selection method based on indicator profiling according to claim 1, characterized in that, The difference measure The calculation formula is: ; In the formula, For the target monitoring indicators, the actual data is in The probability distribution value at that location. The probability distribution assumed for the candidate anomaly detection model is in The value at; For value index; measure of difference Convert to basic fit rating : ; When the difference metric value Greater than the preset threshold At that time, the basic fit score will be used. Attenuation to .

4. The anomaly detection model selection method based on indicator profiling according to claim 3, characterized in that, The reinforcement learning uses a base fitness score. Distance threshold confidence and prediction consistency confidence The state is the input, and the action is to select any candidate anomaly detection model. The reward is calculated based on the detection accuracy and missed alarm penalty of the candidate anomaly detection model on historical data. Q-learning or deep Q-network is trained to maximize the cumulative reward, and the dynamically adjusted fitness score is output. ; The distance threshold confidence level The calculation formula is: ; In the formula, This is the anomaly score for the current candidate anomaly detection model. This is the anomaly detection threshold for the current candidate anomaly detection model; The prediction consistency confidence level The calculation formula is: ; In the formula, The number of candidate anomaly detection models that are consistent with the anomaly judgment results of the current candidate anomaly detection model. This represents the total number of candidate anomaly detection models. award Calculate using the following formula: ; In the formula, To accurately detect the number of anomalies, To ensure accurate detection of normal frequency, Number of false alarms This represents the number of missed reports; Dynamically corrected fit score The calculation formula is: ; In the formula, To normalize rewards, It is a balancing factor.

5. The anomaly detection model selection method based on indicator profiling according to claim 3, characterized in that, The automated machine learning is trained on a synthetic anomaly data training set using a meta-learning model. The input of the meta-learning model is the indicator profile, and the output is the optimal matching probability of each candidate anomaly detection model, serving as a supplementary fit score. ; The synthetic anomaly training set includes spike anomalies, and the injection formula is as follows: ； In the formula, For the original time series at time... The value; For the time series after the injection of anomalies at time 10:00 The value; Let be a Bernoulli distributed random variable used to determine the direction of the peak; For the peak amplitude random variable; This represents the empirical standard deviation of the original time series.

6. The anomaly detection model selection method based on indicator profiling according to claim 1, characterized in that, The anomaly detection model is used to detect anomalies in the actual data of the target monitoring indicator, including: When the determined anomaly detection model is unique, each target monitoring indicator is input into the finally determined anomaly detection model according to the time window segmentation method, anomaly score is output, and the anomaly score is compared with the corresponding model threshold to generate a first judgment result vector, which is directly used as the final anomaly judgment result. When multiple anomaly detection models exist, the anomaly score, first judgment result vector and corresponding confidence value output by each anomaly detection model are collected, a confidence weighting matrix is ​​constructed, and each first judgment result vector is weighted and fused at each time step to form a second judgment result vector as the final anomaly judgment result. When two or more anomaly detection models output inconsistent first judgment result vectors for the target monitoring indicator at the same time, and the difference between the corresponding confidence values ​​exceeds a set threshold, an arbitration process is executed.

7. The anomaly detection model selection method based on indicator profiling according to claim 6, characterized in that, The arbitration process specifically includes: Based on the business scenario tags corresponding to the target monitoring indicators, query the power fault mode library for fault modes with the same business scenario tags and consistent anomaly mode types, determine the anomaly detection model with business relevance in the fault mode, and multiply the anomaly score output by the anomaly detection model by the priority coefficient to enhance the weight of the anomaly detection model in the subsequent weighted fusion. Denoising preprocessing is performed on the time period data where the first judgment result vector conflict occurs, and the denoised target monitoring index data is input into the preset verification model to generate a recalculated anomaly score. The score correction factor corresponding to each anomaly detection model is further calculated. The anomaly score of each anomaly detection model is multiplied by the score correction factor in turn to form the corrected score; Based on the corrected score and confidence value, a weighted fusion is performed to form the final anomaly judgment result of the target monitoring indicator in the corresponding time period.

8. The anomaly detection model selection method based on indicator profiling according to claim 1, characterized in that, If multiple different target monitoring indicators of the same device successively become abnormal within a predetermined time window, the abnormal information is fused for fault correlation analysis, and the alarm order is adjusted or secondary alarms are suppressed, including: Based on the structural mapping relationship between target monitoring indicators and equipment, the target monitoring indicators that have anomalies and their corresponding anomaly scores and confidence levels are input into a pre-established power knowledge graph. Using the equipment component level, indicator association path and fault causal chain in the power knowledge graph, causal reasoning is performed in a confidence-weighted manner, and the fault location or cause that has a causal relationship with the current multi-indicator anomaly pattern is output. Based on the causal reasoning results, the target monitoring indicator with the highest accumulated confidence weight in the causal path is identified, marked as the main fault-related indicator, and a high-level alarm is immediately triggered for any anomaly of the main fault-related indicator. For other target monitoring indicators that are not marked as primary fault-related indicators, the delay trigger parameters are dynamically adjusted in combination with the current equipment operating status, load level and historical alarm records. The alarm delay time is set according to the updated delay strategy. If no new alarm event with higher priority is added within the alarm delay time, it is merged into a single secondary alarm, or the alarm is not triggered when the cancellation conditions are met.

9. An anomaly detection model selection system based on indicator profiling, applied to the anomaly detection model selection method based on indicator profiling as described in any one of claims 1-8, characterized in that, The system includes: The data acquisition module is used to collect historical data of the target monitoring indicators; The feature extraction module is used to extract periodic features, trend features, stationary features, distribution pattern features, historical anomaly rates, business scenario tags, and health scores based on the historical data, and to construct an indicator profile for feature vectorization representation. The indicator type classification module is used to classify target monitoring indicators into preset indicator types based on the similarity between indicator profiles; The model matching module is used to establish a matching rule library between indicator types and anomaly detection models, and to score the suitability of candidate anomaly detection models in conjunction with a model compatibility evaluation mechanism. Based on the matching rules and the suitability score, the optimal anomaly detection model and parameter configuration corresponding to the indicator profile are determined. An anomaly detection module is used to perform anomaly detection on the actual data of the target monitoring indicator using the optimal anomaly detection model, output an anomaly score and compare it with the model threshold to obtain an anomaly judgment result. The fusion decision module is used to generate the final anomaly determination result by weighted fusion or arbitration decision based on the anomaly score, anomaly determination result and confidence level output by each anomaly detection model when multiple anomaly detection models exist. The alarm processing module is used to generate an abnormal alarm and send the alarm according to a preset strategy when the target monitoring indicator is determined to be abnormal and the alarm conditions are met; and when multiple different target monitoring indicators of the same device are abnormal in succession within a predetermined time window, the module integrates the abnormal information to perform fault correlation analysis, adjusts the alarm order or suppresses secondary alarms. The profile update module is used to update the features and types of indicators in the profile based on the performance of the anomaly detection model and feedback from manual handling. New features are added to the indicator profile incrementally and version changes are recorded. The rule optimization module is used to automatically adjust the model selection strategy and parameter configuration in the matching rule base according to the actual false positive rate and false negative rate changes of the anomaly detection model.

Images