A user security feature recognition method based on behavior pattern analysis

Abstract

The application discloses a user security feature recognition method based on behavior pattern analysis, to solve the problem of inaccurate and insufficient robustness of existing technology in recognizing power user power consumption security features. The method first preprocesses and segments the original power consumption time series data; then constructs a self-supervised learning model based on an expert hybrid architecture, which integrates five neural networks to build expert models, dynamically allocates expert weights through a gating network, and outputs power consumption pattern deep embedding vectors after self-supervised training; then clusters the embedding vectors using a clustering algorithm, determines the optimal cluster number using the elbow method and the contour coefficient method, generates user portraits, and performs visualization and feature analysis; finally, according to the user portrait data, transaction behavior pattern recognition is performed on the input user data to be recognized, and the security feature recognition result is output. The application can comprehensively and accurately identify user power consumption security features, and is suitable for smart grid security monitoring and other scenarios.

Description

Technical Field

[0001] This invention relates to the fields of network security and intelligent analysis technology, and in particular to a user security feature identification method based on behavioral pattern analysis, used to identify user security features from electricity trading behavior sequence data. Background Technology

[0002] With the accelerated construction of the global energy internet and the widespread adoption of smart grid technology, advanced metering infrastructure (AMI) has become the "nerve ending" of modern power system security monitoring. Through devices such as smart meters, edge data acquisition terminals, and power IoT sensors, it continuously collects electricity transaction and operation data from residential and commercial users at frequencies of per minute (e.g., high-precision tamper-proof meters), per hour, or even higher, forming petabyte-scale (PB) security-sensitive time-series datasets. These data not only record basic information such as users' real-time electricity consumption and load fluctuations, but also contain deeper value directly related to power safety. From a micro perspective, they reflect traces of users' safety-related behaviors (such as hidden load fluctuations during electricity theft, gradual abnormal electricity signals before equipment failure, and three-phase imbalance-related electricity consumption patterns caused by illegal wiring) and causes of safety risks (such as overload precursors caused by disorderly charging of new energy vehicles and intermittent leakage of old equipment related to load changes). From a macro perspective, their aggregation characteristics can reflect the distribution of regional safety risks (such as the concentrated occurrence of "low voltage and high load in the early morning" in a certain area may point to the activities of electricity theft gangs) and weak links in power grid security (such as frequent equipment failures related to abnormal electricity consumption in a certain area, indicating aging distribution network facilities). For power grid companies, these unlabeled "security data goldmines" are the core basis for achieving accurate security early warning (such as pushing maintenance reminders to users for early signs of equipment failure), strengthening anti-theft electricity inspection (such as identifying hidden electricity theft), and optimizing security operation and maintenance strategies (such as prioritizing on-site verification for high-risk users). They are directly related to the power supply security, operational compliance, and asset protection capabilities of the power system.

[0003] However, current mainstream technologies for identifying the safety characteristics of electricity users still have significant bottlenecks. Existing solutions heavily rely on self-supervised learning paradigms using a single deep learning model: researchers typically choose one from models such as Multilayer Perceptron (MLP), Long Short-Term Memory (LSTM), Temporal Convolution Networks (TCN), Mamba, or Transformer. By designing self-supervised tasks such as time series reconstruction (e.g., completing missing data for suspected electricity theft periods, predicting normal load baselines before equipment failure) and contrastive learning (e.g., distinguishing the similarity between normal and abnormal electricity consumption patterns), the model is forced to learn deep embedding representations of electricity safety-related patterns from unlabeled data. Then, clustering algorithms such as K-means and DBSCAN (Density-Based Spatial Clustering of Applications with Noise) are used to group the embedded vectors, attempting to filter out user groups with safety risks. While this method has shown some effectiveness in simple security scenarios (such as obvious power theft due to sudden load surges), it reveals multiple limitations in addressing complex power security data and diverse risk scenarios:

[0004] First, there is a fundamental mismatch between the model's capabilities and the complexity of safety feature data. The complexity of electricity user safety feature data far exceeds that of ordinary time series, specifically manifested in: the superposition of strong periodicity and safety anomalies (such as non-periodic fluctuations caused by electricity theft embedded in normal daily load cycles), multi-timescale safety features (from sudden anomalies of minute-level electricity theft device access, to continuous anomalies of hourly equipment overload, to gradual anomalies associated with monthly equipment aging), and heterogeneity of user safety behaviors (differences in load characteristics caused by different electricity theft methods—such as the concealed fluctuations of wire-connected electricity theft vs. the overall deviation of meter tampering, and the differences in power consumption signals of different equipment failures—such as the intermittent impact load of motor failure vs. the continuous low load of line aging). Existing single-model approaches all have inherent limitations in capturing security features: LSTM, while capable of capturing long-range dependencies, suffers from gradient vanishing during backpropagation, leading to low training efficiency and difficulty in accurately capturing short-term security features such as minute-level load surges caused by electricity theft; TCN efficiently extracts local multi-scale patterns through dilated convolutions, but lacks a global attention mechanism, making it unable to model long-term security associations such as "weekly regular electricity theft patterns (e.g., electricity theft at fixed times every Saturday morning)"; Transformer achieves global dependency modeling through multi-head self-attention, but its computational complexity increases quadratically with sequence length, resulting in severe performance bottlenecks on high-frequency sampled data (e.g., tamper-proof meter data with 1-minute granularity), making it difficult to support real-time security monitoring for large-scale users; Mamba, as an emerging state-space model, while achieving breakthroughs in long sequence processing efficiency, is extremely sensitive to hyperparameter adjustments and lacks stability in scenarios involving "abrupt changes in electricity usage patterns (e.g., sudden access to stolen electricity devices, instantaneous overload of faulty equipment)," easily leading to missed detection of key security features. The limitations of single-model approaches prevent them from comprehensively covering the diverse features of power security data, becoming a core bottleneck in security risk identification.

[0005] Secondly, the robustness of the model is insufficient to handle extreme and marginal scenarios in the security field. In power security monitoring, rare security events (such as abnormal equipment overload caused by extreme cold waves, short-term behavior of stealing electricity after a sudden power outage, and hidden load changes caused by new electricity theft technologies) and fluctuations on special time scales (such as short-term high-power electricity theft pulses between 1 and 3 a.m., and fault-related load impacts at the moment of equipment startup) occur infrequently but are often the main causes of power grid security losses. Due to their fixed architecture and limited generalization ability, single models will significantly reduce the quality of the learned embedding representations when faced with such "security-oriented out-of-distribution data": for example, LSTM may misclassify "extreme peaks caused by electricity theft" as "normal heating load under extreme weather" and ignore them; TCN may be unable to capture cross-scale security anomalies such as "continuous electricity theft across the early morning period" due to the limitation of the receptive field (such as only covering 12 hours); although Transformer can model globally, it may over-smooth "intermittent fluctuations of equipment failure" into "normal load noise". This robustness defect directly leads to subsequent clustering algorithms incorrectly grouping "similar security risk patterns (such as the same type of electricity theft by different users)" or failing to distinguish "fundamentally different edge security features (such as the superposition of normal peak hours and electricity theft peak hours)", resulting in serious deviations in the final security feature identification results, and even causing misjudgment of security risks (judging normal electricity use as electricity theft) or missed judgment (judging electricity theft behavior as normal).

[0006] Third, the bottleneck of a single model leads to suboptimal representation of safety features. The superposition patterns of safety features and normal behavior in the electricity consumption behavior of different users are highly heterogeneous: the "normal morning and evening peak electricity consumption" of working families may be mixed with "hidden loads that connect to theft devices after get off work"; the "stable electricity consumption during the day" of retired families may hide "gradual abnormal fluctuations caused by equipment aging"; and the "small difference between day and night load" characteristic of commercial and residential users may include "theft of electricity after business closure at night". Forcing all heterogeneous data containing security features to pass through a fixed architecture of a single model (such as a unified hidden layer dimension and attention weight allocation logic) is equivalent to using the same standard to measure diverse security risk patterns. This inevitably leads to the compression or distortion of some key security features. For example, TCN, which focuses on local features, struggles to accurately separate the subtle fluctuations in security features caused by equipment failures in the global context of "stable electricity use by retired households." Transformer, which excels at global modeling, may over-smooth out sharp load pulses caused by electricity theft by working households, blurring the difference between it and normal load. MLP, lacking time-series modeling capabilities, cannot distinguish between "normal load time-series changes" and "time-series anomalies caused by electricity theft." This suboptimal representation directly limits the discriminative power of security features, making it impossible for power grid companies to finely classify "normal electricity use - suspected security risks - confirmed security risks," and even more difficult to accurately distinguish between different types of security risks such as electricity theft, equipment failure, and overload.

[0007] Furthermore, although the Mixture of Experts (MoE) architecture, as an integrated learning approach, has been attempted to improve the capacity of power system models (by distributing complex tasks to multiple "expert" sub-models for parallel processing), its existing applications mostly focus on supervised learning tasks in power systems (such as short-term load forecasting and equipment fault diagnosis classification tasks), and have not been adapted for "unsupervised scenarios of identifying power user security features": On the one hand, existing MoE models do not systematically integrate complementary time series models such as MLP, LSTM, TCN, Transformer, and Mamba, making it difficult to capture "multi-dimensional security features (such as sudden anomalies in electricity theft, gradual anomalies in equipment faults, and cumulative anomalies in overloads)" through multi-expert collaboration; on the other hand, its training objectives are still designed around specific supervised tasks (such as predicting the probability of fault occurrence), and it does not mine "security-oriented general embeddings (such as discriminative features between normal and abnormal loads, and distinguishable representations of different security risk types)" through self-supervised learning, thus failing to directly serve downstream unsupervised security feature clustering and identification, and making it difficult to meet the power grid's need to detect "unknown security risks (such as new types of electricity theft)".

[0008] To address the aforementioned shortcomings, this invention proposes a user safety feature identification method based on behavioral pattern analysis. It organically integrates multiple complementary time-series deep learning models into an "expert network" using the MoE architecture and introduces a gating mechanism to dynamically allocate optimal expert combinations for different electricity trading modes. Simultaneously, by combining self-supervised learning from time-series reconstruction with scientific clustering analysis, it automatically learns high-quality user safety feature representations from unlabeled data. This generates unsupervised safety feature profiles that comprehensively cover electricity consumption patterns, robustly handle extreme scenarios, and finely differentiate user differences. Finally, relying on a hybrid expert model, neural network, and safety feature profiles, it classifies the trading behaviors of different users into patterns and identifies their safety features, providing breakthrough technical support for the refined operation of smart grids. Summary of the Invention

[0009] This invention addresses the shortcomings of existing technologies by providing a user safety feature identification method based on behavioral pattern analysis. It innovatively integrates five complementary temporal deep learning models—multilayer perceptron, long short-term memory network, temporal convolutional network, transformer, and Mamba—as "experts." Through a gating network, it dynamically assigns optimal expert combinations to different power trading behavior patterns, achieving comprehensive capture of complex safety features in power trading behavior. Simultaneously, it combines a self-supervised learning task of time series reconstruction with K-means clustering analysis. First, the model learns high-quality deep embeddings of power trading behavior patterns through self-supervised training. Then, a scientific clustering method generates accurate user safety feature profiles. Finally, safety feature identification is performed based on a hybrid expert model, profile, and efficient neural network. This framework overcomes the limitations of single models, significantly improving the comprehensiveness and accuracy of power trading behavior pattern safety analysis in terms of coverage, feature extraction, and profile precision, achieving accurate safety feature identification and providing more reliable data support for the refined operation of smart grids. The user safety feature identification method based on behavioral pattern analysis of this invention includes the following steps:

[0010] S1: Preprocess and segment the raw power trading time series data to generate standardized time series segments;

[0011] S2: Construct a self-supervised learning model based on the MoE architecture. This model includes a gating network and multiple expert networks. The expert networks adopt a variety of complementary time-series deep learning models. The MoE model is trained through a self-supervised task of time-series reconstruction. The gating network dynamically assigns weights to the expert networks according to the features of the input segments processed by S1, and outputs a deep embedding vector of the power trading pattern.

[0012] S3: Unsupervised clustering of the deep embedding vectors obtained in S2 is performed using a clustering algorithm. The elbow method and the silhouette coefficient method are combined to determine the optimal number of clusters and form a user electricity trading profile.

[0013] S4: Visualize and perform feature analysis on the user profiles of each cluster obtained in S3, including generating daily average load curves and multi-dimensional security feature radar charts, analyzing transaction behavior patterns, and classifying user profiles for security purposes according to behavior patterns.

[0014] S5: Based on the categorized user profile data obtained in S4, perform behavioral pattern analysis on the input user data to identify its security characteristics.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0016] Comprehensive Capture of Complex Security Modes: By integrating five complementary expert models through the MoE architecture, the limitations of single models are addressed. A gating network dynamically assigns weights to these expert models based on input data characteristics, enabling comprehensive capture of diverse power trading security modes, including long-term dependencies, local fluctuations, and global correlations. This completely resolves the limitations of single models in complex security scenarios.

[0017] Improving robustness: Gated networks select the optimal combination of experts based on input features, avoiding performance degradation of a single model in modes it is not good at, and making the embedded representation more stable;

[0018] Automation and Interpretability: The method and process constructed in this invention can achieve end-to-end automated processing from raw power transaction data to user safety feature profiles, without the need for cumbersome manual intervention. Simultaneously, by generating daily average load curves, the temporal distribution patterns of user electricity load can be intuitively presented; using multi-dimensional radar charts, the characteristics of users in multiple safety-related dimensions, such as abnormal load growth rates and the proportion of atypical electricity consumption periods, can be clearly displayed, facilitating business interpretation.

[0019] Highly efficient and practical: Employing a self-supervised learning approach, it eliminates the need for manual labeling of massive amounts of electricity trading data, significantly reducing data preparation costs. This makes it highly suitable for processing large volumes of unlabeled electricity trading data in smart grid scenarios. In determining the number of clusters, the elbow method and silhouette coefficient method are combined to scientifically and objectively determine the optimal number of clusters from the perspectives of intra-cluster compactness and inter-cluster diversity. This avoids biases caused by subjectively setting the number of clusters, improving the practicality and reliability of the generated user electricity trading profiles, and providing more accurate data support for smart grid load forecasting, demand-side management, and other business operations.

[0020] In summary, the user security feature identification method proposed in this invention, based on behavioral pattern analysis, integrates the advantages of five different neural networks and effectively avoids their shortcomings by utilizing hybrid expert model technology. This significantly improves the model's ability to capture complex security data, enhances robustness and interpretability, and can efficiently and practically form different security feature profiles of electricity trading users through unsupervised clustering. It adapts to diverse behavioral patterns and can efficiently and accurately complete the task of identifying security features of user behavior patterns in electricity trading. This provides strong data support for the refined operation of smart grids and helps improve the accuracy of load forecasting and optimize demand-side management. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0022] Figure 1 This is a flowchart illustrating the overall process of a user security feature recognition method based on behavioral pattern analysis, according to an embodiment of the present invention.

[0023] Figure 2 This is a software flowchart of a user security feature recognition method based on behavior pattern analysis according to an embodiment of the present invention.

[0024] Figure 3 This is a detailed diagram of the MoE architecture according to an embodiment of the present invention.

[0025] Figure 4 This is an example of a radar image used in an embodiment of the present invention. Detailed Implementation

[0026] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0027] As attached Figure 1 As shown, this invention provides a user security feature identification method based on behavioral pattern analysis, aiming to achieve security feature identification of user electricity trading behavior patterns. Its core idea is as follows: Figure 2As shown, multiple advanced and complementary time-series deep learning models (including Mamba, Transformer, TCN, LSTM, and MLP) are integrated as "experts" into the MoE framework. These experts are jointly trained on a self-supervised task of time-series reconstruction to learn rich security features of transaction behavior patterns, resulting in a comprehensive range of user security feature embeddings. After obtaining high-quality embeddings, this invention uses the K-means algorithm to cluster these embeddings, automatically discovering and forming security feature profiles of different user behavior patterns. By combining the elbow method and robust analysis of the silhouette coefficient to determine the optimal number of clusters, the automation and objectivity of profile construction are further improved. For each cluster, this invention summarizes all the original (unnormalized) daily load segments assigned to that cluster and calculates the average 24-hour total consumption curve, resulting in a daily average curve visualization. To support more structured and quantitative comparisons of different profiles, the method described in this invention extracts eight high-level behavioral features from the average load curve of each cluster: total security consumption, time features, ratio-based features, shape-based features, and stability features. After normalization, these features are visualized using a radar chart. After obtaining various user security feature images, the method described in this invention pre-trains a Bidirectional Long Short-Term Memory-Convolutional Neural Network-Attention Mechanism (Bi-LSTM-CNN-Attention), and then uses this network in conjunction with a hybrid expert model to achieve security feature recognition of user transaction behavior patterns in subsequent applications. The specific steps are as follows:

[0028] S1. Data Preprocessing and Segmentation

[0029] In the method described in this invention, the raw power trading data collected and processed is a one-dimensional time series, which needs to be segmented by a sliding window and standardized to a format that can be input to the model. The method employs a sliding window segmentation approach to capture local time patterns from the continuous data stream, providing sufficient training samples for subsequent models. Specifically, for each continuous time series, a fixed window length L and step size S are defined. The original sequence is traversed by a window with a step size S and a length of L, thereby generating a series of time series segments. When the cybersecurity-related data is a univariate time series, that is... For example, if the present invention has a time series data that records the number of times a user operates per hour, and sets the window length L to 24 hours and the step size S to 1 hour, then it will sequentially extract segments of 24 hours in length from this time series, with each segment overlapping by 1 hour. These segments contain local information about the user's operating behavior in different time periods.

[0030] To eliminate differences in absolute values ​​across different time periods and allow the model to focus on learning the relative shape and trend of behavioral patterns, Z-score normalization is applied to each extracted time series segment x. The formula is as follows:

[0031] (1),

[0032] in It is a very small positive number, used to prevent division by zero. x represents a series of time series segments, which are normalized segments. Let x be the mean. Let x be the standard deviation.

[0033] This segment-by-segment normalization helps eliminate the impact of differences in absolute electricity consumption between different users or time periods, allowing the model to focus more on learning the relative shape and trends of user behavior patterns. Each processed segment The shape is To accommodate the input formats (batch size, sequence length, features) typically expected by deep learning models.

[0034] S2. Construct a self-supervised learning model based on the MoE architecture and use it for self-supervised learning to obtain deep embedding vectors.

[0035] S21. Constructing a self-supervised model for the MoE architecture.

[0036] As attached Figure 3 As shown, the MoE architecture consists of a gated network and multiple expert networks. An overview of the MoE-based integrated embedded architecture is as follows: Figure 2 As shown, five different deep learning architectures are used as expert networks, each specifically designed to capture different features of the time series:

[0037] TimeSeriesMLPEmbedder: As a baseline model, the Multilayer Perceptron (MLP) directly learns a nonlinear mapping from the input segment to the embedding vector through multiple fully connected layers. Input segment It is first flattened into a one-dimensional vector. Then, it passes through a series of linear layers and nonlinear activation functions.

[0038] (2),

[0039] (3),

[0040] The final output layer maps the last hidden layer to a... Dimensional Embedding MLPs can capture static nonlinear features.

[0041] in, For the k-th layer of a multilayer perceptron, Let be the weight matrix of the k-th layer of the multilayer perceptron. Let be the weight matrix of the k-th layer of the multilayer perceptron.

[0042] (2) TimeSeries LSTM Embedder: Long Short-Term Memory (LSTM) networks are recurrent neural networks, particularly well-suited for capturing sequential dependencies and long-term patterns in time series. This invention employs a bidirectional LSTM, enabling it to utilize information from both the past and future. Input Through a bidirectional LSTM layer. At each time step... LSTM calculates the forward hidden state and backward hidden state :

[0043] (4),

[0044] (5),

[0045] Connecting the forward and backward hidden states generates a bidirectional output. .

[0046] (6),

[0047] Finally, an adaptive average pooling and projection layer produces the embedding. .

[0048] in, Let t represent the forward cell state. The state of the cell at time t is the backward state.

[0049] (3) TimeSeries TCN Embedder: A fully convolutional network (TCN) utilizes causal convolution and dilated convolution to capture local patterns at different time scales. Input First, the sequence is transposed to fit the format of the convolutional layer (batch size, number of features, sequence length). The TCN consists of multiple stacked temporal block layers, each containing two dilated causal convolutional layers with weighted normalization and residual connections. For the input feature map... The output of an extended causal convolutional layer :

[0050] (7),

[0051] in It's the kernel size. It's the expansion rate. Residual connections ensure a stable information flow:

[0052] (8),

[0053] After multiple TCN blocks, the final output is Then, the embedding is obtained through adaptive average pooling and projection layers. .

[0054] in Let j be the weight parameter of the convolution kernel. For the input sequence F in The element value at that position, For the nth convolution operation, The input sequence F is downsampled, where i and j are natural numbers.

[0055] (4) TimeSeriesTransformerEmbedder: The Transformer model utilizes the Multi-Head Self-Attention (Michigan Head Start Association, MHSA) mechanism to capture global dependencies between any positions in the sequence. Input First, it is linearly projected to... Dimension. Then, the input sequence is passed through... There are several Transformer encoder layers. Each encoder layer consists of an MHSA and a feedforward Neural Network (FFN), supplemented by residual connections and layer normalization. Notably, positional encoding is added to the input embedding to preserve sequence order information. For the input of the encoder layer... :

[0056] (9),

[0057] (10)

[0058] (11),

[0059] After the encoder stack, the final output is Then, the embedding is obtained through adaptive average pooling and projection layers. .

[0060] in, The output after multi-head self-attention processing. For position encoding, This is the result of the first level of normalization. This is the result of the second level of normalization. This is a layer normalization operation.

[0061] (5) TimeSeries Mamba Embedder: The Mamba model combines the efficiency of the State Space Model (SSM) with the global receptive field of the Transformer. It achieves linear complexity modeling of long sequences through a selective state space model (selective SSM). Input Also linearly projected to Dimension, then input into Each Mamba block is composed of several Mamba blocks. The core of each Mamba block is a selection parameter dynamically generated based on the input, used to modulate the recursive operation of the SSM. A simplified Mamba block can be summarized as follows:

[0062] (12)

[0063] (13)

[0064] in Let be the hidden state at time t, the state transition matrix, and the input transition matrix, respectively. Based on the input... Dynamic changes For the input projection matrix, The output of the Mamba block at time t. This represents historical information at time t.

[0065] S22. Construct a gated network and combine the gated network with a hybrid expert model.

[0066] The method described in this invention provides a gated network that dynamically assigns weights to different experts for each input time series segment. The method employs a sparse hybrid expert model design, where each input segment is primarily composed of a few experts. This allows for individual expert processing, thereby improving computational efficiency.

[0067] The gated network receives a simplified representation of the original time series segment (e.g., through a small linear layer or a shallow multilayer perceptron), and then outputs the probability distribution of expert activations through a linear layer and a softmax function:

[0068] (14)

[0069] in It is a probability vector. It is the number of experts. This is for feature extraction operations.

[0070] To achieve sparsity, this invention uses a Top-K mechanism, selecting only the highest probability values. Each expert performs the calculations. The final hybrid expert model is embedded. These are The weighted sum of the outputs of each selected expert:

[0071] (15)

[0072] in It is the first One expert for input Extracted embeddings.

[0073] S23. Self-supervised training using a hybrid expert (MoE) model.

[0074] In the method described in this invention, after obtaining the above model, the preprocessed fragment is used. Self-supervised training is performed using a hybrid expert model. During training, in addition to the reconstruction loss, this invention introduces a load balancing loss to encourage the gating network to distribute tasks evenly among all experts, preventing some experts from being overused or completely idle, and ensuring that all experts are adequately trained.

[0075] Furthermore, in the method described in this invention, all hybrid expert (MoE) encoders are paired with a shared decoder. The decoder is a simple multilayer perceptron network with a receiving dimension of... MoE embedding and extend it back To reconstruct the original input segment The overall training loss function is:

[0076] (16)

[0077] in Mean square error, For load balancing losses It is the weighting coefficient for load balancing losses. This is the model's predicted output. This is the actual output of the model. This invention uses the Adam optimizer to jointly train the gating network, all expert encoders, and decoders.

[0078] S3. Unsupervised clustering of the deep embedding vectors obtained in S2 is performed using a clustering algorithm. The optimal number of clusters is determined by combining the elbow method and the silhouette coefficient method to form a user electricity trading profile.

[0079] After training the MoE encoder in a self-supervised manner and extracting the embedding vectors of all daily electricity segments, the method of this invention applies the classic K-means algorithm to high-dimensional embedding, and performs user profiling analysis through K-means clustering and k-value selection in order to automatically identify user groups with similar consumption behaviors.

[0080] K-means is a partition-based iterative clustering method that aims to assign N data points into k clusters such that the sum of the squared distances from each cluster to its centroid is minimized. By alternately updating the data point assignments and recalculating the centroids, K-means converges to K compact and well-separated clusters. Each resulting cluster is interpreted as a unique user electricity consumption profile.

[0081] One prerequisite for selecting the optimal k value is that the number of clusters K is specified in advance. To select a suitable k value that best reflects the inherent structure of the data, the method described in this invention employs two complementary and widely accepted evaluation strategies:

[0082] Elbow method: This invention calculates The inertia values ​​for each cluster were calculated, and the resulting curves were plotted. Generally, the inertia monotonically decreases as k increases. The optimal k was determined as the "elbow" point—the point where the curve transitions from a sharp drop to a more gradual drop—representing the trade-off between model complexity and fit quality.

[0083] Silhouette coefficient method: As a more comprehensive evaluation method, the silhouette coefficient considers both the compactness within clusters and the separability between clusters. The method described in this invention calculates the average silhouette coefficient score for all data points at each k value and selects the k value that maximizes this score. A higher silhouette coefficient indicates a clearer cluster definition and more defined boundaries between different profiles.

[0084] By integrating the insights from these two approaches, the method described in this invention provides a data-driven and interpretable foundation for determining the number of user profiles to use in subsequent visualizations and analyses.

[0085] S4. Visualize and perform feature analysis on the user profiles of each cluster obtained in S3.

[0086] To achieve interpretability and compare the security features of each discovered cluster, this invention designs a two-level visualization and feature analysis strategy.

[0087] (1) Visualization of Daily Average Curves For each cluster, this invention summarizes all raw (unnormalized) daily load segments assigned to that cluster and calculates the average 24-hour transaction curve. These average curves intuitively and directly interpret each user profile, revealing the temporal rhythm of electricity consumption—such as peak and off-peak periods or overall load intensity. This lays the foundation for qualitative naming and preliminary classification of each profile.

[0088] (2) Multidimensional Feature Engineering and Radar Chart Analysis To support more structured and quantitative comparisons of different profiles, this invention extracts eight high-level behavioral features from the average load curve of each cluster. These features capture different aspects of electricity consumption patterns:

[0089] • Total transaction volume: Total daily energy consumption.

[0090] • Time characteristics: Peak hours (hours with the highest usage).

[0091] • Ratio-based characteristics: nighttime to daytime ratio, morning-evening dominance, and off-peak period proportion.

[0092] • Shape-based characteristics: morning rise slope (the rate of increase during the early morning hours) and evening peak sharpness (the steepness of the evening peak electricity consumption).

[0093] • Stability characteristics: Daytime volatility (electricity consumption fluctuations between 9 a.m. and 5 p.m.).

[0094] After normalization, as shown in the appendix. Figure 4 As shown, these features are visualized using a radar chart when k = 2. Each user profile is presented as a polygonal "fingerprint" with different scores on each axis. This visualization significantly facilitates lateral comparison of subtle differences between different profiles and provides a strong quantitative basis for further qualitative interpretation. Based on this quantitative basis, unique security features are extracted and matched with different types of user profiles to obtain security feature profiles of different behavioral patterns, thereby constructing a security feature profile library.

[0095] S5. Based on the categorized user profile data obtained in S4, perform behavioral pattern analysis on the input user data to identify its security characteristics.

[0096] In the method described in this invention, a pre-constructed hybrid expert model (MoE) and a security feature profiling library are used to automatically identify target user data to match the security features of their behavioral patterns. The specific steps are as follows:

[0097] S51. Input Preprocessing and Deep Feature Extraction

[0098] In the method described in this invention, the original electricity transaction time series data of the user whose behavior pattern is to be analyzed is processed by the same preprocessing and segmentation method as in S1, that is: the continuous time series is segmented by using the same sliding window (Window Length L) and step size (Stride S) to generate fixed-length segments; and each segment is subjected to the same Z-score normalization processing, and the calculation formula is the same as (1).

[0099] The preprocessed, standardized time-series segments are input into a converged encoder model based on the MoE architecture, which has been trained and finalized in S2 under self-supervised conditions. The parameters of the gating and expert networks in this MoE model are frozen and will not be updated during training. The MoE model performs forward computation on the input segments, with the gating network dynamically selecting the most suitable combination of experts, ultimately outputting a low-dimensional and dense deep embedding vector that comprehensively represents the behavioral patterns of the segment. This embedding vector captures the essential security temporal features of the input segments.

[0100] S52, Security Feature Profile Probability Matching

[0101] The deep embedding vector obtained in S51 is input into a pre-trained security feature classifier. This classifier is constructed based on the user security feature profile library (i.e., K cluster centers and their represented security behavior pattern categories) formed in S3 and S4. In the method described in this invention, the classifier is a bidirectional long short-term memory-convolutional-attention neural network.

[0102] Furthermore, the Bi-LSTM-CNN-Attention network consists of two bidirectional long short-term memory layers, one convolutional layer, and one multi-head attention layer;

[0103] Furthermore, in the Bi-LSTM-CNN-Attention network, the bidirectional long short-term memory layer includes 256 hidden units, the convolutional layer includes 128 hidden units, and the multi-head attention layer includes 8 attention heads.

[0104] Classifier Training: In the offline phase, all deep embedding vectors obtained after S3 clustering and their corresponding cluster labels (i.e., the cluster ID assigned to each embedding vector) are used as the training dataset to perform supervised training on the Bi-LSTM-CNN-Attention network. The training objective of the network is to learn the mapping relationship from the embedding vectors to K security profile categories. The introduction of the attention mechanism helps the network focus on the most critical feature dimensions in the embedding vectors that distinguish different security categories.

[0105] Online Inference: In online applications, the trained Bi-LSTM-CNN-Attention network receives new embedding vectors and outputs a probability distribution vector of dimension K. ,in This represents the confidence probability that the input user behavior segment belongs to the k-th security feature profile (i.e., the typical behavior pattern represented by the k-th cluster), and .

[0106] S53. Safety Feature Determination and Output

[0107] Based on the probability distribution vector P obtained in S5.3, the security profile category with the highest probability value is selected as the final security feature recognition result for the input segment.

[0108] Therefore, this invention, through the dual drive of multi-expert model integration and self-supervised learning, ensures the comprehensive capture and accurate representation of complex power safety behavior patterns. It can effectively mine deep risk features in massive unlabeled data and adaptively assign appropriate modeling experts to diverse power consumption patterns, thereby significantly improving the discriminative power, robustness, and interpretability of user safety feature profiles, and providing core support for building a highly reliable smart grid safety monitoring system.

Claims

1. A user security feature recognition method based on behavior pattern analysis, characterized by, The method comprises the following steps: S1: preprocessing and segmentation of original electricity transaction time series data; S2: constructing a self-supervised learning model based on the MoE architecture and performing self-supervised learning with the model to obtain a deep embedding vector; The expert network in S2 comprises a multilayer perceptron, a long short-term memory network, a time convolution network, a transformer, and a Mamba, each of which corresponds to capturing static nonlinear features, long-term dependencies, local multi-scale patterns, global dependencies, and long-sequence efficient modeling features of the time series; The working mechanism of the gating network in S2 is: after feature extraction on the input time series segment, the weight distribution of the expert network is output through a linear layer and a Softmax function, the Top-K mechanism is used to select the K expert networks with the highest weights to participate in the calculation, and finally the embedding vector is the weighted sum of the outputs of the selected experts ， in The j-th expert is the input. Extracted embeddings; That is, j belongs to the category of numerical notation The first k largest values; The gating network is used as the input for the j-th expert. The assigned weights; S3: unsupervised clustering of the deep embedding vector obtained in S2 using a clustering algorithm; S4: visualizing and analyzing the features of each user portrait; S5: performing security feature recognition on the input user data according to the user portrait data; The behavior pattern analysis in S5 comprises: S51: input preprocessing and deep feature extraction; S52: security feature portrait probability matching: The trained Bi-LSTM-CNN-Attention network receives a new embedding vector and outputs a probability distribution vector of dimension K wherein represents the confidence probability that the inputted user behavior snippet belongs to the typical behavior pattern represented by the kth security feature portrait, i.e., the kth cluster, and ; S53: security feature judgment and output: According to the probability distribution vector P obtained in S53, the security portrait class with the highest probability value is selected as the final security feature recognition result of the input user behavior segment.

2. The method of claim 1, wherein, The preprocessing and segmentation in S1 comprise: segmenting continuous time series using a sliding window to generate fixed-length segments; and performing Z-score normalization on each segment, and the normalization calculation formula is: ， wherein, is a very small positive number to prevent division by zero, x is a series of time series segments, is a normalized segment, is the mean of x, is the standard deviation of x.

3. The method of claim 1, wherein, In S2, a self-supervised learning model based on the MoE architecture is constructed, and the model is used for self-supervised learning. The method trains the MoE model through a self-supervised task of time series reconstruction. The MoE model comprises a gating network and a plurality of expert networks. The expert networks adopt a plurality of complementary time series deep learning models. The MoE model is trained through the self-supervised task, so that the gating network dynamically allocates weights to the expert networks according to the input segment features, and outputs a deep embedding vector of the electricity transaction mode. The specific steps are as follows: S21: constructing a self-supervised model based on the MoE architecture; S22: constructing a gating network and combining the gating network with a hybrid expert model; S23: using the MoE model for self-supervised training.

4. The method of claim 1, wherein, The self-supervised training in S2 adopts a mean square error loss function and a load balancing loss function, and the total loss is: wherein is the mean square error, is the load balancing loss, is the predicted output of the model, is the weight coefficient of the load balancing loss.

5. The method of claim 1, wherein, The clustering algorithm in S3 is the K-means algorithm. The optimal clustering number k is determined by calculating the inertia value and the average silhouette coefficient under different clustering numbers.

6. The method of claim 1, wherein, The multi-dimensional features in S4 include total transaction volume, peak time, night-to-day ratio, morning and evening dominance, off-peak period ratio, morning rising slope, evening peak sharpness, and daytime volatility. The feature differences of different user portraits are visualized through a radar chart.

7. The method of claim 1, wherein, The Bi-LSTM-CNN-Attention network used in S52 is composed of 2 bidirectional long short-term memory layers, 1 convolution layer, and 1 multi-head attention layer. The bidirectional long short-term memory layer includes 256 hidden units, the convolution layer includes 128 hidden units, and the multi-head attention layer includes 8 attention heads.

Images