Electric energy meter data security hidden danger analysis method and system

Abstract

The application discloses a kind of electric energy meter data security hidden danger analysis method and system, it is related to electric energy meter abnormal analysis field, it is first by to original intelligent electric energy meter data stream is preprocessed, obtains high-quality power time series. Then, by high power event identification, continuous power consumption data is decomposed into discrete, meaningful appliance operation event. Key is to the high power event identified is extracted and classified with light appliance type feature, and specific appliance type is quickly and accurately identified. Finally, based on appliance type label and current time context, retrieve corresponding normal behavior portrait from historical behavior database, and compare with current high power event. This can accurately identify the hidden security risks that power may be normal but running time or running mode is abnormal, so as to realize the intelligent and accurate early warning of abnormal operation of appliance equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electric energy meter anomaly analysis, and more specifically, to an electric energy meter data security risk analysis method and system. BACKGROUND

[0002] With the rapid development and popularization of smart grids, smart meters, as an important interface between the power grid and users, their data security and reliability are increasingly concerned. Smart meters not only record user electricity consumption, but also carry rich user behavior data. Once these data are maliciously used or abnormal, it may lead to user privacy leakage, electricity theft, power grid instability, and even serious consequences such as safety accidents. Therefore, building an efficient and accurate electric energy meter data security risk analysis scheme is crucial for ensuring the safe and stable operation of the power system and the legitimate rights and interests of users.

[0003] However, current methods for analyzing electric energy meter data security risks still have many challenges. Traditional electric energy meter data analysis focuses on electricity consumption statistics and abnormal electricity consumption pattern recognition, often failing to deeply mine the running state of electrical equipment and potential security risks behind the data. For example, simple power threshold alarms may result in a large number of false positives, making it difficult to distinguish between normal high-power electrical equipment startup and abnormal long-term operation. Moreover, the lack of understanding of electrical equipment types and user behavior context also greatly reduces the accuracy of abnormality judgment. In addition, existing methods often face problems such as high computational resource consumption and poor real-time performance when dealing with massive and high-frequency smart meter data, making it difficult to meet the needs of practical applications. These shortcomings make existing solutions inadequate in identifying deep-seated security risks such as illegal tampering of electrical equipment, malicious software attacks leading to abnormal operation of electrical equipment, and even using electrical equipment for illegal activities.

[0004] To overcome the limitations of existing technologies, the present solution proposes a more refined electric energy meter data security risk analysis method. SUMMARY

[0005] In view of the above limitations of existing methods, according to an aspect of the present application, an electric energy meter data security risk analysis method is provided, which comprises:

[0006] obtaining an original smart meter data stream;

[0007] preprocessing the original smart meter data stream to obtain a preprocessed power time series;

[0008] performing high-power event identification on the preprocessed power time series to obtain a high-power event.

[0009] performing lightweight electrical equipment type feature extraction and classification on the high-power event to obtain an electrical equipment type label of the high-power event.

[0010] Based on the appliance type label and the current time context of the high-power event, a corresponding normal behavior profile is retrieved from a historical behavior database, the normal behavior profile containing a typical power range and a typical runtime distribution of the appliance in the context.

[0011] Based on the comparison between the high-power event and the normal behavior profile, it is determined whether the appliance device has abnormal operation.

[0012] According to another aspect of the present application, a power meter data security risk analysis system is provided, comprising:

[0013] An original smart meter data stream acquisition module is configured to acquire an original smart meter data stream.

[0014] An original smart meter data stream preprocessing module is configured to preprocess the original smart meter data stream to obtain a preprocessed power time sequence.

[0015] A high-power event identification module is configured to identify high-power events from the preprocessed power time sequence.

[0016] An appliance type label generation module is configured to extract and classify light appliance type features of the high-power events to obtain appliance type labels of the high-power events.

[0017] A normal behavior profile retrieval module is configured to retrieve a corresponding normal behavior profile from a historical behavior database based on the appliance type label and the current time context of the high-power event, the normal behavior profile containing a typical power range and a typical runtime distribution of the appliance in the context.

[0018] An abnormal operation determination module is configured to determine whether the appliance device has abnormal operation based on the comparison between the high-power event and the normal behavior profile.

[0019] Compared with the prior art, the electric energy meter data security risk analysis method and system provided by the application firstly pre-processes the original smart electric meter data stream to obtain high-quality power time series, solving the problems of data noise and abnormal value interference. Then, through high-power event identification, continuous power consumption data is decomposed into discrete and meaningful electric appliance operation events, focusing on analysis and avoiding blind processing of full data, improving efficiency. The key is to extract and classify the light-weight electric appliance type features of the identified high-power events, quickly and accurately identify the specific electric appliance type, and solve the problem that traditional methods cannot distinguish different electric appliance abnormalities. Finally, based on the electric appliance type label and the current time context, the corresponding normal behavior portrait (including typical power and running time) is retrieved from the historical behavior database and compared with the current high-power event. This abnormality judgment mechanism based on the normal behavior portrait can accurately identify hidden security risks with normal power but abnormal running time or running mode, thereby effectively reducing the false positive rate, realizing intelligent and accurate early warning of abnormal operation of electric appliance equipment, and making up for the deficiencies of the prior art in fine analysis and abnormality judgment. BRIEF DESCRIPTION OF DRAWINGS

[0020] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description of embodiments of the present application taken in conjunction with the accompanying drawings. The drawings provided in the specification and the embodiments of the present application together serve to provide a further understanding that enables others skilled in the art to make or use the present application. The drawings provided are for illustrative purposes and are not intended to limit the present application thereto. In the drawings, the same reference numerals generally refer to the same components or steps throughout the drawings.

[0021] Figure 1 A flowchart of the electric energy meter data security risk analysis method according to the embodiments of the present application.

[0022] Figure 2 A data flow schematic diagram of the electric energy meter data security risk analysis method according to the embodiments of the present application.

[0023] Figure 3 A flowchart of step S2 in the electric energy meter data security risk analysis method according to the embodiments of the present application.

[0024] Figure 4 A flowchart of step S3 in the electric energy meter data security risk analysis method according to the embodiments of the present application.

[0025] Figure 5 A flowchart of step S6 in the electric energy meter data security risk analysis method according to the embodiments of the present application.

[0026] Figure 6 A block diagram of the electric energy meter data security risk analysis system according to the embodiments of the present application. DETAILED DESCRIPTION

[0027] Embodiments of the present disclosure will be described in more detail with reference to the drawings. While certain embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be interpreted as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly and completely understood.

[0028] To solve the problems in the background art, the present application provides an electric energy meter data security risk analysis method. Figure 1 A flowchart of the electric energy meter data security risk analysis method according to an embodiment of the present application. Figure 2 A data flow diagram of the electric energy meter data security risk analysis method according to an embodiment of the present application. As shown in Figure 1 and Figure 2 As shown in the electric energy meter data security risk analysis method according to an embodiment of the present application, it includes: S1, obtaining an original smart meter data stream; S2, preprocessing the original smart meter data stream to obtain a preprocessed power time sequence; S3, performing high-power event identification on the preprocessed power time sequence to obtain a high-power event; S4, performing lightweight appliance type feature extraction and classification on the high-power event to obtain an appliance type label of the high-power event; S5, based on the appliance type label and the current time context of the high-power event, retrieving a corresponding normal behavior portrait from a historical behavior database, the normal behavior portrait containing a typical power range and a typical running time distribution of the appliance in this context; S6, based on the comparison between the high-power event and the normal behavior portrait, determining whether the appliance device is abnormally running.

[0029] In step S1, the original smart meter data stream is obtained. It should be understood that the smart meter is the source of user electricity data, and all subsequent security risk analysis is based on these original data. Obtaining the original data stream is the starting point of the entire analysis process, which ensures the comprehensiveness and timeliness of the analysis. Only continuous and real-time original data can be obtained, and the electricity consumption behavior pattern can be extracted therefrom, and then the potential abnormality and security risk can be identified. If the data cannot be obtained or is incomplete and not timely, the subsequent preprocessing, event identification and abnormality judgment will lose the basis, resulting in unreliable or even incorrect analysis results, which cannot effectively protect the safety of the power system and the rights and interests of the users.

[0030] Specifically, one possible implementation of step S1 is as follows: The raw smart meter data stream is acquired by establishing a connection with the smart meter communication module or data acquisition gateway. For example, the smart meter uploads the collected real-time power data to the data acquisition gateway via power line carrier communication (PLC) or wireless communication, such as GPRS or NB-IoT. This gateway is responsible for aggregating data from multiple meters and transmitting the data to a data center or cloud platform via fiber optic or Ethernet. In the data center, a dedicated data receiving service is deployed. This service continuously listens for data from the gateway's data port. Once a data packet is received, it is parsed and stored in a raw data repository, such as a time-series database like InfluxDB or a message queue like Kafka. The data packet contains information such as timestamps, user IDs, instantaneous power values, voltage, and current.

[0031] In step S2, the original smart meter data stream is preprocessed to obtain a preprocessed power time series. It is understood that the original smart meter data stream often has many problems, such as missing data, outliers due to transmission errors, sensor noise, and inconsistent sampling frequencies. If these problems are not addressed, they will seriously affect the accuracy of subsequent high-power event identification and appliance type classification, leading to misjudgments or missed detections of safety hazards. For example, missing data may prevent the complete capture of appliance operating cycles, outliers may be misjudged as high-power events, and noise may interfere with the identification of normal power patterns. Therefore, this application improves data quality through preprocessing, making it more suitable for subsequent refined analysis, ensuring the reliability and effectiveness of the analysis results, and thus more accurately identifying potential safety risks.

[0032] Specifically, in one particular embodiment of this application, Figure 3 This is a flowchart of step S2 in the method for analyzing security risks of electricity meter data according to an embodiment of this application. Figure 3 As shown, step S2, which preprocesses the original smart meter data stream to obtain a preprocessed power time series, includes: S21, verifying the data integrity of the original smart meter data stream and removing obvious outliers; S22, applying a filter to filter the original smart meter data stream to obtain a filtered smart meter data stream; and S23, resampling the filtered smart meter data stream to a uniform analysis time granularity and calculating the mean and standard deviation of power within each analysis time granularity to obtain the preprocessed power time series.

[0033] Specifically, one implementation of step S2 is as follows: first, perform S21. The data receiving service performs preliminary checking on each record in the original data stream. First, perform integrity checking to ensure that each record contains necessary fields such as timestamp, user ID, and power value, and mark as invalid record if missing. Then, perform reasonability range checking on the power value to remove obvious outliers. For example, set the upper limit of the power value to 20000 watts, corresponding to the maximum load of an ordinary family, and the lower limit to 0 watts, and the power value should not be negative. Any power value outside this range, such as -500 watts or 30000 watts, is considered to be an obvious outlier and is removed. In addition, statistical methods such as sliding window median or interquartile range (IQR) can also be used to identify and remove isolated outliers that deviate significantly from surrounding data points in a short period of time. For example, for 10 seconds of continuous power data, if the power value of a point deviates from the median of the other 9 points in the window by more than 3 times the standard deviation, it is considered to be an outlier. After this step, the preliminary cleaned smart meter data stream is obtained.

[0034] Then, perform S22. After removing obvious outliers, in order to further eliminate sensor noise and transient fluctuations, a low-pass filter is applied to the preliminary cleaned data stream. Common filters include moving average filter or exponential weighted moving average filter. For example, a 5-point moving average filter is used, i.e. the filtered power value of the current point is the average of the power values of the current point and its previous 4 points. For the power value P(t) with timestamp t, the formula for calculating the filtered power value P'(t) is: P'(t)=(P(t)+P(t-1)+P(t-2)+P(t-3)+P(t-4)) / 5. In this way, the data curve can be smoothed, the interference of high-frequency noise on subsequent analysis can be reduced, and the power change trend can be made clearer.

[0035] Then, step S23 is performed. In particular, in one embodiment of the present application, the analysis time granularity is 1 minute. It is worth mentioning that the 1-minute granularity can effectively capture the key power change characteristics such as the start, operation and shutdown of most household appliances (such as air conditioners, water heaters, microwaves, etc.), avoiding the loss of details that may be caused by a coarse granularity (such as hours), so as to identify short-time high-power events. In addition, compared with a super-high granularity of seconds or milliseconds, the 1-minute granularity significantly reduces the data volume, thereby greatly reducing the computational overhead of data storage, transmission and processing, improving the real-time and efficiency of analysis, and making it more suitable for deployment in large-scale user scenarios. This granularity selection balances the system performance and resource consumption while ensuring analysis accuracy, achieving a balance between practicality and effectiveness. Specifically, for example, the sampling frequency of the original data stream is 1 time per second, and the preset analysis time granularity is 1 minute. The system aggregates all filtered power data points in each minute. For each 1-minute time window, for example, from 10:00:00 to 10:00:59, the arithmetic mean of all power values in the window is calculated as the average power of the minute, and the standard deviation of the power values is calculated. For example, in the minute from 10:00:00 to 10:00:59, if there are 60 filtered power data points, the average power and standard deviation of the 60 points are calculated. Finally, the output preprocessed power time series will be one record per minute, including the timestamp, the average power and the standard deviation of the minute.

[0036] In step S3, the preprocessed power time series is subjected to high-power event identification to obtain high-power events. It should be understood that although the preprocessed power time series has improved quality, it is still a continuous data stream containing a large amount of low-power background noise. Directly performing appliance type identification and anomaly judgment on the entire sequence is computationally intensive and inefficient. Therefore, in order to accurately cut out those power consumption events caused by the start and operation of high-power appliances from the continuous power data, which have clear physical meaning. These events correspond to potential safety hazards, for example, long-time operation of high-power appliances may cause overheating. The present application needs to perform high-power event identification, that is, by focusing on these high-power events, the interference of daily low-power power consumption can be effectively filtered out, the data volume of subsequent analysis can be greatly reduced, and the relevance and efficiency of analysis can be improved, so that safety risks related to high-power appliances can be found more quickly and accurately.

[0037] Specifically, in one embodiment of the present application, Figure 4 The flowchart for step S3 of the electric energy meter data safety hazard analysis method according to the embodiment of the present application. As shown in FIG. 3, the high-power event identification process includes the following steps: Figure 4As shown, step S3, high-power event identification is performed on the pre-processed power time series to obtain high-power events, including: S31, setting a basic power threshold; S32, identifying a time period in the pre-processed power time series that continuously exceeds the basic power threshold as the high-power event.

[0038] Specifically, one implementation of step S3 is as follows: first, perform S31. The setting of the basic power threshold is the key to identifying high-power events. This threshold is empirically set according to the actual power usage habits of the household or specific scenarios and the power characteristics of common electrical appliances, aiming to distinguish between background power usage (such as standby power consumption, low-power electrical appliances) and the startup of high-power electrical appliances (such as air conditioners, water heaters, induction cookers, ovens, etc.). For example, for ordinary household users, the basic power threshold can be set to 1000 watts. This value is higher than the sum of small-power electrical appliances such as lighting, televisions, and refrigerators, but lower than the startup power of most high-power electrical appliances. This threshold can be dynamically adjusted according to user historical power usage data, for example, by analyzing the power distribution histogram of user historical power usage data, selecting an inflection point that can effectively distinguish between high and low power segments as the threshold.

[0039] Afterwards, S32 is performed. For example, the pre-processed power time series can be: [{"timestamp": "2023-10-27 10:00", "average power": 850.2, "power standard deviation": 50.1}, {"timestamp": "2023-10-27 10:01", "average power": 2500.0, "power standard deviation": 100.0}, {"timestamp": "2023-10-27 10:02", "average power": 2450.0, "power standard deviation": 90.0}, {"timestamp": "2023-10-27 10:03", "average power": 700.0, "power standard deviation": 40.0}, {"timestamp": "2023-10-27 10:04", "average power": 1800.0, "power standard deviation": 70.0}], which is only an example. First, a minute-by-minute scan is performed on the pre-processed power time series to identify time periods where the power exceeds the above base power threshold continuously. The specific process is as follows: a high power event list is maintained to store the identified events, and a current event start time variable is used to track the starting point of the high power event being formed. When the system traverses to a record, if its average power is greater than or equal to the set 1000 watt threshold and the current event start time is empty, it means that a new high power event starts, at which time the timestamp of the current record is recorded as the current event start time. If the average power of the current record is less than 1000 watts, but the current event start time is not empty, it indicates that the high power event being conducted has ended, and the system will encapsulate the current event start time and the timestamp of the previous minute of the current record as an end time into a high power event object and add it to the high power event list, and then reset the current event start time to empty. For example, in the above data, when the system processes to 2023-10-27 10:03, it finds that the average power is 700 watts, which is lower than the 1000 watt threshold, and the current event start time is 2023-10-27 10:01, so a high power event from 2023-10-27 10:01 to 2023-10-27 10:02 is identified. After traversal, if the current event start time is still not empty, the last high power event is extended to the end of the sequence.Finally, the output is a series of structured high-power events, each containing its explicit start time, end time, and corresponding power data segment during that period, for example: {"start_time": "2023-10-27 10:01", "end_time": "2023-10-27 10:02", "power_data_segments": [{"timestamp": "2023-10-27 10:01", "average_power": 2500.0, "power_std_dev": 100.0}, {"timestamp": "2023-10-27 10:02", "average_power": 2450.0, "power_std_dev": 90.0}]}.

[0040] In step S4, lightweight appliance type feature extraction and classification are performed on the high-power events to obtain appliance type labels of the high-power events. Accordingly, merely identifying high-power events is insufficient to determine whether they are abnormal or have safety hazards. Different electrical appliances, even if the power is similar, have completely different normal operation modes, duration, and power fluctuation characteristics. For example, short-term high-power operation of an electric water heater is normal, while long-term high-power operation of an air conditioner may indicate an abnormality. If the appliance type is not distinguished, it will result in a large number of false positives or false negatives. Therefore, by classifying the high-power events by appliance type, the present application can provide key context information for subsequent abnormality judgment, making the judgment more targeted and accurate. In particular, through lightweight feature extraction and classification, the recognition accuracy and computational efficiency are considered, avoiding the problems of large resource consumption and poor real-time performance caused by traditional complex models, thereby meeting the demand for fast response in actual applications.

[0041] Specifically, in one specific embodiment of the present application, step S4, lightweight appliance type feature extraction and classification are performed on the high-power events to obtain appliance type labels of the high-power events, including: S41, inputting the high-power events into a power time series encoder based on an LSTM model to obtain an appliance power time series mode feature encoding vector; S42, inputting the appliance power time series mode feature encoding vector into a lightweight classifier to obtain the appliance type label of the high-power event.

[0042] Specifically, one implementation of step S4 is as follows: first, S41 is performed. This step is to use an LSTM model as a power time series encoder. Long short-term memory network is a special recurrent neural network that is particularly good at processing and learning long-term dependencies in sequential data, which makes it very suitable for capturing complex dynamic patterns in appliance power time series. The specific architecture of this encoder can be a single-layer or multi-layer long short-term memory network. For example, a single-layer long short-term memory network can be used, whose input layer receives the power data segment of the high-power event, i.e. a series of average power values, the hidden layer contains, for example, 64 long short-term memory units, and the output layer is a fully connected layer that maps the final hidden state of the long short-term memory network to a fixed-dimensional feature vector. In particular, the encoder is trained by a large amount of high-power event data of known appliance types. The training data includes typical power curves of various appliances, such as the power changes of air conditioner startup, running, and shutdown, the power curve of the heating process of a water heater, etc. The training goal is to enable the encoder to map power time series of similar appliance types to vectors close to each other in the feature space, while sequences of different appliance types are mapped to vectors far apart. The encoder is trained by minimizing the reconstruction error or loss function combined with the classification task, and the internal weights and bias parameters are automatically learned by the backpropagation algorithm and optimizer to capture the essential features of the power time series. After training, for the input high-power event described above, the encoder will output a numerical vector of, for example, 128 dimensions. This vector is the appliance power time series pattern feature encoding vector of the high-power event.

[0043] After that, S42 is executed. It is worth mentioning that the lightweight classifier refers to a model with low computational complexity and small parameter quantity to meet the requirements of real-time and resource consumption. Common lightweight classifiers include support vector machines, logistic regression, decision trees, or small multi-layer perceptrons. For example, a multi-layer perceptron with two fully connected layers can be used as a lightweight classifier. The first layer receives a 128-dimensional feature encoding vector, contains, for example, 64 neurons, and the activation function is the rectified linear unit (ReLU). The second layer is the output layer, and the number of neurons is equal to the number of preset appliance types, for example, 5 types of air conditioners, water heaters, microwaves, induction cookers, and washing machines, and the activation function is Softmax, which is used to output the probability distribution of each appliance type. The classifier is trained in the training stage in cooperation with or independently of the power time sequence encoder. It uses a large number of feature encoding vectors with explicit appliance type labels for supervised learning. By minimizing the classification error, the weight and bias parameters of the classifier are adjusted through optimization algorithms such as gradient descent, so that it can accurately map the feature vector to the corresponding appliance type label. For example, after the appliance device power time sequence mode feature encoding vector is input into the lightweight classifier, the classifier will calculate the probability of the vector belonging to each appliance type. For example, the probability distribution output by the classifier is: air conditioner (0.92), water heater (0.03), microwave (0.01), induction cooker (0.02), and washing machine (0.02). The system will select the type with the highest probability as the final appliance type label. In this example, the high-power event will be labeled as an air conditioner. Finally, the output is the appliance type label of the high-power event, for example: air conditioner.

[0044] It should be noted that for high-power events, there are usually actual scenarios where large-power appliances and small-power appliances work in parallel, so the parallel work of large-power appliances and small-power appliances will cause multiple load type parallelism in determining the appliance type label of the lightweight classifier. Therefore, when the power time sequence distribution determined based on the power value exceeding the basic power threshold in the power event sequence is used for short-range and long-range bidirectional context time sequence association to obtain the appliance device power time sequence mode feature encoding vector, the power time sequence encoder based on the LSTM model and the lightweight classifier will have a feature-label-based load type deviation, thereby affecting the accuracy of determining the appliance type.

[0045] Therefore, for the appliance device power time sequence mode feature encoding vector, load type matching balance can be performed in the time sequence association feature expression mode by introducing a power time sequence trajectory analysis based on physical boundaries.

[0046] Therefore, preferably, in another specific embodiment of the present application, the step S42 of inputting the appliance power time-series pattern feature encoding vector into the lightweight classifier to obtain the appliance type label of the high-power event comprises: performing transient trajectory representation and power feature trajectory definition on each feature value in the appliance power time-series pattern feature encoding vector to obtain an appliance power time-series pattern feature trajectory definition encoding vector based on the maximum feature value of the appliance power time-series pattern feature encoding vector; performing label physical boundary weighted association on each feature value in the appliance power time-series pattern feature trajectory definition encoding vector to obtain an appliance power time-series pattern balance feature encoding vector; and inputting the appliance power time-series pattern balance feature encoding vector into the lightweight classifier to obtain the appliance type label of the high-power event.

[0047] Specifically, first, the maximum feature value of the appliance power time-series pattern feature encoding vector is determined as a power feature peak value, and each feature value is divided by to obtain transient trajectory representation, that is, transient working trajectory is expressed based on time-series associated features by the constraint of instantaneous power peak value, so that the trajectory can be essentially represented as a special physical boundary in feature distribution. Moreover, in order to associate with the class label boundary when the classifier works, the boundary threshold is set by and so as to position the boundary of the power trajectory feature in the class label expression space of the classifier, and then the power feature trajectory definition can be performed by the positioned boundary, that is:

[0048]

[0049] wherein, is each feature value in the appliance power time-series pattern feature encoding vector, is the maximum feature value in the appliance power time-series pattern feature encoding vector, is an exponential function value with a natural constant e as the base, is each feature value in the appliance power time-series pattern feature trajectory definition encoding vector;

[0050] Further, for the label physical boundary matching degree problem, the label physical boundary weighted association is performed and acts on the power trajectory feature, that is:

[0051]

[0052]

[0053] wherein, and respectively The corresponding weight parameters are automatically learned and adjusted by optimization algorithms during the model training process, for example is 0.7, is 0.3, is The corresponding label physical boundary correlation factor, is each feature value in the electrical equipment power time sequence mode balance feature encoding vector;

[0054] In this way, the time sequence power trajectory features can be analyzed based on the matched physical boundary, so that the electrical equipment power time sequence mode feature encoding vector can be matched and balanced based on the time sequence correlation feature expression mode on the basis of physical boundary power time sequence positioning, thereby improving the determination accuracy of the electrical appliance type.

[0055] Then, based on the balanced electrical equipment power time sequence mode balance feature encoding vector, classification processing is performed to eliminate the scenario where high-power electrical appliances and low-power electrical appliances run in parallel, thereby significantly improving the accuracy of electrical appliance type determination. In particular, the implementation process of the classification is the same as that of the above embodiment.

[0056] In step S5, based on the electrical appliance type label and the current time context of the high-power event, the corresponding normal behavior portrait is retrieved from the historical behavior database, which contains the typical power range and typical running time distribution of this type of electrical appliance in this context. It should be understood that only identifying the electrical appliance type is not enough to accurately determine whether it is running abnormally. The normal behavior patterns of the same type of electrical appliance under different times and different contexts are different. For example, it may be normal for an air conditioner to run for a long time during the day in summer, but it may be abnormal to run for a long time at night in winter; a microwave oven usually only runs for a short time, and if it runs for a long time at high power, it is likely to be abnormal. Without such a normal behavior reference based on time context, the abnormality judgment will have poor generalization and high false positive rate. Therefore, in the technical solution of the present application, by retrieving the normal behavior portrait that accurately matches the current electrical appliance type and time context, a refined benchmark can be provided for subsequent abnormal score calculation, thereby achieving more intelligent and accurate abnormality identification, effectively reducing false positives and improving the ability to discover deep-seated safety hazards.

[0057] Specifically, one implementation of step S5 is as follows: the historical behavior database stores typical running patterns of a large number of different types of electrical appliances in various time contexts. It is worth mentioning that the construction of the historical behavior database is a key link, which is a structured data storage containing a large amount of real user power consumption data after cleaning, aggregation and statistical analysis. For each type of electrical appliance, the database stores its corresponding normal behavior portrait according to different time contexts, such as time of day, day of week, season of year, etc. For example, for the type of air conditioner, its normal behavior portrait can be divided into: in the context of summer daytime 08:00-18:00, Monday to Sunday, its typical power range can be set to 2000-3500 watts, the typical running time distribution is average 3 hours, standard deviation 1 hour, and the longest does not exceed 8 hours; while in the context of winter night 18:00-08:00 the next day, Monday to Sunday, its typical power range can be 1800-3000 watts, and the typical running time distribution is average 6 hours, standard deviation 2 hours, and the longest does not exceed 12 hours. These typical power ranges and typical running time distributions are obtained by statistical analysis of a large number of historical normal power consumption data, such as calculating mean, standard deviation, quantile, maximum value, etc. For example, the typical power range can be set as the interval in which 95% of the normal power values in the historical data are located.

[0058] During the retrieval process, the system first extracts two key information from the input high-power event: one is its appliance type label, e.g. air conditioner; the other is its current time context, which needs to be parsed from the start time of the high-power event, e.g. for 2023-10-27 10:01, the date: 2023-10-27, day of the week: Friday, time period: 10:00-11:00 AM or even more coarse-grained day time can be parsed. Subsequently, the system will use the extracted appliance type label and current time context as query conditions to conduct an exact match retrieval in the historical behavior database. For example, for the above input high-power event, its appliance type is air conditioner and the start time is 2023-10-27 10:01, the system will determine the current time context as fall day time or weekday day time, etc. Then, the system will look up the database for the normal behavior profile of air conditioner under the context of fall day time or weekday day time. If an exact match profile is found, it will be taken as the output of this step. If no exact match profile is found, the system can take a fallback strategy, e.g. retrieving a profile with a more general time context such as only by season or only by weekday / weekend, or using a generic normal behavior profile of this appliance type. Finally, the output of this step is the normal behavior profile corresponding to the input high-power event. For example, for the above air conditioner event, if a fall day time profile is matched, the output can be: {"appliance type": "air conditioner", "context": "fall day time", "typical power range": [1500, 2800], "typical runtime duration distribution": {"average duration": 2, "standard deviation": 0.5, "maximum duration": 5}}.

[0059] In step S6, based on the comparison between the high-power event and the normal behavior profile, it is determined whether the appliance device has abnormal operation. That is, the foregoing steps have successfully identified the high-power event and determined the appliance type, and the normal behavior profile of the appliance under a specific time context has been retrieved. However, these information itself cannot directly give a clear conclusion of whether it is abnormal. Abnormality determination needs a quantitative evaluation standard to accurately compare the actual operation data (such as operation duration and average power) of the high-power event with the corresponding normal behavior profile. For this purpose, the present application can objectively measure the degree of deviation of the current power consumption behavior from the normal mode by calculating an abnormality score, and set a threshold for decision-making, so as to realize intelligent early warning of potential safety hazards, avoid the subjectivity and inefficiency of manual judgment, and ensure continuous monitoring of user power consumption safety.

[0060] Specifically, in one specific embodiment of the present application, Figure 5 The flowchart for step S6 of the electric energy meter data safety hazard analysis method according to the embodiment of the present application. As shown in FIG. 6, the system first calculates the abnormality score of the input high-power event based on the normal behavior profile retrieved in the previous step. The abnormality score is a quantitative evaluation of the deviation of the current power consumption behavior from the normal mode. The higher the abnormality score, the more abnormal the current power consumption behavior. The system can set a threshold for the abnormality score, e.g. 0.5, to determine whether the current power consumption behavior is abnormal. If the abnormality score is greater than the threshold, the system will determine that the current power consumption behavior is abnormal, and output an abnormality warning. If the abnormality score is less than or equal to the threshold, the system will determine that the current power consumption behavior is normal, and output a normality warning. Figure 5As shown, in step S6, determining whether the electrical appliance exists abnormal operation based on the comparison between the high-power event and the normal behavior portrait comprises: S61, calculating the percentage of exceeding typical duration of the current duration distribution of the high-power event relative to the typical duration distribution in the normal behavior portrait; S62, calculating the average power of the high-power event; S63, calculating the abnormal score based on the average power of the high-power event, the percentage of exceeding typical duration and the electrical appliance type label of the high-power event; S64, determining whether the electrical appliance exists abnormal operation based on the abnormal score.

[0061] Specifically, one implementation of step S6 is as follows: first, S61 is executed. The actual duration of the current high-power event is calculated. For example, from 2023-10-27 10:01 to 2023-10-27 10:08, the current duration distribution of the high-power event is 8 minutes, i.e. 8 / 60 hours. Then, the maximum duration or the average duration+N times of standard deviation of the electrical appliance in this context is obtained from the normal behavior portrait as the upper limit of the typical duration. For example, the maximum duration in the normal behavior portrait is 5 hours. The formula for calculating the percentage of exceeding typical duration can be: the percentage of exceeding typical duration=(current duration distribution-typical duration upper limit) / typical duration upper limit*100%. If the current duration distribution does not exceed the typical duration upper limit, the percentage is 0. For example, the current duration distribution is 8 minutes, about 0.133 hours, and the typical duration upper limit is 5 hours. Since 0.133 hours does not exceed 5 hours, the percentage of exceeding typical duration is 0%. If the actual duration is 6 hours, the percentage of exceeding typical duration is (6-5) / 5*100%=20%.

[0062] Then, S62 is executed. The average power values of all minutes in the event time period of the high-power event are accumulated, and then divided by the total number of minutes in the time period. For example, for the high-power event, the power data segment contains 8-minute average power values, which are 2500, 2480, 2470, 2460, 2450, 2440, 2430, 2400 watts, respectively. Then the average power is (2500+2480+2470+2460+2450+2440+2430+2400) / 8=2453.75 watts.

[0063] Then, S63 is executed. It should be understood that the calculation of the anomaly score is a comprehensive evaluation that combines runtime length anomalies and power anomalies, and can consider the impact of appliance type on anomaly sensitivity. The formula for calculating the anomaly score can be a weighted linear combination or a more complex nonlinear function, and the weights and parameters are trained and optimized through historical anomaly data. A simplified example of the anomaly score calculation formula: anomaly score = W1 * (average power deviation) + W2 * (percentage of typical length exceeded) + W3 * (appliance type sensitivity factor) where: the average power deviation can be defined as abs(average power-normal power range median) / normal power range median, and the deviation is greater if the average power exceeds the normal power range. For example, the normal power range is [1500, 2800], the median is 2150. The current average power is 2453.75. The deviation is abs(2453.75-2150) / 2150≈0.141. W1, W2, W3 are weight coefficients used to balance the influence of different factors on the anomaly score, and these weights can be set by expert experience or learned on labeled anomaly data through machine learning methods such as logistic regression, support vector machines, etc. For example, W1=0.4, W2=0.5, W3=0.1. The appliance type sensitivity factor, some appliances (such as induction cookers, microwaves) are more sensitive to long running time, and the factor value is higher; others (such as refrigerators) are lower. For example, for air conditioners, the sensitivity factor may be 1.0. Substitute the above example values: anomaly score = 0.4*0.141+0.5*0+0.1*1.0=0.0564+0+0.1=0.1564.

[0064] Finally, S64 is executed. Specifically, in one specific embodiment of the present application, step S64, based on the anomaly score, judges whether the appliance device has abnormal operation, including: comparing the anomaly score with a preset anomaly score threshold, if the anomaly score is greater than the preset anomaly score threshold, it is judged that the appliance device has abnormal operation. It is worth mentioning that the setting of the preset anomaly score threshold determines the strictness of the judgment of the anomaly. The threshold is set or optimized empirically by analyzing a large amount of historical data, combined with business needs and acceptable false positive rate, false negative rate. For example, a threshold can be set so that 99% of normal behavior scores are below the threshold, while most abnormal behavior scores are above the threshold. For example, the preset anomaly score threshold is set to 0.5. If the calculated anomaly score is greater than the preset anomaly score threshold, it is judged that the appliance device has abnormal operation. Otherwise, it is judged to be normal operation. In the above example, the calculated anomaly score is 0.1564. Since 0.1564 is less than the preset threshold 0.5, it is judged that the air conditioner device does not have abnormal operation. This result can be used to trigger subsequent warning notifications or further analysis.

[0065] In summary, the electric energy meter data security risk analysis method based on the embodiments of the present application is illustrated. Firstly, the original smart meter data stream is preprocessed to obtain high-quality power time series, solving the problem of data noise and abnormal value interference. Then, through high-power event recognition, continuous power consumption data is decomposed into discrete and meaningful appliance operation events, focusing on analysis and avoiding blind processing of full data, improving efficiency. The key is to extract and classify the lightweight appliance type features of the identified high-power events, quickly and accurately identify the specific appliance type, and solve the problem that traditional methods cannot distinguish different appliance abnormalities. Finally, based on the appliance type label and the current time context, the corresponding normal behavior portrait (including typical power and running time) is retrieved from the historical behavior database and compared with the current high-power event. This abnormality judgment mechanism based on normal behavior portrait can accurately identify hidden security risks with normal power but abnormal running time or running mode, effectively reducing the false positive rate, realizing intelligent and accurate early warning of abnormal operation of electrical equipment, and making up for the shortcomings of existing technologies in fine analysis and abnormality judgment.

[0066] Figure 6 The block diagram of the electric energy meter data security risk analysis system according to the embodiments of the present application is shown. As shown in Figure 6 The electric energy meter data security risk analysis system 100 according to the embodiments of the present application includes: an original smart meter data stream acquisition module 110 for acquiring an original smart meter data stream; an original smart meter data stream preprocessing module 120 for preprocessing the original smart meter data stream to obtain a preprocessed power time series; a high-power event recognition module 130 for recognizing high-power events in the preprocessed power time series to obtain high-power events; an appliance type label generation module 140 for extracting and classifying lightweight appliance type features of the high-power events to obtain appliance type labels of the high-power events; a normal behavior portrait retrieval module 150 for retrieving corresponding normal behavior portraits from a historical behavior database based on the appliance type labels and the current time context of the high-power events, the normal behavior portraits including the typical power range and typical running time distribution of this type of electrical appliance in this context; and an abnormal operation judgment module 160 for judging whether the electrical equipment has abnormal operation based on the comparison between the high-power events and the normal behavior portraits.

[0067] Here, those skilled in the art can understand that the specific operations of each step in the above electric energy meter data security risk analysis system have been described in detail above with reference to the description of the electric energy meter data security risk analysis method of Figures 1 to 5 , and therefore the repeated description will be omitted.

Claims

1. A method for analyzing potential security risks in electricity meter data, characterized in that, include: Obtain the raw smart meter data stream; The original smart meter data stream is preprocessed to obtain a preprocessed power time series; High-power events are identified by performing high-power event identification on the preprocessed power time series. Lightweight appliance type feature extraction and classification are performed on the high-power events to obtain appliance type labels for the high-power events; Based on the appliance type label and the current time context of the high-power event, the corresponding normal behavior profile is retrieved from the historical behavior database. The normal behavior profile includes the typical power range and typical runtime distribution of the appliance type in the current time context. Based on the comparison between the high-power event and the normal behavior profile, it is determined whether the electrical equipment is operating abnormally; The process of extracting and classifying lightweight appliance type features for the high-power events to obtain appliance type labels for the high-power events includes: The high-power event is input into a power timing encoder based on an LSTM model to obtain a power timing pattern feature encoding vector for electrical equipment. Based on the maximum eigenvalue of the power time-series pattern feature encoding vector of the electrical equipment, transient trajectory representation and power feature trajectory limitation are performed on each eigenvalue in the power time-series pattern feature encoding vector of the electrical equipment to obtain the power time-series pattern feature trajectory limitation encoding vector of the electrical equipment. Among them, the maximum eigenvalue of the power timing pattern feature encoding vector of the electrical equipment is determined. To use as the power characteristic peak, and to set each characteristic value Divide by To obtain a transient trajectory representation; Then, the power characteristic trajectory is defined using the following formula: in, These are the feature values ​​in the power timing pattern feature encoding vector of electrical equipment. It is the largest eigenvalue in the power time-series pattern feature encoding vector of electrical equipment. It is the value of an exponential function with the natural constant e as its base. These are the feature values ​​in the power timing pattern feature trajectory constraint encoding vector of electrical equipment; Each feature value in the power time-series pattern feature trajectory constraint encoding vector of the electrical equipment is weighted and correlated by the label physical boundary to obtain the balanced feature encoding vector of the power time-series pattern of the electrical equipment, that is: in, and They are The corresponding weight parameters, yes The corresponding label physical boundary association factor, These are the feature values ​​in the power timing pattern balance feature encoding vector of electrical equipment; The power timing pattern balance feature encoding vector of the electrical equipment is input into a lightweight classifier to obtain the electrical type label of the high-power event.

2. The method for analyzing potential security risks of electricity meter data according to claim 1, characterized in that, The original smart meter data stream is preprocessed to obtain a preprocessed power time series, including: Verify the data integrity of the original smart meter data stream and remove obvious outliers from the original smart meter data stream; The original smart meter data stream is filtered using an applied filter to obtain a filtered smart meter data stream. The filtered smart meter data stream is resampled to a uniform analysis time granularity, and the mean and standard deviation of power within each analysis time granularity are calculated to obtain the preprocessed power time series.

3. The method for analyzing potential security risks of electricity meter data according to claim 2, characterized in that, The analysis time granularity is 1 minute.

4. The method for analyzing potential security risks of electricity meter data according to claim 3, characterized in that, High-power event identification is performed on the preprocessed power time series to obtain high-power events, including: Set a base power threshold; The high-power events are identified as time periods in the preprocessed power time series that continuously exceed the base power threshold.

5. The method for analyzing potential security risks of electricity meter data according to claim 1, characterized in that, Based on the comparison between the high-power event and the normal behavior profile, it is determined whether the electrical equipment is operating abnormally, including: Calculate the percentage of time the current runtime distribution of the high-power event exceeds the typical runtime distribution in the normal behavior profile; Calculate the average power of the high-power event; An anomaly score is calculated based on the average power of the high-power event, the percentage of time exceeding the typical duration, and the appliance type label of the high-power event; Based on the anomaly score, it is determined whether the electrical equipment is operating abnormally.

6. The method for analyzing potential security risks of electricity meter data according to claim 5, characterized in that, Based on the anomaly score, determining whether the electrical equipment is operating abnormally includes: comparing the anomaly score with a preset anomaly score threshold; if the anomaly score is greater than the preset anomaly score threshold, then determining that the electrical equipment is operating abnormally.

7. A system for analyzing security risks of electricity meter data, used to implement the method for analyzing security risks of electricity meter data as described in claim 1, characterized in that, include: The raw smart meter data stream acquisition module is used to acquire the raw smart meter data stream; The raw smart meter data stream preprocessing module is used to preprocess the raw smart meter data stream to obtain the preprocessed power time series; A high-power event identification module is used to identify high-power events from the preprocessed power time series. An appliance type label generation module is used to perform lightweight appliance type feature extraction and classification on the high-power event to obtain the appliance type label of the high-power event; The normal behavior profile retrieval module is used to retrieve the corresponding normal behavior profile from the historical behavior database based on the appliance type label and the current time context of the high-power event. The normal behavior profile includes the typical power range and typical runtime distribution of the appliance in the current time context. The abnormal operation judgment module is used to determine whether the electrical equipment is operating abnormally based on the comparison between the high power event and the normal behavior profile.

Images